5 ms·

Not gonna happen in a million years

vlovich123 3y ago
Some of those suggestions are things that sound good at first glance but are simply not great ideas. For example, support for downgrades means you a security vulnerability can be reintroduced by a malicious user which may not be desirable. Writing software that’s backwards and forwards compatible across all releases can be extremely expensive to impossible (eg a feature in your application that requires a new OS or you need to use a now removed API when running on older releases). There are difficult technical issues involved and trying to legislate specifics may not be the best idea vs other approaches that improve real freedom (eg you have to release sufficient details to your customers that they can write their own software for your hardware).
- thfuran 3y ago
  >For example, support for downgrades means you a security vulnerability can be reintroduced by a malicious user which may not be desirable. And there are regulated industries where a software update could be the fulfillment of a recall.
- csdvrx 3y ago
  > Some of those suggestions are things that sound good at first glance but are simply not great ideas. Actually, yes they are. I'm not a big fan of legislation, but the upgrade crazyness has to stop at some point! > For example, support for downgrades means you a security vulnerability can be reintroduced by a malicious user which may not be desirable What if "I, the user" deem it "desirable"? I'm holding to bios with known vulnerabilities so I can work around "security features" that are "for my own protection" like 1) preventing me from underclocking (to keep the security features of the now-dead SGX) 2) using any M2 WWAN or NVMe that I want It's gone to a point where it's not desirable for me to upgrade, and to prefer the risks that come with an exploit as at least I know my freedom to use my hardware the way I want will not suddenly become limited. Another example: getting root on android with mediatek was considered a "bug" and work a mandatory "upgrade" that prevent users from being able to get root that way. But I want to be root!
  - hdhuwgdue2 3y ago
    Regular bios updates rub me the wrong way. Wife's lappy recently decided to update it of its own volition too. I was livid, but thankfully nothing broke. I hate that OS can do it, but I hate more the fact that bios is clearly less reliable..
  - thfuran 3y ago
    Do you believe that the operator of a deliberately insecure system should be liable if it ends up suborned by a botnet and used to attack someone else's system?
    - csdvrx 3y ago
      > Do you believe that the operator of a deliberately insecure system should be liable Only if said operator signed a contract. No contract=no liability. Here in the US, the Supreme Court has made it clear that law enforcement agencies are not required to provide protection to the citizens cf https://www.nytimes.com/2005/06/28/politics/justices-rule-police-do-not-have-a-constitutional-duty-to-protect.html https://www.nytimes.com/2005/06/28/politics/justices-rule-po... If even the police isn't liable, why should I be liable or have any kind of duty to protect your system? Your system, your problem.
      - thfuran 3y ago
        Do you also think it's fine to shit in other people's wells or for companies to dump their toxic waste in the middle of other companies parking lots as long as you/they haven't signed a contract explicitly agreeing not to?
        csdvrx 3y ago
        > Do you also think it's fine to shit in other people's wells or for companies to dump their toxic waste in the middle of other companies parking lots as long as you/they haven't signed a contract explicitly agreeing not to? You are using loaded words to 1) imply I would support some questionable actions where you assume intent and 2) refer to negative externalities, but I'll suppose you are not trolling interact in good faith with you. Both the actions you define are ignoring property rights: your well, your parking lot = I can't do that, unless you allow me (with a contract!) My well, my parking lot = I can do that, and you don't get to say what I do with my property, unless we have signed a contract which creates liability. Many people seem to have a strong desire to be able to force ME to update MY browser/operating system/bios/whatever else to be up to THEIR standards, because it has consequences on THEIR liability. I care a bit about them, but I care way more about MY freedom: I do what I what with MY computers. Note that intent matters: I have no desire to cause bad things to other people. I'd be very sad if my computer was used as "part of a botnet" like someone else said. I might even try to avoid that - but only as far as it puts my freedom first, and there's not even a requirement that I try (because I might have better things to do lol) Should bad things like botnets happen, 1) it wasn't my intent, as preserving my freedom was my intent 2) the negative externality is sad, but it's not my liability: you should secure your property, or said differently "your problems aren't my problem" This whole interaction feels very strange to me. By any chance, are you European? Europeans seem to have very different concepts of freedom and liability than we do.
- amelius 3y ago
  > For example, support for downgrades means you a security vulnerability can be reintroduced by a malicious user which may not be desirable. Backports exist because of this reason. Just added them as a requirement to the list of rules above.

Some of those suggestions are things that sound good at first glance but are simply not great ideas. For example, support for downgrades means you a security vulnerability can be reintroduced by a malicious user which may not be desirable. Writing software that’s backwards and forwards compatible across all releases can be extremely expensive to impossible (eg a feature in your application that requires a new OS or you need to use a now removed API when running on older releases). There are difficult technical issues involved and trying to legislate specifics may not be the best idea vs other approaches that improve real freedom (eg you have to release sufficient details to your customers that they can write their own software for your hardware).

thfuran 3y ago
>For example, support for downgrades means you a security vulnerability can be reintroduced by a malicious user which may not be desirable. And there are regulated industries where a software update could be the fulfillment of a recall.
csdvrx 3y ago
> Some of those suggestions are things that sound good at first glance but are simply not great ideas. Actually, yes they are. I'm not a big fan of legislation, but the upgrade crazyness has to stop at some point! > For example, support for downgrades means you a security vulnerability can be reintroduced by a malicious user which may not be desirable What if "I, the user" deem it "desirable"? I'm holding to bios with known vulnerabilities so I can work around "security features" that are "for my own protection" like 1) preventing me from underclocking (to keep the security features of the now-dead SGX) 2) using any M2 WWAN or NVMe that I want It's gone to a point where it's not desirable for me to upgrade, and to prefer the risks that come with an exploit as at least I know my freedom to use my hardware the way I want will not suddenly become limited. Another example: getting root on android with mediatek was considered a "bug" and work a mandatory "upgrade" that prevent users from being able to get root that way. But I want to be root!
- hdhuwgdue2 3y ago
  Regular bios updates rub me the wrong way. Wife's lappy recently decided to update it of its own volition too. I was livid, but thankfully nothing broke. I hate that OS can do it, but I hate more the fact that bios is clearly less reliable..
- thfuran 3y ago
  Do you believe that the operator of a deliberately insecure system should be liable if it ends up suborned by a botnet and used to attack someone else's system?
  - csdvrx 3y ago
    > Do you believe that the operator of a deliberately insecure system should be liable Only if said operator signed a contract. No contract=no liability. Here in the US, the Supreme Court has made it clear that law enforcement agencies are not required to provide protection to the citizens cf https://www.nytimes.com/2005/06/28/politics/justices-rule-police-do-not-have-a-constitutional-duty-to-protect.html https://www.nytimes.com/2005/06/28/politics/justices-rule-po... If even the police isn't liable, why should I be liable or have any kind of duty to protect your system? Your system, your problem.
    - thfuran 3y ago
      Do you also think it's fine to shit in other people's wells or for companies to dump their toxic waste in the middle of other companies parking lots as long as you/they haven't signed a contract explicitly agreeing not to?
      - csdvrx 3y ago
        > Do you also think it's fine to shit in other people's wells or for companies to dump their toxic waste in the middle of other companies parking lots as long as you/they haven't signed a contract explicitly agreeing not to? You are using loaded words to 1) imply I would support some questionable actions where you assume intent and 2) refer to negative externalities, but I'll suppose you are not trolling interact in good faith with you. Both the actions you define are ignoring property rights: your well, your parking lot = I can't do that, unless you allow me (with a contract!) My well, my parking lot = I can do that, and you don't get to say what I do with my property, unless we have signed a contract which creates liability. Many people seem to have a strong desire to be able to force ME to update MY browser/operating system/bios/whatever else to be up to THEIR standards, because it has consequences on THEIR liability. I care a bit about them, but I care way more about MY freedom: I do what I what with MY computers. Note that intent matters: I have no desire to cause bad things to other people. I'd be very sad if my computer was used as "part of a botnet" like someone else said. I might even try to avoid that - but only as far as it puts my freedom first, and there's not even a requirement that I try (because I might have better things to do lol) Should bad things like botnets happen, 1) it wasn't my intent, as preserving my freedom was my intent 2) the negative externality is sad, but it's not my liability: you should secure your property, or said differently "your problems aren't my problem" This whole interaction feels very strange to me. By any chance, are you European? Europeans seem to have very different concepts of freedom and liability than we do.
amelius 3y ago
> For example, support for downgrades means you a security vulnerability can be reintroduced by a malicious user which may not be desirable. Backports exist because of this reason. Just added them as a requirement to the list of rules above.