3 ms·

What good are replaceable batteries if the software becomes obsolete and un-upgradeable by the time you need to replace the battery?

kylehotchkiss 6mo ago
the secondary market for old phones seems strong?
- fsflover 6mo ago
  Because people don't understand the security implications of non-updated software?
  - dingaling 6mo ago
    If it's a choice between no phone and an old, software-EOL phone I can't blame them. Frankly so long as my browser, VPN and mail app are updated I'm happy.
  - okanat 6mo ago
    Phones cannot have non-updated software due to another EU Regulation: Cyber Resilience Act. You need to support devices at least for 5 years starting from December 2027.
    - fsflover 6mo ago
      And after 5 years? My phone runs mainline Linux and thus will have lifetime updates, just like my laptop.
      - okanat 6mo ago
        How sure are you that the vendor is actually providing device-specific updates? What about firmware updates? Outside of x86 ecosystem the whole-device-family updates in mainline Linux kernel is rare. You're probably deceiving yourself believing that your devices are up-to-date. Most of the time laptops and many "mainline-friendly" phones stop receiving firmware updates in 2 years. By "firmware" I mean the binary blobs for the peripherals. Most of the SoCs have unified memory for the LTE and CPU modules. If a vulnerability found in the firmware of the LTE module, it can be used for data extraction. CRA puts hard requirements on documenting and fixing vulnerabilities in device software in 5 year period. It cannot be infinite amount of years, so a reasonable update period had to be choosen. It covers everything provided by the vendor itself too. So if there are vulnerabilities in FW they have to fix it unlike the current situation.
        fsflover 6mo ago
        > How sure are you that the vendor is actually providing device-specific updates? First of all, my phone runs an FSF-endorsed operating system, so no closed drivers. Granted, not everything has been upstreamed yet, but they're working on it and I trust that it will be done soon. (They have done it with the devkit.) Second, my phone has removable modem and removable WiFi card (no unified memory), so when the firmware can't be updated anymore, the card itself can be replaced. (They actually have already done it by releasing a new WiFi card; 5G modem is also being tested). In the worst case, the device can still be used as a pocket computer with no wireless communications.
Someone 6mo ago
https://energy-efficient-products.ec.europa.eu/product-list/smartphones-and-tablets_en https://energy-efficient-products.ec.europa.eu/product-list/...: - rules on disassembly and repair, including obligations for producers to make critical spare parts available within 5-10 working days, and for 7 years after the end of sales of the product model on the EU market - availability of operating system upgrades for longer periods (at least 5 years from the date of the end of placement on the market of the last unit of a product model)

kylehotchkiss 6mo ago

the secondary market for old phones seems strong?

fsflover 6mo ago
Because people don't understand the security implications of non-updated software?
- dingaling 6mo ago
  If it's a choice between no phone and an old, software-EOL phone I can't blame them. Frankly so long as my browser, VPN and mail app are updated I'm happy.
- okanat 6mo ago
  Phones cannot have non-updated software due to another EU Regulation: Cyber Resilience Act. You need to support devices at least for 5 years starting from December 2027.
  - fsflover 6mo ago
    And after 5 years? My phone runs mainline Linux and thus will have lifetime updates, just like my laptop.
    - okanat 6mo ago
      How sure are you that the vendor is actually providing device-specific updates? What about firmware updates? Outside of x86 ecosystem the whole-device-family updates in mainline Linux kernel is rare. You're probably deceiving yourself believing that your devices are up-to-date. Most of the time laptops and many "mainline-friendly" phones stop receiving firmware updates in 2 years. By "firmware" I mean the binary blobs for the peripherals. Most of the SoCs have unified memory for the LTE and CPU modules. If a vulnerability found in the firmware of the LTE module, it can be used for data extraction. CRA puts hard requirements on documenting and fixing vulnerabilities in device software in 5 year period. It cannot be infinite amount of years, so a reasonable update period had to be choosen. It covers everything provided by the vendor itself too. So if there are vulnerabilities in FW they have to fix it unlike the current situation.
      - fsflover 6mo ago
        > How sure are you that the vendor is actually providing device-specific updates? First of all, my phone runs an FSF-endorsed operating system, so no closed drivers. Granted, not everything has been upstreamed yet, but they're working on it and I trust that it will be done soon. (They have done it with the devkit.) Second, my phone has removable modem and removable WiFi card (no unified memory), so when the firmware can't be updated anymore, the card itself can be replaced. (They actually have already done it by releasing a new WiFi card; 5G modem is also being tested). In the worst case, the device can still be used as a pocket computer with no wireless communications.

Someone 6mo ago

https://energy-efficient-products.ec.europa.eu/product-list/smartphones-and-tablets_en https://energy-efficient-products.ec.europa.eu/product-list/...: - rules on disassembly and repair, including obligations for producers to make critical spare parts available within 5-10 working days, and for 7 years after the end of sales of the product model on the EU market - availability of operating system upgrades for longer periods (at least 5 years from the date of the end of placement on the market of the last unit of a product model)