Hacker News Reader

Comment by jacquesm | Hacker News Reader

That's going to hurt a lot of folks. Especially those whose manufacturers are not doing their bit with respect to updates. It's absolutely incredible to me how sloppy manufacturers are when it comes to keeping phones updated, they seem to see phones that are older than two years as effectively end-of-life.

Even Google is guilty of this, though to a slightly lesser extent.

See: http://www.androidpolice.com/2016/06/21/google-support-site-...

So three years or 18 months past sale.

Personally I think that a phone is only end-of-life when it stops to work and that manufacturers should either offer to buy them back if they don't want to support them any longer or should be forced to provide security updates.

View on HN

Manufacturers are used to developing a product and selling that product as-is. The entire idea of needing to maintain (develop, improve, update) a product beyond the point of sale is a fairly new one.

I'm sure manufactures are slow to embrace this new reality because consumers see little value in paying for it.

They've already paid for it.

The sales price was enough to cover not just development and production, but also free long-term maintenance that the manufacturer didn't know to plan for (and possibly couldn't have known to plan for)?

But that they should have planned for. Really, it's not as if security issues are a new thing, we've been dealing with this crap for several decades now.

OP's point is that most consumers are much more sensitive to price than they are to X years of updates as a deciding factor when buying a new phone. If a manufacturer planned for a longer update timeline and hence charged more, they'd lose business to a competitor who didn't.

Consumer understanding and/or regulation needs to change in order to provoke a different response from the manufacturers.

Consumers have no clue how the cell phone ecosystem works in the first place let alone that they would be able to put a value on the security of their devices. They are going on the assumption that the manufacturers/carriers would not sell a product that is defective. Manufacturers make enough profit as it is to update their devices for the expected service life of the devices. They're just not willing to go the distance.

Industries that do not self regulate tend to find that they will then be regulated by the authorities.

The phone companies used to be so anal about this that they would ban 'unlicensed' hardware from their networks to the point that you could only use their overpriced hardware. Now that has changed to the point where they will push whatever junk gives them the biggest margins at the moment of sign-up and never mind the long view.

Yet another example of a place where strict software liability would be a great thing to have.

Industries that do not self regulate tend to find that they will then be regulated by the authorities.

The phone companies used to be so anal about this that they would ban 'unlicensed' hardware from their networks to the point that you could only use their overpriced hardware.

I thought that was more because it was overpriced than out of any attempt to avoid regulation. And that they were blatant enough about being anti-competitive that they got regulated for it.

Yes, so now we have this split where you can buy equipment from a whole range of manufacturers and suddenly the phone company doesn't care at all what crap gets on their networks.

This to me clearly indicates that the carriers at least have the option to ensure that the equipment connected to their network is up to certain standards. But since they don't car e (they never did) they'll be happy to sell you a phone from some manufacturer that is most likely not going to outlive the contract because of the extra margin they make on that phone.

So either they should take it back for some residual value (which they can then try to recover from the manufacturer) or they should ensure it keeps working properly.

This to me clearly indicates that the carriers at least have the option to ensure that the equipment connected to their network is up to certain standards.

I thought some of the fallout from that mess was that they can't impose rules beyond "doesn't break our shit".

If I had to guess, I imagine auto manufacturers allocate some amount of the sales price towards future recalls as well. A little googling seems to indicate I'm at least partially correct:

A major recall that affects a large number of cars can create huge expenses in the aggregate. According to Toyota's Q3 conference call, they have set aside 100 billion yen (approximately $1.12 billion) for these "quality-related expenses" which will be allocated between the third and fourth quarters. (Some products were announced with great hype, only to be pulled from shelves. Find out more in A Year In Product Recalls.)[1]

I suspect that legally required recalls are viewed differently than security updated mainly because they are legally required. I wouldn't mind a consumer law requiring companies to provide at least a minimum period of security updates from the time it's officially available from the manufacturer. I also wouldn't mind if that period was longer for "appliance-like" IoT devices...

It probablt can even use the same justification. Unsafe vehicles on the road are a danger to us all, and so are unsafe devices on our networks.

1: http://www.investopedia.com/financial-edge/0210/the-cost-of-...

The entire idea of needing to maintain (develop, improve, update) a product beyond the point of sale is a fairly new one.

But not in computers. Even in the 80ies, we would buy new version of MS-DOS for our existing hardware.

The difference is that on most normal computers (except Apple), software was/is decoupled from hardware, they have different manufacturers. Software developers want to reach an as large as possible audience, so it is typically not in there interest to support only the latest hardware iteration.

And PC manufacturers still screw it up. If you're lucky you'll get 4 updates to a computer spread 6 months apart and delivered by a custom app that is just as likely to crash as it is to update you're system.

... or indeed brick your laptop (as happened to me once with an HP).

I don't see how your point contradicts with what they said. Selling a new version of MS DOS is not developing/improving/updating a product beyond the point of sale. It's creating a new product to sell, which non-software has been doing forever as well.

They wouldn't have to maintain the software if they released it so it could be updated by either the kernel developers or the OEM.

My 73 year old mom is quite happy with the 2014 Moto G I got her three years ago. I guess she'll need something new now (No idea if it has a BCM wifi chipset, but I'm guessing so - how do you even find this out without having physical access to the device?).

I'm thinking Apple may be the way to go this time, because they maintain security updates for older devices for longer. (Seems like 5+ years.)

Another way of looking at this is that lacking security updates create unnecessary electronic/chemical pollution/waste. I think the EU should tackle this. I'm sure they could come up with some scheme for penalties for lacking security updates. (Does anyone know of any initiative in this area?)

I'm thinking Apple may be the way to go this time, because they maintain security updates for older devices for longer. (Seems like 5+ years.)

The iPhone SE has a reasonable price and is only a year old. E.g., here in Germany you can still get the 16GB version from before last month's storage bump for 399 Euro. It has the same SoC as the iPhone 6s (A9).

According to GSM Arena, the 2nd generation Moto G uses a Qualcomm MSM8226 Snapdragon 400 chipset, so it shouldn't be affected by this issue.

http://www.gsmarena.com/motorola_moto_g_(2nd_gen)-6647.php

Thanks! :)

(I still reckon my mom needs a new phone though, there are other less severe exploits out there for this non-updated device.)

Moto seems to put out a new Moto G every year, and I've had good success with just replacing the old ones with the new ones.

Yes, an iPhone is better, but if you're on a budget and don't have those security needs, the Moto G seems fine.

If you don't need something secure, get a Moto. Check.

There are plenty of Qualcomm based devices that use Broadcom wifi.

My moto e got patched a few weeks ago and now crashes several times a day. It seems Motorola is trying to train users not to update their systems.

But on the other hand they're very friendly when you want to install alternative firmware (eg cyanogenmod). They let you unlock the bootloader and then you can flash at will.

Or at least commit to a period of support like a warranty so at least it's another metric to consider upfront when purchasing

The EU loves creating standardized sticker layouts. In this case I would welcome it.

"Security updates guaranteed for: nn months"

"Security updates guaranteed until: YYYY/MM"

There should be a also scheme where companies who claim these things would have to deposit some calculated amount in some offical place.

(Btw, since so there's so much cheap crap being imported from china, I guess the most consumer-protecting approach would be to make both the reseller and producer responsible for the penalties resulting from a lack of security updates.)

Not sure about the EU, but the UK has this covered under the Sales of Goods Act: https://en.wikipedia.org/wiki/Sale_of_Goods_Act_1979

Has that 1979 law been proven in court to be valid about the kind of things we are talking about now, and can you link the specific cases, please? :=)

Do you have a resource in which can look up past cases, including small claims court that is not paywalled in some form?

Asking as I'm aware of a couple of cases with friends in the past few years. Personally had one case in which was about to go to SCC regarding software update removing some functionality and the company settled out of court and left me most happy with the settlement.

I think the onus is on you.

That is why I asked as I'm not aware of any non-paywall sites that allow such lookups and neither it seems are you.

Maybe somebody else knows one, but as I stated, I have personally used this law in comparable circumstances and aware others have. But without the ability to lookup such cases on a non-paywall site then alas we have hit an enpass.

What he means is that if you are going around claiming all kinds of things then you should be the one to provide the evidence to go with the claims.

..yes. Thanks for clarifying :).

I'm fully aware of what he asked for and as I have made clear, unless somebody can link a site that allows such lookup of past cases (including SCC) then there is nothing further I can do beyond express my personal experience, and link to the law in question (which I did).

So unless you are able to link such a site then your not helping at all.

> So unless you are able to link such a site then your not helping at all.

You are right, we are not helping at all with proving your unsubstantiated claim.

Well, part of the claim is a personal experience, so evidence isn't strictly required, since the source is making the statement. At that point, you have to determine how well you trust the source.

More evidence would be preferred, and would definitely raise my trust that there wasn't some mistake of memory, but it seems a bit extreme to dogpile on someone who is stating what they believe as fact from personal experience, and when asked for verification seems willing to try to find that but without the knowledge or ability to do so and asking for pointers on how to do that.

Use dejure.org for German cases and law.

Bookmarked, alas for the UK the only public offerings are pay per search: https://www.trustonline.org.uk/ which does not seem to have Small Claims Court judgments.

Also http://law.stackexchange.com/questions/940/is-there-a-prefer... kinda back's this up alas.

Reply on news.ycombinator.com