Hacker News Reader

> The manufacturer should never be able to either deactivate or otherwise disable the functionality of a device they sold in a form that requires a service to function.

I would go further: IMO, the manufacturer should never be able to sell the device that requires a service to function, period. They should only be able to either a) sell the device that can be optionally tied to a service - not necessarily manufacturer's - but otherwise works fine without it, or b) rent a device as a part of a service, remaining responsible for its maintenance.

Model a) is how cell phones work - you buy a cell phone, a cellular connection is a separate service provided by multiple competing parties that are not the manufacturer. Model b) is how ISPs tend to work - they lend you hardware to connect to their network infrastructure, they replace it if it breaks, they take it away at the end of the contract, and they absolutely refuse to let you use their hardware with a different ISP.

> Ideally in a form that would also work when the company closes shop

You typically already have to provide full hardware schematic when submitting an electronic product to test labs to get various certifications.

It doesn't seem that far fetched that you would also have to submit server software and the certification house would keep it in escrow in case you go bankrupt.

I don't think it's realistic to expect that will happen though.

Code escrow isn't unheard of in B2B software. Maybe enough people will be burned by companies bricking their hardware that it will happen with B2C, too?

Let's assume product uses domain.com to get updates.

domain.com one day might be owned by $badDude - that's a huge risk

domain.com might return 404's - that's pretty terrible.

What happens to domain.com once $business is now $noLongerBusiness?

You can provide a method of flashing firmware onto the device itself (possible security risk?), but where do you get the files from? How do you verify they're safe?

Then, you need to host the server software itself (depending on how it's coded, that ranges from quite simple to your worst nightmare), and you expect someone to keep that secure? The EU dictates GDPR compliance, which adds additional cost to maintenance.

It's just easier and cheaper to just not bother with servers if the company can't keep them online.

Let user change server domain. Firmware must be signed by certificate with that domain. So now user can change server domain to his own server (or someone he trusts) and sign firmware with that key. It poses no security risk.

That's a very idealistic but unrealistic perspective. Often times the source code can't or won't be released - it could put further customers at risk if a vulnerability is found and the update servers have gone away.

Some devices might not be possible to update due to hardware/software configuration (perhaps certain variables are hard coded?).

Whilst what you're saying is right it just doesn't work that way. I'd love for all the Android devices to get years of OS and security patches, but it simply doesn't happen.

Any IoT device is pretty much the same. It's not going to change any time soon.

Only invest in products you can be sure of (which is hard these days). Expect them to break, expect nobody to care, and be prepared to lose money or get a terrible ROI - it's why phones don't get updates, the OEM doesn't make money from providing updates which are a direct cost VS selling a new phone.

This is capitalism, produce crap, sell many units, offer no support, rinse and repeat.

Security by obscurity does not work. For experienced reverse engineers reading assembly code is as easy as reading C code for someone else.

Market forces have clearly failed to address this issue for an extended period, so this seems to be a situation where statutory regulation is indicated.

Isn't that tying? The manufacturer sells both the product and the service, and they can't be separated. Many countries have laws against it, or at least some forms of it.

Furthermore, many countries now have some regulations regarding e-waste. Either now or in the making. And I expect "bricking" to be punished in some way. Right to repair comes to mind.

The manufacturer should never be able to either deactivate or otherwise disable the functionality of a device they sold in a form that requires a service to function.

Exactly, why can’t I still dial in with my 2400 baud modem to get virus definitions for Norton Antivirus for my 386 that I bought in the 80s?

You can dial your 2400 baud modem if you find another endpoint or operate one yourself, you're not bound to a specific provider. Fax machines still work after all.

You can run norton antivirus for DOS in whatever state it was when it was last sold.

So now all I have to do is find someone who keeps a bank of 2400 baud modems and an updated list of virus definition files.

As far as using as it was, what good is virus protection software that only works for viruses created in the 80s?

Sure I can use a standalone gps device that I bought 10 years ago that doesn’t get updated but that doesn’t do me too much good navigating in a suburban area where most of the roads, houses and businesses didn’t even exist then.

But this is the point, manufacturers should offer improved features as incentives not intentionally and gratuitously deprecating older products.

It is an optional feature in this case. He could go out and buy a regular cartridge and print from his same printer.

I looked at the pricing. I would go for the free tier in a heartbeat- 15 pages a month and $1 for 10 (?) pages over that. I don’t print that often.

A general-purpose computer with a general-purpose operating system and a general-purpose network adapter tied to it absolutely does not require Norton Antivirus or its virus definitions to function. Correspondingly, Norton is not involved in manufacturing any of these components.

That seems like a distinction without a difference. I hypothetically bought a product that requires a service for functionality - Norton Antivirus. According to the parent poster, Norton should be required to keep their service running.

Should Sony also be forced to keep their service running for PS1 games that had an online component - forever?

> Should Sony also be forced to keep their service running for PS1 games that had an online component - forever?

On the other hand, would that even be particularly difficult?

For most companies making games with an online component, if they set aside 0.1% of revenue into a fund that would take over server costs once support ends, that fund would last for a very long time.

At a certain point the player base drops enough that you only need one server and a few hours a month of labor. (Less than one server, actually, once you factor in virtualization. Even if you want to have some redundancy and support multiple regions.)

Technically you didn't buy a Norton Antivirus, you entered into a license agreement. Software is, unfortunately, almost always leased and not bought. However, I would very much be into forcing companies to either a) keep their service running forever, or b) allow the user to use a third-party service - in this case, virus definitions. This is in line with my comment elsewhere in the thread - companies should be allowed to either a) sell a product that doesn't require a service, and if it uses a service, it should support compatible third-party services as well, or b) lease the product as a part of a service. They should explicitly be banned from selling a product that requires their particular service to function.

As for Sony, PS1 games and on-line: similarly, whatever middleware there is that facilitates on-line gaming, endpoints should be user-configurable. Fortunately, at least PS1 the device doesn't require Internet to run.

(Come to think of it, did PS1 even support an Internet connection?)

You’re right. It was first introduced with the PS2 in 2000. I do however have a vague recollection of early cartridge based systems where you could download games over cable.

You're probably thinking of Sega Channel [1] which was functionally like Microsoft's Game Pass that is available now. You knew that you would only have access to the games as long as you subscribed, and that they could be changed at any point by Sega.

[1] - https://en.wikipedia.org/wiki/Sega_Channel

>Should Sony also be forced to keep their service running for PS1 games that had an online component - forever?

Yes! Absolutely they should.

Why do you specify “device”. Shouldn’t the same be said for an app or service that is sold?