Germany wants smartphone makers to offer 7 years of software updates | Hacker News Reader

Germany wants smartphone makers to offer 7 years of software updates

xda-developers.com

718 pointsunderscore_ku351 comments

1. Security updates. No feature updates are required (Which is sensible in my opinion.)

2. The federal election happens later this month. Take this plan with a grain of salt.

3. The original article by heise.de mentions that the federal government will push these plans during negotiation of the EU wide laws. The government thinks that the plans of the commission do not go far enough. However it's unlikely that Germany will implement stricter rules on a national level.

Sure, but Germany has a lot of clout in the EU, and this might be a good point for –just a random pick– a new chancellor to show his/her concern for the people. I'm almost sure the new German chancellor could get that done in EU record time.

> to show his/her concern for the people

While I'd be happy for this plan to go through, I don't think most of the people will be happy with the side effects. Especially because of the spare parts requirements, I guess manufacturers will

1) Withdraw from EU market. 2) Reduce number of models on offer. 3) Raise prices.

it's still better than the actual state of million of phones filled with "abandonware"

I agree it's better, just I doubt it'll be popular.

It would also mean poor people being unable to afford these devices.

Do poor people not have a right to secure devices?

Should it be legal to make cars for poor people without airbags and seatbelts?

And are we really gonna argue that this idea would be for the benefit of the poor people?

Who can afford to just withdraw from 25% of world GDP? That’s the leverage of unionization.

I'm not sure how unionisation is relevant, but lots of models of products target different regulatory regimes.

By forming an economic union, the EU punches at a higher weight than it's constituent parts.

Oh, I see!

1. No enterprise will withdraw from the EU market because of this. There are too many customers with too much money in the EU. It's a bigger market than the US.

2. That would actually be good, the amount of models aims at confusing customers. But also: Why would that happen? Many models can (and do) share the same spare parts.

3. Prices are already as high as they can be. They do not get lowered because production gets less expensive, they get lowered because of competition. This might have an effect on prices if the competition was very high and profit span very thin - which might be the case for the cheapest budget phones. For something like an iPhone? To my knowledge they are already utterly overpriced, as is tradition (https://www.forbes.com/sites/ewanspence/2017/11/08/apple-iph...), then it will have no effect there.

So, the price rises hit the poorest. Fantastic.....

Buying a phone that lasts you seven years may still be cheaper than buying two.

Your average person breaks devices before than and you expect people to have access to a load of money at once?

A very capable smartphone currently costs ~200€, so if prices rise by 50% (an unbelievable amount), that would be 300€. Certainly not nothing, but car repairs or a new dishwasher are much more expensive.

I expect the poorest to benefit the most from extended longevity, since more affluent people "need" the better camera or a more fashionable design the most.

I know quite a few people with >3 year old smartphones, but mostly with custom roms, since stock firmware isn't usable anymore.

1. 100 euros is a lot of money to the poorest people in society. Many of them can't afford a car or dishwasher.

2. "longevity" means nothing when most people keep dropping their phone. Even used phones that appear perfect can start bootlooping months after buying because of damage caused by the first owner and the eBay seller won't accept returns by than, even if you could prove it was not caused by you.

Most people I know get a phone case to limit damage to their phone. A case is an inexpensive investment that usually pays for itself many times over.

Someone who is really clumsy or in a situation where they are much more likely than average to drop their phone should purchase phone insurance.

And for uninsured people who happen to break their phone, it would still be cheaper to repair it than to get a new one. Repaired phones still benefit from longer support lifecycles, and the proposed legislation would ensure that spare parts are affordable and available.

A case is fantastic at protecting the outer areas of the phone by being a layer that comes in contact with the ground. They do fuck all to protect the internals as the forces still exist and can break a phone months down the road from the drop.

That contrasts sharply with my experiences, having dropped phones that were adequately protected by cheap cases on many occasions. These phones were still working fine years later, with no internal or external damage. Users who are more concerned about phone damage can buy tougher multi-layer cases, which are still great investments.

The former is why right to repair is so important.

The latter may be a problem but you could still buy an older (mid-cycle) model instead of the latest one and still get updates for years.

Right to repair is nearly meaningless on the budget-end as a repair guy will charge £50 to £100 for the labour plus parts with their own mark-up.

Does everyone on hackernews get paid £100k a year and spend over £1,000 on a phone?

If a person can’t afford expected repair expenses during the useful lifetime of a product, then they can’t afford that product.

You wouldn’t buy a car either without planning for repair costs.

A repair in Romania (EU, unlike UK) has a labor cost of 10-20EUR depending on the complexity; in most cases the "repair" is just replacing a component that has connectors, so it takes minutes, or swapping a new battery. A £100 fee sounds like science-fiction or lack of common sense.

A fee of 100-120 euros is not unusual in a part of the EU that isn't dirt poor, nothing science fiction about it.

The question is, would it lower the total cost of ownership? A phone that lasts twice as long will cost roughly half as much (perhaps a bit more if repairs are needed).

There is also no good reason for the cost of security fixes to vastly increase the cost for manufacturers if they slow down the release cycle for hardware and software. This isn't 2010 after all. The pace of meaningful improvements is considerably slower.

Most iPhones hit the second user market whether gifted or sold on.

They have a far higher trade in or resale value than any other brand.

It actually causes a bigger second hand market of phones if they have a longer life. Plenty of users still want the latest or there abouts. While others will happily go for the nearly new.

People don't change phones, especially cheap phones, because they stop getting security updates.

The result of this law would be that cheap phones will get more expensive for no benefit at all and expensive phones will cost the same.

Users of low-end phones would still benefit from the extended support lifecycle because their device and data would remain secure for a longer period of time.

Have you asked them if they are in agreement of that in exchange for a more expensive phone?

They're free to purchase second-hand phones, if they want to buy an even cheaper device. When most phones are supported for 7 years instead of 2-3, the market of second-hand phones that are still supported will expand greatly.

Second-hand phones will massively go up in price if this happens. Not a solution.

Not even going into the problems with second-hand phones and that poor people de-factor have zero legal rights as they don't have the money to take sellers to court.

Instead of buying a 1-2 year old phone with 1 remaining year of support, the legislation would allow users to choose to buy a 6 year old phone with 1 remaining year of support. Since new phone releases apply downward price pressure on older phone models each year, the 6 year old model would most likely be much cheaper under the new legislation than the 1-2 year old model is currently. Budget-conscious users would appreciate having the 6 year old model available as a more affordable and equally viable choice.

Many used phone sellers/marketplaces offer extended warranties on second-hand phones, which risk-averse buyers should purchase.

> Not even going into the problems with second-hand phones and that poor people de-factor have zero legal rights as they don't have the money to take sellers to court.

This thread is about EU law.

In EU you don't have to take sellers to court, you just have to nag customer protection authorities until they do.

It might take some time: Google still hasn't gotten a massive fine for abusing its position in search and ads to kill competing browsers despite my reports but I will not be surprised when it happpens.

PS: come on guys and gals and do write to your local competition authorities. The sooner we can get this sorted the better.

I'm not sure that any significant number of people have switched phones due to lack of updates. It usually comes down to:

(1) Battery stops holding a charge

(2) The device gets damaged

(3) Cameras get a lot better

Beyond just battery flash slowly wears out over time, degrading performance. Based on my Nexus 6 I would love it if the EU dictated batteries must be replaceable, but you need an overabundance of flash so a few years in there are still cells left to balance wear across.

The Nexus 6 automatically throttled performance based on battery left, but at some point the battery wore out to the point that less than 1/2 an hour of use got you below that threshold. After that the phone was very laggy and frustrating to use. No way anyone would want 5 years of that experience, updates or not.

Expensive phones don’t necessarily have much more long term software support than cheap ones and the cost is typically shared across the full product line. Yes Apple provides longer support than Android phones, but a high end iPhone and a low end iPhone get the same term of updates, just as a high end Samsung and a low end Samsung get the same term of updates. A highend Samsung absolutely could have longer support which would improve its value. At the point where this is being built for high end phones, the marginal cost of including support for low end models is very low.

The benefit is receiving security updates. People may not choose to update their phones with security in mind, which is all the more reason to do it. Security updates is a place where consumers can be shortchanged simply because they are invisible, the consumer may not be aware that the security of their phone has been breached, and it is the sort of thing that consumers rarely think of until something bad has happened.

As for cost, I don't see why it would have to go up all that much. Apps are already upgradable on phones and much of the OS is hardware independent. So the only real pressure point is with the kernel and other hardware dependent code.

You've described most EU policies.

> 2) Reduce number of models on offer.

I see this as a big plus. Not a fan of Apple but they did get this one right (at least in the past).

4) Use components for which open-source drivers are available. Phone vendors would then be able to build the drivers from source, possibly reducing the cost of shipping updates.

In the modern day Smartphone market you are practically dealing with three groups. Apple, Samsung and Chinese Brands. These three represent over 80% of market and closing it to 90%.

1) Withdraw from EU market - I guess most people dont realise EU as a market itself is 2nd just behind US.

2) Reduce number of models on offer - Parts aren't that different across models.

3) Most likely answer - Although it doesn't cost that much at all. You can still get a 7 years old iPhone 6 repaired, it is just costly, as it did 7 years ago. The incentive pushes you to buy a new Phone.

> withdraw

Come on. Every time the EU tries to implement a consumer protection a whole contingent of people comes here to say that this will cause companies to leave the EU. China is so much worse in terms of constrictive laws and regulations and you can plainly see that companies don't care. They adapt and sell, that's how they work.

I don't think security updates are quite enough. Sometimes you need updates to keep functioning. For example support for TLS 1.0/1.1 or older signature algorithms was widely removed, which can prevent old clients from connecting to most servers.

Would deprecated TLS not fall into the "security" category? It's hardly a feature.

As a practical matter, it's a far cry from something like backporting a vulnerability patch. How likely is it that you can actually get TLS 1.(N+1) without a breaking change to an API?

I view this as a breaking change in the behaviour of many internet servers, which happened to be motivated by security. Which is different from fixing the security of the software on the device.

Some other examples of non security issues that might require modifications:

* Widespread adoption hosting multiple services on the same IP, relying on SNI for TLS to function. While this is in TLS as well, it's not a security issue. In practice it was adopted slowly enough that it didn't cause many problems

* A quick switch from IPv4 to IPv6 (lol)

* Y2K (happened before smartphones)

* timezone database changes (e.g. if the EU abolishes DST)

* Regulatory changes (e.g. which frequencies the phone may send on)

* A third party service the phone relies on for essential functionality gets shut down

It does, plainly. Just like not using MD5 is a security concern and patching that out would be a security patch.

yes, security updates are really not enough. just consider the case of app permission hardenings on latest android versions (12/11/10)

I doubt vendors will implement 2-stream updates. Mandating 7 years probably means we’ll all have to use the most recent version.

Weren't phones in 2014 using TLS 1.2? It was specified in 2008.

Sure, but if you deprecated TLS 1.2 today, you'd have to make sure that all devices that are less than 7 years old will get the update.

Is anyone talking about deprecating TLS 1.2 before 2025? (TLS 1.3 being specified in 2018 )

TLS standards are deprecated by vulnerabilities not new Features.

If phones normally receive say 2 years of updates, any phone built since 2016 - thus eol in 2023, should support it (chrome/firefox were supporting tls 1.3 in 2017) - i.e in the next 18 months.

A vulnerability in TLS1.2 would need to be fixed (by implementing TLS1.3) in 7 years under "security patching".

One thing, sometimes phones are released, but manufactured for 2 or 3 years, plus sit on store shelves for a year after that.

Today, you can often find such new phones on sale, yet already? No security updates. End of support.

So the life of a phone model before you even buy it new, may be years...

TLS adoption has been surprisingly slow historically. I don't know if any phones were affected. But .net on Windows 7 ran into issues with TLS deprecation (TLS 1.2 was disabled by default). And I think Windows update on Windows 7 and/or 8 broke due to upgraded certificate hashes.

Android 5.0 is considered as the first version fully supporting TLS 1.2 according to https://support.globalsign.com/ssl/general-ssl/tls-protocol-.... It was released end of 2014, so nearing 7 years.

Wikipedia indeed no longer supports TLS 1.1, i.e. if the phone didn't receive any updates beyond security updates, it'd be broken.

This seems to have happened around 2019: https://phabricator.wikimedia.org/T238038

I'm honestly surprised, I expected the overlap between "everything new supports this" and "actually turned off" to be bigger.

So realistically, after 5 years without updates, the phone would be a brick. That's still 3 more useful years for people who care about security, and perhaps more importantly, 3 years where people who don't know about the importance of security updates or can't afford to care remain secure. This also assumes no non-security updates at all.

the phone would be a brick

Well, to be fair here, the phone would still be able to make phone calls and send/receive texts, so it would hardly be a brick.

As a practical matter, stuff like supporting a newer version of TLS is at the application, not the OS level, so the user would just have to get an update with their browser to be able to use newer TLS. [1] Supporting newer TLS, for a browser, is little more than recompiling the browser; even stuff like Lynx and newer builds of Dillo have current TLS support.

[1] Windows XP stopped being updated by Microsoft in 2014 [2] but Firefox up until 52.9.0 (2018) runs in Windows XP.

[2] The post-2014 point of sale updates were quite limited in scope, and can not be seen as general OS updates

True, the brick was an exaggeration. I thought about the "applications bundling SSL libraries", but especially on a phone, I expect enough things to break to result in a user experience that most would not be willing to accept.

For me, if my phone still made phone calls, still sent texts, still got critical security updates, but I were forced to get Firefox from the app store to browse the modern TLS 1.2 web, I would consider it still quite usable.

For the average user who doesn’t know about security, having their phone updated w.r.t. security but having the phone’s built in browser break because it doesn’t work with modern TLS websites would be much better than having them have their phone compromised and critical information given to hackers. They would be able to get a new phone (or download another browser) if they want a modern browser with modern TLS; that’s a very different rodeo than the current situation of “update your phone or have security problems” with phones not even five years old.

Browsers don't have to use the base os TLS libs.

True, but I expect enough things to break that no non-desperate person would want to use that.

In fact, Chrome does use its own TLS libs and don't have any trouble connecting on TLS 1.2 on Android 4.4.

On the other hand, nearly every application use the base OS TLS libs and cannot connect anymore to servers that disabled TLS 1.0/1.1 on Android 4.4.

Yep. But this is probably a good thing, since those out of date libs are likely to be vulnerable from today's POV.

To engineer the app work remotely safely on such vendor-abandoned devices you need to basically assume you're running on a malware or rootkit compromised device, and just hope that by using your self bundled components you'll have better chances to survive in the core wars game because your app is not being specifically targeted.

Re 1, yes it’s sensible as law, but I imagine Big Tech freaking out at the possibility of having to maintain some security-only update branch for every version a user might have started with.

I don't think this even registers on the list of topics relevant for the federal elections.

"Security updates. No feature updates are required (Which is sensible in my opinion.)"

The lines get blurry. Is a modern browser a feature upgrade or security?

Well, both. But if the vendors really would just sort of fix their old mobile browser, you would still be stuck with a old browser unable to interact with the modern web.

Is it a feature update, that you want to install newer apps? (like another browser)

For this to make sense, it should enable you to update your whole OS of the devicey that it can at least install and update common apps. Otherwise its benefit is very limited.

> But if the vendors really would just sort of fix their old mobile browser, you would still be stuck with a old browser unable to interact with the modern web.

This is a non-problem nowadays. We have long left the times in which browsers received essential features every few weeks. Using a browser with a feature set from five years ago you can still use all the most-visited websites perfectly fine. At the worst you're unable to use small, non-essential features of some sites. Maybe some ads look less fancy ;-)

Your problem today as a browser user is security against zero-interaction exploits, not missing out on some obscure brand-new CSS features. Security updates are thus what you need first and foremost.

Wasm is becoming a thing.

With updates needed.

Browser APIs are less stable than you might think. If you've ever had to develop web apps for smart TVs (Samsung, LG, Vizio, etc.), then you'll find that each model year is frozen on an old version of Chromium – some from 2016, some from 2017, some from 2018, etc. There are enough differences between them to make this painful. For example: multiple versions of the Media Source Extensions API, web components, CSS variables, ES6 modules, and web font loading patterns.

> The lines get blurry. Is a modern browser a feature upgrade or security?

A modern browser should be a feature upgrade. A browser as modern as the one that came with the device, except without known security issues, should be a required security update.

Coincidentally no one develops the latter without the former, so you get the former, but I don't see that you are entitled to it.

If anything I think the law should be designed such that there's an argument that you are entitled to the version of the browser that came with your device with security updates and without any feature regressions, which is never available today since browsers do choose to remove features on a regular basis.

Replying to myself here, one interesting result of the "security updates without any feature regressions" interpretation is that it would be a very strong disincentive to bundling software. You would want to let users install their own browser instead, so that every browser feature isn't a feature that you need to maintain. It seems like it could completely eliminate shipping with apps like Facebook pre-installed, because Facebook is never going to commit to not removing features.

It's probably not feasible with todays software ecosystem to actually create that constraint... but I still really like the idea.

I like the idea.

Often when apps like Facebook are bundled on lower-end Android phones, they are not uninstallable. This means they take internal memory and can't even be moved to SD cards, severely restricting the functionality and durability of those phones. The only way way to fix it is by rooting.

Non-essential or third party apps should be at least un-installable. I'd be ok with a law for that.

A browser is an application, one of which you can have multiple versions installed (even so modern OS vendors try to prevent that). If the system default browser in Android/iOS has a vulnerability, that should be patched. No one forces you to install the latest version of that browser as a security mitigation.

Note that WKRL and DIDRL (two new European directives) will be in effect in Germany starting Jan 1, 2022. They include a consumer's right to updates that allow the device to keep working (including security updates).

But they don't specify an actual period for updates (this will have to be decided by the courts). And, what I find worse, they force the seller to provide the update, not the manufacturer. If the seller is not able to do that (which will be the case most of the time), they can be relieved of their duty.

We're only halfway there.

I don't know anything about these directives, but

> they force the seller to provide the update, not the manufacturer.

This (like warranties) is normally because there's no actual relationship between the consumer and the manufacturer. You do enter a contract with the seller, so they can be held liable when the law is broken.

For smartphones this can be different, since they tend to come with EULAs, but not necessarily.

And the sellers can in turn ask their seller for updates.

So for smartphones devices, if you buy from Apple and Google directly the law should apply. By support extension (through paywall?!) I’d think it will be a small step away from applying to all.

I'm eternally grateful every time I can complain to the seller, and hold them liable for the product for at least 2 years here in Europe. I once tried getting in contact with a major manufacturer about a broken device, and they did absolutely everything to make my life hard and draw the dispute out, even when I had video evidence of the failure. I just gave up at the end. So yes, the seller has to be held liable, and if the product is bad for business, the seller will not want to carry the products. If sellers stop buying unreliable, hard to update devices/vulnerable devices, maybe it will make enough of a dent on the bottom line.

So who was this deplorable seller, so that we may also avoid them?

It was a case with Samsung, but I've had bad experiences before with other brands too like Lenovo. The only reason I've got my money back with the Lenovo case, was because the seller was so tired of lenovos responses, he just gave me the money back because he thought their customer service was hopeless and it didn't lead anywhere. I think good service from the brands themselves is the exception, and judging by the ratings they get here in Denmark, it seems to be true.

> And, what I find worse, they force the seller to provide the update, not the manufacturer. If the seller is not able to do that (which will be the case most of the time), they can be relieved of their duty

I'm not familiar with the Android world these days, is it still common for mobile carriers to be a bottleneck for updates? If so, it sounds like this could at least be a solution for that.

I like this, but I think a reasonable alternative would be that for smart phones older than a certain age the manufacturer publish enough information for the creation of free drivers and software and unlocks for installing that software. One thing that makes me really sad is that I would probably be perfectly fine still using iPhone 5 era hardware if I had a free OS I could put on there with ongoing support. That's entirely reasonable in the desktop/laptop space so it strikes me as kinda sad that it seems non-existent in phones, when it's all just computers anyway.

I am a proponent of this idea, but I could never figure out how to address proprietary blobs and third-party entanglements. Even Apple with their massive vertical integration likely cannot fully open source an iPhone 5, as there are proprietary bits like certain chip driver's software API they've agreed to not divulge that are still in effect due to the nature of many legal agreements to grasp for indefinite terms in these matters.

If you're gonna have a law about open sourcing things, you just add a clause that says IP agreements after the lock-up term ends are null and void and unenforceable at law. You can have privacy (of your IP) or property rights, but state institutions will only help you enforce one, not both.

Some people will argue that this will stifle innovation, because the manufacturers of the latest and greatest won't be incentivized to license their stuff. OK. Essentially I'm describing a bet on openness winning out over proprietary over time.

The problem are the SoC that often have weird peripheral and drivers that require patched kernels (and often it's to interface with proprietary hardware that's under IP constrains).

Two options: the claimed IP on the interface is removed or said to never have existed in the first place, and/or prevent bootloader locking.

First one is a very good idea, as older IP law actually holds that interfaces aren't copyrightable. US IP law is schizophrenic on this last point considering the Oracle ruling. E.g. you're free to implement an interface for compatibility.

>> SoC that often have weird peripheral and drivers that require patched kernels

This is a sad industry-wide mess which should have been fixed long time ago IMO.

It is unfortunately common for an Android device to come with a custom patched 2.x kernel with no plans for 3.x support. Then when a next Android is released it has a hard requirement of 3.x kernel. So no Android update for that SoC/device and no way to port this mess into the newer kernel.

If SoC/peripheral manufacturers only supply "software" as a custom hacked 2.x kernel branch they are basically supplying unfinished PoC-quality un-updatable garbage and such software should have never been released with a production device.

This is non-existent on desktop and laptop space where you often have mainline support for all the essential components.

It would be very nice if this happened.

In my view, one other feasible good step would be to require companies to publish the source code of their phones, ie provide the option for people to download, compile and install the full sw stack. Like this even if manufacturers stop supporting their devices, people can step in and do it. At the very least it would make it easier to support devices than it currently is in third party ROMs

I think that would be the ideal scenario.

>In my view, one other feasible good step would be to require companies to publish the source code of their phones

That is definitely not feasible. Vendors are very protective of their code. eg. https://github.com/github/dmca/blob/master/2019/08/2019-08-0...

Vendors can be as protective as they want, they can't go against the law of the land.

The point is that there will be a lot of pushback from vendors. Meanwhile I doubt even 5% of the electorate actually cares about this. For that reason I don't think it's really "feasible".

>Meanwhile I doubt even 5% of the electorate actually cares about this. //

Representational democracy is supposed to work around the problem of an uninformed electorate. The question should be "if a member of the electorate understood this situation well enough would they care", representatives are supposed to use subject experts to help them answer that question and then use their political expertise to implement laws that move us towards a solution.

It's a big ask, and it doesn't work that well -- politicians often work at what will win them plaudits in the press (or what can be presented as a win, if they control the press), rather than actually doing their job.

Fundamentally though "the electorate doesn't care" is the wrong measure, there are a million things the electorate don't care about but would care about if they had the situation presented to them fully ... we pay representatives and advisors so we don't have to care directly ... that's supposed to be how it works.

If the EU will also be happy to pay 100s of billions in IP reparations to the US and Asian countries affected then I’m sure the law will big fine :)

The law only works if it makes sense. Aggressive and borderline punitive laws where IP is forced open will not be followed.

requing operators to allow phone owners to update all OpenSource code, which is probably the majority of the Internet/network facing code in ios and android, could be doable.

They are. But perhaps there is little reason for them to be.

Especially if everyone else wanting to play needs to open up as well.

You could just give vendors the option:

- Release all code necessary for independent developers to provide updates.

- Release updates for 7 years yourself.

Then they can decide what is cheaper for them.

This is not just feasible, there is a device like this: https://puri.sm/products/librem-5.

What about a law the forces vendors to either provide security updates or publish the source code? That seems like a reasonable trade off between consumer rights and ip protection.

Frequently SoC manufacturer make quick and dirty changes to a fork of the Linux kernel. By the time the hardware actually ships, those changes don't work any more with the current Linux kernel.

Trying to make those work 2 years later is a huge effort -- probably worth less than just replacing the phones.

Mind you, I agree with you in principle, but I can see how in practice in might all go to shit.

I guess they gotta stop doing that then, huh? I don't see how consumers and society benefit from rushed, vulnerable crap software. Oh, right. Time to market. Race to the bottom. That's what we need more of.

> I don't see how consumers and society benefit

Actually, you do see. The price of your phone would be higher if Qualcomm had to hire competent engineers to make properly designed kernel changes for their hardware.

How much higher though? If you were to take the total extra expenditure on increased salaries for those engineers, and divide by the number of phones produced, the result is what? A dollar?

Sure, but when applying Marketing Math™, remember that all prices need to end in "49" or "99" to "sound cheaper" than the next incremental bump. So you'll end up with a device that is either $50 or (more likely) $100 more than otherwise.

Or they'll eat that $1 from their profit margins…eh, who am I kidding?

If they're rounding to the nearest $50, they're doing it based on the final cost. They're not going to base it on a what-if scenario of having a cheaper development team. So it's more or less a 2% chance of the price going up $50.

The price of your phone would be much lower if the software stack was truly Open Source, allowing distribution to remove clutter and spyware, and make older phones perfectly usable again.

Planned obsolescence is designed to increase TCO

Magic of compartmentalization of concerns.

It turns out that getting a bunch of programmers to do careful modifications to some C code base over a couple of months is more work than getting great many thousands of people across multiple companies to manufacture, distribute and sell new hardware to millions of customers.

> I guess they gotta stop doing that then, huh?

Why would they? They get paid to put out crap, so they'll continue doing it.

Bottle water continues to come in plastic bottles, even though glass if far cheaper/easier to reuse or recycle. Plastic bottles are literally trash, yet it'll continue being produced if people keep buying it.

Near-disposable phones (both hardware and software) won't stop being manufactured if they continue being in high demand.

If the code were open source, I'd be willing to bet quite a lot that this kind of code would get cleaned up and mainlined. Certainly for popular handsets from major manufacturers which probably account for the majority of handsets sold.

Thanks to the GPL this is already often the case (at least for the kernel). But vendor code is so abhorrent in quality, upstream efforts are few and far between.

> Frequently SoC manufacturer make quick and dirty changes to a fork of the Linux kernel.

SoC makers deliberately do this as a way to force phone manufacturers to buy new chips.

For example, if they release a chipset in 2020, it will ship with Kernel 4.14 (released in 2017). Why ship such an old kernel on brand new hardware you say?

Well Android 11 (also shipped in 2020) supports Kernel 4.14, but you can be pretty sure that Android 12 won't support 4.14. So that means that OEM's can't make android 12 work with that chip without a massive engineering effort (and by the way, a bunch of chipset blobs will be compiled against those kernel headers, so changing kernel versions is pretty much impossible).

So, the main reason to use a deliberately outdated kernel is to prevent last years chips running next years android release, without the chipset manufacturers permission and a share of the profits.

> and by the way, a bunch of chipset blobs will be compiled against those kernel headers, so changing kernel versions is pretty much impossible

Binary drivers can be reverse engineered and reimplemented for the new kernel. This takes a lot of effort since it requires following a "proper" clean-room methodology when doing so for interoperability purposes, but is otherwise doable. A complementary approach is to forward port the minimum set of features that's required for Android 12 to the older kernel, in a way that carefully preserves the portions of in-kernel ABI that the binary drivers depend on.

Reversing engineering is hard. It would be nice if the kernel didn’t trash it’s ABI all the time for ideological reasons. Hopefully a new OS (fuscia) will fix this.

Meanwhile in Windows land: You can run 20 years old drivers, no problems. Hardware is a commodity.

I can see why Android was so popular with OEMs!

> Meanwhile in Windows land: You can run 20 years old drivers, no problems. Hardware is a commodity.

You can sometimes run 20 year old drivers, assuming same ISA and that none of the ABI has changed, which does in fact happen, just more rarely. Windows 10 is certainly not compatible with 100% of drivers from Windows 7, let alone XP (20 years ago is 2001, so Windows 2000 is actually likely).

Why not both? There is no compromise needed here. Both things benefit the public interest which, after all, should be the author of the law (in a democratic country at least).

> Why not both? There is no compromise needed here.

You're assuming that it's actually feasible to keep old devices up to date for that long. It may well not be. It gets substantially harder to maintain old branches the further mainline has diverged from them. The original engineering team has typically long since moved on. The magnitude of the issue, here, can be on the scale of "we now need several times as many engineering teams".

This isn't a matter of "security updates would be better than no security updates". This may potentially be a matter of "security updates for four years is economically feasible, security updates for seven years isn't". (I'm not saying it is infeasible, just that it may well be.)

Thus a neat effect of such a law would be that SOC manufacturers would not purposefully break compatibility as much as they do now. Sounds like a win-win to me!

Or, much more likely, they'll continue building new hardware as they do now, and let the length of software support for old hardware in one particular market be a software problem for the vendors selling into that market.

Don't assume that attempting to solve a problem with a law can only have one possible outcome, and can't possibly have a different outcome instead.

I think this is much more reasonable as well, for many kinds of devices. Either give people the ability to update the device themselves, or you have to supply updates. (I think 7 years is a bit much, but the duration is a quibble over a minor detail rather than a fundamental principle.)

I would prefer if instead smartphone makers were at least forced to add a tool so users could wipe the memory and install a free bootloader.

And would be great if they had to also provide a free OS, like postmarketos, lineage, Debian or something like that. It could be very rudimentary without a GUI, just drivers for GPS and Wifi. And they would not have to provide even security updates for that. So I would think that many companies would also prefer that.

Literally the only reason I stopped using my last two phones was that the security updates stopped streaming in. Even now they sit in a drawer, perfectly functional, abandoned by Google.

It's one of the reasons I moved from Google to Apple. iPhones 5-6 yrs old still supported. I always thought iPhones were too expensive, but I didn't take into account the upgrade cost every 2 yrs on Android.

Same here, I bought my first iPhone almost 4 years ago. It still works like the first day. I used to like constant change (installing different roms, customizing my phone, waiting for the next cool Android UI refresh, switching phones every 2 years etc). But as I get older I started to like consistency and the feeling of using my phone for years without thinking too much about updates and whether I would get them or not.

same here. turns out an iphone 8 is a damn good phone today and I expect the new iphone se to be the TCO-wise budget choice.

This seems backwards to me. You can still run modern Android versions on old phones like the OnePlus One thanks to LineageOS. There is no custom ROM scene for iOS devices.

Except you cannot. The graphics driver of my Nexus 5 no longer receives updates. It is not compatible with newer Android versions.

And… that's it. Just like that, no more updates. Less than two years after I bought it.

There are numerous open source builds of AOSP forks for the Nexus 5, including LineageOS.

Yeah, you're not gonna get baseband / blob / firmware updates or security patches outside of platform, but the damn thing is 8 years old.

The Nexus 5 issue was just an example. Even phone makers are totally dependent on Qualcomm etc. providing drivers and maybe updates to those drivers.

It's not like you can just hack updates together yourself. Not always anyway.

Show me one exploit in the wild that you would download from Google Play or be affected by using an updated Google Chrome from the Play Store.

Just because security updates stop doesn't mean your device is immediately insecure and cannot be safely used.

The majority of the phone's actual updates come through Google Play Services.

Meanwhile, I can show you an exploit in the wild that affects virtually all iOS devices even though they're regularly patched up: Jailbreak methods and iMessage zero clicks.

There was a six-part series on Google's Project Zero blog at the start of this year called the "In-the-Wild Series" which included Chrome and Android exploits. In May, Ars Technica had a post called "4 vulnerabilities under attack give hackers full control of Android devices" which detailed more exploits Project Zero had found -- there were actually 50 in the Android security bulletin that month, four of which were zero-day exploits explicitly described as "exploited in the wild" by a Google researcher.

I'm not going to argue that iOS is some super secure fortress of impenetrableness, or that Android is some kind of digital petri dish that becomes immediately infected with the 500 Viruses of Bartholomew Cubbins the moment it connects to wifi. But there are Android exploits documented routinely, some of them are serious, and some of them have been found in the wild.

I'll make it easier for you.

I have a Nubia phone which runs Pie.

Its last security patch is dated August 5th, 2019.

Play Services and Chrome are fully updated.

Where is there an in the wild exploit that you can point me to? Proof of concept or otherwise. I'll happily load it up in Chrome on my phone and let it compromise my system.

Meanwhile there's a zero click iMessage exploit article still on the first page of HN.

What gives you the impression that Android security updates only involve Play Services and Chrome as opposed to the file system, bluetooth, wifi, CPU, and GPU stacks, or anything else? Do you have a reason for believing that any of the numerous drive-by Android remote code execution CVEs published since August 2019 can be mitigated without updating any of the vendor and kernel components that Google had to update to stop them?

Let's ask ourselves this basic question: If Play Services and Chrome could keep an Android Pie system secure, why does Google bother with a separate security patch date?

> Meanwhile there's a zero click iMessage exploit article still on the first page of HN.

Maybe because it's news and critical Android remote exploits are found often enough to not be news.

> Maybe because it's news and critical Android remote exploits are found often enough to not be news.

Then you should have no problem being able to find one that will exploit my phone. I even gave you the specific Android version AND security patch level to target.

Get at it instead of pointing to the sky and saying "look!"

> Then you should have no problem being able to find one

https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

https://source.android.com/security/bulletin

Enjoy your phone. Or don't. None of us are your mom, so we can't tell you what to do.

> Get at it

Abrasive demands are unpleasantly childish. Not being your mom also means that I don't care if you suffer from your own negligence. You can either keep yourself abreast of Android platform security woes or not. As Captain Planet says, the power is yours.

So basically, you have no in the wild exploit that you can have me load up on my phone and have it become compromised. Got it.

Thanks for proving my point.

Dude, I literally mentioned articles with in-the-wild exploits that have been found for Android this year. "Yes, but those are from a few months ago, they are fixed now, and there is a CURRENT one for iOS" is not the "checkmate, iSheep!" move you apparently think it is.

Then you should be able to provide an actual link of an in the wild exploit.

Try Xiaomi, we bought a MiPad 2 and it was EOL after 6-months.

You should not buy a cheap device from a manufacturer with bad SW update reputation.

Look at Samsung Galaxy S7 Edge - 5 years old device:

- Released with Android 6.0.1. - Received 7.0 and 8.0 major updates. - Has unofficial 11 support. - Received September 2020 security update.

Cheap device manufacturers unable or unwilling to support software updates should be banned by law. It should be a part of their job. Instead, they often seem to release one "proof-of-work" initial release and then don't care and work on the the next model to repeat the same. Pretty sad.

I think these requirements are very reasonable and we have an existence proof that it is doable.

I know that Apple supports its hardware for seven years in California (and not other US states as far as I know) due to state law. I can’t imagine other manufacturers are immune to this same law.

I’m not holding Apple up to be some paragon of virtue, but it was easy for me to find what they write on the subject: https://support.apple.com/en-us/HT201624

Oh! "Apple I" is considered obsolete :)

Clear evidence the government needs to act.

Eh; it's slightly past 7 years old;)

...and listed, like the Lisa, under "Mac desktops" for some reason. But aside their organization, the comprehensiveness of this list is actually quite satisfying:)

It's amazing just how many products are on that list. I wonder how many man-hours of development that represents.

Providing firmware-updates and spare-parts (especially batteries) should be a requirement for all-purpose-computers i.e. laptops and desktops. And also for smartphones with user replaceable operating-system. For devices which are only appliances (smartphones with boot-lock and worse) this also extends to the operating-system itself.

This makes devices more expensive? The prices will be higher but the value you get also. I'm talking about companies which uses adhesive strips and unusual screws with tiny buckles (Apple - iPhones) or the ones which glue the display onto the baseboard (Google - Pixel). Or companies which used to provided user-replaceable batteries with notches, which now uses screws inside the device (okay!), but now also a firmware to ensure that the user won't get a replacement battery some years later (Lenovo - ThinkPad). Otherwise Lenovos ThinkPads are good example, step-by-step manuals, explosion diagrams, well maintained replacement-part numbers...and yes, more expensive.

> The prices will be higher but the value you get also.

Not everyone values repairability.

Your statement is valid for individuals. But as a society, we could value reparability. And laws are there to enforce what the society values, not the selfish individuals you and me are part of.

But we know society doesn’t value repairability as they don’t prefer repairable devices in practice.

I as an individual hardly have a choice. If they offered a version of the next samsung phone with a removable battery I'd probably buy it.

Just know it’ll be at least 2x as thick if not more.

https://www.gsmarena.com/compare.php3?idPhone1=10001&idPhone...

10 mm vs 7-8 mm for class leading phones. Maybe the Xcover Pro is rugged enough to use it without a case/sleeve ("Drop-to-concrete resistance from up to 1.5 m"), so it might end up being thinner in practice.

Google Pixel 3a XL: 7.6mm Samsung X Cover: 10mm (replaceable battery)

It's definitely thicker. But not double.

My S4 with a removable battery seemed like the same thickness as my S8 without a removable battery.

If that’s what you want then you be the one to build it or pay someone else to build it.

Why should the rest of us pay for your preferences?

If there was no e-waste, you’d have a point. The problems come when negative externalities are not priced in. Then we’re forcing people to pay those costs, though they may be distant in time or space.

This is an odd question. There are "losers" and "winners" with the state of any market. Currently, those of us that prefer repairability are the "losers" in the smartphone market. I therefore put your question back to you.

Why should _we_ pay for _your_ preferences?

Because you lose the vote (we voted with our wallet the other way). Anyway, there’s plenty of room for niche companies to serve your market.

The current situation is people providing the products they want to.

Yours is the position of applying state force to make them do something they don't want to - the burden to justify is entirely yours.

Why do you think the market is providing people the products they want? This may be self-evident for you; it isn't for me. Markets are useful, but they don't work well. People want to be forced to spend an extra buck for guaranteed free returns and another extra buck for minimum warranties, and maybe another buck for 7 year of updates. They also want the resulting costs to be distributed amongst everyone, which makes them trivial. This isn't a particularly unusual idea in a continent that has tended to embrace socialized healthcare.

A big enough majority of people wants it, anyway, to vote for representatives that write these laws. I'm sure there is a small minority of oppressed Randians who suffer terribly from all of this.

https://www.samsung.com/us/business/mobile/phones/galaxy-xco...

There you go.

Society is looking only one immediate issues: Is it comfortable. Only later the notice the long term consequences.

That is the reason why Microsoft was able to dominate the desktop market. Now wonder, the number of professionals on the desktop market is low. Despite the harmful effects of the UNIX-Wars, Linux managed slowly to take leadership of servers, super-computing and some professional devices (Lenovo ThinkPads, Dell Developer Edition).

Naturally some consumer test boards would hint on long term effects and consumers would adapt ("Don't buy car X from Z, it has problems with the engine after 40.000 km.") computing is very fast changing and one bad decision can bound you for years. A large base of Windows users cannot switch, they are not able to switch because they bought sadly hardware from a vendor with not open drivers, or a specially crafted bureaucracy. Of course XMPP existed and was more secure but WhatsApp was more comfortable. And even despite Signal is better, they sheer group pressure is extreme. And your Apple-Music account and all the invested money on the App-Store and your GMAIL-Account...

Interesting enough, if you don't buy the most expensive device you get replaceable batteries. If you buy rough phones ("professional") you get replaceable batteries.

Industry is quite good teaching leymans what the have to buy "blingbling" and then just lock-in the buyers. Of course they would appreciate repair ability - they just don't know it better at time. It actually US which fail to help them before they are in the next trap. Schools now using foreign clouds and Zoom. Holy...why we failed to show them Matrix and Jitsi? Why we didn't improved comfort?

Society is a collection of individuals.

>But as a society, we could value reparability

Only if there is large enough individuals who value reparability.

>And laws are there to enforce what the society values

That laws exist when there is enough individuals to support it.

Something that's hardly ever discussed is reliability; having less parts and fewer points of failures typically means that devices can last longer.

> But as a society, we could value reparability

That is irrelevant to the discussion at hand. Yes, free repairability would be fun, but as everything comes with a cost, values are encoded as trade offs between desirable outcomes, rather than the desirable outcomes themselves. When some desirable outcome is not obtained in society, almost always the reason is that there are other tradeoffs being made. So society values affordability, competition, performance, longevity, quality, repairability, customizability -- and that's just on the product side. Then these product trade offs compete against things like labor market protections, use of resources for competing products, etc.

When Apple decides to solder RAM into the motherboard, it is making a trade off between performance and repairability. When Tesla chooses megacasting that might result in a fender bender totaling your car, they are choosing reliability and lower production costs over repairability. Just bemoaning that some product is less repairable and that society values repairability so therefore some dark force must be working to subvert society's values is not a useful or insightful analytical approach. Everything boils down to tradeoffs.

repairability = better resale value. more people would value this.

I'd go even one step further: EOL software and hardware should be forced to be open-hardware (at least open schematics) or opensource. If you're not willing to support a product anymore then it should not be possible for it to simply turn into a brick because you turned off a server.

This would either create a market where companies will sell the license to support old products to other companies, or old hardware and software would finally be able to be supported by the community. There wouldn't be a need to reverse engineer or develop stuff in a "clean room" for fear of litigation.

I really like this idea. I know in the business world a lot of EOL products get spun off into companies that maintain support.

Sounds great until companies sell the license to maintenance as the last buck to squish from a product to a third party that will jack up the price just to keep the service running. Better to either force an open source/schematics approach and let the community keep it, or force to sell a certain number of licenses for maintenance.

Imagine powerful and lightweight laptops only sold in Americas and Asia while in Europe one will only be able to buy bulky (because repairability) and slow (because high-end manufacturers focus on less regulated markets) versions.

That's what grey-market imports are for!

> This makes devices more expensive?

No, it makes them cheaper by pushing back planned obsolescence.

> ones which glue the display onto the baseboard

yea funny story about that. I have a google pixel 3 xl. Was in great condition. No cracks or issues. So I'm in the medellin airport waiting for my flight to Lima when I'm talking to a friend and notice that a crack is forming alongside my phone. To my horror, the battery decided to swell open so far that it cracked open the cell case. Here I am with a phone that as far as I know, is about to shit the bed and I'm in the middle of a foreign country on my way to ANOTHER foreign country with no way of activating a new phone. (google fi requires the phone be in america during activation.)

Luckily in Lima, I was able to track down someone that could doa. replacement. This phone was clearly not designed to be repaired as I saw him slowly melt layers of glues and pull apart different pieces to do the actual battery replacement.

He managed to get it working but now the finger print reader isnt' working. So here I am currently in latin america with a phone that has a cracked case and a broken fingerprint reader. I'm waiting till I can stomach coming back stateside to replace this phone because repairability was never a concern.

Here's a "win-win" scheme which benefits both consumers as well as manufacturers/retailers without running up the costs for either: mandate the release of a device tree for all devices at least a year before the last vendor-supplied update so the users can migrate to any AOSP-derived distribution - LineageOS being the most well-known. The device tree should be complete, i.e. it needs to contain any needed drivers in either source (preferable) or blob form so the device will continue to be fully functional when used with a third-party distribution. Doing this will drastically increase the useable life span of devices by mostly removing software obsolescence as a factor. Hardware will still age, performance will eventually lag too far behind current devices but seeing as how I'm using several devices from around 2010 (Motorola Defy/Defy+) for specific tasks those 7 years can easily be extended without any additional cost to either vendor or consumer.

Project treble should actually be really close to this, come to think of it. And I kind of think that that's theoretically supposed to be part of Google's certification process for Android, though I suspect there are caveats (ex. without unlocking the bootloader it doesn't help).

iPhone 6s (not 6) level of performance and above is really enough for most people to do normal every day tasks (not gaming). People are going to be keeping their devices for longer lengths of time. Security updates for longer periods are essential.

However, not all phones are iPhone 6s. A Nexus 5X is almost seven years old at this point, but I found mine to be rather slow a few years back.

Android phones just hit the "good enough" point a few years later than the iPhone ecosystem. My Samsung S7 (2016) is roughly as fast as my 6S (I have both for developing, and they're both plenty fast enough for everyday usage).

I don't think consumers are that interested in processor speeds anymore. Cameras are probably the biggest selling point for new phones these days, followed by battery life and display quality.

Except all the flagship phones regressed from 1440p to 1080p displays.

They have gained things like high refresh rate and OLED etc, though

My S8 was reasonably priced with a 1440p screen. High refresh is horribly supported on android and nothing like display port adaptive sync. I don't to pay a new ultra price for what I already have.

I believe industry noticed that 1440p on 75mm width display is overkill (or say there are other points should be improved than resolution). It's good thing for battery and price.

I prefer the crispness of text on a 1440p screen. Why should I pay more for less?

I wish you could get what you want. Why smartphone price rising is mainly due to almost all smartphone improving camera too much. I hate it.

Even cameras are starting to get "good enough" in most phones; even less expensive ones (ie: last years' Pixel 4a).

Gaming worked fine on a game boy. I support the end of arms race in gaming and a move towards power capped gaming rigs with games to match. Other sports have done this and it has many benefits above and beyond CO2 reductions.

Early humans (at least some of them, I gues…) lived happily in the caves. We should ban everything and move back into caves. Just imagine how much co2 would that save!

I only replaced my 6S a few months ago, and found it perfectly good to continue to use, not just around the house but in some outdoor uses where my phone might be at risk. Yes the 12 has some features that are nice, but upon a few months’ reflection really its biggest advantage (to me) is that it is smaller.

Software updates should be indefinite, like Linux distros, which can still run on 15 year old hardware just fine.

The future ought to be something like PinePhone (but with better hardware) that can be customized to run a variety of OS with consumables such as batteries easily user replaceable.

I would assume the reason why open Linux distros support 15 year old hw is because the OEM dropped support for it in the first place.

Yeah, that is definitely the ideal future. Problem is that it has to be a well organized entity behind this. The open source community is very fragmented and can't spawn a reliable product for the mass consumer in the way current companies can.

Yes, but who will pay for that? More burden on maintainers -> less maintainers -> more burden on maintainers.

If phone manufacturers stopped producing 10 models every year and focused on making a single robust one, they would have plenty of resources left for actual maintenance.

Sure, but they're in the business of selling as many phones as possible which means getting you to upgrade every so often. Unless they settle on a business model that allows them to make money from your old phone, I see this continuing.

> Unless they settle on a business model that allows them to make money from your old phone, I see this continuing.

...like apple and its recent focus on services?

Honestly why should I care what their business model is, if it is detrimental to users and the environment. That's the whole point of laws, to discourage behaviour that we as society deem undesirable.

And that's why you can't let the market govern lives, and we have regulations.

Plus one flagship phone neglects the largest portion of the market who want cheaper phones

Then they should do like Apple did(?) and continue to sell older generations as the low end segment offering.

Which should incidentally make sense since they'd be still supporting because of the said law anyway.

Another side effect is this may also discourage them from churning pointless new models year after year with minor spec bumps.

> from churning pointless new models year after year with minor spec bumps.

They'd never abandon a working business model like that

> Sure, but they're in the business of selling as many phones as possible which means getting you to upgrade every so often.

Indeed they are, but planned obselescence should quite simply be illegal. For sure it'll hurt some businesses, but it's better for everyone else.

"Selling as many phones as possible" allows yearly upgrades, but instead of 10 different models per year they can sell 3 models per year with 3.3x sales of each model. I am looking at Samsung models on the market, they are close to 10, Apple has maybe 2 or 3.

Basically... be more like Apple?

How so? Apple also releases new models almost every year with very dubious quality. I remember some scandals about antennas, and more recently about RF interference with pacemakers, but i'm sure there's a lot more i'm unaware of. Apple prevents users from using the hardware however they please and blocks the bootloader. They don't even give you root on your own phone!

Also they're famous for making their products hard to repair. It's hard to find spare parts, hard to find their custom screw heads, and hard to tear everything apart. You can't even remove the battery without tools which is very user-hostile, bad for the environment, AND was a pattern "popularized" by Apple, because if any other hardware manufacturer had dared to do that, they would have sold exactly ZERO phones.

All in all, Apple is close to the worst manufacturer i can think of to get inspiration from, although on specific topics (eg. LCD screen solidity) they are definitely not the worst.

I so wish that at least when a manufacturer stops supporting hardware, he has to drop source code of drivers and the firmware in the public domain.

Wouldn't that cause them to skip features and pick cheap drivers? How many people would benefit (not theoretically, but in practice)? Average life span of a mobile seems to be 2 years and a bit. After seven years, very few users will be left. And it's not as if everyone ditches their phone because of lack of updates.

I don't see why. Theorically it could benefit a lot of people and help community driven projects or companies wanting to provide long term support. For example, if you create a phone that relies on Qualcom socs, qualcom only provides a few years of support, once they don't provide any new driver you're screwed. Forcing the release of source code would at least help open source driver initiatives.

> And it's not as if everyone ditches their phone because of lack of updates.

Often it's because of lack of app support, which is in turn because of lack of updates. Of course some people will always want the latest phone, but there are plenty of people that don't, and the second hand market is thriving. This is especially true in countries with lower income levels. I went on a trip to South America a few years ago, and most of the young people seemed to be using iPhone and android phones from top-tier manufacturers, but several generations old.

> like Linux distros, which can still run on 15 year old hardware just fine

First, let's remind that LineageOS does not run on 15 year old smartphones (and they drop support for a device when there is no upstream support from vendors on the same Android version).

One issue is that unlike x86/x86_64, there is no generalized abstraction platform (similar to BIOS/UEFI/ACPI description tables) that enables "one kernel to rule them all" i.e. you need some custom adjustments on your kernel for your SoC and board. Since a few years we have device-tree which improves a lot the situation, but I understand it does not cover everything (i.e. there would still be some missing aspects compared to UEFI/ACPI with regards to hardware description. Maybe some embedded experts can comment ?). Besides it is still not always implemented in chipset vendor's BSP which sometimes still rely on board files (where the data is not easy to extract from a binary kernel, noting that a lot of low-end OEMs do not properly comply with GPL and do not publish their sources)...

> and they drop support for a device when there is no upstream support from vendors on the same Android version

Nope, they drop support when the community runs into issues with a particular model that it's impractical to fix. Upstream vendor support helps but is not required in any way.

Device tree "doesn't cover everything" because some device components are yet to be supported in the mainline kernel. Once mainline support is added, that enables a 'universal' kernel to provide that support via the device tree.

This is true. I have used Lineage OS with android 7.1 on a first gen Motorola G phone (that was declared EOL after the Android 5.1 update) and now on a OnePlus 5 with Android 11 (manufacturer dropped support after 10)

And I can get Android 11 (LineageOs 18.1) for my Galaxy S5. I believe Samsung stopped updating it at 6.

> One issue is that unlike x86/x86_64, there is no generalized abstraction platform (similar to BIOS/UEFI/ACPI description tables) that enables "one kernel to rule them all"

Windows on Arm devices use UEFI + ACPI, including Windows Phone starting from Windows Phone 8 (2012!). That allowed even the latest releases of Windows 10 Mobile to work on totally unsupported devices (1st gen WP8 devices) when that existed.

It's not an Arm problem, it's that the Android world didn't bother really tackling the problem for a long time.

I think user karteum brings up good points, but they are more like industry excuses than reasons. It's clearly possible to clean up this mess, but the OEMs and OS vendors simply won't bother since there is no regulatory reason to do it. This move from Germany is a great first step, but it's a step down a long road that the industry will fight at every exit.

This is a bit disingenuous. The problem is that every soc manufacturer wants custom data to pass to their driver. With ACPI, you need to standardize this data and get it published in the yearly spec update. With device tree you just check in your new device tree bindings alongside your driver in the kernel repo. Device Tree blobs are only stable with respect to the kernel version they were built for. It also doesn't have to worry about being OS independent. SoC manufacturers are happy with this arrangement because it lets them iterate quickly. It is a much lower bar with much lower costs compared to ACPI. In recent years, ACPI has started adding support for encoding data which is non standard by allowing key value data, but using that sort of defeats the point. Those fields aren't usually documented and only the driver written for it understands how to interpret that data. Again, that forces ACPI blobs to be versioned alongside drivers. There is completely unlike how x86 works where everything really is standardized and you don't need specific drivers operate every peripheral on the board. Of course even on x86 you can have more specific drivers which are more optimized or expose additional functionality, but generic drivers can an do exist which get you decent support. Beyond device tree/ACPI this means adhering to standardized register layouts and things like that which is completely off the table with arm soc manufacturers.

Windows doesn't have that issue on Arm, you can just boot the newest Windows on Arm release on a random SoC from the past that (if it's the same arch of course, 32 bit or 64 bit have different drivers) as long as the work was initially done first.

For ACPI, the vendors themselves tend to avoid changing bindings between generations for Windows there. Compounded with a stable driver ABI, things continued to work stably within all of Windows Phone (NT based, 8.0 to 10)'s lifetime, which had security update support until December 2019.

Windows RT 8.1 still gets security updates today, and will continue to do so until January 2023.

Linux not managing to standardize on a proper driver ABI _or_ stable bindings with the drivers in the kernel tree is just a Linux problem, and doesn't even affect other kernels on the platform, which mandate ACPI or something else.

> There is completely unlike how x86 works where everything really is standardized and you don't need specific drivers operate every peripheral on the board

Nope, on x86, the meaty bits like the GPU and such do not have a stable register interface or anything remotely near that between generations. :)

On Arm systems, the interrupt controller (GICv2/3/4), timer (arch timer, since Cortex-A7/A15), IOMMUs (SMMU) and other standard devices were standardised since ages now (Apple is their own bubble and doesn't apply to this discussion). One of the remaining issues so far is PCIe hardware quirks/erratums, but that's getting solved.

But Qualcomm isn't interested in making their Linux drivers work with their ACPI definitions, they are stable between generations on Windows though, and not changed needlessly over there. (which allowed us to work to bring AArch64 Windows on the Lumia 950/950 XL using drivers from other SoCs too)

Linux hasnt managed to standardize a proper driver ABI for political reasons - not technical.

While you cherry picked examples that work for your arguments, I would say that they arent entirely correct. On x86, you can use a bounded number of drivers and boot successfully on a large number of boards. This is because things like buses, storage and display are standardized. This is not true for ARM. Every manufacturer does its own thing. Yes there are bits which have been standardized and shared, but for the most part that's not the case. As a result you cannot really make a single image that boots on a large number of boards without also including a very large number of drivers. Windows phone only ran on a limited number of SOCs, primarily Qualcomm.

Also for what it's worth, Qualcomm does update their ACPI definitions between SoC generations. They also fork their drivers to match. If there was a stable driver ABI they could probably do the same on Linux but that's not an option.

On server, ARM vendors went the PC route and just adopted standard interfaces used servers (pcie, sata, etc). This is large departure from SoCs targeting phones, tablets, and iot.

For QCOM the bindings for the base drivers are stable, and despite them forking drivers, the one for the others generally are - too

The biggest concern there is the PEP power management mechanism instead of using what ACPI provides.

> This is because things like buses, storage and display are standardized

That's a rosy view of x86. Quite some laptops ship with Intel RST set up such as stock Windows wouldn't boot on them before adding that driver. Display (frame buffer) is standardised too as UEFI GOP, but that no longer applies when the GPU driver takes over of course. Storage controllers & USB bindings are standardised too.

Doing a Qualcomm driverless boot on those platforms is very much possible, with storage and USB available, enough to install the OS and make it reach the desktop.

(and on a side note, as far back as the Snapdragon 810, PCIe was very much used. The Lumia 950 (XL) had their Wi-Fi controller over a PCIe bus.)

Laptops are definitely trending in the same direction as smart phones, I will not contest that. However my main point is that it's all much more standardized. Booting the system to the point you can prompt the user to connect to the internet and download more drivers is much easier on x86.

Qualcomm having "stable" bindings is a choice they've made. There is nothing forcing them to do that. The point is that they could not do that, because they know all images built for their phones will be specialized.

Qualcomm may use PCIe for one off peripherals, but it is not the bus used for most peripherals.

> SoC manufacturers are happy with this arrangement because it lets them iterate quickly. It is a much lower bar with much lower costs compared to ACPI.

You can also get away with ugly hacks and sub par devs. Doesn't matter anyways, you got all the money from selling the SoC, software is an afterthought.

While the idea that companies are held responsible for all theyr actions are good, there is one big problem. If the rist of failure of a product is to large, companies build shell companies that can go bancrupt. It is done so in oil shipment companies and i am sure there are other good examples. Nothing has been done against that even after huge oil leaks where the responsible companies have been very obvious.

(I do agree to longer enforced support on devices nevertheless)

Linux distros also drop hardware support as my AMD card knows quite well.

Which card are you talking about? I recently ran a ~15 year old card for basic video output and all worked fine.

AMD Brazos E-450.

Basic video is the keyword, on its heyday of GNU/Linux drivers it was capable of OpenGL 4.1 with hardware video decoding, then it got replaced with a driver that does OpenGL 3.3 and that is about it, thankfully the Windows drivers have been kept up to date.

> Software updates should be indefinite, like Linux distros, which can still run on 15 year old hardware just fine.

We'd need an open spec SoC for that.

Pinephone and Librem 5 have that.

This requires hardware manufacturers to work with kernel maintainers. It’s hard enough just getting them to publish the driver source code and not screw the user over for removing “value add” user space software.

The article mentions three and four year update cycles for some android devices.

The "Android Enterprise Recommended" program provides "rugged devices" with five years of "90-day security updates". (see: https://static.googleusercontent.com/media/www.android.com/e... )

The Nokia XR20 is one of these devices, it was released in August 2021. However according to https://www.nokia.com/phones/en_int/security-updates it is not guaranteed to receive security updates after August 2025. Something is wrong.

I love that they are closing all of the loopholes at the start - can’t raise the cost of the replacement parts over time, have to deliver them within a defined timeframe, etc. Combine that with meaningful penalties for non-compliance and I’m sure there are a lot of executives cursing.

I’d love to see the same thing applied to lightbulbs - instead of throwing away the entire bulb because 1/n leds have failed, be able to replace the failed led. I’ve seen a number of YouTube videos where a guy tears down “burnt out” led bulbs and every time he’ll find a single led that is dead or dying and he’ll bypass it and the bulb works fine. However he usually destroys the plastic bulb piece getting it open - would be great if those screwed or snapped on.

They already have a similar law in place for car parts. Manufacturers have to supply them for 10 years. And also 3rd party garages have to be able to buy them. And compatible parts from another manufacturer are mostly legal (can't be protected by copyright).

Extending something like this to software and security updates is a promising idea.

It's hard to see how this could be enforced meaningfully. After all, who gets to decide if the updates represent a reasonable effort at bug fixing and security patching? What's to stop a company throwing out rudimentary updates as a box ticking exercise? In some ways that could be worse by creating a superficial appearance that phones are up to date.

How about "you didn't fix a known security flaw within 3 months, pay 10% of MSRP to all your customers"?

Sounds wonderful, but the entire Android platform relies on patches from upstreams (Linux kernel devs, Google, device driver vendors. Numerous other open source projects that contribute critical components). Timelines like that simply aren't possible. It would kill Android stone dead.

I upvoted because it's an actual concern, but don't agree with your point. Of course non-profit vendors should be excluded from such regulations, providing a best-effort solution.

For other vendors, that would actually be a feature. It would incentivize hardware manufacturers to stop bundling bad/broken Androids with their hardware, open the bootloader and partner with serious free-software organizations who won't break your system or backdoor it. If you really want to roll out broken software for your customers and not give them a choice, pay up.

Then the commercial upstreams will have to provide patches in time in order to still be able to sell their products downstream-wards.

For the open source upstreams... I've heard they accept patches. If not, the source is open, the downstream vendors can fix that. They can even put together a pool, pay into it together, and use the pooled money to develop (and hopefully upstream) a patch...

How do you people never consider the difficulty of implementing these policies. I dont get why some people love new rules and schemes so much.

These are massive companies with revenue in the billions of dollars. If this was regulated, they would figure it out. Frankly, in a lot of cases, it's their own fault that phones aren't updated anymore, not because of any inherent difficulties. If a handful of volunteers can push the latest Lineageos to 7 year odl devices, then Samsung can too. It's just that they have no financial incentive to do so and there are no regulations forcing them to implement what's necessary for long-term support.

They have no financial incentive to do so because people don't care. So why should the government try to substitute its own remote, bureaucratic judgement?

People generally don't see long-term or on a societal level. Do you think most people wanted seatbelts or the founding of the EPA? A lot of times these are issues that are outside the purview of individuals, outside of their visibility. Most people only care about a small number of things like where their next paycheck is coming from and what to wear going out tonight.

This is what government is for.

Many phone manufacturers really struggle to make a profit. See HTC, LG, Nokia, etc.

This will put many smaller brands out of business, driving up prices on the poor. Most lower end brands barely make a profit as if (often selling at a loss when doing sales).

They don't even have to do their own security updates. If they stick to vanilla Android, they have much less work than if they customize the ROM for every one of their devices. There might even be an industry-wide push for Google to make it easier to update phones independent of firmware blobs (beyond project treble), because suddenly there will be financial incentive to push as much work/effort onto the most obvious candidate.

Random updates can break capability with the firmware if anything that firmware relies on in the kernel changes. Would still require them to fully test every function before each update.

This industry wide push to make it easier to update phones will also piss of HN :)

Not at all.

It could be enforced on EU level through CE compliance. No updates -> No sale of future models

Reasonable (security) updates could, for example, include a timely reaction to published vulnerability, A (responsible) disclosure process etc.

I was going to argue, but this could be considered an environmental concern – and hence, it would be in the remit of CE.

Couldn't the CE requirements just be expanded to include "software security"?

Environmentalism and sustainability are the political motivation but are not legally required afaik.

You write down a set of pretty good guidelines and then let it go to court when a manufacturer is found lacking. Court decides. Update guidelines, repeat.

One could check if the phone is vulnerable to any published issues in the CVE database. (I applaud this effort in reducing e-waste).

I think there are some pretty clear-cut cases where it's easy to argue that a phone isn't up to date. For example: a critical severity vuln in the Linux kernel that's already been patched upstream >6m ago, but that phones don't have yet.

If this legislation starts to get the SOC manufacturers and device manufacturers to play ball, I think it could be a huge win.

Force listing specific CVEs that have been fixed. A big enough issue currently is that different devices with the same chipsets won't always get the same firmware fixes, thus this ckuld easily be hepled via market competition - if a device A has a fix and device B doesn't, the manufacturer of B can either explain it or pay the fine.

I'd rather let users install their own OS with minimal roadblocks (one click verification, no loss in functionality, standard low-level interface), seems to me like a more feasible and general option than forcing support of whatever ad-ridden rubbish manufacturers cook up these days.

This is already the case for some manufacturers: see phones supported by LineageOS.[1]

But the manufacturers are changing device drivers like the I change my socks. The community can't keep up.

[1] - https://wiki.lineageos.org/devices/

Right now, there's just not enough people to keep up with all the phones, but with a standard bootloader interface (let's call it EUFI :P), a lot of that work could be made easier and we could have universal images like on the PC.

Also, we can't expect the community to thrive when installing a custom OS on phones is relegated to die-hard enthusiasts by manufacturers who constantly make the experience worse.

EDIT: Many of those phones also lose capabilities users might care about by unlocking: playing DRM'd media, using banking apps... That all inhibits OS customisation.

The that authoritarian DRM crap and a banking bullshit has to stop. Why do they work on old vulnerable Android stock versions, but not on new Lineage os? Security is a dumb excuse here, it is all about exercising power over the user.

I think the goal here is to keep the phone usable for longer than to offer flexibility for tech enthusiasts.

Most people who use phones don't even know what an OS is.

Sure, but that's not the case for PCs. Almost every family I know has at least one guy who can update/reinstall Windows, and those who don't will know to take an old/broken PC to a repair shop.

That mentality isn't there with phones, because historically it hasn't been easy to do more than a factory reset. If right-to-repair initiatives make repairing phones a normal thing, that could very well extend to phones in the right environment.

That guy has limited capacity, and will only support bespoke odd configurations of custom operating systems for so long until he gets a job, realizes this is way too much of a timesink, and announces that from now on, everyone gets a Chromebook.

My point is: Why should phones be any different to desktops with regards to OS availability/ease of installation? If we accept that a significant number of users do use that ability on desktops, why wouldn't they use it on phones?

Because desktops have a higher degree of standardization of some parts needed for this, ex. UEFI, ACPI etc. while the ARM SoC world is full of customizations.

But there is no reason why it needs to stay that way.

Part of the reason why people use phones is that phones aren't as complex as desktops. You don't need to install an OS, it just works.

Unfortunately, that's not enough, since old drivers and firmware remain as security risks even if the OS is updated. This is why GrapheneOS refuses to support hardware after the manufacturer drops support.

https://grapheneos.org/faq#legacy-devices

Some ideas I had for what a regulator can do to protect our consumer rights (including right to repair) on the software tech side:

- All devices should come with unlocked bootloader. No exceptions.

- OS updates should be mandated for a certain period. Especially security updates.

- Standardisation: An open standard API for device drivers should be mandated for the hardware components used so that system developers can easily create support for any OS, and don't need to resort to reverse engineering.

- Copyright restrictions on software code should be valid only for a certain period and become public domain (open source) after that. (It should definitely not be 75+ years of copyright that is currently mandated for films and books).

> All devices should come with unlocked bootloader. No exceptions.

Agree, but I would say it differently : users ought to be able to push their own keys while keeping the "secure boot" feature. e.g. "fastboot key push <key>"...

> An open standard API for device drivers should be mandated

You would also need to convince kernel devs to reconsider the "stable api nonsense" ideology... (https://www.kernel.org/doc/html/latest/process/stable-api-no...)

Agreed on all your points, especially the last -- only I'd include a shorter patent term as well. If the phone is going to have an artificially limited life of 3 years, the 3 year term for both copyright and patent on its constituent parts (software and hardware) is more than reasonable: especially given that the whole purpose of copyright and patent is to build up the public domain commons for society's benefit.

I feel as though consumer protection hasn’t really caught up with technology and this is definitely a step in the right direction.

But what if some software update “bricks” or regresses your device in some way?

I’ve had video games even that have become unusable after software updates.

> But what if some software update “bricks” or regresses your device in some way?

At least in Norway that causes you to get your device either fixed for free, or you get a new one. Any item you can expect to last at least five years, are covered. So for example, if you have a harddrive die after 4 years, you get a new one.

Does that law take into account abuse of the device? For example, if my SSD dies after 4 years because the NAND wore out from me writing terabytes a day, would I still be allowed a new one under the law?

But this can happen anyway during the "regular" support window. I had this happen to me ol years back and it made booting the phone go from a few seconds to minutes as it had to do something with each installed app. This eventually got me to put a custom ROM just so I could stop having this bug, all because the manufacturer (Samsung) stopped caring about it.

The Android world is full of finger pointing about why this is hard. SoC makers have crap BSP support and closed-source drivers. OEMs want to sell new phones (profit) instead of supporting old phones (pure cost). Google can't keep watches updateable despite dictating which SoC is used. Lots to complain about but no real excuses. This invites regulation.

For comparison, Linux LTS releases have up to around 6 years of support.

.. from the kernel.org maintainers, some distros / vendors offer longer support.

But android vendors can update the kernel version too, eg once along with android major version upgrade and then stay on LTS updates only, adds up to more than 7 years.

The latest iOS supports 6 year old iPhones ... this law seems pretty reasonable give that a iPhone 6 is unsupported but is still a solid device.

Just looking at the iPhone release list, I we should be doing something like full product support for at least 5 years, full software support for 7 years, security updates for 10 years (iPhone 5 and up).

Why are you moving the goalposts just because iPhones meet the potential requirements as they are?

You misread. GP specially says they think the law makes sense because currently an iPhone 6 isn’t supported but they feel it should be.

And clearly could be! Apple just drew an arbitrary line at 6 years, 7 would be doable.

Where am I “moving goal posts”? I’m saying the law is reasonable because clearly Apple could follow it and, hence, so could other manufacturers.

Then said I’d go further.

Why Apple can provide such longer update is partially thanks to they adopt vertical integration model. It's not fair to just expand it for all manufacturers.

Samsung is a $500B dollar company, Google is a trillion dollar company. I think they can manage.

Everybody else can ride (Android) Google's coat tails.

I love it how android phones ship with 1-2 year old software and NEVER update, and folks are complaining about iphones :)

Better option: after the vendor stops support it, they should release the keys to unlock the bootloader.

Specification and source code for drivers would be even better, but harder to get.

I don't see why this is a better option:

If a vendor supplies bad security updates after six years, I can demand proper updates or perhaps my money back in return for my insecure device.

If the software is open source i may not receive any updates regardless.

> If the software is open source i may not receive any updates regardless

If the software is open source, anybody can update it. I use a cellphone from 2012 whose manufacturer abandonned a few years after release. This year alone I got 2 updates for it because I'm running the e.foundation /e/ OS. This wouldn't be possible had AOSP not being open source or its bootloader was locked.

How about enforce that vendors publish how long they will support the device and hold them to the promise. Consumers can then decide if they go with the vendor or device with the longer support timeline. If it's a real differentiator vendors will compete on support. I expect though that that won't happen because most consumers won't pay attention or simply don't care or need 7(!) years of support.

I think consumers who care about upgrades are mostly aware that their iPhone will be supported 5 to 6 years, the low end android perhaps one or two year, and expensive androids perhaps 2 to 3 years.

This market exists for more than a decade now, people have had the time to see how it works and how makers behave. It will be nice to always have official commitments (some makers already commit to timelines), but I don’t expect them to be different from the effective support time we already have.

While I am all for long-term support, as stated this law could be a little harh on manufacturers, forcing them to support multiple obsoletter models (we are talking iPhone 6 released 7 years ago). I think it would be reasonable to give them an opt-out by EITHER providing X years of support, or offering a shorter support period but with a discount on device upgrade calculated as percent from the original list price.

Then they just set the list price too high, always sell with a shrinking rebate, and it turns out that nothing changed in comparison to as so it is today. Nice idea...

In case of this law passing they will raise prices to cover costs for supporting old hardware. But I, perosnally change phones every 2 years becuse I like new techology and do not want to pay the price for supporting obsolte hardware which I do not use. Proposed law should balance benefits of people who want to use old hardware vs. ones who one to upgrade often.

This would probably increase resell value of your old devices so most of the cost would be returned if you resell your device.

You need to be able to replace your battery for a phone to last that long.

It would be nice if manufacturers had to make them easily replaceable too.

There's a huge service infrastructure around phone repair and battery replacement nowadays. Not only can you go to the manufacturer and let them do it, but you also have a choice between lots of small phone repair shops, of which there are literally hundreds to be found in any bigger city on this planet. They are as ubiquitous as gas stations.

This development has made non-user-replaceable batteries much more bearable.

Made the article better http://www.wonder-tonic.com/geocitiesizer/content.php?theme=...

Well (just reading the headline) I certainly wouldn't wanna be making a hobby device targeting the German market... sure if this only applies to companies who have been in business for X years and/or are selling Y+ devices.

Anyone have details on how any of these required security updates will be forced to be anything more than an update to the version number?

What's a "sufficient" update?

I can imagine companies just updating whatever models they want to but the older model updates just being cosmetic to save costs.

Shouldn't be a problem if they quit releasing new models at the same rate they are now.

I agree with just not complete with it. It is just important to keep the software actual / safe. Not new features, like Apple does it with full OS upgrade. Not to raise the price for 7 years for spare parts is BS and far from reality.

This might be very naive, but I hope people developing Fuscia at Google bring in some ecological sense, and might find a way to naturally support phones and chromebooks well beyond a five-year point.

I’m pretty sure they will support a stable driver API which will fix many of these issues.

It will open new issues.Everything will be closed source and we are back to this windows 95 crappy driver situation.

What about the windows 10 good driver situation?

Fuchsias is just a way to not open source drivers and kernel modifications at all. So they can just willfully plan obsolescence without having to fear that any of those pesky hobbyist runs their own version that would circumvent those limitations.

At what point does it become cheaper for manufacturers to officially support alternative, third-party OSes (like LineageOS) than to commit to long-term support for Android?

one thing I would love would be a mandate in the usa for cell carries to offer 20 years of service. We don't need 9g. Frankly 3g worked great for everything I needed and 4g works worse (spotty coverage, quicker battery drain). I can't see the point in 5g or beyond. I don't need to watch 4k videos on a 4 inch screen or whatever but I kind of would like to not have to upgrade a freaking cellphone every three years.

Apple already does this

Seems like 7 years could be pretty brittle. Could there be a floor of user requests for update per month or something?

Why? 7 years is a very limited duration, i would personally advocate for (at the very least) twice that, and not just for security updates but also for hardware warranty.

It would push hardware manufacturers to produce good reliable hardware instead of 10 crappy new phones every year, and to partner with reliable systems developers/vendors instead of pushing their own broken-in-1000-ways Androids.

None of the governments business in the first place. 14 years would mean the original iphone is being updated. There would be like 4 people still using it.

At a certain point it's probably cheaper to give these people new phones then it is to update their software. (Ignoring the incentives this would create, of course)

Certainly not from an environmental perspective, and i assume also not (though i don't have a study on the topic) from an economic perspective.

The Playstation2 was produced for 13 years, Xbox360 for 11 years. The CPU I am having in my PC is 10 years old already as well. Long lifespan is not exactly impossible in tech.

Also bringing up the original iPhone is a strawman, as that's not going to be supported by this law any more than it is today, newly released phones however are. And since technological progression has slowed down a lot in the last few years that really shouldn't be that hard.

People don't carry game consoles around in their pockets all day. The refresh cycle for phones is also much faster for a verity of reasons.

> People don't carry game consoles around in their pockets all day

No, but most people also don't need SoCs which performance doubles every 2 years. If the software was properly written and optimised (which would be more common if the firmware developers expected the hardware to have a long lifespan), there would be no reason any phone manufactured in the last 7 years to be sluggish. Anyway most people just want their basic apps to work (e.g. phone, emails, whatsapp, agenda, hotel booking, photos, maps, chat, music player, etc.), none of which should require a very powerful CPU or tons of RAM...

I'd also argue that lack of software support has got to be one of the primary reasons phones get refreshed at the rate they do. I keep my phones until the vendor stops shipping software updates. If today's iOS remained compatible with past devices, I'd probably still be using my iPhone 3. There's no reason it doesn't have to, either. Apple and other phone vendors deliberately choose to drop software support for hardware they consider "too old".

I was referring to the physical wear and tear that a phone had to withstand compared to a game console.

Indeed, but smartphone HW is much more mature nowadays and even the cheaper smartphone can do what most people need from a device like that. So, expecting a device released in 2021 to last 10 or even 15 years and still be useful it's not that weird (beside storage losing speed, maybe). 10 years for a device from 2012 OTOH would be completely impossible.

> 10 years for a device from 2012 OTOH would be completely impossible.

Why? My Nokia N9 is still my daily driver. Only the lack of software updates is making it less and less useful.

Maybe more people would be using it if it was still supported?

You must still dedicate developer time to devices that aren’t used seems like a bad law.

I want seven years of warranty for computers and mobile devices and would be willing to pay a lot for it, but alas.

With people buying more and more smartphone directly from China, will this have an impact ?

Since July, you now have to pay customs & al on goods coming from outside the UE, which wasn't always the case before. But regarding those kind of requirements, would they apply since the seller is not located in Germany (or within the UE) ?

That would kill cheap smartphones.

Presumably you mean sales of cheap phones couldn't be supported as there would be less demand.

So it seems like new sales would be hit but in favour of second hand phones? That seems like the right thing - more use of products that can be repaired and maintained for longer is good, right?

Second hand phones are a shit-show, full of hidden costs (often at least new batteries and paying to check if it has been stolen) and people treat their phones like crap, meaning once the often one-month warrently you often get will not matter much once the phone starts bootlooping after three months from damage caused by the last owner.

Used goods sold by a business carry a 1 year (minimum) warranty in the EU.

Good luck proving that the last owner dropping the phone over and over caused the bootlooping and you would have to spend more than the cost of the device to take someone to court.

Poor people de-facto don't have those legal rights, only what the seller is willing to allow.

If it happens in the first 6 months, you don't have to prove it, the seller has to prove you did something to cause the bootloop[1] (and it's usually not worth it to them). I've had good luck with warranty claims beyond the 6 month period, when sticking to reputable sellers.

[1] https://europa.eu/youreurope/citizens/consumers/shopping/gua...

All those same problems have applied to used cars for more than one century. There’s still a billion people who drive used cars.

Phones are always going to be harder to repair, because of their size.

I mean the cost of the phones would obviously rise if their manufacturers are to do what this proposal dictates. For cheap smartphones the increase will be the most dramatic.

There are many more models of low-end phones than high-end phones. Manufacturers could adapt by producing fewer models of low-end phones, which would make them less expensive to support.

This is how it should have been. Who needs a cheap phone which is obsolete after 6 months... If you need a burner phone you can easily buy a dumbphone. The problem is manufacturers like Xiaomi are misleading customers into thinking that their devices will last them for years.

I wonder how large would be the container with all the unused/expired smartphones.

Be careful what you wish for.... updates have bricked a few of my past phones

Germany and me too :)

maybe instead make it easy for the user to load their own operating system. (and force hardware vendors to release specs and data that would enable open source drivers to be created without having to do reverse engineering). That way, good hardware can have a dedicated community.

I would like a complete ban on sales of mobile phones and computers from companies that attempt to make it hard for independent repair shops to repair them.

Spare parts, schematics and whatever tooling is required or GTFO.

For me, the good compromise for start would be 3 devices per year per maker to have this prolonged support.

Probably I'm native, but also wonder, why there is no single manufacturer that offers payed updates after product EOL. Like subscription service, canonical is offering after LTS release is EOL.

Because it is the phone manufacturers' suppliers, specifically the SoC manufacturers, who have created this mess for all the reasons previously stated upthread. Bright line regulations like those proposed (with some of the suggestions made here) would change that for the better.

I think both the market and now the legislators are pushing connected devices to a subscription model. It's just economically unrealistic to pay once for a 7 years long service.

If this law comes into effect, consumers will pay the increased cost of delivery of 7 years of software updates when they purchase new phones.

Smartphone makers don't sell new phones with a higher price tag and the guarantee of 7 years of software updates, likely because consumers would prefer a lower price and no guarantee.

Thus, the law would effectively force people to buy something that they don't want.

You forgot to account for much higher resale values. After 2 years, you can resell your phone to someone who can still get 5 years out of it.

The fact that consumers don't want phones with 7 years of guaranteed updates (if they did, they would be willing to pay more for them, and smartphone makers would happily oblige) means that the impact on resale values would likely be small, or that consumers are unlikely to try to resell their phones.

> 7 years of software updates

I read this as requiring some software on the device to be updated every now and again for 7 years. I believe most Androids receive updates on the bundled Google apps for approximately that time period.

The article isn't the proposed law, which probably has a more precise requirement.

If it were me, I'd require software updates for devices with known vulnerabilities putting a typical user at risk. And software updates to allow for newer standards compatibility (eg TLS, WiFi protocols, API versions for apps) where typical users are likely to be impacted by not having the new version.

I would start the 7 year countdown from the date that the device disappears from most shops (so exclude specialist eBay stores that allow enthusiasts to buy old devices).

Reply on news.ycombinator.com