The next thing I'd like to see is a rule on maintaining security updates for devices beyond 3-4 years. I'm going to have to give up my perfectly operating 4/5 year old Samsung phone shortly because it'll be falling into the "no support" bracket.
It's just that the lifecycle they work to is the two year phone contract replacement lifecycle, not the longer one you might imagine.
It's Darwinian: as long as the phone is not abandonware by the time the user's contract runs out, it doesn't matter.
And the only Darwinian pressure to resolve this would be longer plan terms.
I suspect the increasing discussion of longer support periods does suggest my Darwinian scenario is changing. A bit.
An alternative would be to require that all products with an "expiration date" list it prominently on the packaging and marketing materials. Make it very clear that the device will no longer be receiving security fixes and will be increasingly likely to be dangerous to use after that date.
Then you still have the option to produce and purchase devices that won't be supported a reasonable time, but the consumer is aware of exactly what those limits are before purchasing so they can compare prices accurately.
What you seem to be suggesting is that it should be OK to sell people products that NEED to be supported to not be dangerous, with the knowledge that they will be used beyond their support period, just to save money. Sometimes there is a minimum cost a thing has to be to be done right, and anything cheaper than that is cutting corners somewhere.
---
If it's connected to the internet it needs to be receiving security updates, period. No exceptions. If you can't update for whatever reason (crappy software, ancient but irreplaceable hardware, production requirements), it shouldn't be connected to the internet.
---
edit: Another point to make, specifically when referring to cell phones and similar systems, is that in a lot of cases the vendors making these devices are themselves at fault for them being hard to support long term. They're the ones who choose to hack up the Linux kernel in their own weird ways, with no common base. A phone vendor should be able to update their entire line more or less one-shot for the majority of fixes, but they usually cant due to bad decisions made in-house or by their SoC vendor.
And all of those bad decisions are things these vendors have been getting yelled at about for well over a decade now, so they know they're doing it wrong and choose to continue.
Not sure I understand the 2nd part. If Apple or Google don’t want to issue security fixes after N years, should they remotely disable the device? How many of us are currently using devices beyond their warranty period? How many of us will appreciate it if our devices got disabled “for our own good”?
People generally understand the concepts of a warranty and the need for maintenance for something to last in the physical realm.
For the most part though in the software world people believe that it's good forever as long as it does what you want it to do. The point is to make that explicit.
> Not sure I understand the 2nd part. If Apple or Google don’t want to issue security fixes after N years, should they remotely disable the device? How many of us are currently using devices beyond their warranty period? How many of us will appreciate it if our devices got disabled “for our own good”?
I did not say anything should be remotely disabled, I said "shouldn't be connected to the internet". It's not about your own good, it's about the rest of us users of a shared network. Think about it like the road. Vehicle safety inspections aren't for you, they're for the rest of us who don't want to be in the way when your 15 year old tires that "still have plenty of tread" give out.
Use outdated and unsupported devices all you want in air-gapped applications, but don't connect it to a public network without extreme restrictions through external firewalls. Since the majority of people don't have the ability nor interest to actually do that, I simplify the recommendation to just "don't connect it to the internet".
Windows, MacOS, Linux, and other systems receive updates nearly forever even on ancient hardware. The choice to not do this with Android or ChromeOS is one Google made pretty deliberately.
Keeping hardware abstracted from higher layers has been a solved problem for at least a half-century now.
It's an economic inefficiency that's exploiting information asymmetry between Google and consumers.
Capitalism assumes perfect information and transparency. When this doesn't happen, you have inefficiencies, and those require regulation to address.
Throwing away my phone before it's broken is extremely inefficient economics. If you address that through regulation, those same resources will get reallocated elsewhere. Google might be an epsilon smaller, but that will be more than compensated for with more gainful employment elsewhere.
Same thing with regulations to prevent polluting a commons, to prevent monopolistic trusts, truth-in-advertising laws, and otherwise.
Indeed, in many of these places, without regulation, *everyone* is worse off. For example, if you can lie in advertising, and my business does and yours doesn't, mine will win in the free market system. As an executive, you don't have the choice to be honest. With truth-in-advertising laws, everyone is required to be honest, and that's better for the executives, businesses, and consumers.
This might involve fewer synergies occasionally and more standardization, as we have in x86 computers. This might slow progress a little bit or lead to a slight decrease in performance. Or it might not. If my device is 10% slower, I'm fine with it; I don't think I'd notice.
The primary "cost" is in number of units sold. If phones don't obsolete, you'll sell less phones. This means Apple/Samsung/Sony/... make lower revenues selling phones. R&D costs are roughly fixed, while economies-of-scale are reduced, so per-unit costs are a little bit higher. I do pay a little bit more for my phone, which I'm glad to do, since I'm doing it less often.
On the whole though, society is more efficient, and so an average, everyone is better off.
Besides, this is a false dichotomy- chrome books are very cheap, but come with years of updates. Move them to Linux and it’s decades of updates.
Because there’s no way for you to buy a replacement battery. [1]
Seriously. Don’t buy a Librem 5 unless you live in the US.
[1]: https://shop.puri.sm/shop/librem-5-evergreen-battery/
[2]: https://forums.puri.sm/t/librem-v15-battery-replacement-euro...
And it’s not worse for other modern phones. On the contrary: if I wanted my iPhone battery replaced, I’d have a choice between a nearby Apple Store and countless independent repair shops, all of whom would be able to source and replace the battery in no time.
But with the Librem, I’ll be out of luck. Nobody in Europe would be able and willing to source that battery for me if I needed one. Few potential buyers aren’t aware of that; Purism understandably doesn’t advertise it.
So here I am spreading the word.