Hacker News Reader

Comment by HideousKojima | Hacker News Reader

Not going to happen any time soon because there is no concern about this from the consumer side, no financial incentive from the manufacturing side, and no regulatory pressure from the government (and I have low hopes that any regulatory solutions would actually fix the problem).

View on HN

>no regulatory pressure from the government

No much, but there is some. Getting rid of default admin/1234 passwords was 100% a regulatory push

Small but important win

What about EU's CRA?

Doesn't really do anything to ensure the end-user truly has ownership over the device and the ability to control what software runs on it. 10 years of security updates is nice (assuming the company making the device doesn't go out of business in that time) but doesn't stop those devices becoming vulnerable after that (and a truly useful device will likely have more than 10 years of useful life). I don't know the specifics of the CRA, but most proposed regulatory solutions I've seen intentionally take control away from the end-user.

The manufacturer is encouraged to open source the product at the end of the life plus the government agencies now have a saying in what is EOL.

If you still sell EOL Products, you have to make sure it is still save, even as distributor.

Take control away from the end-user is a good point, I will keep this in mind.

You are the only one mentioning it.

I think the CRA is the right step in the right direction. Companies can finally be fined when they sell a product that has known vulnerabilities.

This is something that is discussed for years - now we have a definite Law.

And we already see changes: if you install Windows, the first thing it does is to get patches and the start over.

Reply on news.ycombinator.com