This is the way bills in congress work, so let's apply the same social engineering to software.

Someone else gets to ruin my system by bundling a non-essential change with an "essential" change. Never waste a good disaster.

Microsoft supported XP for a long time, but that was paid. At some point it becomes unfeasible to maintain older versions.

Also Android/Chrome is free, so just because phones are paid doesn't mean such laws would apply.

Phone security updates are sometimes provided for some time, actually. I know Samsung at least went back and made new releases for abandoned phones after stagefright.

True, and that would mostly likely fulfill their obligation, though personally I don't think I should have to accept what is essentially a new product to get a manufacturing flaw repaired.

Also Android/Chrome is free, so just because phones are paid doesn't mean such laws would apply.

Ah, with that I wholly disagree, and I expect the law to do as well. Android (and Chrome nowadays) is clearly part of the package that I buy with the phone, and advertised as such. That the phone OEM got it for free from Google is irrelevant to me as the consumer; I paid for the whole thing.

Chrome is free and also optional. If you don't like the new features that come with the security updates, you can easily use a different browser.

I disagree with the EU's decision to force MS to have that browser selection dialog, but that doesn't mean bundling should be consider a "gift" by the manufacturer. A browser is an expected part of a current smartphone OS, and as such they should be responsible for the one they include.

I am pretty sure what my "Search for updates" returns as error message.

1) Perfectly secure software has never been invented and may never be. Does that mean all software has "manufacturing defects"? It definitely means you can't penalize the "manufacturer".

2) Not all security holes are defects that are discoverable when a program is released. There are attacks that no one has thought of. Someone invents the attack, tests it, and then discloses it (or uses it). The average coder isn't anywhere near smart enough to think of all these things (and that includes me). Even if we were, we wouldn't have time to test and mitigate all of them.

If you want to get the exact same piece of software updated only with security patches, you'll have to select software that is updated this way or pay someone to write it for you.

2) True. So what? Why should that get them off the hook? Statistically, we also know that people will always make mistakes, does that mean companies shouldn't be responsible for the blunders of their employees?

The fact that we know our software will have problems we can't fix at launch time just means we need to account for that post-launch cost, plus possibly have insurance for major screw-ups. It doesn't mean we get to claim "caveat emptor" unlike any other industry.

If you want to get the exact same piece of software updated only with security patches, you'll have to select software that is updated this way or pay someone to write it for you.

Yes, that's currently the case, as I admitted in my other post, but it's not an immutable law of nature.

If you find that Chrome updates come with unwanted changes, you might want to try Firefox or Opera.