Given that many many many devices are not patched despite known vulnerabilities, I'd not be overly optimistic about this. Vendors do not provide patches for devices, Vendors go out of business, Users don't patch even when patches are available. This affects everything, routers, phones, IP cameras, you name it.

I'd rather expect that the access vectors get noticed and applied by criminals en masse.

Ah, the horrors of lifecycle management of consumer devices.

Every networked product should come with a legally binding A4/letter-sized sheet that clearly shows the last date the product is guaranteed to receive security patches. Not fulfilling the requirements would have to result in a buyback with the sum directly proportional to whatever time of the promised lifetime is left unused.

EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software.

> EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software.

That is definitely covered by the standard 2 year warranty as insecurity (when security is expected) is seen as defect. If they don't fix it you get your money back. I successfully got my money back for several phones after 1 to 1.5 years.

First time I've heard of this, this is really interesting. Don't most phones release updates for the first ~2 years? Maybe this law is the reason?

Indeed most phones do. This law however applies to resellers of cheap chinese phones of small brands as well, which was my case.

Sure, but the key point is that the access vectors will get noticed, and publicized. And people who pay attention and care (including many criminals) will protect themselves.

Eh, how does that make it OK in any way?

It doesn’t make it ok but it makes it self defeating.

We can’t win the ok battle any more as no one up top gives a shit clearly.

I'm absolutely sure it's self defeating only temporarily and/or when it doesn't matter. Governments can use literally any amount of money and other resources if they care, and there are many people who wouldn't even require extraordinary sums (being in army is not exactly well paid).

We're going full speed into totality. It was absolutely the same when the communist regime started in my home country: People were saying they would not use their new powers against ordinary people and that seizing all farmland would be impractical and then after few years of silence KGB and gulags and executions happened (our local alternatives of course).

They can but they don’t pay people much and you have to be morally bankrupt to work there. Very few people fit that niche.

After paying £27k+ in tuition fees grad priority is earning so the government chased them off too.

Not at all. Most people see working for their country as a good thing. They can start paying people literally any sum of money literally any minute they want. And even if UK people wouldn't work for them, mercenaries are common.

Not here in the UK. Once you’ve taken a public sector position you are tainted.

I assume that doesn't include working for NHS?

In an IT capacity that does include the NHS.

I'm not for a moment suggesting this is right for ref. Individual merit is much more important.

That is absolutely not the case

> We can’t win the ok battle any more as no one up top gives a shit clearly.

That's the reason to battle, not the reason you lost before you even did that.

There aren't enough people who care about it to win the battle so we make sure the victory is pointless.