But they don't specify an actual period for updates (this will have to be decided by the courts). And, what I find worse, they force the seller to provide the update, not the manufacturer. If the seller is not able to do that (which will be the case most of the time), they can be relieved of their duty.

We're only halfway there.

> they force the seller to provide the update, not the manufacturer.

This (like warranties) is normally because there's no actual relationship between the consumer and the manufacturer. You do enter a contract with the seller, so they can be held liable when the law is broken.

For smartphones this can be different, since they tend to come with EULAs, but not necessarily.

I'm not familiar with the Android world these days, is it still common for mobile carriers to be a bottleneck for updates? If so, it sounds like this could at least be a solution for that.

Some other examples of non security issues that might require modifications:

* Widespread adoption hosting multiple services on the same IP, relying on SNI for TLS to function. While this is in TLS as well, it's not a security issue. In practice it was adopted slowly enough that it didn't cause many problems

* A quick switch from IPv4 to IPv6 (lol)

* Y2K (happened before smartphones)

* timezone database changes (e.g. if the EU abolishes DST)

* Regulatory changes (e.g. which frequencies the phone may send on)

* A third party service the phone relies on for essential functionality gets shut down

Wikipedia indeed no longer supports TLS 1.1, i.e. if the phone didn't receive any updates beyond security updates, it'd be broken.

This seems to have happened around 2019: https://phabricator.wikimedia.org/T238038

I'm honestly surprised, I expected the overlap between "everything new supports this" and "actually turned off" to be bigger.

So realistically, after 5 years without updates, the phone would be a brick. That's still 3 more useful years for people who care about security, and perhaps more importantly, 3 years where people who don't know about the importance of security updates or can't afford to care remain secure. This also assumes no non-security updates at all.

Well, to be fair here, the phone would still be able to make phone calls and send/receive texts, so it would hardly be a brick.

As a practical matter, stuff like supporting a newer version of TLS is at the application, not the OS level, so the user would just have to get an update with their browser to be able to use newer TLS. [1] Supporting newer TLS, for a browser, is little more than recompiling the browser; even stuff like Lynx and newer builds of Dillo have current TLS support.

[1] Windows XP stopped being updated by Microsoft in 2014 [2] but Firefox up until 52.9.0 (2018) runs in Windows XP.

[2] The post-2014 point of sale updates were quite limited in scope, and can not be seen as general OS updates

For the average user who doesn’t know about security, having their phone updated w.r.t. security but having the phone’s built in browser break because it doesn’t work with modern TLS websites would be much better than having them have their phone compromised and critical information given to hackers. They would be able to get a new phone (or download another browser) if they want a modern browser with modern TLS; that’s a very different rodeo than the current situation of “update your phone or have security problems” with phones not even five years old.

On the other hand, nearly every application use the base OS TLS libs and cannot connect anymore to servers that disabled TLS 1.0/1.1 on Android 4.4.

To engineer the app work remotely safely on such vendor-abandoned devices you need to basically assume you're running on a malware or rootkit compromised device, and just hope that by using your self bundled components you'll have better chances to survive in the core wars game because your app is not being specifically targeted.

A vulnerability in TLS1.2 would need to be fixed (by implementing TLS1.3) in 7 years under "security patching".

Today, you can often find such new phones on sale, yet already? No security updates. End of support.

So the life of a phone model before you even buy it new, may be years...

While I'd be happy for this plan to go through, I don't think most of the people will be happy with the side effects. Especially because of the spare parts requirements, I guess manufacturers will

1) Withdraw from EU market. 2) Reduce number of models on offer. 3) Raise prices.

2. That would actually be good, the amount of models aims at confusing customers. But also: Why would that happen? Many models can (and do) share the same spare parts.

3. Prices are already as high as they can be. They do not get lowered because production gets less expensive, they get lowered because of competition. This might have an effect on prices if the competition was very high and profit span very thin - which might be the case for the cheapest budget phones. For something like an iPhone? To my knowledge they are already utterly overpriced, as is tradition (https://www.forbes.com/sites/ewanspence/2017/11/08/apple-iph...), then it will have no effect there.

There is also no good reason for the cost of security fixes to vastly increase the cost for manufacturers if they slow down the release cycle for hardware and software. This isn't 2010 after all. The pace of meaningful improvements is considerably slower.

They have a far higher trade in or resale value than any other brand.

It actually causes a bigger second hand market of phones if they have a longer life. Plenty of users still want the latest or there abouts. While others will happily go for the nearly new.

The result of this law would be that cheap phones will get more expensive for no benefit at all and expensive phones will cost the same.

As for cost, I don't see why it would have to go up all that much. Apps are already upgradable on phones and much of the OS is hardware independent. So the only real pressure point is with the kernel and other hardware dependent code.

(1) Battery stops holding a charge

(2) The device gets damaged

(3) Cameras get a lot better

The Nexus 6 automatically throttled performance based on battery left, but at some point the battery wore out to the point that less than 1/2 an hour of use got you below that threshold. After that the phone was very laggy and frustrating to use. No way anyone would want 5 years of that experience, updates or not.

Not even going into the problems with second-hand phones and that poor people de-factor have zero legal rights as they don't have the money to take sellers to court.

Many used phone sellers/marketplaces offer extended warranties on second-hand phones, which risk-averse buyers should purchase.

This thread is about EU law.

In EU you don't have to take sellers to court, you just have to nag customer protection authorities until they do.

It might take some time: Google still hasn't gotten a massive fine for abusing its position in search and ads to kill competing browsers despite my reports but I will not be surprised when it happpens.

PS: come on guys and gals and do write to your local competition authorities. The sooner we can get this sorted the better.

I expect the poorest to benefit the most from extended longevity, since more affluent people "need" the better camera or a more fashionable design the most.

I know quite a few people with >3 year old smartphones, but mostly with custom roms, since stock firmware isn't usable anymore.

2. "longevity" means nothing when most people keep dropping their phone. Even used phones that appear perfect can start bootlooping months after buying because of damage caused by the first owner and the eBay seller won't accept returns by than, even if you could prove it was not caused by you.

Someone who is really clumsy or in a situation where they are much more likely than average to drop their phone should purchase phone insurance.

And for uninsured people who happen to break their phone, it would still be cheaper to repair it than to get a new one. Repaired phones still benefit from longer support lifecycles, and the proposed legislation would ensure that spare parts are affordable and available.

The latter may be a problem but you could still buy an older (mid-cycle) model instead of the latest one and still get updates for years.

Does everyone on hackernews get paid £100k a year and spend over £1,000 on a phone?

You wouldn’t buy a car either without planning for repair costs.

Should it be legal to make cars for poor people without airbags and seatbelts?

And are we really gonna argue that this idea would be for the benefit of the poor people?

I see this as a big plus. Not a fan of Apple but they did get this one right (at least in the past).

1) Withdraw from EU market - I guess most people dont realise EU as a market itself is 2nd just behind US.

2) Reduce number of models on offer - Parts aren't that different across models.

3) Most likely answer - Although it doesn't cost that much at all. You can still get a 7 years old iPhone 6 repaired, it is just costly, as it did 7 years ago. The incentive pushes you to buy a new Phone.

Come on. Every time the EU tries to implement a consumer protection a whole contingent of people comes here to say that this will cause companies to leave the EU. China is so much worse in terms of constrictive laws and regulations and you can plainly see that companies don't care. They adapt and sell, that's how they work.

The lines get blurry. Is a modern browser a feature upgrade or security?

Well, both. But if the vendors really would just sort of fix their old mobile browser, you would still be stuck with a old browser unable to interact with the modern web.

Is it a feature update, that you want to install newer apps? (like another browser)

For this to make sense, it should enable you to update your whole OS of the devicey that it can at least install and update common apps. Otherwise its benefit is very limited.

A modern browser should be a feature upgrade. A browser as modern as the one that came with the device, except without known security issues, should be a required security update.

Coincidentally no one develops the latter without the former, so you get the former, but I don't see that you are entitled to it.

If anything I think the law should be designed such that there's an argument that you are entitled to the version of the browser that came with your device with security updates and without any feature regressions, which is never available today since browsers do choose to remove features on a regular basis.

It's probably not feasible with todays software ecosystem to actually create that constraint... but I still really like the idea.

Often when apps like Facebook are bundled on lower-end Android phones, they are not uninstallable. This means they take internal memory and can't even be moved to SD cards, severely restricting the functionality and durability of those phones. The only way way to fix it is by rooting.

Non-essential or third party apps should be at least un-installable. I'd be ok with a law for that.

This is a non-problem nowadays. We have long left the times in which browsers received essential features every few weeks. Using a browser with a feature set from five years ago you can still use all the most-visited websites perfectly fine. At the worst you're unable to use small, non-essential features of some sites. Maybe some ads look less fancy ;-)

Your problem today as a browser user is security against zero-interaction exploits, not missing out on some obscure brand-new CSS features. Security updates are thus what you need first and foremost.

With updates needed.