Re:Germany wants smartphone makers to offer 7 years of softw...
by tgsovlerkhgsel on Tuesday September 07, 2021 @02:13PM
(#28447952)
True, the brick was an exaggeration. I thought about the "applications bundling SSL libraries", but especially on a phone, I expect enough things to break to result in a user experience that most would not be willing to accept.
Re:Germany wants smartphone makers to offer 7 years of softw...
by strenholme on Wednesday September 08, 2021 @01:57AM
(#28453568)
For me, if my phone still made phone calls, still sent texts, still got critical security updates, but I were forced to get Firefox from the app store to browse the modern TLS 1.2 web, I would consider it still quite usable.
For the average user who doesn’t know about security, having their phone updated w.r.t. security but having the phone’s built in browser break because it doesn’t work with modern TLS websites would be much better than having them have their phone compromised and critical information given to hackers. They would be able to get a new phone (or download another browser) if they want a modern browser with modern TLS; that’s a very different rodeo than the current situation of “update your phone or have security problems” with phones not even five years old.
Well, to be fair here, the phone would still be able to make phone calls and send/receive texts, so it would hardly be a brick.
As a practical matter, stuff like supporting a newer version of TLS is at the application, not the OS level, so the user would just have to get an update with their browser to be able to use newer TLS. [1] Supporting newer TLS, for a browser, is little more than recompiling the browser; even stuff like Lynx and newer builds of Dillo have current TLS support.
[1] Windows XP stopped being updated by Microsoft in 2014 [2] but Firefox up until 52.9.0 (2018) runs in Windows XP.
[2] The post-2014 point of sale updates were quite limited in scope, and can not be seen as general OS updates