It shouldn't be time-based it should be support-based. As in, the moment you stop supporting your product is the moment you're legally required to publish the source code and any signing keys, tools, etc necessary to use it.

The problem is "oh, we're still supporting it, we just released an update yesterday that fixed an issue with kerning when selecting certain fonts on the built-in LCD. What do you mean 12 critical CVEs unpatched for years?" So now you have to define "supported," which will be lobbied to death by every vendor in the world.

Well, if the company is willing to live with the risks/liability of a still-supported product containing unfixed vulnerabilities then they're clearly not long for this world. Eventually someone will sue--no matter what the support agreement/TOS states--and they will win. Even if they don't it'll still be a pointless large expense for the business.

Then by the time you can see what they actually provided, the company is already bankrupt and if what they provided is non-compliant or otherwise useless, it's too late.

There is no excuse for not providing it from day one. And more than one reason to do it -- not only do you verify that you have what you need before they're gone, it allows people to find vulnerabilities sooner so they get patched before more people have the vulnerable device.

So any company that makes a device knows that all their proprietary work will become public if they end support -- that seems like a great reason for companies to not build devices.

The FCC actually could have a decent mechanism to force this. The documentation for Part 15 compliance often has a confidentiality request for certain device internals. They could have some uncloaking mechanism where that information is released if the company is no longer supporting the device.

That's a pretty slick idea actually. I've been battling on the upstream reference design angle as I think that's where a lot of security issues truly come from. Release of device internals probably wouldn't help fix those upstream references unless it also covered support the drivers of individual electronic chips from their producers as well, but it definitely would help opensource devs to potentially fix things for devices they love.

This is not viable because what of the vendor used a proprietary build system? They can't open source it.

Setting that aside, I have yet to see a complex system that you can rebuild without a lot of undocumented know-how just by having the source code. Companies don't typically keep meticulous documentation on this, they keep people around to do it. When the product goes out of support, the people get transferred or fired.

It just doesn't work in reality. I work somewhere that makes IoT devices, our microphone noise-cancellation code is written by a third party with a license not to redistribute. They sell their code to multiple companies. If we stopped supporting some device for X years, does that mean we're legally allowed to open source their noise cancelation code?