That would be a regression in terms of consumer rights, in my opinion. I don’t see why the EU shouldn’t legislate such that the right to control owned hardware becomes fundamental.

Although I think it's fair that the company not have to deal with a defect that is almost certainly caused by something you do to your device. Like, strawman, but early iPhones sometimes encountered issues while doing an untethered jailbreak, or people would install tweaks that were less than stable (even sometimes on relatives' or friends' phones), then they would walk into an Apple Store with weird behavior and expect the fix to be free. That shouldn't be covered by warranty.

Why should you have a right to operate the device in a dangerous way that the manufacturer engineered to prevent?

Those people rightfully were like why can’t we keep it and the company was like we have to run the services to manage it. Why not just open up the hardware and let it continue being used? Well if you put the wrong software and it ends up killing the person, the hardware company can be held liable.

Made me realize my dream of having an open-source car is never going to happen.

Basically, we already live a reality where dangerous machines like cars have been hacked and are operated on the street among us.

This is the same argument that was being made that FOSS is less secure because it's open in the 90s or 2000s. Yet the most of critical infra today runs on open source.

Don't you think it'd be safer if these tuners had access to the source code?

But at the same time, risk profiles between different tools are different, and it is common to have special rules for some of them. Eg. guns already do.

While we might need to stop an unlicensed SW engineer to accidentally or purposely turn your housekeeping robot into a killer robot, the risk of them messing up their fridge is lower. Yes, your food could spoil and kill you, but your fridge could face a power cut and do the same.

So establish which devices have a higher risk and limit changes to those with more expertise — if it means licensed engineers, so be it.

I think the main thing to grapple with is the idea that even laypeople who aren't security or SWE experts may want to protect against the highest risk profile possible, even if they don't personally understand what they're giving up. (And, for most of these people, I imagine they're giving up a freedom they might not have ever thought of using in the first place)

Strawman but, If you want to make a device called "securePhone 2027", where not even an evil maid attacker (say, a national security agency who has spied on you over your shoulder for 180 days and has thus seen all of your passwords) can install spyware on your phone, what sort of qualifications do you need to have in order to purchase (or qualifications for a manufacturer to sell) such device?

Part of the issue in arguments like this is in saying that, because the iPhone is the most popular phone in the United States, they should be forced to compromise on security because enough buyers aren't aware of the compromises they're making in order to have the iPhone. So if you still want companies to be able to sell a brick that never runs unsanctioned7 code, you either need

(A) setting an upper bounds (market share?) to how big a company can get before they must compromise on security and allow people to self-compromise via going through multiple hoops to disable security protections (e.g. disabling SIP on a Mac). (B) means-testing that the customer understands that what they're buying could compromise their security (C) some key ceremony for allowing said device to be unlocked. I imagine a 1 month waiting period plus needing to show passport and proof-of-non-coercion across multiple nation-states could work? maybe only if they're not apart of a shared intelligence network coallition (like five/nine/fourteen eyes)?

The fact that the iPhone is incredibly resistant to all forms of widespread malware is really good for society at large. Like, the only known widespread malware (outside of web-based scams calling Alert("Apple has compromised your device, call this number")) has been developer-distributed malware due to chinese developers releasing apps via a malicious unsigned Xcode app [0].

0: https://youtu.be/tJeEuxn9mug?t=1502

Just like PKI infrastructure, vendors could embed and tie into a TPM similar key infrastructure that would be the only part you couldn't touch (key storage + key validation and signing implementation so it can't be tampered with). I mean, even there the code could be open and only the key material would be secret.

(I find revocation a harder problem, really)

That is to a certain point. If deemed misuse would be harm against other people or circumvent export control. You may also restrict, who is allowed to do it. However, if software is the only protection against dual-use, tler might have a general problem.