Should OS makers, like Microsoft, be legally required to provide 15 years of security updates?

  • Petter1@discuss.tchncs.de
    link
    fedilink
    English
    arrow-up
    5
    ·
    edit-2
    18 days ago

    I would prefer if they force the companies to unlock root and boot-loader, when they not ship security updates anymore for a device.

    • WhatAmLemmy@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      edit-2
      18 days ago

      Fuck it. Force them from release date. There’s no reason for them to dictate what you can and cannot run on the hardware you purchase. If they can’t compete by providing a better OS or software, and must rely on anti-competitive models to profit, then they don’t deserve to waste the planets resources.

    • jet@hackertalks.com
      link
      fedilink
      English
      arrow-up
      3
      ·
      17 days ago

      I’d add the hardware drivers must be open sourced at the end of support as well, and no drm, patent, reverse engineering legal protections for a out of support Device/chipset

  • nucleative@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    ·
    17 days ago

    15 years is too long, it doesn’t match the state of the industry or technological progress.

    If anything this slows down innovation which leads me to suspect the 15 year idea was though of by someone who dislikes any technical changes.

    • stuner@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      16 days ago

      15 years is too long, it doesn’t match the state of the industry or technological progress.

      How is this too long? I would consider it a reasonable amount of time to receive security updates on a computer.

      I have a notebook that I bought in 2012. It can run Ubuntu LTS 24.04, which is supported until 2034, without issue. There is no indication that the next release will stop supporting this hardware. I don’t see why Microsoft couldn’t provide this.

    • Holytimes@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      2
      ·
      16 days ago

      Outside of aero and financial where it’s not uncommon for this to use 20+ year old tech.

      If something isn’t hyper critical 15 is way too long

    • Rednax@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      17 days ago

      Before Microsoft demanded TPM 2.0, you could install the latest version of Windows on extremely old hardware. Easily reaching that 15 years. We had this already. And Windows 11 can easily run without TPM 2.0. Microsoft just has business reasons to demand it. So I don’t see how innovation is slowed down by this.

    • bestboyfriendintheworld@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      1
      ·
      17 days ago

      15 years is actually reasonable.

      I have a ten year old laptop with an i7 processor, 16 GB RAM, and 1 TB SSD. It still does most things, I bought it for initially just fine. Granted this was one of the best laptops you could buy at the time.

      Apple stopped supporting it with a current version of macOS a couple of years ago sadly. It’s still possible to patch newer versions to install and run on the old machine, but it’s a bit of a hassle.

      • pirat@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        14 days ago

        Are we talking OpenCore Patcher? I was actually planning on trying that for my Early 2013 MBP, but I’m leaning more towards some Linux distro now, for the longevity of it, though I haven’t yet figured out which distro supports my MBP the best. Got any recommendations to share on some of this?

        • bestboyfriendintheworld@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          1
          ·
          12 days ago

          Yes, OpenCore Legacy Patcher.

          Regarding Linux distributions, I don’t have a specific recommendation. You might be worse off with a distro that doesn’t include nonfree drivers for wifi, bluetooth, graphics by default. IIRC these MBPs use Broadcom Wifi chips. Ubuntu and derivatives would be my first try. Definitely read up on how to install Linux on MBPs. You probably might have to configure something in OpenFirmware/EFI.

      • phillipp@discuss.tchncs.de
        link
        fedilink
        English
        arrow-up
        0
        ·
        17 days ago

        But unlike server aided services an OS still keeps working. You can use that PC for 10 more years, if you like.

        I think there’s a discrepancy in the understanding of ‘support’ and what it entails in different technology fields. Demanding to receive NEW features for decades is not feasible in the current economic environment.

    • golli@sopuli.xyz
      link
      fedilink
      English
      arrow-up
      1
      ·
      17 days ago

      Or an established player in the market that wants to keep competitors out (but I guess in a way that is someone who dislikes change). While legislation like this can sometimes be great (e.g. the recent changes forcing longer support for mobile phones) there comes a point where it cuts the other way and it becomes an entry barrier.

      Imo the better solution would be to legislate what happens after support ends. Like forcing the disclosure of at least some documentation that allows others to continue servicing the product or at least transfer out data and install other software on the device.

  • minorkeys@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    ·
    17 days ago

    Or legislate that unsupported software becomes public domain or is open for development and the public can try and make the updates themselves.

    Forcing people to upgrade entirely depends on the nature of the upgrades and the motive of the company. What we need is competition so there are alternatives for people to use if they don’t want to upgrade. But somehow Microsoft is not considered the monopoly of the PC OS market, despite being a monopoly, and uses that position to force changes nobody wants but them, like turning window into an AI data farming scheme that violates user privacy.

    • thethunderwolf@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      4
      ·
      17 days ago

      Mandatory open source public domain release at EOS.

      At Win10 EOS, people would make Windows distros, and ReactOS would no longer have to be a clean room implementation.

      Also this would be a success for Stop Killing Games.

  • Zink@programming.dev
    link
    fedilink
    English
    arrow-up
    4
    ·
    16 days ago

    This seems backwards. Let’s just assume we’re always going to be willingly beholden to tech giants, and so we’re going to pass a law to make our masters treat us well.

    Maybe instead campaign for a law that says all publicly funded computer resources must be reliably usable for 15 years. So you either go FOSS and save money too, or you get guarantees in writing before you hand over your hand over money to the people who won’t even let you see what their code is doing on your hardware.

  • Korhaka@sopuli.xyz
    link
    fedilink
    English
    arrow-up
    4
    ·
    17 days ago

    That sounds like an insane duration, even LTS distros are not usually anything like 15 years

    • iesha_256@lemmy.ml
      link
      fedilink
      English
      arrow-up
      3
      ·
      17 days ago

      this isn’t about the age of the OS, it’s the age of the device. I can install linux on a device from 20 years ago if not more.

    • ratten@lemmings.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      17 days ago

      These multi-billion dollar corporations have more than enough resources to provide updates for 15 years.

      There’s nothing insane about it, unless you’ve been conditioned to live vicariously through business owners.

      • Korhaka@sopuli.xyz
        link
        fedilink
        English
        arrow-up
        3
        ·
        17 days ago

        Pretty sure postmarketOS isn’t made by a multi-billion dollar corporation. Such a requirement would mean ONLY multi-billion dollar corporations can release an operating system. You do not want to give them that power.

  • Matriks404@lemmy.world
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    17 days ago

    No, OS makers should just not make their OS bloated with useless shit, stealing your data and have arbitrary system requirements. I think 15 years of OS updates is excessive unless we’re talking about servers or very specific workflows. IMO 5-10 years is enough.

    That said, for some operating systems it doesn’t even make sense to support for THAT long, because how they are designed (A lot of Linux distros for example). It turns out, if you don’t break users’ workflow, they don’t mind to upgrade.

    • some_kind_of_guy@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      17 days ago

      I agree with most of that, but there are loads of embedded systems still running the equivalent of Windows XP and they’re chugging along just fine. That OS still receives updates and ending that would break a lot of backend stuff. Mostly banking.

      Boeing just started making planes which don’t rely on floppy disks for updates. That will continue on the older part of the fleet until it’s no longer feasible to procure the disks or the planes are no longer airworthy. I mean, why not? If you only need to store a few mbs for something critical, it’s not a bad choice of medium.

      If a system is secure, reliable and works for decades without complaint, there’s no need to fix that.

  • iegod@lemmy.zip
    link
    fedilink
    English
    arrow-up
    2
    ·
    17 days ago

    This is a prime example of legislators not understanding technology.

  • Runaway@lemmy.zip
    link
    fedilink
    English
    arrow-up
    2
    ·
    17 days ago

    15 is an arbitrarily long time. I think forcing it to be open sourced upon the companies end of life is the better option

    • ronigami@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      17 days ago

      Then you can have a company that acquires the original failed company and provides “support” in the form of one bugfix per year.

      All of these solutions are gamable except for requiring that the solution be open source from the get-go.

  • panda_abyss@lemmy.ca
    link
    fedilink
    English
    arrow-up
    2
    ·
    18 days ago

    This is stupid.

    15 years is a massive time to just update your OS.

    15 years ago instagram didn’t exist, the iPad was new, and people were just updating from Vista to Windows 7. I think Hadoop was just created then.

    That is a massive amount of time to support software that would have almost no architectural protection against things like heartbleed.

    • ramble81@lemmy.zip
      link
      fedilink
      English
      arrow-up
      1
      ·
      18 days ago

      And yet people are bitching because Windows 10 is getting cut off after 10 years of support. Raise it to 15 and people will just bitch at the 15 year mark.

    • Buffalox@lemmy.world
      link
      fedilink
      English
      arrow-up
      0
      ·
      edit-2
      18 days ago

      "Microsoft’s decision to end support for Windows 10 could make 400 million computers obsolete

      This is more stupid, and I absolutely agree with the article it shouldn’t be legal to end support of an OS this quickly, mind you this is not update to a new OS, like is common on phones, but mostly security updates for the OS you purchased with the device.
      I absolutely think 10 years should be a minimum, but for PC, I can easily see an argument for 15 years, as many systems are purpose built, and should keep working even if an OS is discontinued.

      A similar argument can be made for phones, but maybe that should just be 10 or maybe even just 5 years, which very few phones have. My vote is on 10 years, because what some companies have been doing for a long time, only supporting security updates for 3 years is not acceptable IMO. If the phone is free to install custom ROM unhindered, I would be more understanding, but phones are generally locked, potentially rendering them worthless if updates are not available.

      • JustARaccoon@lemmy.world
        link
        fedilink
        English
        arrow-up
        0
        ·
        18 days ago

        I think I’d prefer if there was a minimum updates guarantee that OS sellers would have to disclose, but even then I’m more in favour of other companies being able to pick up the work by making sure devices have their bootloader unlockable after they don’t get any more updates for X amount of time, rather than add burden to OS makers, because forcing people to support a project for Y amount of years would really harm indie developers releasing Linux distros and the like

        • Buffalox@lemmy.world
          link
          fedilink
          English
          arrow-up
          0
          ·
          17 days ago

          rather than add burden to OS makers

          It’s not a burden for the OS maker, except when the OS is the product, and in that case it’s only fair.
          With Android the phone maker adapt the OS to their phones and flavor of Android, if they can’t handle maintaining it, they can use vanilla. Google is the OS maker, and I think they can handle the burden.

          • ell1e@leminal.space
            link
            fedilink
            English
            arrow-up
            1
            ·
            edit-2
            17 days ago

            The EU has been so far bad at making sure FOSS isn’t seen as a paid product in the eyes of regulation, even in cases where it’s clearly unpaid, see here. They can’t be trusted to get this differentiation right.

            Therefore, unlockable bootloader seems like the better idea. Get people to Linux and open Android variants if the closed-source companies won’t serve them.

        • thethunderwolf@lemmy.dbzer0.com
          link
          fedilink
          English
          arrow-up
          0
          ·
          17 days ago

          forcing people to support a project for Y amount of years would really harm indie developers releasing Linux distros and the like

          Solution: implement as consumer protection that only applies to paid OS’s (and also ones that require a license, even if it’s “free” due to coming with the hardware)

  • cmnybo@discuss.tchncs.de
    link
    fedilink
    English
    arrow-up
    1
    ·
    17 days ago

    Just require any new operating systems to support 15 year old hardware. We should require manufacturers to provide 15 years of UEFI and firmware updates too.