603
Campaigners urge EU to mandate 15 years of OS updates (www.theregister.com)
submitted 11 months ago by to c/technology@lemmy.world
140 comments fedilink hide all child comments
 

Should OS makers, like Microsoft, be legally required to provide 15 years of security updates?

you are viewing a single comment's thread
view the rest of the comments
[–] 31 points 11 months ago (7 children)

This is stupid.

15 years is a massive time to just update your OS.

15 years ago instagram didn’t exist, the iPad was new, and people were just updating from Vista to Windows 7. I think Hadoop was just created then.

That is a massive amount of time to support software that would have almost no architectural protection against things like heartbleed.

  • permalink
  • fedilink
  • source
  • hideshow 14 child comments
    •
  • [–] 18 points 11 months ago* (last edited 11 months ago) (1 child)

    "Microsoft's decision to end support for Windows 10 could make 400 million computers obsolete

    This is more stupid, and I absolutely agree with the article it shouldn't be legal to end support of an OS this quickly, mind you this is not update to a new OS, like is common on phones, but mostly security updates for the OS you purchased with the device.
    I absolutely think 10 years should be a minimum, but for PC, I can easily see an argument for 15 years, as many systems are purpose built, and should keep working even if an OS is discontinued.

    A similar argument can be made for phones, but maybe that should just be 10 or maybe even just 5 years, which very few phones have. My vote is on 10 years, because what some companies have been doing for a long time, only supporting security updates for 3 years is not acceptable IMO. If the phone is free to install custom ROM unhindered, I would be more understanding, but phones are generally locked, potentially rendering them worthless if updates are not available.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 11 months ago (2 children)

    I think I'd prefer if there was a minimum updates guarantee that OS sellers would have to disclose, but even then I'm more in favour of other companies being able to pick up the work by making sure devices have their bootloader unlockable after they don't get any more updates for X amount of time, rather than add burden to OS makers, because forcing people to support a project for Y amount of years would really harm indie developers releasing Linux distros and the like

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 11 months ago (1 child)

    forcing people to support a project for Y amount of years would really harm indie developers releasing Linux distros and the like

    Solution: implement as consumer protection that only applies to paid OS's (and also ones that require a license, even if it's "free" due to coming with the hardware)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago (1 child)

    rather than add burden to OS makers

    It's not a burden for the OS maker, except when the OS is the product, and in that case it's only fair.
    With Android the phone maker adapt the OS to their phones and flavor of Android, if they can't handle maintaining it, they can use vanilla. Google is the OS maker, and I think they can handle the burden.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 11 months ago* (1 child)

    The EU has been so far bad at making sure FOSS isn't seen as a paid product in the eyes of regulation, even in cases where it's clearly unpaid, see here. They can't be trusted to get this differentiation right.

    Therefore, unlockable bootloader seems like the better idea. Get people to Linux and open Android variants if the closed-source companies won't serve them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 11 months ago* (last edited 11 months ago) (1 child)

    I have no idea what I'm supposed to see from you link? I don't see any particular legal knowledge, or description of any particular legal consequences, and I have no idea what the point is???
    Obviously software provided for free "as is", cannot be required to be maintained. And if it is owned by the public which is the case with FOSS, there is no "owner" who can be made responsible.

    If however the software is part of a commercial package, the one supplying the package has responsibility for the package supplied, you can't just supply open source software as part of a commercial product, and waive all responsibility for your product in that regard.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago* (last edited 11 months ago) (1 child)

    I admit it's a complex topic, but if you read the post in detail, it should answer your questions. The "owner" is typically the maintainer, if in doubt that's the person with repository write access. And the EU can apparently potentially require whatever to be maintained, not that I understand the exact details. The point was that the regulation doesn't seem to avoid FOSS fallout well.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 11 months ago (1 child)

    “owner” is typically the maintainer,

    Nope, AFAIK that is not legally applicable, that is very clear with licenses like MIT BSD etc, and for GPL in all versions it's very explicitly stated in the license.
    You can also release as simply public domain, which very obviously means nobody owns as it is owned by everybody.
    Generally if you give something away for free, you can't be claimed to be the owner.
    I have no idea where that idea should come from, some typical anti EU alarmists maybe? And I bet there is zero legal precedent for that. And I seriously doubt any lawyer would support your claim.

    If however you choose a license where the creator keeps ownership it may be different, but then it's not FOSS.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago* (last edited 11 months ago) (1 child)

    As far as I understand the license doesn't matter at all for EU regulation, other than "non-free" software is treated even worse.

    Generally if you give something away for free, you can’t be claimed to be the owner.

    The CRA from what I can tell applies to software given away for free, sadly. I'm not a lawyer, though. But you can perhaps see why people don't trust the EU.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago (1 child)

    If it's proprietary it doesn't, between proprietary and FOSS it absolutely does for the reasons I already stated.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago* (1 child)

    https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL_202402847

    Supply in the course of a commercial activity might be characterised not only by charging a price for a product with digital elements, but also by charging a price for technical support services where this does not serve only the recuperation of actual costs, by an intention to monetise, for instance by providing a software platform through which the manufacturer monetises other services, by requiring as a condition for use the processing of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software, or by accepting donations exceeding the costs associated with the design, development and provision of a product with digital elements

    TL;DR, just donations can already be a problem, apparently. But IANAL.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 11 months ago* (last edited 11 months ago) (1 child)

    but also by charging a price for technical support

    Which exactly includes systems like RedHat which I already included, but in no way includes voluntary FOSS work for free.

    an intention to monetise

    Again it's very much about the money, and being non free both as in beer and in freedom.

    just donations can already be a problem, apparently. But IANAL.

    NOPE!!!
    Donations are not a charge. A donation is as the word says a donation typically to support a voluntary effort or an organization working for the common good in some way.
    A donation does not require anything in return.

    Why are you making scaremongering arguments from ignorance?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago (1 child)

    Did you actually read the quote I gave? I'm honestly confused.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago* (last edited 11 months ago) (1 child)

    or by accepting donations exceeding the costs associated with the design,

    I'm guessing that's what you are referring to, this is not relevant to normal donations, but only a use of "donations" to circumvent regulation.
    Show me any FOSS project that has donations exceeding costs of development, it's basically non existent, only the Linux kernel project itself, which is fair enough to be covered, since the Linux kernel is driven by commercial interests today, and "donations" are payment for membership and influence.

    The claim originally in this line of debate was that small projects could risk this, and no they can't, only projects that are in reality commercial are affected. Those are very few, like Red Hat and the Linux kernel itself.
    The legislators in EU are not morons, and they actually listen to the FOSS community.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago* (last edited 11 months ago) (1 child)

    I will stop discussing since suddenly this is about "normal" and I guess "abnormal" donations, and I don't think we're having a clear-headed debate here.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 11 months ago* (1 child)

    There really are differences, Linux kernel membership could be called based on donations, but they are clearly more than that.
    Also you haven't mentioned a single 1 man FOSS project that could be affected, which was the original claim could be even from just being a maintainer, which is bullshit.

    We hear these EU warnings over and over again, and they are always wrong.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago* (last edited 11 months ago)

    I continue to believe the risk is real and supported by my links and quotes. You might notice some people in the linked discussions who seem to be thinking it's not entirely baseless. You're free to disagree. I'm not a lawyer anyway.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 6 points 11 months ago

    My ThinkPad x230 will soon turn 13 (since it was manufactured, I picked it up second hand from a business that went bankrupt). It’s still alive and kicking, just not with Windows. The hardware is dated, but for what I do it’s good enough. I only replaced the battery and the screen. I don’t care for instagram or any of that crap, this machine chugged along for 13 years, it will chug at least for another 5. Don’t let hardware manufacturers normalize dunking perfectly capable good hardware into a landfill because it hurts their profits. If you need any further proof just look into the old Apple hardware modding and some of the stuff they pulled off.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 11 months ago

    15 years is a massive time to just update your OS.

    The last version of Windows 10 (22H2) is nothing like the RTM release from 2015 (1507). 1507 still has Cortana and their failed "Continuum" concept.

    Essentially we are asking Microsoft to support Windows 10 22H2 for another ~5 years, which is reasonable considering 22H2 is a just under 3 years old.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 11 months ago

    Windows used to support really old hardware, I believe more than 15 years old until they introduced the new requirements for particular CPU models and TPM 2.0 chips. If anything, I feel that 15 years is too short. iPads and Hadoop have nothing to do with PC hardware.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 11 months ago (1 child)

    And yet people are bitching because Windows 10 is getting cut off after 10 years of support. Raise it to 15 and people will just bitch at the 15 year mark.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 11 months ago

    I think major factors in people bitching about the Windows 10 EOL is that a) Windows 10 was explicitly marketed as the final version of Windows and b) Windows 11 is so unappealing that even companies are reluctant to upgrade.

    Normally, that wouldn't be a big problem. We had dud releases before. Windows Vista had few friends due to compatibility issues but was workable. Besides, 7 was launched shortly after Vista's EOL. Likewise, Windows 8's absurd UI choices made it deeply unpopular but it was quickly followed by 8.1, which fixed that. And Windows 10 again followed shortly after 8's EOL (and well before 8.1's).

    Windows 11, however, combines a hard to justify spec hike with a complete absence of appealing new features. The notable new features that are there are raising concerns about data safety. In certain industries (e.g. medical, legal, and finance), Recall/Copilot Vision is seen as dangerous as it might access protected information and is not under the same control that the company has over its document stores. That increases the vector for a data breach that could lead to severe legal and reputational penalties.

    Microsoft failed to satisfyingly address these concerns. And there's not even hope of a new version of Windows releasing a few months after 10's EOL; Windows 12 hasn't even been announced yet.

    It's no wonder that companies are now complaining about Windows 10's support window being too short.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 11 months ago*

    Better laws would be:

    • to mandate open source relaease at EOS
    • automatically public domain at EOS
    • require paid operating systems to supporr hardware from 15 years ago (as a consumer protection law, so that it only applies to paid OS's (and also ones that require a license, even if it’s “free” due to coming with the hardware), so that foss projects arent hurt)
  • permalink
  • fedilink
  • source
  • parent