A sane architecture means support is much easier. I've used low power PCs that were more than one decade old, and I could still run the same well supported software as in a newly built machine.

Some regulation is needed to stop this madness. We don't have enough resources to let everyone trash their phones every three years. Rare earths are scarce, not to talk about all the junk going to landfills.

Had IBM been able to prevent it (and they did try with PS/2 and MCA when the courts failed), there wouldn't be PCs as we know it, rather like every other 16 bit computer of the time.

For example if a CPU instruction-level issue was discovered Fairphone would have no way to fix that without microcode updates. This means that a vendor can't guarantee security updates for longer than Qualcomm will offer low-level support. However the discovery of an explotable instruction 3 years after release is quite unlikely and as far as I am aware hasn't occured so presumably Google *could" continue updates in this case.

Of course there is still consumer expection issues. If phones are usually supported for 5 years even though they only promise 3 you might feel cheated if your particular model has to stop at 3.5 years.

There is also the option of ignoring the CPU vulnerability but continuing other security updates. However trying to explain this to users is incredibly difficult. Even if you can get their attention you have to explain the impact of being able to break out of the app sandbox to them.

I decided to take a risk with them and buy FP4 to support them.

I'll second the request for a source for this, $1M seems ridiculously low.

If you see the entire picture, it's the most expensive cost any department can ever present.

it is a "revenue-less $1M"! pure Career suicide.

Specially because marketing can't even use it. today only false-equality sells. Eco-thinking is so 90s.

This is a huge part of the reason why Androids depreciate so much faster on the used market, if you compare the Galaxy S20 to the even older iPhone 11, the iPhone 11 will likely receive 5 years of OS updates compared to 1 year for Samsung. Other OEMs like OnePlus or Sony will have already had support end. Maybe your average customer doesn't really understand why this stuff matters but they do understand that an old iPhone seems to work better than an old Android that cost the same at release.

Of course this is a great decision because people will be forced to buy a new phone more often right? No! People using your phone are a captive audience for selling high-margin services and accessories. If you don't support the phone they'll still use their old phone anyways but will be annoyed and likely to switch to the competition next purchase cutting off all your profit streams.

Pass a new "right to repair" law, such that any OEM that halts software patches on any network-connected device for more than 6 months will be required to unlock bootloaders and publish technical specs.

Apple and Android will see enormous and wonderful community involvement if that were to happen, and congress could force it, should we motivate them.

Pass a law that taxes Google punitively for each app sale on an unmaintained phone, and see how quiclky they'll find a way to support their phones.

Wouldn't the result of that, be that phones that get anywhere even close to being unmaintained would stop dead (or close to it), so Google doesn't get exposed to a problem?

To me, that doesn't sound better than the situation you're trying to fix.

As long as there is also a minimum support window, say 3+ years, and full specs and source are community released, then why not?

The important part could easily be ensuring that older hardware can be accessed. We need an end to binary blobs, or, to force long term blob support and updates.

I imagine a scenario where you pay $20 per year for support and updates for your old device, to a third party.

Or of course, there could be foundations, compile it yourself, etc too.

But if the environment is the reason, why not share the load?

Manufacturers publishing code, sources, and docs is not trivial in of itself.

I know that's the case for lots of open-source software, but since we're coming to that topic, Google's open-source policy that produces software that is either tightly aligned with their own interest (Chrome) or barely usable without their proprietary ecosystem (Android) is shameful. Quite frankly, I would much rather see open-source communities work on linux phones, no matter how useless that may be.

Another reason I'm not a fan of it is that if Google is allowed to transfer their responsibility to a community, I'm willing to bet that their initial support duration will drop even more, and that any issue will be blamed on open-source maintainers, log4j-style.

> But if the environment is the reason, why not share the load?

Does Google share the profits? Is their Android business barely profitable to justify getting free labour?

Forcing 3+ year support in law, plus forced code release at the end, gives a massive change, and some important bits.

It is part 1.

Also, my 3 years support is after last sale... not release date.

is probably sufficient motivation. There's no way Apple would be willing to do that. Google might be, but they might have a lot of resistance from Qualcomm and possibly mobile carriers and other partners.

Comparatively, it's much easier to make a law targeting the stores that's hard to avoid.

It is likely that Google would stand to make more money by offering longer service duration for their OS, and by demanding phonemakers to maintain their firmware.

I guess the info we need to see whether this would be a good decision or not is how much money Google makes from selling apps to phones 3 year and older.

My bet would be on Google successfully lobbying to kill the bill in the first place, or to cripple it and make it irrelevant (for instance with a long grace period that always gets extended).

Depends on what the law makers actually want. Enough legislation is passed just do they can tell their voters "look, we did something" without actually hurting their corporate buddies.

Any locked device must brick itself after 6 months of no patches, to ensure the safety of the network.

A few months of that, and we will arrive at the previous law.

>Any locked device must brick itself after 6 months of no patches, to ensure the safety of the network.

What does this accomplish? Get people mad? Moreover, what prevents someone from making trivial patches to keep a device "up to date", kind of like how people make trivial changes to their passwords to keep up with password rotation policies?

I was thinking that we could name this law after you.

Maybe I misunderstand it, but I think it’s not that bad?

The kernel gets kept up-to-date by LineageOS, the device builds (official or unofficial) use the base builds, but add device-specific tweaks, and cherry-pick commits from elsewhere. And actually a level above that is AOSP which is maintained by Google.

Would love if someone could correct me.

How do you think the CVEs get discovered? What about CVEs in the qualcomm specific code? How do you know that the amateur kernel developers wouldn't fall prey to c footguns and introduce new vulnerabilities?

Don't get me wrong, this is strictly better than the current state of affairs where there's zero patches, but I think people are underestimating how much effort it takes to keep a huge codebase patched.

> We need a lemon-like law for consumer electronics.

I wonder how this should apply to planned obsolescence of devices like smartphones.

On one hand, it's obscene that manufacturers expect us to routinely spend ~$1k on a device that will in the best case scenario last for three years. There's no inherent reason that a flagship Samsung from 2017 shouldn't be perfectly serviceable today, and likewise for a Pixel 6 or iPhone 13 in 2030. However, the discontinuation of security updates makes it so that for all practical purposes they are not.

On the other hand, we can't exactly compel speech or labor. It would be one thing if there were a kill switch triggered after N years, but in this case the obsolescence isn't caused by an active update, rather a lack thereof.

Here's a possible middle ground:

1. Block device manufacturers from arbitrarily deprecating hardware. We can't compel the release of new software, but we can block the release of new software. Require manufacturers to submit a filing with request for approval before the release of any new mobile OS update, which must include an exhaustive list of all supported devices. In the event that a device is dropped from the list in a subsequent filing, it must be explained to the satisfaction of regulators that a specific hardware limitation makes continued support for the device problematic or impractical. Given approval to drop support for a device from an OS release, there would be no obligation on the manufacturer to backport security updates to prior releases.

2. Block component manufacturers from arbitrarily deprecating hardware. Any hardware included in a publicly available consumer electronic device must have its manufacturer commit to providing up-to-date driver software with support for the latest OS for the lifetime of the device. Failure to provide this within a certain time frame (say, three months) following the request of a device manufacturer would open them up to a lawsuit, wherein they could be compelled to publish the most recent release of the driver as open source / public domain. #1 would provide the incentive for each device manufacturer to proactively enforce this, as their entire product roadmap would be effectively frozen if they allowed component manufacturers to drag their feet.

3. Ban irreversible bootloader locking in new devices. Maybe an initial bootloader lock would be acceptable, but power users should have some way to override the lock and install a custom ROM without relying on vulnerabilities in the software.

If you're asking how it gets enforced, there could be a government office tasked with enforcement, and the law could let people sue.

My galaxy note 10 (purchased 2 years ago) is still receiving updates.

In fact Samsung is saying they'll support most phones for 4 years while others are supported for 5:

https://www.theverge.com/2021/2/22/22295639/samsung-galaxy-d...

>Samsung did guarantee support for at least three “generations” of Android OS updates in 2020

The 4/5 year support is for security updates. I will correct that some samsungs are now receiving 5 years of security updates, I didn't realize that.

I suspect that the majority of Android-using techies that notice this are either on a faster new phone cycle than 3 years, or have already priced that difference into their total value calculation.

I also strongly suspect that the average customer does not indeed understand.

You spend the $1M because it improves customer value by far more than $1M and that works out for everyone in the long run. This thread is a testament to what happens when you pinch pennies.

QA exists to keep the sales/avoid returns/refunds. Not for pure customer value.

Do you have a source for that? That does seem pretty low.

I was hopeful with Windows Phone running a build of NT that the platform would still have the same strict ABI compatibility for drivers as the desktop version has. So you get kernel updates and the existing drivers just work.

Now, with Windows getting some emulation support for Linux (one of their Subsystems for Linux effectively translates system calls and execution happens in the NT kernel) I wonder if they could ship a phone running NT with an Android userland.

[0] https://en.wikipedia.org/wiki/Application_binary_interface

Arm, who has refused to bundle or assure system IP compliance to the level of their CPUs (aka interconnects, interrupt controllers, iommu's, pcie bridges, etc). Meaning that even very basic things like how one gets an interrupt isn't reliable, and somewhat worse are the buggy implementations of arm system IP that are allowed to reach the market.

Google, for failing to provide platform standard interfaces, similar to what the Arm server vendors enforce via SBSA/SBBR. Meaning that every single phone is doing low level platform mgmt in proprietary ways. That includes its own power mgmt, led blinking, etc, a good part of the time actually in the linux kernel, or via proprietary hooks in the linux kernel. Further despite making more money on the android ecosystem than RH+suse+canonical put together their changes are generally dwarfed by other much smaller players (although they have hired a bunch of maintainers over the past couple years).

Linux itself, for failing to provide a stable/backwards compatible driver API. Meaning a small simple driver either needs to spend months upstreaming (if that is even possible, see GPUs) or man years of maintenance keeping up with the kernel churn over the lifetime of the device. Further the arm/kernel community encourages a "everything in the kernel" (everything from firmware functionality, to the actual machine descriptions in the form of all the DTs) attitude which completely fails to grasp the huge number of bugs and device varieties on these arm devices. Its rumored that QC by itself had a million plus lines of out of tree code a few years ago. Its likely that this attitude could more than double the number of lines of driver code in the linux kernel if just the past few years of Arm Soc's were fully supported.

So, the combination of the three are the perfect storm of massive overhead for supporting the couple hundred phone models in existence. Imagine for a moment if every PC model made in the past 10 years required a few (tens) of thousand lines of kernel changes, how unworkable that would be.

There aren't enough engineers to solve this as a brute force problem, the solution is to look at the PC market and consider that maybe it would be better if there were actually some standardization in the phone space.

Compare with the second most successful platform, and how Microsoft has been solving problems for decades while maintaining their first commandment: Thou shall not break backwards compatibility.

I wouldn't say that they've refused to solve its deficiencies; Google is not to blame for nor do they have any control over the Linux kernel's development practices. The kernel developers don't want to have stable APIs and the natural result is that out-of-tree drivers are poorly supported.

If your willing to dedicate an engineer or two to keeping it running then so be it. I can assure you that your average 10 year old PC running Linux probably hasn't gotten that much attention since before it was released. But then again, PC's adhear to industry standards and are mostly iterative designs.

So, to clarify things considering all the answers:

- Qualcomm's development cost is shared amongst all OEMs (Except Google), because all OEMs share the same development branches Qualcomm-side. So 1M$ isn't 1M$ for Qualcomm but more

- Qualcomm's development cost is shared amongst a lot of SoCs. Qualcomm have like one shared tree per year. So one development tree spans maybe 10 SoCs, including XR, automative, IoT, and smartphones. So yeah, from Qualcomm's PoV, it's not 1M$ additional revenue it's much more.

- "Extended support" is +30% of support time (so just one additional year). My source tells me that the actual content of "Extended support" varies a lot. Sometimes it's just security patches, sometimes it's Android major upgrade

- Qualcomm "standard" support is 3 years,

- My source is currently writing a full-blown article about Android upgrades. Not sure you'll trust them more than me though

Would you like to be one of two developers whose responsibility is looking after all security patches and the build and release process for a 100 million line codebase?

Sounds cheap to me.

Though Qualcomm get much cheaper engineers than me in India.

I ported Android 12 on thousands of Android devices. I'm already bearing the support cost myself.

Small proof, Android 12 on 17 of devices I bought with my money to support that cost, 7 days after Android 12 is released https://twitter.com/phhusson/status/1447824974396497924

But (and I'm sure this will be an unpopular sentiment) you realize that it doesn't fully address the article's concerns about security. Nor does it provide the experience people expect from tested manufacturer updates (which are far from perfect, but still). This is not the same thing as manufacturer support. You could provide that level of support even as a third party, but it would be a lot more work and it would require the cooperation of Qualcomm and other vendors. You'd need to start a company and charge for your work to make it feasible.

This is about their profits. It's not about security, environmental responsibility, or the users. Regulatory authority exists to promote the interests of the people when the interests of the corporation's profits conflict with them.

Would you pay $50 for a stick of gum? Why not? If you make hundreds of thousands of dollars, surely it shouldn't phase you?

Money is a means to an end. The fact that so much of our society treats it as their score in the game of life—something to be maximized at all costs as an end in itself—is a disease of the mind.

If Google (and, yes, literally every other major corporation) made more decisions based on what was better for their users (not just "their customers", because in certain aspects of their business that's advertisers, not regular users) and for the health of the planet, while simply making sure that they had a reasonably comfortable financial cushion, we would all be better off, and Google's executives and shareholders would barely notice the difference in their high scores.

On the other hand if you consider the real intention of illuminating Google's cashflow it's pretty damning. Do you pay some relative pittance to keep devices supported, adding value to customers, reducing waste, increasing convenience? 'Cause this is a moral argument, not a financial one, and if you're fleecing the public at large (in myriad ways) it's more a question of the lord giving alms to his subject than it is paying $50 for a piece of gum.

Should Lord Google be a beneficent ruler, or a shitpile?

The argument still breaks down at bigger numbers. If you have 500 different ideas for ways the lord should spend a negligible 1% of his money, then even if you have a good argument that the lord should do something, that's not enough by itself to show that any particular idea meets the bar.

You can't run afoul of antitrust laws without being a monopoly. It's why Apple can make it so safari is the only browser available on the Iphone whereas microsoft lost a bunch of money (particularly in the EU) for installing IE by default on everyone's computer.

Android phones are nowhere near antitrust territory, specifically from google. Before they'd run any risks they'd need to actually outsell someone like samsung or apple.

Just because you are rich and potentially a monopoly in one market, doesn't mean you are in all markets.

It seems reasonable for Google to offer that level of support, certainly. But anyone expecting it isn't paying attention to Google's record.

Apple used to look expensive to me, but if I divide initial cost per number of year of device exploitation, it actually gets cheaper then Android devices.

There's only so much you can do with money. Their yearly profit (once again, not revenue, profit) is larger than the entire state budget revenue of more than 150 countries (not combined) [1].

So yes. The argument is very valid.

[1] https://en.wikipedia.org/wiki/List_of_countries_by_governmen...