In my view, one other feasible good step would be to require companies to publish the source code of their phones, ie provide the option for people to download, compile and install the full sw stack. Like this even if manufacturers stop supporting their devices, people can step in and do it. At the very least it would make it easier to support devices than it currently is in third party ROMs
You're assuming that it's actually feasible to keep old devices up to date for that long. It may well not be. It gets substantially harder to maintain old branches the further mainline has diverged from them. The original engineering team has typically long since moved on. The magnitude of the issue, here, can be on the scale of "we now need several times as many engineering teams".
This isn't a matter of "security updates would be better than no security updates". This may potentially be a matter of "security updates for four years is economically feasible, security updates for seven years isn't". (I'm not saying it is infeasible, just that it may well be.)
Don't assume that attempting to solve a problem with a law can only have one possible outcome, and can't possibly have a different outcome instead.
Trying to make those work 2 years later is a huge effort -- probably worth less than just replacing the phones.
Mind you, I agree with you in principle, but I can see how in practice in might all go to shit.
It turns out that getting a bunch of programmers to do careful modifications to some C code base over a couple of months is more work than getting great many thousands of people across multiple companies to manufacture, distribute and sell new hardware to millions of customers.
Why would they? They get paid to put out crap, so they'll continue doing it.
Bottle water continues to come in plastic bottles, even though glass if far cheaper/easier to reuse or recycle. Plastic bottles are literally trash, yet it'll continue being produced if people keep buying it.
Near-disposable phones (both hardware and software) won't stop being manufactured if they continue being in high demand.
Actually, you do see. The price of your phone would be higher if Qualcomm had to hire competent engineers to make properly designed kernel changes for their hardware.
Or they'll eat that $1 from their profit margins…eh, who am I kidding?
Planned obsolescence is designed to increase TCO
SoC makers deliberately do this as a way to force phone manufacturers to buy new chips.
For example, if they release a chipset in 2020, it will ship with Kernel 4.14 (released in 2017). Why ship such an old kernel on brand new hardware you say?
Well Android 11 (also shipped in 2020) supports Kernel 4.14, but you can be pretty sure that Android 12 won't support 4.14. So that means that OEM's can't make android 12 work with that chip without a massive engineering effort (and by the way, a bunch of chipset blobs will be compiled against those kernel headers, so changing kernel versions is pretty much impossible).
So, the main reason to use a deliberately outdated kernel is to prevent last years chips running next years android release, without the chipset manufacturers permission and a share of the profits.
Binary drivers can be reverse engineered and reimplemented for the new kernel. This takes a lot of effort since it requires following a "proper" clean-room methodology when doing so for interoperability purposes, but is otherwise doable. A complementary approach is to forward port the minimum set of features that's required for Android 12 to the older kernel, in a way that carefully preserves the portions of in-kernel ABI that the binary drivers depend on.
I can see why Android was so popular with OEMs!
You can sometimes run 20 year old drivers, assuming same ISA and that none of the ABI has changed, which does in fact happen, just more rarely. Windows 10 is certainly not compatible with 100% of drivers from Windows 7, let alone XP (20 years ago is 2001, so Windows 2000 is actually likely).
That is definitely not feasible. Vendors are very protective of their code. eg. https://github.com/github/dmca/blob/master/2019/08/2019-08-0...
Representational democracy is supposed to work around the problem of an uninformed electorate. The question should be "if a member of the electorate understood this situation well enough would they care", representatives are supposed to use subject experts to help them answer that question and then use their political expertise to implement laws that move us towards a solution.
It's a big ask, and it doesn't work that well -- politicians often work at what will win them plaudits in the press (or what can be presented as a win, if they control the press), rather than actually doing their job.
Fundamentally though "the electorate doesn't care" is the wrong measure, there are a million things the electorate don't care about but would care about if they had the situation presented to them fully ... we pay representatives and advisors so we don't have to care directly ... that's supposed to be how it works.
- Release all code necessary for independent developers to provide updates.
- Release updates for 7 years yourself.
Then they can decide what is cheaper for them.
Especially if everyone else wanting to play needs to open up as well.
And would be great if they had to also provide a free OS, like postmarketos, lineage, Debian or something like that. It could be very rudimentary without a GUI, just drivers for GPS and Wifi. And they would not have to provide even security updates for that. So I would think that many companies would also prefer that.