You can’t create perfect software no matter how hard you try. Security updates especially need to be a forever thing, lest some major RCE comes along and is used on tech support scam sites to cause actual harm to the user.
Software for utility devices should not be a selling point. It should just be there and do its job and maybe get an update every five years or so.
Why does my TV need updates nowadays? My car? Do I have to download updates for my clothes or my bed soon? How about the toilet?
These updates are indeed just a way to turn products you once used to buy into leased stuff. Every business loves to lease: There's much more profit in it and the customer has no say about how long they use a particular device. But as a customer I hate it.
Here's just one instance: I had an old kindle paperwhite. I loved that thing for piling all the stupid, cheap scifi on it that I would otherwise have bought as cheap paperback and that would then clutter my apartment. Literally two weeks after the device went out of the warranty, amazon decided to push an over-the-air upgrade. And it bricked the device. Now customer care was nice enough to send me a new one, but what if they didn't? Who is legally to blame? I would have to explain the concept of over-the-air upgrades and how software can sometimes destroy hardware to a judge and that judge would have to apply law from a hundred years ago to that situation. In a court case over maybe $100 - good luck with that.
Those things don't all need software to exist. But good luck buying a new TV or car these days that isn't 100% reliant on software to keep doing what you bought it to do. (And I'm sure there are clothes/furniture/toilet manufacturers looking very closely at John Deere's current business model to try and see if they can turn "buyers" into "recurring licensees" of their products.)
But I think that's missing the article's point. It talks about "some old gadgets" and "each booted up successfully" and "Two perfectly good pieces of electronic gear have become useless, simply for want of software updates." - it's clearly not talking about clothes or beds, probably not cars (although arguably they count), and probably is talking about modern TVs (many of which het thrown away when the ancient Android version they run can no longer update to new versions of that apps the TV came with).
I'm not sure whether "We should mandate that device manufacturers set aside a portion of the purchase price of a gadget to support ongoing software maintenance, forcing them to budget for a future they'd rather ignore." is the only/right answer. but the article certainly eraises an important question.
isn't even true. The PSP is "useless" (in his book) for want of hardware updates and the same is probably true of the tablet to be honest.
(Personally, my PSP isn't useless; I even have a secondary wifi running 802.11b and WEP for it and other old hardware.)
> How about the toilet?
Because they're connected to the internet or to internet-connected networks.
Anything that's connected to the internet needs to be receiving at least security updates. If it's not connected to the internet, it's your call whether the update is worthwhile
If you don't want to update it, don't connect it to the internet. Easy.
If you want to connect it to the internet, you need to accept the rules of society and one of those is don't leave vulnerable systems online where they can become part of a botnet and mess things up for the rest of us.
I could not care less about your data, but we've seen with hacked security cameras and such that insecure crap left on the internet causes problems for everyone, not just their owners.
But with most companies' development process, you're stuck having to take the bad with the good. Their release tree is one long trunk, and to get the security updates you must also take the latest PM's pet features and the disruptive results of their latest UX designer's art project. Companies need to learn how to branch at major versions and offer minor maintenance releases on each of those branches, while offering the next version.
EDIT: If 'grep' was developed like most commercial/startup software, its command-line switches would all change with every release, it would require an internet connection, it would be able to grep through Tweets, and it would phone home to its developer with logs of every file you grep through.
I shouldn't have to accept whatever feature/UI madness developers have cooked up in order to have security issues fixed.
Nobody does because it causes a combinatorial explosion in code branches, and in testing. This isn't just a problem with the higher level convenience tools like compilers and package managers, its a problem with the actual source code as formulated as it is today. We'd need an entirely different way of writing code in order to do that without a massive increase in programmer/testing hours. Personally I don't think it will ever realistically happen, but I'd love to be proven wrong.
As a developer, I don't really understand. I've been working on large, complex software that targets multiple operating systems for years, and we don't have any such issues.
It sounds to me like a lot of companies are using development methodologies that are a bit broken...
I've long thought that the reason for this is rather different -- the industry really wants to go to continuous-release models (which I don't think is a good thing, but that's a separate issue), which make security-only releases a bit nonsensical.
You buy a device, the manufacturer finds out there are flaws -- if it's under their promised timeframe (there's an incentive for them to offer ) they offer you updates. If you're outside of their time frame, you hope for a third party or you determine if you must upgrade. As the number of devices outside support range grows a market is made.
This isn't a new problem -- software can copy off of the robust recipe that automobiles have left, hopefully making fewer mistakes this time and letting a little less corruption in.
Most RCE come to to happen, because the industry largely considers security best practices an afterthought and keeps pushing for the use of unsafe languages.
Don't complain about death tools, when people keep driving without helmets and seat belts.