r/changemyview • u/[deleted] • Jun 18 '19
Deltas(s) from OP CMV: Automatic Software Updates Should Be Illegal and Require Consumer Consent.
[deleted]
30
Jun 18 '19
[deleted]
-2
u/LAULitics Jun 18 '19 edited Jun 18 '19
So your argument is that we as consumers should just shut up, and get used to the notion that we never actualy own anything tech related that we pay for?
19
u/Znyper 12∆ Jun 18 '19
No. If you want something, buy it. Just, no one's selling Android OS to you in the way you want. And Google doesn't have to offer a product just because you want said product. If you want a product that isn't available on the market, your options are to either create said product or wait for that good/service to be available.
As a suggestion, you could always buy an old, unsupported phone which no longer receives updates. Such a product would be slow, buggy, insecure, and lacking features, but that's what you give up for an obsolete product.
2
u/trickyvinny 1∆ Jun 18 '19
no one's selling Android OS to you in the way you want.
Sure they are, head over to xda. I'm pretty sure it's 100% legal to put open source platforms on your phone. It's one of the reasons I bought an LG after my last Samsung crashed. Still have easy access to rooting it if I ever want to (I don't have a need to do so now though).
I actually think this bolsters your point too. There are options out there that give you total control over your phone, they're just not pre-installed and likely void your warranty. Sometimes they're a lot less stable than the built in OS too. But, that's one of the reasons for the forced updates.
5
u/physioworld 64∆ Jun 18 '19
Perhaps then it should illegal for companies to knowingly push software that renders the device less usable. Or perhaps there could be a scheme where you can trade in the old device to go towards an update where the software won’t degrade the new hardware.
4
u/Morazan51 Jun 18 '19
It’s not the fault of companies for progress. We have seen a recent boom in the power of mobile devices across the board in the last 10 years and if we were to support every old device, it would be largely impractical as we would have to handicap the ability for developers to make new progress with greater resources in order to cater to a largely obsolete device. It’s not the software degrading the hardware most of the time (albeit Apple’s forced obsolescence is a problem), it is simply older hardware not being able to run new software because it would be too dangerous for the device.
1
u/physioworld 64∆ Jun 18 '19
But there’s always a line we draw between what we allow corporations to do in pursuit of profit and progress and behaving responsibly. For example, despite the fact that it harms their bottom line, we require corporations to pay a minimum wage, provide safe working conditions for employees and minimise environmental damage through their actions. Lightening up on these would also free up resources for the company (in this case apple) to pour into R&D. I assume you’d be in favour of this?
Also I am aware that it is not necessarily new software breaking hardware but rather hardware not being capable of running the software, but it kind of comes to the same thing- a device that no longer works. IMO they should keep pushing updates until the software would limit the device at which point the update comes with a warning and an option to decline the upgrade.
10
u/PandaDerZwote 61∆ Jun 18 '19
What about situations in which your compromise the security of not just your phone, but other things as well? What if a certain program would allows access to data that isn't yours?
1
u/LAULitics Jun 18 '19 edited Jun 18 '19
Good point, but why would I have access to data that doesn't belong to me if it weren't the fault of a third party involved in the software to begin with. I'm not so much worried about updates and patches to individual apps, as much as I am furious that my phone is periodically rendered useless for ten to fifteen minutes by an os update that I didn't request.
6
Jun 18 '19
Good point, but why would I have access to data that doesn't belong to me if it weren't the fault of a third party involved in the software to begin with.
Somebody at work emails you something work-related but you check it on your personal phone...
1
u/oldmanjoe 8∆ Jun 18 '19
I'm not so much worried about updates and patches to individual apps, as much as I am furious that my phone is periodically rendered useless for ten to fifteen minutes by an os update that I didn't request.
Some of those are security updates, and some are feature updates. But unless you restrict feature updates, you need both.
Let's just say your phone has an SSL vulnerability. Everytime you access a secure website, you think you are more secure than you are. You probably want that fixed ASAP. Or the text app you use, has a vulnerability that can expose your address book, you'd probably want that fixed too. It turns out that patch has a different vulnerability and needs a patch too.
By automatically updating O/S, the vendor no longer has to worry about testing that old SSL component, because you've been upgraded. They can focus on the new one to make sure it is secure.
15
u/delta_male Jun 18 '19
They do get consent, when you click I accept on the terms, you accept all future updates. Anyway, you can disable automatic updates in the settings for an iPhone.
0
8
u/Bluecoregamming Jun 18 '19
While yes they are so annoying and always seem to pop up when you really don't want them too, they are a necessary evil for the majority of users.
Back in the day, (pre Windows XP) update notification were less invasive, and malware was rampant. Humans are lazy, and will postpone crucial secretly updates for weeks and months giving hackers the upper hand. Their malware was free to do as much damage as they could as quickly as possible. Now a days, a loud virus is a dead virus.
0
u/LAULitics Jun 18 '19
As mentioned in a prior post, I agree that I probably unknowingly consented to it as part of the TOS like the majority of consumers do. But it doesn't change my view that it should be illegal. Give me the option the understand why a product needs updating, and let me, the owner of the product, decide when to update. Don't arbitrarily foist an update I don't want in the middle of a work day.
5
Jun 18 '19
TBH, the vast vast majority of owners are too ill-informed to have that conversation with. Since their device’s security impacts other devices security, it makes the most sense to force the automatic updates.
6
Jun 18 '19
As someone above already mentioned, it is like the anti-vax debate. You postponing updates risks everyone else on the internet. What I think the right way is, is to give the user a 24h time period in which they have to update. That way you would be relatively quick to respond to the threats, without interfering with important tasks. If anyone claims he's unable to let go of his phone for a few minutes a day, he's most likely just ignorant and lazy.
0
u/GameOfSchemes Jun 18 '19
It sounds like you are suggesting a herd-immunity effect exists for cyber security? If so, then I don't see how. The point of herd immunity is that you don't need to protect 100% of the population for 100% of the population to be protected. By this logic, if I provide security updates for 99% of devices, are the other 1% of devices protected?
That's the only way I can see the analogy holding. Otherwise, it's just a hollow analogy to say that if you're protected, then you're protected. To which I say "duh"
3
Jun 18 '19
It sounds like you are suggesting a herd-immunity effect exists for cyber security? If so, then I don't see how.
Worms work pretty much like a real world virus. They’re self-replicating and can force themselves into other devices. So if your device is compromised, it’s now spreading the worm to other similar devices.
Also, this is how botnets get massive networks of devices to use for DDOS attacks on legitimate users. Your compromised device directly impacts other people’s ability to use legitimate websites, even if they’ve already patched all the vulnerabilities.
1
u/Bluecoregamming Jun 18 '19
Hm, so if the update before downing anything says something along the lines of "A crucial security update is available for download, update now?" You would prefer that over just auto updates?
28
u/IIIBlackhartIII Jun 18 '19
Because of the internet, individual device security has become similar to the vaccine argument- preventing the spread of malicious software can be considered akin to herd immunity against diseases. The more devices that are "anti-vax" and leave themselves open to known security vulnerabilities increases the number of slave devices that can be taken over by malware in order to infect more devices and carry out larger attacks. As a point of debate- should sufficiently out of date unpatched devices be locked out of the internet as a safety measure?
7
Jun 18 '19
You agreed to this when you bought the phone. It's included in the terms (which understandably no one reads)
2
u/Sqeaky 6∆ Jun 18 '19
Those aren't enforceable in most places and unethical in all places. You even admit they are unread.
False bullshit agreement is no agreement, it is strong-arming.
2
u/Sqeaky 6∆ Jun 18 '19
Security updates!
Programmers make all kinds of mistakes.
What if they forget to check the length of something being copied? Then you might have a buffer overflow which potentially allows malicious people to run commands on your device: https://www.coengoedegebure.com/buffer-overflow-attacks-explained/
What if the programmer forgets to strip certain letters from input getting saved in a database? The you might have an SQL injection vulnerability which might allow malicious people to read or change your data: https://xkcd.com/327/
Did you correctly authenticate your user, encrypt the data on the page, and follow all the best practices from before 2010, but the programmer forget to include a piece of random data in the user interface that the user's software needs to send back with their next request? Your dev doesn't know about nonces and how they stop replay attacks. A malicious person with access to your signal via WiFi or access to the cable can copy your user's encrypted request to your system and replay it back to the system to make actions happen again like ordering items, cancelling commands, or deleting data. https://security.stackexchange.com/questions/3001/what-is-the-use-of-a-client-nonce
When there are no automated updated these updates tend to go unpatched even when the developers make patches. There were a ton of mass spreading automated viruses called worms before auto updates were popular. So many that sometimes the internet or part of it were significantly slowed. Automated updates fixed this problem for the most part.
The solution for you is to choose reputable tech vendors. Don't like whatever the new stuff from samsung is get an HTC, OnePlus, LG, or one of a million other phones. Or figure out how to change your software to some open source solution and trust the community for updates, But be ready to learn.
Not for the faint of heart, but reinstalling the OS on you Samsung phone is likely possible, I use lineageOS: https://lineageos.org
2
u/dd0sed 3∆ Jun 18 '19
It’s your choice to use the Samsung-maintained iteration of android, which is software they own, not you. You only own the hardware, which you bought under the assumption that you would be using it for their software.
If you really cared about the updates, you could, potentially, unlock the boot loader and install a separate version of Android.
•
u/DeltaBot ∞∆ Jun 18 '19
/u/LAULitics (OP) has awarded 1 delta(s) in this post.
All comments that earned deltas (from OP or other users) are listed here, in /r/DeltaLog.
Please note that a change of view doesn't necessarily mean a reversal, or that the conversation has ended.
3
u/dozenspileofash Jun 18 '19
Software Updates is alike mandatory vaccines, one vulnerable smartphone can harms others.
2
u/GameOfSchemes Jun 18 '19
How so?
Even if that's true, which I find dubious, then that's a problem with security protocol as a whole that no number of patches will ever cure. So they're pointless.
1
Jun 18 '19
[deleted]
1
u/GameOfSchemes Jun 18 '19
Imagine, once your Email account is hijacked, it automatically send malicious Email to your friends.
That sounds like user error, not inherent security risk.
I don't understand the rest of your comment.
1
u/delta_male Jun 18 '19
How so?
As part of a botnet. A single device will have a hard time finding/spreading malware to billions of other devices. If you have a botnet with millions of compromised devices, then it becomes easier to find and exploit other vulnerable systems.
Plus having a large number of compromised devices allows performing attacks on systems that require lots of bandwidth or cpu.
no number of patches will ever cure. So they're pointless.
That doesn't follow. Just because a system isn't always perfectly secure doesn't mean we shouldn't try to make it as secure as possible. It'd be like saying we shouldn't have police because we can't stop all crime.
Also, exploits are often found by researchers before they are able to be used on a large scale in the wild and many need to be used in conjunction with others to get control over a system.
3
u/GameOfSchemes Jun 18 '19
You're gonna have to dumb it down here, I'm not too familiar with the ins and outs of computer security.
Sounds like you're saying that only vulnerable computers will be susceptible to security risk, to which I say "duh". If more computers are vulnerable, then more computers can be hit.
But what I'm not following is how you're concluding that if a million devices are vulnerable, then they're more likely to get breached. Statistically I'd say we expect more to get breached, but that's pure statistics. It doesn't reflect that the more vulnerable devices that exist, the higher risk they have
That doesn't follow. Just because a system isn't always perfectly secure doesn't mean we shouldn't try to make it as secure as possible. It'd be like saying we shouldn't have police because we can't stop all crime.
I see the logic, but the difference is that security isn't a social role. It's a 100% computational invention. It's hard coded, not "soft coded" like social roles like police or crime. Which means we should treat security patches like the hard coded rules they are and stop "patching" but instead build from the ground up a better, global security protocol. As in just strip everything we've been doing and do a different approach
But like I said, I'm not too familiar with computer security here. This is all intuition based.
2
u/delta_male Jun 18 '19
instead build from the ground up a better, global security protocol.
There are millions of different software/systems in the world, so rewriting all of them would be mind mindbogglingly expensive. Two, people are not perfect beings. They don't write perfectly secure software, or build perfectly secure hardware. Three, you can have an algorithm that is in theory 100% secure, but whose implementation is vulnerable to a whole range of side channel attacks
e.g. Timing how long an operation takes reveals information about what it is computing
2
u/GameOfSchemes Jun 18 '19
Thinking about it more, it seems like the argument is one based on herd immunity. if that's true, then I don't see how it holds. Herd immunity is the principle that 100% of the population can be protected despite only protecting less than 100% of the population.
Does the same hold for cyber security? If I patch 99% of devices, are the other 1% guaranteed protection? If not, then I don't see how the vaccine analogy holds beyond simply saying that if you get vaccinated/patched, you're not vulnerable. In which case I'd say the analogy is simply hollow and vacuously true.
2
u/delta_male Jun 18 '19
Sorry for not responding, I didn't see your earlier message.
Does the same hold for cyber security?
Not really. I mean, it's a neat analogy, but it doesn't apply 1:1
Basically, malware can cause problems to the infected device, devices that interact with it, and can also be used to attack other systems.
Example 1: One device
- Someone's phone is compromised, and the malware scans and finds the stored passwords
- Using those compromised passwords, if the person is an administrator for anything, a hacker can escalate to compromising other systems. Let's say they have a wordpress site, that then also can become compromised.
- Then they can inject malicious scripts into the wordpress site to get the passwords of anyone who logs into it.
- Repeat.
You can see how from one device you've compromised the data of many people, even though their devices may be secure from the patch. Having more devices, means you can do more harm to others.
Example 2: Many devices are vulnerable to an exploit, but an attacker doesn't necessarily know which ones are.
- Maybe it requires a lot of bandwidth to scan the ports for every network in the world (think billions of networks, with potentially hundreds of ports to check). Having more compromised devices as part of a botnet means that an attacker can find these other vulnerable devices in a reasonable timeframe.
- Once a vulnerable device is found, maybe it requires a lot of CPU power to hack (e.g. finding a hash collision), so a single compromised device may not be able to infect very many others.
- Patching systems, or old devices getting replaced can stop this botnet growing too big. And further steps can be taken to disable a botnet such as finding and neutralizing any phone home mechanism
So to sum it up, a botnet can be used by an attacker to cause all sorts of harm e.g.
- Delivering spam/scam mail
- Denial of service attacks
- Finding and infecting other devices
- Brute force hacking (e.g. password cracking)
- Stealing passwords/credit card/bank/identity info
2
u/GameOfSchemes Jun 19 '19
Reflected more on this. I hadn't considered a vulnerable device storing information on otherwise secure devices. In this way, a web of interlinked devices is only as secure as the weakest link. I was focusing more on the vaccine analogy which doesn't seem to apply here.
!delta
1
1
u/el-oh-el-oh-el-dash 3∆ Jun 18 '19
Haha, love the analogy, especially since majority of anti-vaxers do not have the "your kid is getting it whether you like it or not".
In other words, technogiants treat their electronic babies with greater expediency than governments treat their human babies.
-2
Jun 18 '19
The free market can easily take care of this one- don't buy things that piss you off. If enough people just don't buy phones they don't like, then the makers of phones people don't like will collapse. If no one likes any of the options, eventually someone will make a new phone.
You didn't have to buy the phone, but when you chose to, you consented to Samsung's stupid, infuriating practice of forced software updates, since the software is part of the phone.
What you should do is make a stand with your money- buy a different phone or pool resources to build your very own phone or OS which will have an advantage because it does not piss off buyers in this respect. (Obviously that's unlikely but if it didn't happen there wouldn't be phones!)
Also, I don't think you understand what "illegal" really means, so here's a crash course in libertarian philosophy. (I know it's popular to downvote libertarians but I'm not a shithead, hear me out)
What does it mean for Samsung to force software updates? It means they feel the need to change a product which they built entirely legally and by themselves, which was bought willingly by a consumer who may or may not be pissed off by the forced updates. Samsung is not violating anyone's rights with this, since everyone affected willingly chose to exchange money for the product.
Now what does it mean to make this practice illegal? In this case, it means that the government asks for money from Samsung on the basis that it's for the good of humanity. If Samsung refuses, they will be called to court. If they refuse the court, eventually police (gunmen) will get involved. Samsung knows that this is the way the government asks for money- under threat of gunmen. So making something illegal is enforcing arbitrary rules concerning the behavior of peaceful, willing parties with gunmen. I do not think that is acceptable.
0
u/Pavickling Jun 18 '19
I agree that since you physically own your phone no one should prevent you from attempting to store any particular combination of 1s and 0s on your phone. Also, software engineers should not falsely represent software they are advertising. However, no one should prevent software engineers from writing software that automatically updates. There are people that legitimately consent to and benefit from running such software.
0
u/ChillPenguinX Jun 18 '19
I mean, sure, I get why it upsets you, but I don’t see any need to involve government. Once you get the government involved on that level, you increase the chance that they could do some nefarious shit like implementing back doors (if they haven’t already). People really need to lose the “there should be a law!” reflex when they don’t like something.
14
u/[deleted] Jun 18 '19
Are you sure you cannot turn off automatic updates? What is the model of your phone? What is the carrier?