I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic [LWN.net]

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 25, 2016 8:19 UTC (Mon) by smurf (subscriber, #17840)
In reply to: I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic by anselm
Parent article: Dutch consumer group sues Samsung over Android updates (OSNews)

German law (BGB §437 et al.) says that the buyer has a choice of returning the product for full price, or getting part of their money back, consumer's choice, if the seller can't repair the defect.
This however assumes that the security problem is a material defect. "Material" meaning "it matters", i.e. either it significantly impedes your use of the phone, or something that was explicitly promised in advertising / user manual / sales contract is missing (thus the buyer can assert they wouldn't have bought the thing otherwise).
The law does not say whether continuing security updates are material, neither does the phone's advertising or the user manual, and AFAIK there are no relevant court decisions.

Disclaimer: IANAL², but my father was.

to post comments

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 25, 2016 9:35 UTC (Mon) by anselm (subscriber, #2796) [Link]

German law (BGB §437 et al.) says that the buyer has a choice of returning the product for full price, or getting part of their money back, consumer's choice, if the seller can't repair the defect.

Yes, but according to §346 BGB, if you as the buyer opt for the return-with-a-refund you still need to pay for the use you had from the device. This doesn't matter a lot if you receive and unpack the thing, find that it's broken, and return it immediately, but if you turn it in for a refund under the statutory warranty after having used it for some considerable time (nearly two years, in the extreme case), you can't expect a full refund.

This however assumes that the security problem is a material defect. "Material" meaning "it matters", i.e. either it significantly impedes your use of the phone, or something that was explicitly promised in advertising / user manual / sales contract is missing (thus the buyer can assert they wouldn't have bought the thing otherwise).

Since smartphone manufacturers – for very good and sensible reasons as far as they're concerned – don't promise or advertise that their devices are completely devoid of security bugs, the $64,000 question is really whether a customer can reasonably expect that if such bugs are in fact found, they will be fixed in existing and deployed devices in a timely manner. Judging from past performance on the part of manufacturers, the answer to that question is likely “no”. The other question is whether it will be believable for a consumer to claim that if they'd only known that there was this terrible security hole in Android they would have bought an iPhone instead (or vice versa), when terrible security holes are found all the time in either platform.

We'll be watching the outcome of that lawsuit with great interest. (Oh, and IANAL either.)