“Veni, Vidi, Velcro: I came, I saw, I stuck around.” – unknown
How long should you keep your products in production?
If you’re making steam locomotives, the answer is: about a hundred years. If it’s iPhones, the production life shrinks to just a handful of months. Harlequin romance novels? About a week.
But what if you’re making software? Is there a reasonable time limit for availability, or should code live on forever? At what point is it okay to cut off the bitstream, versus taking advantage of the “long tail” and offering old software in perpetuity?
That question now affects the users of certain outdated Intel motherboards following the company’s announcement that it would be removing some old firmware from its download site. The motherboards themselves were discontinued years ago, so Intel is merely cleaning up its support site by eliminating the BIOS firmware for outdated items it no longer makes.
Seems harmless, right? But the move drew howls of anger and indignation from engineers, programmers, and maintenance personnel from all over the world who still use those motherboards. Even though the hardware has ceased production, it doesn’t mean all those boards abruptly disappeared or become unusable. Many old Intel motherboards still work just fine. But anybody using one has no way to get the firmware.
So… what would you do in that case?
Intel gave everyone 13 months’ notice (from October 23, 2018 until last Friday) and recommended that users “…uninstall and/or discontinue use as soon as possible.” In other words, shut down, turn off, and chuck out any hardware that uses the affected firmware.
The key sticking point here is that Intel isn’t merely ending support for the old firmware. It’s removing the firmware from its official support site, thus making it unavailable. It’s gone. Unless you downloaded a copy before November 22, you won’t find it anywhere (not officially, anyway).
Is this a big deal, or a whole lot of nothing?
If you’re an engineer making long-life products based on Intel motherboards, it’s a huge deal. What happens if you need to re-flash the BIOS someday? It’s not available on Intel’s site anymore, so unless you’ve already got a backup copy stashed away, you’re out of luck.
On the other hand, we’re talking about 8-year-old motherboards based on the old Sandy Bridge CPUs (2nd-generation Core), DDR3 memory, and H67 Express chipsets. Of course the firmware is out of date. How long can Intel be expected to keep a dead product on life support? These motherboards were never guaranteed for long-life products.
On the other-other hand, what’s the harm in keeping old firmware available for download? It costs nothing and it might help keep some older machines running. What does Intel gain by cutting off the only source of firmware for its own hardware?
As usual, it’s complicated. There are practical issues, technical issues, ethical issues, and – of course – legal issues.
As a practical matter, the firmware in question is tiny; it takes up a negligible amount of storage space on Intel’s servers. A free Dropbox account could probably hold it all. There’s zero reason Intel would need to free up that space on its servers, so economizing isn’t the issue.
Support isn’t an issue, either. Nobody’s asking Intel to generate updates for the zombie firmware, only to keep the current (i.e., old) versions online in case they’re needed.
Intel’s official workaround is to tell users to download the firmware they need and keep a private copy. That’s legal (see below) but assumes a few things. First, you had to be aware of the change in policy, and you had to act promptly enough to capture the firmware you need before the November 22 deadline. Second, you need to know what firmware you’ll need – what firmware you’ll ever need – although you could just scrape everything from the support site and sort it out later.
On the technical side, old motherboards with outdated firmware might harbor all sorts of security holes, vulnerabilities, and weaknesses that Intel can’t be expected to fix. Staying on top of all of that would be a big task, even for a big company. And some bugs just won’t be fixable at all because of underlying hardware problems. Chipset or PCB layout bugs in an 8-year-old motherboard would be tough to fix with a firmware patch. At some point, Intel is entitled to cut off support, upgrades, and patches for hardware it hasn’t made in years.
You could argue that keeping the firmware around is just good business. It’s a nice gesture, it’s helpful to a handful of users, and it instills confidence that Intel products are well supported even in dotage. A marketing guy would say it’s good optics.
Or, you could make the opposite case. Ending support for an old product might nudge users toward a newer upgrade. There’s no money to be made from handing out free firmware for paid-off hardware, so why do it? Where’s the profit motive in delaying or even discouraging new hardware purchases?
Finally, there are the legal issues. I’m no lawyer, so this is pure speculation, but Intel might have to shoulder certain legal responsibilities by offering the software on its official support site. The click-through license agreement runs for over 1700 words and includes the usual disclaimer language: “The software is provided ‘as is’ without any express or implied warranty of any kind… Intel does not warrant or assume responsibility… In no event shall Intel be liable for any damages whatsoever….” You get the idea. But that doesn’t mean Intel won’t still have to support it in some ways, field calls, maintain the integrity of the downloads, answer customer questions, and so on. By discontinuing both the hardware and the software, Intel can finally wash its hands of the old support burdens.
Maybe someone outside of Intel could step up and fill the void? Nice idea, but it’s probably not legal for anyone else to host Intel’s orphaned firmware. Copyright applies to software more or less as it does to other content, so simply mirroring Intel’s support site would constitute infringement and wouldn’t be allowed. Handy, yes. Legal, no.
Which doesn’t mean someone won’t try – but that just opens a different can of worms. Plenty of well-meaning developers might volunteer to host the old firmware, but so will a lot of bad guys. How do you tell legitimate firmware from malware? A BIOS download is the perfect vector for spreading a virus. Anything that doesn’t come directly from the intel.com domain should automatically be suspect. Are you really going to trust boot ROMs from www.firmwarez.ru?
Intel could help matters by publishing the MD5 hash of each firmware version (as they do now), but then you have the chicken-and-egg problem of whose hash do you trust? And why would Intel offer the hash but not the download that goes with it?
Hardware products have a finite lifespan, and we’re accustomed to that. Components wear out. Last year’s model is replaced with a newer one. Features improve and we voluntarily upgrade. But software? That can potentially live forever – or, at least, for as long as there’s compatible hardware to run it on. But that doesn’t mean the software publisher wants to keep it around forever, and, legally speaking, it’s their call. Publishers might have their own motives for axing an old program, even if it annoys and antagonizes their customer base. Hey, that’s business.
In this case – as in other cases where hardware vendors have inexplicably pulled the plug on working products – I’d like to see Intel keep the firmware online and available. It costs the company nothing, would generate goodwill, and wouldn’t (as far as I know) trigger any legal problems. It seems like a no-brainer. But then again, maybe that’s exactly what happened.
