Right-to-repair legislation has made real progress on the things it set out to address: parts availability, access to service documentation, tools.
The binding constraint moved while all that was going on.
Parts pairing¶
A replacement component (battery, display, sensor, drive) is cryptographically tied to the device it was first installed in. Fit a genuine part taken from another unit of the very same model and the device rejects it, degrades what it does or nags you about it forever.
The stated justification is security and authenticity. Making sure a battery is genuine is a real safety concern, and a fingerprint sensor's integrity is a real security concern; nobody sensible disputes either.
Both of those are legitimate. They're also indistinguishable, from outside, from controlling who's allowed to do the repair. The mechanism serves both purposes identically, and the vendor is the only party in a position to tell you which one is operating.
Signed firmware¶
The deeper version of the same problem. If a device will only run firmware signed by its manufacturer, then the day the manufacturer stops signing is the day the device's remaining life becomes fixed. The hardware hasn't failed; nobody else is permitted to update it.
This is where repair and e-waste run into security policy, and the tension here is real rather than manufactured:
- Signed firmware is a real security control. It's what keeps persistent malicious firmware off the device, and tearing it out would be a serious regression.
- It also makes the vendor's support horizon the device's horizon.
There's a resolution available in principle, and it's owner-controlled keys: the device still enforces signatures, and the owner can enrol a key of their own after a documented, physically-present procedure. Secure Boot on general-purpose PCs works roughly like this, so we know the approach is implementable.
Elsewhere it's rare, and the reason isn't a technical one.
Why an engineering site cares¶
Because this is a design decision that anybody building hardware makes, and usually makes by default.
Ship signed firmware with no owner key enrolment and you've decided your product dies when you stop supporting it. That's a choice with environmental, commercial and ethical dimensions, and it's routinely made without anyone recognising it as a choice.
For anything with a server component the adjacent question is sharper: what becomes of deployed devices if the company stops existing? A device that bricks when a service shuts down was sold to you as a product and delivered as a subscription.
What owner-controlled keys would make possible¶
Spell out the world where this is normal, because it is a better one and it is within reach.
A hospital buys infusion pumps with a ten-year clinical life from a vendor whose support window is five years. Today year six is a procurement crisis. With owner key enrolment it is a maintenance contract: the hospital's own biomedical engineering team, or any firm it hires, signs and ships patched firmware for the back half of the device's life, and the pump keeps its verified boot chain the whole time. The security property survives the vendor. That is the entire argument in one sentence, and it is deliberately narrow. The key solves who may sign a boot, while the validation, certification and safety evidence a regulated device needs still have to exist for whatever is signed, whoever signs it.
A council runs ten thousand streetlight controllers. A farm runs tractors with twenty-year hulls and five-year electronics. A school has a room of eight-year-old laptops that are perfectly adequate for the work and are refused the next operating system because nobody will sign a bootloader for them. In every case the hardware is fine and the signature is the thing that expired. The volume of e-waste produced by working devices that were locked rather than broken is large and entirely avoidable.
For engineering, the class of problem that disappears is the end-of-life scramble: no more rushed hardware refresh driven by a signing calendar rather than by capacity or failure rates, no more fleet frozen on a known-vulnerable firmware because the only party who could fix it has moved on. You get to plan replacement on the device's physical condition, which is the thing you can measure.
And it unlocks a repair industry. Independent workshops can offer firmware maintenance, not just component swaps, which is skilled local work in the sort of towns that lost their manufacturing. Repairability is an employment policy as much as an environmental one.
The power sits in one specific place.
The chokepoint is one private key, held by the manufacturer, which decides whether the hardware you bought will execute. Not the part, the manual, the diagnostic tool or the legislation. Ownership of the device is nominal while somebody else holds that key. You have possession, maintenance obligations and the depreciation; they have the veto.
This concentrates in a way that should bother you. A small number of silicon vendors supply the root-of-trust blocks that nearly all this firmware chains to, and the key hierarchy above the device is theirs, not the device maker's. Several platforms now ship with attestation that reports to the vendor's service which firmware a device is running. It is sold as fleet management, and it is useful for that, while also being a reliable per-device presence and inventory feed flowing to a third party by default. A government that wants to know which devices are in a building has an easier job than it used to, and does not need to ask the owner.
Where is the open version? Better than it was. Coreboot and its descendants are real and run on real machines, Secure Boot on PCs does permit owner keys, and the fwupd and LVFS work has made vendor firmware updates on Linux ordinary rather than heroic. But it is losing badly on anything integrated: phones, consumer appliances, most medical and industrial kit, anything with a cellular modem. On those platforms there is no owner key path at all and no sign of one, because no regulator has required it and no customer has refused to buy without it.
Keep verified boot; change who owns it¶
The sustainable position is verified boot with owner-controlled keys: keep the security property, drop the vendor's monopoly on how long the device gets to live.
It costs engineering effort and it closes off an after-sales revenue stream, which between them explain its rarity perfectly well without anyone having to assume bad faith. We specify owner key enrolment when we buy, and we would rather pay more for hardware whose working life we control than save money renting the right to run our own machines. The question to put to a vendor is short: can I enrol my own key, and if not, what is your plan for my hardware after your last signature?