AXIS OS 13 breaking changes

You might remember the Y2K bug, where systems were at risk of failing when the year rolled over from 1999 to 2000. A similar, less-famous issue is around the corner, the "Year 2038 problem" (Y2038). In short terms, many 32-bit systems store time as the number of seconds since January 1, 1970. In 2038, that number will exceed what a 32-bit can hold, causing the system clock to "wrap around" and reset to 13 December 1901 (20:45:52 UTC), leading to catastrophic failures. While 2038 may seem far off, AXIS OS 13 is proactively solving this problem now by switching to 64-bit time.

The reason for the urgency is that Axis devices used today could have a certificate valid to 2038 or very well still be in service when 2038 arrives. This is why it is important that you have hardware and software that is built to last.

The change is a fundamental break in the systems architecture, meaning all applications (known as ACAP applications) must be recompiled to work. If any incompatible apps are present on a device, the upgrade to OS 13 will simply rollback. While you should always stay proactive; we know that the process is more challenging for 32-bit products. Yet AXIS OS 13 is tackling this complexity to ensure that existing devices are future-proofed.

For years, the standard approach to security was to provide you with options that you had to find and enable. The upcoming OS update flips that script entirely, adopting secure-by-default. This means the most secure settings are enabled out-of-the-box, forcing you to intentionally downgrade security if you have a specific need, rather than requiring you to opt-in to being protected.

This trend toward default security might add a small amount of friction for you during initial setup, but it dramatically hardens devices against common attacks. Please make sure to see the full list of all security changes.

• HTTPS-Only Connections
  Our devices will no longer allow insecure HTTP connections. All network communication will require a secure HTTPS connection by default. If you absolutely need to use the less secure option, you will have to go in and deliberately enable it.
• Password Complexity
  Default enforcement of strong password rules will apply to any new accounts, as weak passwords serve as the primary entry point for hackers. Crucially, for existing devices that are upgraded, this rule only applies to new or edited accounts. So, your current passwords will not break but will need to be adjusted manually to meet the new standard.
• Signed Video
  To combat deepfakes and video tampering, footage will be cryptographically signed by default. This feature is to verify that a video clip is authentic and comes directly from the camera, ensuring its integrity has not been compromised.
• Removal of UPnP Discovery
  UPnP Discovery has been replaced by Bonjour since AXIS OS 12.0 to enhance security and simplify setup. Starting with AXIS OS 13, UPnP will be fully removed, making devices undiscoverable via UPnP on upgrade or reset. This change streamlines device hardening and aligns all discovery with Bonjour.

Axis devices support a rich ecosystem of partner-developed applications (ACAPs) that enhance functionality and introduce new features to our products. However, with that openness comes an important question - how can you be sure that every application installed on a device is trustworthy and will not compromise your device?

To strengthen security and reliability, the single most impactful change is that all ACAP applications used in production will need to go through a signing process that will be available to the public when AXIS OS 13 is launched. The option to install unsigned applications in production environments will be removed.

This signing process guarantees that each application is authentic, has not been tampered with, and that its source can be verified. In other words, it establishes a clear chain of trust between Axis, our partners, and end users.

These improvements are further supported by new requirements, such as explicitly declaring which AXIS OS versions an application is compatible with, helping prevent compatibility issues after updates. Together, these changes make the Axis ecosystem more secure, stable, and trustworthy for everyone.

AXIS OS 13 includes a software tweak designed explicitly to reduce physical wear and tear. The feature is called PTZ continuous pan control. On a Pan-Tilt-Zoom camera, an operator could issue a command for the camera to pan continuously. Previously, the camera would obey that command indefinitely, moving until it was stopped or hit a mechanical limit. This constant motion could wear out the motors and other mechanical parts over time.

In AXIS OS 13, this behavior changes. If a camera is instructed to pan continuously, it will now automatically stop after 10 minutes. It is a perfect example of software intelligence being used to physically preserve the hardware it runs on. 

Note: In specialized use cases, it will be possible to disable the timeout or change its value.