11 ms·

Don't you mean Android phone OEMs and carriers? Google already updates their phones every month for three years which is long enough for a device most people r

Don't you mean Android phone OEMs and carriers? Google already updates their phones every month for three years which is long enough for a device most people replace or break within two years. Verizon isn't the only carrier of course.

mjevans 10y ago
Security updates need to be for the lifetime of the /device/ through all parties. Think of it the same way you would an airbag or break recall for a car. Feature updates? Sure those can go away as the manufacturer feels like it (though they should be required to be upfront about this).
- 01Michael10 10y ago
  Who supplies security updates for the "lifetime" of their product in your fantasy world? Three years is a good amount of time for security updates but could be extended to four years since people are keeping their phones longer these days. You are comparing software security updates to products recalled for safety issues? Well phones are already subject to recalls for hardware/battery problems. Let me know when a phone kills or hurts someone due to lack of security updates.
  - danudey 10y ago
    The iPhone 5, introduced in 2012, is getting iOS 10, which means security updates into 2015. That's a five-year span, which is much longer than the average person uses their iPhone 5. iOS 9 supports the iPhone 4S and the iPad 2, which again is a five-year span (2011 to 2016). I have devices that are that old; the iPad 3 I have just prompted me to update to the latest 9.3 update, and it's so slow running newer apps that I gave it to my toddler to play games on instead. So I agree, three years is good, four years is better, but Apple is already at five years and has been for a while now.
  - mjevans 10y ago
    With replacement of consumable parts (mostly batteries), I would not be surprised to see current phones in use for 10+ years. Just like desktop computers they will reach a point where, for most people, they're 'good enough', even if they're really slow. For some people, particularly the elderly, the young, and the poor, they'll use it until it literally stops working at all because they literally cannot afford otherwise. Cell phones are a literal lifeline device, to the point that emergency calls (at least in the US, and probably in any civilized part of the planet) //WILL// always work; without unlocking the phone, without the phone being on a payment plan, as long as the device has the power to transmit that distress need. It is not difficult to imagine how issues with the security portion of the layer could allow anything from a computer virus to DDoS local infrastructure (jamming), to targeting specific individuals (lock out their ability to call for help, bug and track movement), to picking out individuals that are alone and in vulnerable moments. Those are attacks I thought of just typing this comment and are not an exhaustive list. This is why the security updates either must be performed by the companies in question through the actual use lifetime of the device: not just by it's first owner, but all the way through to it's last. Or failing that, they should be required to both release the sources and provide everything necessary in a legal sense for other entities in the community to perform the security updates they are unwilling to do. Carriers should also be liable for failing to (offer to) distribute said security updates to devices on their network (it is in the interest of everyone that they do this and do not charge for it).
    - 01Michael10 10y ago
      >With replacement of consumable parts (mostly batteries... What? Most phones sold today do NOT have replaceable batteries. >For some people, particularly the elderly, the young, and the poor, they'll use it until it literally stops working at all because they literally cannot afford otherwise. One can get a new Android phone from Amazon for $50 no contract. Landlines still exist and are almost available anywhere unlike cell coverage. >Cell phones are a literal lifeline device... I could live with a dumb phone as my PC is way more important. When are we going to make Microsoft start to provide security updates to XP again? You must be like 20 years old... I hate to break it to you but no one needs a cell phone to survive. >This is why the security updates either must be performed by the companies in question through the actual use lifetime of the device... Well start writing Congress but personally I don't want my new phone to be another $50 more because the OEM is required to provide security updates for phones 5 or more years old.
tdkl 10y ago
> Google already updates their phones every month for three years For 18 months actually.
- 01Michael10 10y ago
  I should have said up to three years but you are even more incorrect --> https://android.googleblog.com/2015/08/an-update-to-nexus-devices.html https://android.googleblog.com/2015/08/an-update-to-nexus-de...
  - tdkl 10y ago
    You're right. Although those security updates have been out for a year now, so technically Google doesn't update their phones for three years yet and we're yet to see this commitment happening. Based on their track record, my confidence level isn't exactly high.
ocdtrekkie 10y ago
Google loves when people blame OEMs and carriers for bad OS design. There's no reason a security flaw in Google's code needs to go through two layers of approval by other companies to be distributed in a costly OTA distribution method. Google should control the release of fixes to it's own code. If the operating system allows otherwise, the operating system is flawed. Microsoft distributes security updates regardless of what OEM their software is installed on. With Windows 10, this is true of mobile as well. My two year old Verizon phone runs the latest official version of Windows 10 Mobile, released direct from Microsoft, at the same time as everyone else.
- 01Michael10 10y ago
  Android OEMs love it when people keep blaming Google for phones not being updated and as long as this happens this issue will never be addressed. Do you know how open source works? Google has no control over OEM phones or the carrier approval process. Period! The only reason OEM Windows phones can be upgraded is that OEMs agree to that level of control by Microsoft. Have you ever noticed their are few Windows phone OEMs? LOL Google could try to assert this kind of control on OEMs but Samsung would bail as soon as possible for sure. They would fork AOSP or move to their own OS.
  - wmf 10y ago
    Google can definitely control any phone that has Play Services installed since that requires a non-open-source license. I agree that Samsung would probably not agree to stricter control, but other OEMs probably would since they don't have any other realistic choice.
    - 01Michael10 10y ago
      No! They absolutely can not! OS updates do not come via Play services... Why can't people understand that Android is open source? An Android OEM can (and does) modify their Android distribution anyway they like UNLIKE a Windows phone OEM. The fact is any OS update directly from Google would probably brick an OEM phone not that Google can unilaterally decide to update someone else's phone anyway. Samsung bails, Google and Android is screwed...
pjmlp 10y ago
Most of the world isn't US. In most countries people use pre-paid devices, which get used until they die.

mjevans 10y ago

Security updates need to be for the lifetime of the /device/ through all parties. Think of it the same way you would an airbag or break recall for a car. Feature updates? Sure those can go away as the manufacturer feels like it (though they should be required to be upfront about this).

01Michael10 10y ago
Who supplies security updates for the "lifetime" of their product in your fantasy world? Three years is a good amount of time for security updates but could be extended to four years since people are keeping their phones longer these days. You are comparing software security updates to products recalled for safety issues? Well phones are already subject to recalls for hardware/battery problems. Let me know when a phone kills or hurts someone due to lack of security updates.
- danudey 10y ago
  The iPhone 5, introduced in 2012, is getting iOS 10, which means security updates into 2015. That's a five-year span, which is much longer than the average person uses their iPhone 5. iOS 9 supports the iPhone 4S and the iPad 2, which again is a five-year span (2011 to 2016). I have devices that are that old; the iPad 3 I have just prompted me to update to the latest 9.3 update, and it's so slow running newer apps that I gave it to my toddler to play games on instead. So I agree, three years is good, four years is better, but Apple is already at five years and has been for a while now.
- mjevans 10y ago
  With replacement of consumable parts (mostly batteries), I would not be surprised to see current phones in use for 10+ years. Just like desktop computers they will reach a point where, for most people, they're 'good enough', even if they're really slow. For some people, particularly the elderly, the young, and the poor, they'll use it until it literally stops working at all because they literally cannot afford otherwise. Cell phones are a literal lifeline device, to the point that emergency calls (at least in the US, and probably in any civilized part of the planet) //WILL// always work; without unlocking the phone, without the phone being on a payment plan, as long as the device has the power to transmit that distress need. It is not difficult to imagine how issues with the security portion of the layer could allow anything from a computer virus to DDoS local infrastructure (jamming), to targeting specific individuals (lock out their ability to call for help, bug and track movement), to picking out individuals that are alone and in vulnerable moments. Those are attacks I thought of just typing this comment and are not an exhaustive list. This is why the security updates either must be performed by the companies in question through the actual use lifetime of the device: not just by it's first owner, but all the way through to it's last. Or failing that, they should be required to both release the sources and provide everything necessary in a legal sense for other entities in the community to perform the security updates they are unwilling to do. Carriers should also be liable for failing to (offer to) distribute said security updates to devices on their network (it is in the interest of everyone that they do this and do not charge for it).
  - 01Michael10 10y ago
    >With replacement of consumable parts (mostly batteries... What? Most phones sold today do NOT have replaceable batteries. >For some people, particularly the elderly, the young, and the poor, they'll use it until it literally stops working at all because they literally cannot afford otherwise. One can get a new Android phone from Amazon for $50 no contract. Landlines still exist and are almost available anywhere unlike cell coverage. >Cell phones are a literal lifeline device... I could live with a dumb phone as my PC is way more important. When are we going to make Microsoft start to provide security updates to XP again? You must be like 20 years old... I hate to break it to you but no one needs a cell phone to survive. >This is why the security updates either must be performed by the companies in question through the actual use lifetime of the device... Well start writing Congress but personally I don't want my new phone to be another $50 more because the OEM is required to provide security updates for phones 5 or more years old.

tdkl 10y ago

> Google already updates their phones every month for three years For 18 months actually.

01Michael10 10y ago
I should have said up to three years but you are even more incorrect --> https://android.googleblog.com/2015/08/an-update-to-nexus-devices.html https://android.googleblog.com/2015/08/an-update-to-nexus-de...
- tdkl 10y ago
  You're right. Although those security updates have been out for a year now, so technically Google doesn't update their phones for three years yet and we're yet to see this commitment happening. Based on their track record, my confidence level isn't exactly high.

ocdtrekkie 10y ago

Google loves when people blame OEMs and carriers for bad OS design. There's no reason a security flaw in Google's code needs to go through two layers of approval by other companies to be distributed in a costly OTA distribution method. Google should control the release of fixes to it's own code. If the operating system allows otherwise, the operating system is flawed. Microsoft distributes security updates regardless of what OEM their software is installed on. With Windows 10, this is true of mobile as well. My two year old Verizon phone runs the latest official version of Windows 10 Mobile, released direct from Microsoft, at the same time as everyone else.

01Michael10 10y ago
Android OEMs love it when people keep blaming Google for phones not being updated and as long as this happens this issue will never be addressed. Do you know how open source works? Google has no control over OEM phones or the carrier approval process. Period! The only reason OEM Windows phones can be upgraded is that OEMs agree to that level of control by Microsoft. Have you ever noticed their are few Windows phone OEMs? LOL Google could try to assert this kind of control on OEMs but Samsung would bail as soon as possible for sure. They would fork AOSP or move to their own OS.
- wmf 10y ago
  Google can definitely control any phone that has Play Services installed since that requires a non-open-source license. I agree that Samsung would probably not agree to stricter control, but other OEMs probably would since they don't have any other realistic choice.
  - 01Michael10 10y ago
    No! They absolutely can not! OS updates do not come via Play services... Why can't people understand that Android is open source? An Android OEM can (and does) modify their Android distribution anyway they like UNLIKE a Windows phone OEM. The fact is any OS update directly from Google would probably brick an OEM phone not that Google can unilaterally decide to update someone else's phone anyway. Samsung bails, Google and Android is screwed...

pjmlp 10y ago

Most of the world isn't US. In most countries people use pre-paid devices, which get used until they die.