4 ms·

And that can be blamed back to users. Average Joe couldn't care less if his phone won't get updated so often or at all after some time. They should, but they d

And that can be blamed back to users. Average Joe couldn't care less if his phone won't get updated so often or at all after some time. They should, but they don't. Can be said about many aspects of our lives generally, humans are on average not that clever. Voting with wallet is something companies understand very well, I don't see any other fix (maybe EU could force them into something, till they find a way to skip it).

close04 6y ago
> And that can be blamed back to users. That's victim blaming. Companies are the ones who shaped this situation and they managed to because each intrinsically acts as a unified entity with a unified goal and a lot of power behind it. People may be many but have little to no individual power, and they don't act in any coordinated fashion. Users accept this because they can't really imagine it differently. Many of them never saw it working any other way. And phones never had the same kind of flexibility and repairability that PCs offer so people unwittingly assume this is normal and not even give it a second though.
- retpirato 6y ago
  Exactly. Plenty of users care, they're just powerless to do anything about. The OEM's are so big A LOT of people would have to outright boycott them to make any difference, but even then where are the going to go? ALL OEMs do this, so customers really have no choice in the matter.
arsome 6y ago
Honestly, the users are right here - look at the history of this one, there's millions of dated Android devices out there lacking years of security patches, but do they get exploited? Not in any significant number certainly, there haven't been any wildly successful Android worms like we've seen on Windows even in recent years. The nature of sitting behind NATs, implementation of modern exploit mitigations in even older versions of Android, the diversity of devices, installation only via a marketplace, sandboxing and being able to rapidly update apps like browsers and email clients that do interact with network services makes those big OS-level exploits almost entirely unimportant. The Average Joe has limited reason to care even if they stop getting security updates.
- scarface74 6y ago
  In 2020, I’m kind of amazed to hear you say that NAT is a mitigation for security exploits. “NAT is not a firewall” has been a mantra for at least 20 years. This is just one exploit that can’t be patched by the app level and is dependent on the OEM. https://threatpost.com/mediatek-bug-actively-exploited-android/153408/ https://threatpost.com/mediatek-bug-actively-exploited-andro...

close04 6y ago

> And that can be blamed back to users. That's victim blaming. Companies are the ones who shaped this situation and they managed to because each intrinsically acts as a unified entity with a unified goal and a lot of power behind it. People may be many but have little to no individual power, and they don't act in any coordinated fashion. Users accept this because they can't really imagine it differently. Many of them never saw it working any other way. And phones never had the same kind of flexibility and repairability that PCs offer so people unwittingly assume this is normal and not even give it a second though.

retpirato 6y ago
Exactly. Plenty of users care, they're just powerless to do anything about. The OEM's are so big A LOT of people would have to outright boycott them to make any difference, but even then where are the going to go? ALL OEMs do this, so customers really have no choice in the matter.

arsome 6y ago

Honestly, the users are right here - look at the history of this one, there's millions of dated Android devices out there lacking years of security patches, but do they get exploited? Not in any significant number certainly, there haven't been any wildly successful Android worms like we've seen on Windows even in recent years. The nature of sitting behind NATs, implementation of modern exploit mitigations in even older versions of Android, the diversity of devices, installation only via a marketplace, sandboxing and being able to rapidly update apps like browsers and email clients that do interact with network services makes those big OS-level exploits almost entirely unimportant. The Average Joe has limited reason to care even if they stop getting security updates.

scarface74 6y ago
In 2020, I’m kind of amazed to hear you say that NAT is a mitigation for security exploits. “NAT is not a firewall” has been a mantra for at least 20 years. This is just one exploit that can’t be patched by the app level and is dependent on the OEM. https://threatpost.com/mediatek-bug-actively-exploited-android/153408/ https://threatpost.com/mediatek-bug-actively-exploited-andro...