3 ms·

It is not correct to compare Android updates to iOS updates. On iOS, the bundled apps are locked to the iOS release. One of these is Safari - the only browser

It is not correct to compare Android updates to iOS updates. On iOS, the bundled apps are locked to the iOS release. One of these is Safari - the only browser allowed on iOS. So to have a current browser it is critical to update the underlying OS too. On Android, this is not the same. The apps are updated even if the OS is not; so you will have Chrome (or Firefox) in the current version, even if your vendor doesn't update the OS.

blinkingled 6y ago
Right. Newer Android versions keep adding more and more critical stuff that gets updated via the play store - ART (Android Runtime) will be a Mainline module in Android 12 that would allow Google to update it without needing a system OTA update. Chrome/System WebView have been updated via Play Store since Android 5 I think. https://source.android.com/devices/architecture/modular-system https://source.android.com/devices/architecture/modular-syst...
- foolmeonce 6y ago
  The manufacturer/google installed apps really undermine what little trust I have in Android security. If you do a normal OS update, the old version is gone. With these playstore things, ancient versions are sitting in storage waiting to be rolled back to (or probably otherwise executed with the permissions they shipped with,) since no one can be trusted to know they don't need bloatware.
908B64B197 6y ago
Assuming the app vendors still targets old stale releases. Fragmentation on Android makes it worthwhile to only test on the flagship phones with a few different version. Everywhere else is pretty much too small to be worth the effort.
simonh 6y ago
That’s better than nothing, but still pretty half arsed. To see why, here’s the latest monthly Android Security Bulletin. I count 43 of these fixes are for issues with the underlying AOSP platform, kernel and drivers. One of them is a Play Store codec update. Admittedly not all of those fixes are relevant to every device because some of them (about a dozen) are specific driver updates, but over 40 fixes in one randomly chosen monthly update isn’t trivial. This is what you lose when your device goes out of support. https://source.android.com/security/bulletin/2021-02-01 https://source.android.com/security/bulletin/2021-02-01

blinkingled 6y ago

Right. Newer Android versions keep adding more and more critical stuff that gets updated via the play store - ART (Android Runtime) will be a Mainline module in Android 12 that would allow Google to update it without needing a system OTA update. Chrome/System WebView have been updated via Play Store since Android 5 I think. https://source.android.com/devices/architecture/modular-system https://source.android.com/devices/architecture/modular-syst...

foolmeonce 6y ago
The manufacturer/google installed apps really undermine what little trust I have in Android security. If you do a normal OS update, the old version is gone. With these playstore things, ancient versions are sitting in storage waiting to be rolled back to (or probably otherwise executed with the permissions they shipped with,) since no one can be trusted to know they don't need bloatware.

908B64B197 6y ago

Assuming the app vendors still targets old stale releases. Fragmentation on Android makes it worthwhile to only test on the flagship phones with a few different version. Everywhere else is pretty much too small to be worth the effort.

simonh 6y ago

That’s better than nothing, but still pretty half arsed. To see why, here’s the latest monthly Android Security Bulletin. I count 43 of these fixes are for issues with the underlying AOSP platform, kernel and drivers. One of them is a Play Store codec update. Admittedly not all of those fixes are relevant to every device because some of them (about a dozen) are specific driver updates, but over 40 fixes in one randomly chosen monthly update isn’t trivial. This is what you lose when your device goes out of support. https://source.android.com/security/bulletin/2021-02-01 https://source.android.com/security/bulletin/2021-02-01