6 ms·

There are only a tiny handful of Android phone models that get security patches after 2–3 years are up, and they are generally rather expensive phones. Sometime

There are only a tiny handful of Android phone models that get security patches after 2–3 years are up, and they are generally rather expensive phones. Sometimes phones are supported for longer by LineageOS, but the LineageOS devs emphasize that they are only a group of hobbyists, they don't work for you, and they can drop support for a phone any time they want (because they e.g. lost their phone of that model, or simply lost interest).

lotsofpulp 6y ago
That's still not every year though.
- ajyotirmay 6y ago
  I don't think so
- Mediterraneo10 6y ago
  It could be. I have twice been burned by LineageOS. I wanted a deGoogled Android phone, but the only LineageOS-supported models that were available in my region, and which I could afford, had been initially released already 1.5–2 years before. Not only was my new phone soon abandoned by the manufacturer, it was also suddenly dropped by LineageOS after only about a year of my owning it. The prospect of truly long-term support for years and years is one reason I bought a PinePhone and have been keeping track of its development. But sadly the current PinePhone has too ancient and underpowered a CPU to be useful.
DyslexicAtheist 6y ago
guess the reasoning is that there is a lot less attack surface when used in a way where number of apps is reduced to 2-3 (I have such a set-up and for my purpose even an older non-smart motorola flip phone would do the trick). as soon as I want to do video calls at reasonable speeds, it's probably in my interest to have moderately new hardware and chipsets supporting things like beamforming or other things that only more recent hardware can give me. but even here my 8 yro phone does everything I want it to so that argument kicks only in for truly ancient hardware (e.g. LTE support etc)
Solvitieg 6y ago
Many people I know, who are much smarter than me, keep their Android phones for 3, 4, 5 years. So I'm not sure this is an issue.
- andor 6y ago
  It's totally an issue. There have been tons of critical Android vulnerabilities over the last years that cannot be fixed by app updates, e.g. remote code execution via Bluetooth stack or MMS.
  - marshmallow_12 6y ago
    are there really people hunting around preying on old, vulnerable Androids? The argument is, there are too few of them for any serious actor to waste time trying to hack one. It's just not worth it. This makes them pretty secure, for the simple reason they are ignored. Obviously old Androids are only scarce because the general population keep buying the latest. They are essentially a buffer zone to protect the Hackers..
    - blaser-waffle 6y ago
      > are there really people hunting around preying on old, vulnerable Androids? Yes. Because like windows the ecosystem is huge, and there are plenty of grandmas who don't know how or why to update things. Much of the world can't afford to replace their phone every 2 years.
    - andor 6y ago
      Yes. There are active Android malware campaigns sending out links via text message. I know because I recently received one.
lostmsu 6y ago
Right now you can get vanilla Android on most recent devices, same image for all of them thanks for the Treble project, that separated kernel and hardware drivers from Android system. https://github.com/phhusson/treble_experimentations https://github.com/phhusson/treble_experimentations
bserge 6y ago
Here's something horrifying for you. I ran Android 5.x with updates blocked for 5 years, and even now that phone works unchanged! I also disable Spectre/Meltdown mitigations in Windows and undervolt my processors! I have no antivirus! I don't lock my door at night and my dog is going deaf with old age! Oooh, even I shudder when reading that! :D
- coldtea 6y ago
  It's all fun and games until you get some huge charges in your credit card, or your bank details leaked, or some fraud is commited in your name with you details and everything...
  - nightowl_games 6y ago
    After the Target credit card leak and the Equifax leak it really doesn't matter anymore. Besides, Visa typically just refunds you. It's really about someone taking an undetected loan out in your name, credit card fraud is not a big deal to the regular consumer anymore.
    - blaser-waffle 6y ago
      If you really believe that give me your social security number and credit card details. I won't do anything with em, pinky-promise, but if something did happen, it doesn't matter, right? Just talk to Visa. Like, why lock my car and house doors when insurance will pay for it?
      - photojosh 6y ago
        > Like, why lock my car and house doors when insurance will pay for it? Because you'll have a really hard time with a claim if there's no sign of forced entry, since many insurance policies are void in this situation?
      - jjav 6y ago
        > Just talk to Visa. Yes, just call them. By regulation, you're not liable for unauthorized use of credit card (specifically, credit card). As a consumer you have zero concerns about card theft.
M277 6y ago
I keep hearing this argument but I don't understand it. What does not having security patches do? I am using an HTC Desire 826 from 2016 running Android 6, while my father is using a Galaxy Note 3 Neo running Android 4.3. I personally don't have much issues with regards to not having security patches.. the phone itself does most of what I want, although I am having issues with other things unrelated to security patches -- it's getting a bit sluggish, the 16GB storage does get annoying, and the battery barely lasts two hours of web browsing. Also, it no longer accepts SIM cards for whatever reason. But it's not a big deal to warrant spending money (I don't get called at all and I do have a dumb phone that I go out with for emergencies. Besides, I no longer get annoying messages and calls from my carrier) Similarly, my father's is doing alright, and the issues he is facing are unrelated to security patches -- many apps don't support Android versions older than 6.. some of them are essential things like Google stuff. YouTube and Gmail for instance outright don't work, and Chrome occasionally brings up messages along the lines of "Please update your Chrome version". But nothing is caused by not having security patches. What am I missing? This is a genuine question.
- yjftsjthsd-h 6y ago
  That you have not noticed problems as a result of not having security problems doesn't mean that there aren't problems, and doesn't mean that there won't be problems. Maybe you've lucked out and haven't actually gotten malware yet, and maybe tomorrow you open your phone to a ransomware message, or maybe you've had spyware for 3 months and just not noticed.
  - M277 6y ago
    Good point, but wouldn't there have been more pressure on the OEMs to increase security patch support if this were a widespread issue? Because most do 2 - 3 years.
boring_twenties 6y ago
If I'm not mistaken, LineageOS support is good but not good enough. Vulnerabilities in the higher level Android system will be fixed, but updates to the kernel must be provided by the vendor on many (most? all?) devices.
- heavyset_go 6y ago
  This is true. Most Android devices run forked kernels supplied by manufacturers. Once the manufacturers stop updating the kernel, the device is stuck using the old kernel forever. I have several phones running LineageOS that I use as remotes for my TVs, and they'll never see a kernel beyond the 3.x fork the manufacturers released 5+ years ago. This issue is indicative of the larger problem ARM SoCs pose to consumers: manufacturers choose not to design ARM boards with SBSA-like features[1] because it's cheaper to do so. While x86 machines have enumerable buses for hardware discovery, as well as ACPI support, ARM SoCs don't. As a result, mainline Linux kernels won't boot on them, they require a kernel fork, and a kernel fork must be maintained. Manufacturers have no incentive to maintain that fork for more than a year or two. As ARM SoCs take over what are considered general purpose computing devices, like laptops, devices that we once thought of as being upgradable, software-wise, suddenly aren't. Apple's M1 Macs are an example of this. To get Linux running on them is a massive undertaking, and running Linux on them in the long-term means relying on a third party to build and maintain M1-specific images in perpetuity, because the SoCs can't run the generic ARM images that ARM servers can run. There are mitigations against this problem in Linux, like Device Tree[2] support, but that is only one small part of the big[2] undertaking when it comes to porting Linux to ARM SoCs. [1] https://en.wikipedia.org/wiki/Server_Base_System_Architecture https://en.wikipedia.org/wiki/Server_Base_System_Architectur... [2] https://en.wikipedia.org/wiki/Device_tree https://en.wikipedia.org/wiki/Device_tree [3] https://elinux.org/images/a/ad/Arm-soc-checklist.pdf https://elinux.org/images/a/ad/Arm-soc-checklist.pdf

lotsofpulp 6y ago

That's still not every year though.

ajyotirmay 6y ago
I don't think so
Mediterraneo10 6y ago
It could be. I have twice been burned by LineageOS. I wanted a deGoogled Android phone, but the only LineageOS-supported models that were available in my region, and which I could afford, had been initially released already 1.5–2 years before. Not only was my new phone soon abandoned by the manufacturer, it was also suddenly dropped by LineageOS after only about a year of my owning it. The prospect of truly long-term support for years and years is one reason I bought a PinePhone and have been keeping track of its development. But sadly the current PinePhone has too ancient and underpowered a CPU to be useful.

DyslexicAtheist 6y ago

guess the reasoning is that there is a lot less attack surface when used in a way where number of apps is reduced to 2-3 (I have such a set-up and for my purpose even an older non-smart motorola flip phone would do the trick). as soon as I want to do video calls at reasonable speeds, it's probably in my interest to have moderately new hardware and chipsets supporting things like beamforming or other things that only more recent hardware can give me. but even here my 8 yro phone does everything I want it to so that argument kicks only in for truly ancient hardware (e.g. LTE support etc)

Solvitieg 6y ago

Many people I know, who are much smarter than me, keep their Android phones for 3, 4, 5 years. So I'm not sure this is an issue.

andor 6y ago
It's totally an issue. There have been tons of critical Android vulnerabilities over the last years that cannot be fixed by app updates, e.g. remote code execution via Bluetooth stack or MMS.
- marshmallow_12 6y ago
  are there really people hunting around preying on old, vulnerable Androids? The argument is, there are too few of them for any serious actor to waste time trying to hack one. It's just not worth it. This makes them pretty secure, for the simple reason they are ignored. Obviously old Androids are only scarce because the general population keep buying the latest. They are essentially a buffer zone to protect the Hackers..
  - blaser-waffle 6y ago
    > are there really people hunting around preying on old, vulnerable Androids? Yes. Because like windows the ecosystem is huge, and there are plenty of grandmas who don't know how or why to update things. Much of the world can't afford to replace their phone every 2 years.
  - andor 6y ago
    Yes. There are active Android malware campaigns sending out links via text message. I know because I recently received one.

lostmsu 6y ago

Right now you can get vanilla Android on most recent devices, same image for all of them thanks for the Treble project, that separated kernel and hardware drivers from Android system. https://github.com/phhusson/treble_experimentations https://github.com/phhusson/treble_experimentations

bserge 6y ago

Here's something horrifying for you. I ran Android 5.x with updates blocked for 5 years, and even now that phone works unchanged! I also disable Spectre/Meltdown mitigations in Windows and undervolt my processors! I have no antivirus! I don't lock my door at night and my dog is going deaf with old age! Oooh, even I shudder when reading that! :D

coldtea 6y ago
It's all fun and games until you get some huge charges in your credit card, or your bank details leaked, or some fraud is commited in your name with you details and everything...
- nightowl_games 6y ago
  After the Target credit card leak and the Equifax leak it really doesn't matter anymore. Besides, Visa typically just refunds you. It's really about someone taking an undetected loan out in your name, credit card fraud is not a big deal to the regular consumer anymore.
  - blaser-waffle 6y ago
    If you really believe that give me your social security number and credit card details. I won't do anything with em, pinky-promise, but if something did happen, it doesn't matter, right? Just talk to Visa. Like, why lock my car and house doors when insurance will pay for it?
    - photojosh 6y ago
      > Like, why lock my car and house doors when insurance will pay for it? Because you'll have a really hard time with a claim if there's no sign of forced entry, since many insurance policies are void in this situation?
    - jjav 6y ago
      > Just talk to Visa. Yes, just call them. By regulation, you're not liable for unauthorized use of credit card (specifically, credit card). As a consumer you have zero concerns about card theft.

M277 6y ago

I keep hearing this argument but I don't understand it. What does not having security patches do? I am using an HTC Desire 826 from 2016 running Android 6, while my father is using a Galaxy Note 3 Neo running Android 4.3. I personally don't have much issues with regards to not having security patches.. the phone itself does most of what I want, although I am having issues with other things unrelated to security patches -- it's getting a bit sluggish, the 16GB storage does get annoying, and the battery barely lasts two hours of web browsing. Also, it no longer accepts SIM cards for whatever reason. But it's not a big deal to warrant spending money (I don't get called at all and I do have a dumb phone that I go out with for emergencies. Besides, I no longer get annoying messages and calls from my carrier) Similarly, my father's is doing alright, and the issues he is facing are unrelated to security patches -- many apps don't support Android versions older than 6.. some of them are essential things like Google stuff. YouTube and Gmail for instance outright don't work, and Chrome occasionally brings up messages along the lines of "Please update your Chrome version". But nothing is caused by not having security patches. What am I missing? This is a genuine question.

yjftsjthsd-h 6y ago
That you have not noticed problems as a result of not having security problems doesn't mean that there aren't problems, and doesn't mean that there won't be problems. Maybe you've lucked out and haven't actually gotten malware yet, and maybe tomorrow you open your phone to a ransomware message, or maybe you've had spyware for 3 months and just not noticed.
- M277 6y ago
  Good point, but wouldn't there have been more pressure on the OEMs to increase security patch support if this were a widespread issue? Because most do 2 - 3 years.

boring_twenties 6y ago

If I'm not mistaken, LineageOS support is good but not good enough. Vulnerabilities in the higher level Android system will be fixed, but updates to the kernel must be provided by the vendor on many (most? all?) devices.

heavyset_go 6y ago
This is true. Most Android devices run forked kernels supplied by manufacturers. Once the manufacturers stop updating the kernel, the device is stuck using the old kernel forever. I have several phones running LineageOS that I use as remotes for my TVs, and they'll never see a kernel beyond the 3.x fork the manufacturers released 5+ years ago. This issue is indicative of the larger problem ARM SoCs pose to consumers: manufacturers choose not to design ARM boards with SBSA-like features[1] because it's cheaper to do so. While x86 machines have enumerable buses for hardware discovery, as well as ACPI support, ARM SoCs don't. As a result, mainline Linux kernels won't boot on them, they require a kernel fork, and a kernel fork must be maintained. Manufacturers have no incentive to maintain that fork for more than a year or two. As ARM SoCs take over what are considered general purpose computing devices, like laptops, devices that we once thought of as being upgradable, software-wise, suddenly aren't. Apple's M1 Macs are an example of this. To get Linux running on them is a massive undertaking, and running Linux on them in the long-term means relying on a third party to build and maintain M1-specific images in perpetuity, because the SoCs can't run the generic ARM images that ARM servers can run. There are mitigations against this problem in Linux, like Device Tree[2] support, but that is only one small part of the big[2] undertaking when it comes to porting Linux to ARM SoCs. [1] https://en.wikipedia.org/wiki/Server_Base_System_Architecture https://en.wikipedia.org/wiki/Server_Base_System_Architectur... [2] https://en.wikipedia.org/wiki/Device_tree https://en.wikipedia.org/wiki/Device_tree [3] https://elinux.org/images/a/ad/Arm-soc-checklist.pdf https://elinux.org/images/a/ad/Arm-soc-checklist.pdf