4 ms·
Literally the only reason I stopped using my last two phones was that the security updates stopped streaming in. Even now they sit in a drawer, perfectly functi
by tlhunter 5y ago
Literally the only reason I stopped using my last two phones was that the security updates stopped streaming in. Even now they sit in a drawer, perfectly functional, abandoned by Google.
- e40 5y agoIt's one of the reasons I moved from Google to Apple. iPhones 5-6 yrs old still supported. I always thought iPhones were too expensive, but I didn't take into account the upgrade cost every 2 yrs on Android.
- elboru 5y agoSame here, I bought my first iPhone almost 4 years ago. It still works like the first day. I used to like constant change (installing different roms, customizing my phone, waiting for the next cool Android UI refresh, switching phones every 2 years etc). But as I get older I started to like consistency and the feeling of using my phone for years without thinking too much about updates and whether I would get them or not.
- baq 5y agosame here. turns out an iphone 8 is a damn good phone today and I expect the new iphone se to be the TCO-wise budget choice.
- opan 5y agoThis seems backwards to me. You can still run modern Android versions on old phones like the OnePlus One thanks to LineageOS. There is no custom ROM scene for iOS devices.
- fuzzy2 5y agoExcept you cannot. The graphics driver of my Nexus 5 no longer receives updates. It is not compatible with newer Android versions. And… that's it. Just like that, no more updates. Less than two years after I bought it.
- h4waii 5y agoThere are numerous open source builds of AOSP forks for the Nexus 5, including LineageOS. Yeah, you're not gonna get baseband / blob / firmware updates or security patches outside of platform, but the damn thing is 8 years old.
- fuzzy2 5y agoThe Nexus 5 issue was just an example. Even phone makers are totally dependent on Qualcomm etc. providing drivers and maybe updates to those drivers. It's not like you can just hack updates together yourself. Not always anyway.
- techrat 5y agoShow me one exploit in the wild that you would download from Google Play or be affected by using an updated Google Chrome from the Play Store. Just because security updates stop doesn't mean your device is immediately insecure and cannot be safely used. The majority of the phone's actual updates come through Google Play Services. Meanwhile, I can show you an exploit in the wild that affects virtually all iOS devices even though they're regularly patched up: Jailbreak methods and iMessage zero clicks.
- chipotle_coyote 5y agoThere was a six-part series on Google's Project Zero blog at the start of this year called the "In-the-Wild Series" which included Chrome and Android exploits. In May, Ars Technica had a post called "4 vulnerabilities under attack give hackers full control of Android devices" which detailed more exploits Project Zero had found -- there were actually 50 in the Android security bulletin that month, four of which were zero-day exploits explicitly described as "exploited in the wild" by a Google researcher. I'm not going to argue that iOS is some super secure fortress of impenetrableness, or that Android is some kind of digital petri dish that becomes immediately infected with the 500 Viruses of Bartholomew Cubbins the moment it connects to wifi. But there are Android exploits documented routinely, some of them are serious, and some of them have been found in the wild.
- techrat 5y agoI'll make it easier for you. I have a Nubia phone which runs Pie. Its last security patch is dated August 5th, 2019. Play Services and Chrome are fully updated. Where is there an in the wild exploit that you can point me to? Proof of concept or otherwise. I'll happily load it up in Chrome on my phone and let it compromise my system. Meanwhile there's a zero click iMessage exploit article still on the first page of HN.
- BugsJustFindMe 5y agoWhat gives you the impression that Android security updates only involve Play Services and Chrome as opposed to the file system, bluetooth, wifi, CPU, and GPU stacks, or anything else? Do you have a reason for believing that any of the numerous drive-by Android remote code execution CVEs published since August 2019 can be mitigated without updating any of the vendor and kernel components that Google had to update to stop them? Let's ask ourselves this basic question: If Play Services and Chrome could keep an Android Pie system secure, why does Google bother with a separate security patch date? > Meanwhile there's a zero click iMessage exploit article still on the first page of HN. Maybe because it's news and critical Android remote exploits are found often enough to not be news.
- b0ner_t0ner 5y agoTry Xiaomi, we bought a MiPad 2 and it was EOL after 6-months.
- neop1x 5y agoYou should not buy a cheap device from a manufacturer with bad SW update reputation. Look at Samsung Galaxy S7 Edge - 5 years old device: - Released with Android 6.0.1. - Received 7.0 and 8.0 major updates. - Has unofficial 11 support. - Received September 2020 security update. Cheap device manufacturers unable or unwilling to support software updates should be banned by law. It should be a part of their job. Instead, they often seem to release one "proof-of-work" initial release and then don't care and work on the the next model to repeat the same. Pretty sad.