15 ms·

Kudos to Google for doing this but this could be even more effective if Google committed to say, 15 years of security updates or something along those lines.

runnerup 5y ago
A bit extreme but I empathize your position. I’m okay with the PalmOS phones from 2005 not working anymore. Their 2G/EDGE data doesn’t work and the Wi-Fi standard they used aren’t compatible with anything anymore either. Not to mention they were incredibly slow and unwieldy even when they were new.
- yjftsjthsd-h 5y ago
  On the other hand, my desktop is from 2011 and it works fine and Linux happily supports it; 15 years isn't that impractical any more. As time goes on, the pace of change slows and longer life is reasonable; early Android devices may well have been genuinely obsolete inside a year, but current devices aren't even that slow after 4-5 years.
  - kllrnohj 5y ago
    For current phones I think 5 years is a good support window, the batteries don't last much longer than that. But if replaceable batteries make a comeback (and I hope they do with the push from the EU), then I definitely agree that more like 10 years should be demanded as reasonable. Especially for something like Android where if you compare a flagship from 5-7 years ago with a brand new Android Go phone the level of performance & feature set is not really that different. So it's not like the OS gets to actually start expecting things like a high end Vulkan capable GPU & neural net accelerators or anything. It still has to work with what is essentially old hardware anyway just in a brand new body.
    - saidinesh5 5y ago
      Batteries and flash storage too wears off on modern day phones imo. So anything beyond 5 years is asking for a lot on a typical smartphone where people share lots of memes and videos everyday.
      - nielsole 5y ago
        Replacing flash chips is probably not beyond the local repair shops capabilities.
    - shard 5y ago
      I gave my tween kid a Galaxy S8 (released 2017) recently and it suites her needs fine. I'd prefer if I don't have to upgrade her phone for another 2-3 years. I'm having trouble finding an Android Go phone released this year, the most recent I can find are from 2020, like the Nokia 1.3. Compared with the Galaxy S8, the Nokia has a lower rez camera, less RAM, lower quality build, lower quality display, lower spec SoC, no biometrics, and no fast charge. Perhaps there are higher spec'd Android Go phones, but at least a 3-year-gap is not enough to overcome the premium-vs-entry-phone tier difference.
    - Wowfunhappy 5y ago
      I’ve had a shop replace the battery in my iPhone 6S three times, for ~$50 each time. The batteries aren’t user replaceable, but they are absolutely replaceable.
      - zerof1l 5y ago
        More accurately, the batteries are replaceable, it's just that Apple designed the phone and battery in such a way that replacing it for a regular consumer is too much. You can still replace it yourself, but then you can void your warranty.
        GeekyBear 5y ago
        >Apple designed the phone and battery in such a way that replacing it for a regular consumer is too much It's pretty easy to find videos showing you how to replace those batteries. >Jerry Rig Everything: iPhone 6S Battery Replacement in 3 minutes (Easy Method) https://www.youtube.com/watch?v=0ZBQO1-kQTQ https://www.youtube.com/watch?v=0ZBQO1-kQTQ
  - cjsplat 5y ago
    "my desktop is from 2011 and it works fine" Nope - you just think it does. It has been spectre'ed and friends to oblivion. I don't know if security support horizons are going to expand as CPU manufacturers clean up their hardware, but the rear view mirror is a support permutation nightmare.
    - yjftsjthsd-h 5y ago
      I... promise it does. I mean yeah, it can't run untrusted programs at the same speed as before, but it's still perfectly serviceable. And since it can run mainline Linux, it will continue to get those security mitigations with or without the manufacturer helping.
      - aaaaaaaaata 5y ago
        Most people don't think fine == it simply does the stuff I ask. Baseline security is a part of many people's requirements.
    - Melatonic 5y ago
      Hasnt that been mitigated with firmware updates and OS patches? I know I isntalled both specifically for Spectre mitigation and it slowed down certain things that I thankfully do not use much. My CPU and Mobo are from 2014
      - aaaaaaaaata 5y ago
        Not...well.
      - pabs3 5y ago
        Systems and CPUs that old don't get microcode/BIOS updates any more.
    - throwaway81523 5y ago
      Spectre is a serious concern for virtualization hosts. For a single user desktop, if you're running hostile code that's going to carry out a spectre attack, you are already pwned, so spectre vulnerability is just frosting.
  - foresto 5y ago
    For some of us, it's not impractical at all. I have hardware from about that time (plus a six-year-old GPU) that plays many modern games. The 1-5 year upgrade cycles that so many companies are pushing seem criminally wasteful to me.
    - yjftsjthsd-h 5y ago
      It depends what happens to the hardware when they offload it. I'm 100% on board with companies rotating their machines out every few years and selling them to the second-hand market (because that's how I get good hardware at great prices:D). So long as everyone just sells old stuff off, by the time a machine actually gets thrown out for good it can have had a decade+ of life across owners, and everyone along the way got it for cheap.
      - foresto 5y ago
        Few tech manufacturers support reuse in any meaningful way, and I seldom see it in practice. While I'm glad you've managed to include it in your own life, my comment was about the bigger picture. I think we can and should do a lot better as a society.
  - dangus 5y ago
    The desktop computer was a much more mature piece of tech by 2011. If you were in 2011 you couldn’t really say the same about a desktop computer from 2000. You’d be comparing a 2/4/6/8 core 64-bit processor to a NetBurst Pentium 4. I think it’s reasonable that relatively young phones aren’t usable at this point in time. But maybe in 2030 I might expect to be able to keep using a phone from 2020, assuming I’ve replaced the battery.
- nescioquid 5y ago
  Consider what consumer technology might look like if products were designed with this sort of time horizon in the first place. I'd expect hardware to be more generally upgradeable/repairable extending its service life and at the very least I would not expect to see products assembled by drowning them in glue. It feels to me like the generational difference in hardware products has been flattening out so 15 years may not be an outrageous practical service life, really.
- Teknoman117 5y ago
  I would be fine with Google dropping support, but they should at least let us run a mainline Linux kernel or something on them so that if people want to keep providing support after Google drops them we can. That behavior is the only reason that 15+ year old machines can still run current Linux. There's at least someone out there interested in keeping them working.
  - floatboth 5y ago
    Snapdragon 845 and 855 mainlining is going pretty well. e.g.: https://fosdem.org/2022/schedule/event/mobile_kernel_snapdragon_845/ https://fosdem.org/2022/schedule/event/mobile_kernel_snapdra...
unmole 5y ago
> 15 years of security updates How much do you think that will add to the cost of a product? Software engineers are not cheap.
- dmm 5y ago
  My 14yo Thinkpad x200 still gets security updates. Why is the situation for mobile devices so different?
  - unmole 5y ago
    Honest question: What security updates does a ThinkPad get?
    - yjftsjthsd-h 5y ago
      While the Linux answer is also accurate, ThinkPads in particular also have good coreboot/libreboot support such that much of the firmware can also be kept up to date.
    - ticviking 5y ago
      Anything in the Linux Kernel
      - unmole 5y ago
        That is really not the same thing.
        pjerem 5y ago
        Yes it totally is. PCs are the proof that manufacturers don’t have to push security updates for decades. But in the phone world, they would have to because they don’t want to open the platform. So the user is dependent on the manufacturer for updates. But it don’t have to be like that.
        deleted 5y ago
owly 5y ago
This seems reasonable. Ask for 15 and maybe get 5!
mrtksn 5y ago
This sounds extreme at first but if you had to support 15 years of security updates, how would you do it? What is the necessary human resources and structure to pull this off?
- jewel 5y ago
  I've got a laptop from 2004 that still works fine. It has 1.5 GB of RAM and a spinning 60GB hard drive. It runs the latest Xubuntu, which is getting security updates. Android should take a similar path. Mainline the kernel drivers, keep the minimum system requirements low (which you'll want to do anyway for 3rd world handsets), add developer modes to test apps with constrained RAM and throttled CPU, rank "eco-friendly" apps that have lower storage requirements higher on the play store. As far as the human resources required, see Ubuntu or Redhat Enterprise, which manage to do ten year support cycles for servers. I think handsets could be easier if you keep upgrading the kernel and core components instead of only applying security updates to the existing software. If you can do that then there's no more security work than you would otherwise be doing, since your latest handsets would need those security updates too.
- StillBored 5y ago
  Abstract the hardware platform from the OS and applications. You know, like pretty much every operating system except linux on arm. Everyone complains about having to install drivers on windows, but having a driver ABI is largely how one can expect 10+ years of OS updates without any particular engineering work. The OS and applications get updated and as long as they maintain the driver API the graphics drivers, network drivers, etc all continue to work. Once in a while you have to go back and revisit this stuff, but drivers themselves are rarely sources of exploits because they exist below all the userspace interaction shielded by the kernel, and on the HW side tend to be little more than shims to forward data/packets/etc from the HW to the OS.
  - kllrnohj 5y ago
    > You know, like pretty much every operating system except linux on arm. Android is Linux on ARM but it also abstracts the hardware platform from the OS & apps, that's the whole "Project Treble" thing Google was talking about a few years back. https://android-developers.googleblog.com/2017/05/here-comes-treble-modular-base-for.html https://android-developers.googleblog.com/2017/05/here-comes... But that's the easy non-answer. Abstractions can't add features. Like Windows 11 dropped support for old hardware not because the right abstractions weren't in place, but because you can't add things like a TPM in software. It needs full stack support. Similarly if it turns out a device driver had a bug in its implementation of the interface, you're kinda stuck with that. And the workaround may or may not be reasonable to put up with, if a workaround exists at all.
amir734jj 5y ago
My pixel 3 motherboard died suddenly last year. Unfortunately, I am too deep into google services/devices that I can't switch. But I don't think pixel phones are designed to last over 5 years. It's not matter of parts; they are just not designed for >5 years of use/abuse.
- neogodless 5y ago
  I'm trying to imagine what I would have to be using my phone for such that I could not switch away from the Google brand of smartphones to an alternative. Could you illuminate me?
  - amir734jj 5y ago
    20+ nest cameras (multiple homes) + Google docs (collaboration) + Google photos (tons of family photos)
    - andbberger 5y ago
      you know you can use google products on ios right
    - neogodless 5y ago
      But what about the Google brand of smartphone is proprietary, and prevents you from using other Android smartphones?
    - rootusrootus 5y ago
      I have no problem with any of those on my iOS devices.
- wlesieutre 5y ago
  They've already pulled the plug on Pixel 3 security updates, so you wouldn't have wanted to keep using it anyway (without switching to LineageOS or similar at least). They delivered three years of updates as promised and after that it's a security risk. You know Google apps are available on iOS as well as other Android phone though, right?
pabs3 5y ago
Are there any operating system vendors who support their releases for 15 years? I think RedHat is like 10 years? There is CIP that is longer term though. https://www.cip-project.org/ https://www.cip-project.org/
aaaaaaaaata 5y ago
They don't even consider the chips and design they were putting out 3-5 years ago as adequately secure. Hard to tell them they're wrong.

runnerup 5y ago

A bit extreme but I empathize your position. I’m okay with the PalmOS phones from 2005 not working anymore. Their 2G/EDGE data doesn’t work and the Wi-Fi standard they used aren’t compatible with anything anymore either. Not to mention they were incredibly slow and unwieldy even when they were new.

yjftsjthsd-h 5y ago
On the other hand, my desktop is from 2011 and it works fine and Linux happily supports it; 15 years isn't that impractical any more. As time goes on, the pace of change slows and longer life is reasonable; early Android devices may well have been genuinely obsolete inside a year, but current devices aren't even that slow after 4-5 years.
- kllrnohj 5y ago
  For current phones I think 5 years is a good support window, the batteries don't last much longer than that. But if replaceable batteries make a comeback (and I hope they do with the push from the EU), then I definitely agree that more like 10 years should be demanded as reasonable. Especially for something like Android where if you compare a flagship from 5-7 years ago with a brand new Android Go phone the level of performance & feature set is not really that different. So it's not like the OS gets to actually start expecting things like a high end Vulkan capable GPU & neural net accelerators or anything. It still has to work with what is essentially old hardware anyway just in a brand new body.
  - saidinesh5 5y ago
    Batteries and flash storage too wears off on modern day phones imo. So anything beyond 5 years is asking for a lot on a typical smartphone where people share lots of memes and videos everyday.
    - nielsole 5y ago
      Replacing flash chips is probably not beyond the local repair shops capabilities.
  - shard 5y ago
    I gave my tween kid a Galaxy S8 (released 2017) recently and it suites her needs fine. I'd prefer if I don't have to upgrade her phone for another 2-3 years. I'm having trouble finding an Android Go phone released this year, the most recent I can find are from 2020, like the Nokia 1.3. Compared with the Galaxy S8, the Nokia has a lower rez camera, less RAM, lower quality build, lower quality display, lower spec SoC, no biometrics, and no fast charge. Perhaps there are higher spec'd Android Go phones, but at least a 3-year-gap is not enough to overcome the premium-vs-entry-phone tier difference.
  - Wowfunhappy 5y ago
    I’ve had a shop replace the battery in my iPhone 6S three times, for ~$50 each time. The batteries aren’t user replaceable, but they are absolutely replaceable.
    - zerof1l 5y ago
      More accurately, the batteries are replaceable, it's just that Apple designed the phone and battery in such a way that replacing it for a regular consumer is too much. You can still replace it yourself, but then you can void your warranty.
      - GeekyBear 5y ago
        >Apple designed the phone and battery in such a way that replacing it for a regular consumer is too much It's pretty easy to find videos showing you how to replace those batteries. >Jerry Rig Everything: iPhone 6S Battery Replacement in 3 minutes (Easy Method) https://www.youtube.com/watch?v=0ZBQO1-kQTQ https://www.youtube.com/watch?v=0ZBQO1-kQTQ
- cjsplat 5y ago
  "my desktop is from 2011 and it works fine" Nope - you just think it does. It has been spectre'ed and friends to oblivion. I don't know if security support horizons are going to expand as CPU manufacturers clean up their hardware, but the rear view mirror is a support permutation nightmare.
  - yjftsjthsd-h 5y ago
    I... promise it does. I mean yeah, it can't run untrusted programs at the same speed as before, but it's still perfectly serviceable. And since it can run mainline Linux, it will continue to get those security mitigations with or without the manufacturer helping.
    - aaaaaaaaata 5y ago
      Most people don't think fine == it simply does the stuff I ask. Baseline security is a part of many people's requirements.
  - Melatonic 5y ago
    Hasnt that been mitigated with firmware updates and OS patches? I know I isntalled both specifically for Spectre mitigation and it slowed down certain things that I thankfully do not use much. My CPU and Mobo are from 2014
    - aaaaaaaaata 5y ago
      Not...well.
    - pabs3 5y ago
      Systems and CPUs that old don't get microcode/BIOS updates any more.
  - throwaway81523 5y ago
    Spectre is a serious concern for virtualization hosts. For a single user desktop, if you're running hostile code that's going to carry out a spectre attack, you are already pwned, so spectre vulnerability is just frosting.
- foresto 5y ago
  For some of us, it's not impractical at all. I have hardware from about that time (plus a six-year-old GPU) that plays many modern games. The 1-5 year upgrade cycles that so many companies are pushing seem criminally wasteful to me.
  - yjftsjthsd-h 5y ago
    It depends what happens to the hardware when they offload it. I'm 100% on board with companies rotating their machines out every few years and selling them to the second-hand market (because that's how I get good hardware at great prices:D). So long as everyone just sells old stuff off, by the time a machine actually gets thrown out for good it can have had a decade+ of life across owners, and everyone along the way got it for cheap.
    - foresto 5y ago
      Few tech manufacturers support reuse in any meaningful way, and I seldom see it in practice. While I'm glad you've managed to include it in your own life, my comment was about the bigger picture. I think we can and should do a lot better as a society.
- dangus 5y ago
  The desktop computer was a much more mature piece of tech by 2011. If you were in 2011 you couldn’t really say the same about a desktop computer from 2000. You’d be comparing a 2/4/6/8 core 64-bit processor to a NetBurst Pentium 4. I think it’s reasonable that relatively young phones aren’t usable at this point in time. But maybe in 2030 I might expect to be able to keep using a phone from 2020, assuming I’ve replaced the battery.
nescioquid 5y ago
Consider what consumer technology might look like if products were designed with this sort of time horizon in the first place. I'd expect hardware to be more generally upgradeable/repairable extending its service life and at the very least I would not expect to see products assembled by drowning them in glue. It feels to me like the generational difference in hardware products has been flattening out so 15 years may not be an outrageous practical service life, really.
Teknoman117 5y ago
I would be fine with Google dropping support, but they should at least let us run a mainline Linux kernel or something on them so that if people want to keep providing support after Google drops them we can. That behavior is the only reason that 15+ year old machines can still run current Linux. There's at least someone out there interested in keeping them working.
- floatboth 5y ago
  Snapdragon 845 and 855 mainlining is going pretty well. e.g.: https://fosdem.org/2022/schedule/event/mobile_kernel_snapdragon_845/ https://fosdem.org/2022/schedule/event/mobile_kernel_snapdra...

unmole 5y ago

> 15 years of security updates How much do you think that will add to the cost of a product? Software engineers are not cheap.

dmm 5y ago
My 14yo Thinkpad x200 still gets security updates. Why is the situation for mobile devices so different?
- unmole 5y ago
  Honest question: What security updates does a ThinkPad get?
  - yjftsjthsd-h 5y ago
    While the Linux answer is also accurate, ThinkPads in particular also have good coreboot/libreboot support such that much of the firmware can also be kept up to date.
  - ticviking 5y ago
    Anything in the Linux Kernel
    - unmole 5y ago
      That is really not the same thing.
      - pjerem 5y ago
        Yes it totally is. PCs are the proof that manufacturers don’t have to push security updates for decades. But in the phone world, they would have to because they don’t want to open the platform. So the user is dependent on the manufacturer for updates. But it don’t have to be like that.
        deleted 5y ago

owly 5y ago

This seems reasonable. Ask for 15 and maybe get 5!

mrtksn 5y ago

This sounds extreme at first but if you had to support 15 years of security updates, how would you do it? What is the necessary human resources and structure to pull this off?

jewel 5y ago
I've got a laptop from 2004 that still works fine. It has 1.5 GB of RAM and a spinning 60GB hard drive. It runs the latest Xubuntu, which is getting security updates. Android should take a similar path. Mainline the kernel drivers, keep the minimum system requirements low (which you'll want to do anyway for 3rd world handsets), add developer modes to test apps with constrained RAM and throttled CPU, rank "eco-friendly" apps that have lower storage requirements higher on the play store. As far as the human resources required, see Ubuntu or Redhat Enterprise, which manage to do ten year support cycles for servers. I think handsets could be easier if you keep upgrading the kernel and core components instead of only applying security updates to the existing software. If you can do that then there's no more security work than you would otherwise be doing, since your latest handsets would need those security updates too.
StillBored 5y ago
Abstract the hardware platform from the OS and applications. You know, like pretty much every operating system except linux on arm. Everyone complains about having to install drivers on windows, but having a driver ABI is largely how one can expect 10+ years of OS updates without any particular engineering work. The OS and applications get updated and as long as they maintain the driver API the graphics drivers, network drivers, etc all continue to work. Once in a while you have to go back and revisit this stuff, but drivers themselves are rarely sources of exploits because they exist below all the userspace interaction shielded by the kernel, and on the HW side tend to be little more than shims to forward data/packets/etc from the HW to the OS.
- kllrnohj 5y ago
  > You know, like pretty much every operating system except linux on arm. Android is Linux on ARM but it also abstracts the hardware platform from the OS & apps, that's the whole "Project Treble" thing Google was talking about a few years back. https://android-developers.googleblog.com/2017/05/here-comes-treble-modular-base-for.html https://android-developers.googleblog.com/2017/05/here-comes... But that's the easy non-answer. Abstractions can't add features. Like Windows 11 dropped support for old hardware not because the right abstractions weren't in place, but because you can't add things like a TPM in software. It needs full stack support. Similarly if it turns out a device driver had a bug in its implementation of the interface, you're kinda stuck with that. And the workaround may or may not be reasonable to put up with, if a workaround exists at all.

amir734jj 5y ago

My pixel 3 motherboard died suddenly last year. Unfortunately, I am too deep into google services/devices that I can't switch. But I don't think pixel phones are designed to last over 5 years. It's not matter of parts; they are just not designed for >5 years of use/abuse.

neogodless 5y ago
I'm trying to imagine what I would have to be using my phone for such that I could not switch away from the Google brand of smartphones to an alternative. Could you illuminate me?
- amir734jj 5y ago
  20+ nest cameras (multiple homes) + Google docs (collaboration) + Google photos (tons of family photos)
  - andbberger 5y ago
    you know you can use google products on ios right
  - neogodless 5y ago
    But what about the Google brand of smartphone is proprietary, and prevents you from using other Android smartphones?
  - rootusrootus 5y ago
    I have no problem with any of those on my iOS devices.
wlesieutre 5y ago
They've already pulled the plug on Pixel 3 security updates, so you wouldn't have wanted to keep using it anyway (without switching to LineageOS or similar at least). They delivered three years of updates as promised and after that it's a security risk. You know Google apps are available on iOS as well as other Android phone though, right?

pabs3 5y ago

Are there any operating system vendors who support their releases for 15 years? I think RedHat is like 10 years? There is CIP that is longer term though. https://www.cip-project.org/ https://www.cip-project.org/

aaaaaaaaata 5y ago

They don't even consider the chips and design they were putting out 3-5 years ago as adequately secure. Hard to tell them they're wrong.