6 ms·

> 15 years of security updates How much do you think that will add to the cost of a product? Software engineers are not cheap.

by unmole 5y ago

dmm 5y ago
My 14yo Thinkpad x200 still gets security updates. Why is the situation for mobile devices so different?
- unmole 5y ago
  Honest question: What security updates does a ThinkPad get?
  - yjftsjthsd-h 5y ago
    While the Linux answer is also accurate, ThinkPads in particular also have good coreboot/libreboot support such that much of the firmware can also be kept up to date.
  - ticviking 5y ago
    Anything in the Linux Kernel
    - unmole 5y ago
      That is really not the same thing.
      - pjerem 5y ago
        Yes it totally is. PCs are the proof that manufacturers don’t have to push security updates for decades. But in the phone world, they would have to because they don’t want to open the platform. So the user is dependent on the manufacturer for updates. But it don’t have to be like that.
        deleted 5y ago
        [deleted]
      - Strom 5y ago
        Android literally has the Linux kernel. Can't get more same than that.
- kube-system 5y ago
  The OS you've installed gets security updates, but you're not getting any security updates from any of the software provided by the manufacturer. You're usually lucky if any of the drivers/firmware on any PC laptop's support page get updated more than a few months after release.
- joecool1029 5y ago
  Probably should note that it gets updates outside of its normal product lifecycle in the same way Pixel phones get updates, from and by other vendors. It does not get firmware/bios updates, will not be microcode patched for spectre/meltdown. An unsupported Pixel phone will not get modem or sensor/wifi firmware updates after support gets dropped. Maybe it will not be a problem, maybe a problem like the sib24[1] issue from a year or so ago will be there. [1] https://www.reddit.com/r/tmobile/comments/l74hto/this_is_apparently_a_result_of_a_network_update/ https://www.reddit.com/r/tmobile/comments/l74hto/this_is_app...
  - dmm 5y ago
    > It does not get firmware/bios updates Surprisingly this is not the case. The x200 can run coreboot and related forks like libreboot: https://www.coreboot.org/Board:lenovo/x200 https://www.coreboot.org/Board:lenovo/x200 > unsupported Pixel phone will not get modem or sensor/wifi firmware updates That's a good point. The removal of 2g/3g made the modems in a lot of phones non-functional. Even without cell support a phone would still be useful as a small wifi tablet if it could run up-to-date software.
    - joecool1029 5y ago
      >Surprisingly this is not the case. The x200 can run coreboot and related forks like libreboot: https://www.coreboot.org/Board:lenovo/x200 https://www.coreboot.org/Board:lenovo/x200 Yes, yes, BIOS is supported by third-party vendor. Still leaves the microcode problem. >That's a good point. The removal of 2g/3g made the modems in a lot of phones non-functional. Even without cell support a phone would still be useful as a small wifi tablet if it could run up-to-date software. That's not what I'm talking about. Some phones required a modem update to work around a bug caused by broadcasting a different LTE signalling message they couldn't handle. It would crash the phone's baseband. Similarly some security group like Google Project Zero could figure out vulnerabilities in the modem (maybe unprivileged code execution using specially crafted status messages or something of the like). This is the sort of thing you will not get updates for, and the updates you've received til now won't detail much because SoC vendors have all that shit under NDA.
vbezhenar 5y ago
Ask for subscription. Make it more prohibitive as time goes on, until there's not enough demand.
pjerem 5y ago
Updates don’t have to be free. They have to be possible. The solution already exists, it’s called a PC. Just make standard and compatible hardware. And it works.
mhitza 5y ago
My understanding is that if the SoC drivers would be upstreamed, the cost would be negligible.
- unmole 5y ago
  The Linux kernel is a small part of Android. The bulk of the changes and fixes are in the userspace framework.
  - mhitza 5y ago
    Please go into detail, if you can. As the Linux kernel champions backwards compatibility it should not break userspace. And updates to userspace I imagine to be similar to Linux distros, just needing to update system/userspace libs and apps. The only time I see problems, is when the system-level software requires new hardware features that older models do not have.
  - Nullabillity 5y ago
    And why would those care about the particular phone at all?

> 15 years of security updates How much do you think that will add to the cost of a product? Software engineers are not cheap.

by unmole 5y ago

> 15 years of security updates How much do you think that will add to the cost of a product? Software engineers are not cheap.

dmm 5y ago

My 14yo Thinkpad x200 still gets security updates. Why is the situation for mobile devices so different?

unmole 5y ago
Honest question: What security updates does a ThinkPad get?
- yjftsjthsd-h 5y ago
  While the Linux answer is also accurate, ThinkPads in particular also have good coreboot/libreboot support such that much of the firmware can also be kept up to date.
- ticviking 5y ago
  Anything in the Linux Kernel
  - unmole 5y ago
    That is really not the same thing.
    - pjerem 5y ago
      Yes it totally is. PCs are the proof that manufacturers don’t have to push security updates for decades. But in the phone world, they would have to because they don’t want to open the platform. So the user is dependent on the manufacturer for updates. But it don’t have to be like that.
      - deleted 5y ago
        [deleted]
    - Strom 5y ago
      Android literally has the Linux kernel. Can't get more same than that.
kube-system 5y ago
The OS you've installed gets security updates, but you're not getting any security updates from any of the software provided by the manufacturer. You're usually lucky if any of the drivers/firmware on any PC laptop's support page get updated more than a few months after release.
joecool1029 5y ago
Probably should note that it gets updates outside of its normal product lifecycle in the same way Pixel phones get updates, from and by other vendors. It does not get firmware/bios updates, will not be microcode patched for spectre/meltdown. An unsupported Pixel phone will not get modem or sensor/wifi firmware updates after support gets dropped. Maybe it will not be a problem, maybe a problem like the sib24[1] issue from a year or so ago will be there. [1] https://www.reddit.com/r/tmobile/comments/l74hto/this_is_apparently_a_result_of_a_network_update/ https://www.reddit.com/r/tmobile/comments/l74hto/this_is_app...
- dmm 5y ago
  > It does not get firmware/bios updates Surprisingly this is not the case. The x200 can run coreboot and related forks like libreboot: https://www.coreboot.org/Board:lenovo/x200 https://www.coreboot.org/Board:lenovo/x200 > unsupported Pixel phone will not get modem or sensor/wifi firmware updates That's a good point. The removal of 2g/3g made the modems in a lot of phones non-functional. Even without cell support a phone would still be useful as a small wifi tablet if it could run up-to-date software.
  - joecool1029 5y ago
    >Surprisingly this is not the case. The x200 can run coreboot and related forks like libreboot: https://www.coreboot.org/Board:lenovo/x200 https://www.coreboot.org/Board:lenovo/x200 Yes, yes, BIOS is supported by third-party vendor. Still leaves the microcode problem. >That's a good point. The removal of 2g/3g made the modems in a lot of phones non-functional. Even without cell support a phone would still be useful as a small wifi tablet if it could run up-to-date software. That's not what I'm talking about. Some phones required a modem update to work around a bug caused by broadcasting a different LTE signalling message they couldn't handle. It would crash the phone's baseband. Similarly some security group like Google Project Zero could figure out vulnerabilities in the modem (maybe unprivileged code execution using specially crafted status messages or something of the like). This is the sort of thing you will not get updates for, and the updates you've received til now won't detail much because SoC vendors have all that shit under NDA.

vbezhenar 5y ago

Ask for subscription. Make it more prohibitive as time goes on, until there's not enough demand.

pjerem 5y ago

Updates don’t have to be free. They have to be possible. The solution already exists, it’s called a PC. Just make standard and compatible hardware. And it works.

mhitza 5y ago

My understanding is that if the SoC drivers would be upstreamed, the cost would be negligible.

unmole 5y ago
The Linux kernel is a small part of Android. The bulk of the changes and fixes are in the userspace framework.
- mhitza 5y ago
  Please go into detail, if you can. As the Linux kernel champions backwards compatibility it should not break userspace. And updates to userspace I imagine to be similar to Linux distros, just needing to update system/userspace libs and apps. The only time I see problems, is when the system-level software requires new hardware features that older models do not have.
- Nullabillity 5y ago
  And why would those care about the particular phone at all?