3 ms·

My 14yo Thinkpad x200 still gets security updates. Why is the situation for mobile devices so different?

by dmm 5y ago

unmole 5y ago
Honest question: What security updates does a ThinkPad get?
- yjftsjthsd-h 5y ago
  While the Linux answer is also accurate, ThinkPads in particular also have good coreboot/libreboot support such that much of the firmware can also be kept up to date.
- ticviking 5y ago
  Anything in the Linux Kernel
  - unmole 5y ago
    That is really not the same thing.
    - pjerem 5y ago
      Yes it totally is. PCs are the proof that manufacturers don’t have to push security updates for decades. But in the phone world, they would have to because they don’t want to open the platform. So the user is dependent on the manufacturer for updates. But it don’t have to be like that.
      - deleted 5y ago
        [deleted]
    - Strom 5y ago
      Android literally has the Linux kernel. Can't get more same than that.
kube-system 5y ago
The OS you've installed gets security updates, but you're not getting any security updates from any of the software provided by the manufacturer. You're usually lucky if any of the drivers/firmware on any PC laptop's support page get updated more than a few months after release.
joecool1029 5y ago
Probably should note that it gets updates outside of its normal product lifecycle in the same way Pixel phones get updates, from and by other vendors. It does not get firmware/bios updates, will not be microcode patched for spectre/meltdown. An unsupported Pixel phone will not get modem or sensor/wifi firmware updates after support gets dropped. Maybe it will not be a problem, maybe a problem like the sib24[1] issue from a year or so ago will be there. [1] https://www.reddit.com/r/tmobile/comments/l74hto/this_is_apparently_a_result_of_a_network_update/ https://www.reddit.com/r/tmobile/comments/l74hto/this_is_app...
- dmm 5y ago
  > It does not get firmware/bios updates Surprisingly this is not the case. The x200 can run coreboot and related forks like libreboot: https://www.coreboot.org/Board:lenovo/x200 https://www.coreboot.org/Board:lenovo/x200 > unsupported Pixel phone will not get modem or sensor/wifi firmware updates That's a good point. The removal of 2g/3g made the modems in a lot of phones non-functional. Even without cell support a phone would still be useful as a small wifi tablet if it could run up-to-date software.
  - joecool1029 5y ago
    >Surprisingly this is not the case. The x200 can run coreboot and related forks like libreboot: https://www.coreboot.org/Board:lenovo/x200 https://www.coreboot.org/Board:lenovo/x200 Yes, yes, BIOS is supported by third-party vendor. Still leaves the microcode problem. >That's a good point. The removal of 2g/3g made the modems in a lot of phones non-functional. Even without cell support a phone would still be useful as a small wifi tablet if it could run up-to-date software. That's not what I'm talking about. Some phones required a modem update to work around a bug caused by broadcasting a different LTE signalling message they couldn't handle. It would crash the phone's baseband. Similarly some security group like Google Project Zero could figure out vulnerabilities in the modem (maybe unprivileged code execution using specially crafted status messages or something of the like). This is the sort of thing you will not get updates for, and the updates you've received til now won't detail much because SoC vendors have all that shit under NDA.

My 14yo Thinkpad x200 still gets security updates. Why is the situation for mobile devices so different?

by dmm 5y ago

My 14yo Thinkpad x200 still gets security updates. Why is the situation for mobile devices so different?

unmole 5y ago

Honest question: What security updates does a ThinkPad get?

yjftsjthsd-h 5y ago
While the Linux answer is also accurate, ThinkPads in particular also have good coreboot/libreboot support such that much of the firmware can also be kept up to date.
ticviking 5y ago
Anything in the Linux Kernel
- unmole 5y ago
  That is really not the same thing.
  - pjerem 5y ago
    Yes it totally is. PCs are the proof that manufacturers don’t have to push security updates for decades. But in the phone world, they would have to because they don’t want to open the platform. So the user is dependent on the manufacturer for updates. But it don’t have to be like that.
    - deleted 5y ago
      [deleted]
  - Strom 5y ago
    Android literally has the Linux kernel. Can't get more same than that.

kube-system 5y ago

The OS you've installed gets security updates, but you're not getting any security updates from any of the software provided by the manufacturer. You're usually lucky if any of the drivers/firmware on any PC laptop's support page get updated more than a few months after release.

joecool1029 5y ago

Probably should note that it gets updates outside of its normal product lifecycle in the same way Pixel phones get updates, from and by other vendors. It does not get firmware/bios updates, will not be microcode patched for spectre/meltdown. An unsupported Pixel phone will not get modem or sensor/wifi firmware updates after support gets dropped. Maybe it will not be a problem, maybe a problem like the sib24[1] issue from a year or so ago will be there. [1] https://www.reddit.com/r/tmobile/comments/l74hto/this_is_apparently_a_result_of_a_network_update/ https://www.reddit.com/r/tmobile/comments/l74hto/this_is_app...

dmm 5y ago
> It does not get firmware/bios updates Surprisingly this is not the case. The x200 can run coreboot and related forks like libreboot: https://www.coreboot.org/Board:lenovo/x200 https://www.coreboot.org/Board:lenovo/x200 > unsupported Pixel phone will not get modem or sensor/wifi firmware updates That's a good point. The removal of 2g/3g made the modems in a lot of phones non-functional. Even without cell support a phone would still be useful as a small wifi tablet if it could run up-to-date software.
- joecool1029 5y ago
  >Surprisingly this is not the case. The x200 can run coreboot and related forks like libreboot: https://www.coreboot.org/Board:lenovo/x200 https://www.coreboot.org/Board:lenovo/x200 Yes, yes, BIOS is supported by third-party vendor. Still leaves the microcode problem. >That's a good point. The removal of 2g/3g made the modems in a lot of phones non-functional. Even without cell support a phone would still be useful as a small wifi tablet if it could run up-to-date software. That's not what I'm talking about. Some phones required a modem update to work around a bug caused by broadcasting a different LTE signalling message they couldn't handle. It would crash the phone's baseband. Similarly some security group like Google Project Zero could figure out vulnerabilities in the modem (maybe unprivileged code execution using specially crafted status messages or something of the like). This is the sort of thing you will not get updates for, and the updates you've received til now won't detail much because SoC vendors have all that shit under NDA.