7 ms·

The security upgrades situation on Google is intolerable. I finally have a phone (3axl) that didn't die in a couple years from accidents / abuse / going to the

by x0x0 5y ago

The security upgrades situation on Google is intolerable. I finally have a phone (3axl) that didn't die in a couple years from accidents / abuse / going to the gym in my pocket, and Google is eol-ing it because they've cut off security upgrades. My next phone will be an iphone.

kyrra 5y ago
Googler opinions are my own. At least they fixed this with the pixel 6 with a 5 year upgrade plan.
- jiggawatts 5y ago
  I gave my 6-year old iPhone to elderly relatives and it still gets security upgrades. Google “upgraded” to less than any other mainstream computing platform. Windows gets about 10 years of security updates for each major version, up to 15 if you pay extra.
  - cogman10 5y ago
    And that is just for the OS itself. Hardware wise, you can easily pull out 20 years or longer simply by constantly bumping up the OS version.
- mdoms 5y ago
  No. Google is the operating system vendor. They either fix this with all Android phones or they haven't fixed anything at all.
  - Andrex 5y ago
    They've been at it for years, but it's been a difficult problem to solve. Tangible progress has been made in the last 2 or so OS updates, however. https://arstechnica.com/gadgets/2018/06/talkin-treble-how-android-engineers-are-winning-the-war-on-fragmentation/ https://arstechnica.com/gadgets/2018/06/talkin-treble-how-an... https://arstechnica.com/gadgets/2020/12/qualcomm-promises-three-years-of-android-updates-for-its-entire-soc-lineup/ https://arstechnica.com/gadgets/2020/12/qualcomm-promises-th... https://arstechnica.com/gadgets/2020/07/android-10-has-the-fastest-update-rate-ever-hits-16-of-users-in-10-months/ https://arstechnica.com/gadgets/2020/07/android-10-has-the-f...
  - vetinari 5y ago
    Google is not operating system vendor for all Android phones. They release a generic template, other vendors then apply platform kits for the SoCs they use and they release the operating system for their devices. Google has no idea what it runs on, or what is needed to make it run on specific devices. It is the vendor's task. Mobile devices have no UEFI, no bus enumeration, so the OS image has to be taylored for each device. It is similar to Raspberry or Odroid or similar SBCs: althrough both are arm, you cannot use Ubuntu (or other disto) image intended for one on another.
    - jiggawatts 5y ago
      That’s the cause of the problem, not the excuse for it.
    - my123 5y ago
      (disclaimer: I work at Qualcomm) > Mobile devices have no UEFI Since the Snapdragon 835, Android devices with Qualcomm processors use UEFI all the way to the kernel. However, custom UEFI binaries aren't part of the boot flow, with an Android UEFI boot application running instead. > no bus enumeration It's device tree instead of ACPI, but apart from that the situation isn't _that_ different from PCs today. We aren't in the ATAGS era anymore. The reflashing interface nowadays is standardised through fastboot too. > so the OS image has to be taylored for each device Thankfully a lot of progress has been done on that. Since Treble, the BSP proper has been untied from Android releases. Since devices shipping with Android 12, a Google-built kernel with a stable kernel module ABI has been shipping (for a given major kernel + Android version release combo). This allows kernel security updates to be identical across the whole ecosystem. > althrough both are arm, you cannot use Ubuntu (or other disto) image intended for one on another That used to be true, but across the whole Android device fleet (even between SoC vendors) it's not true anymore. However, there's a catch still: there isn't a central update service. So while you might use a custom OS that way, you'll still need to update the vendor partitions (with the drivers, both kernel and user-mode ones) out of band in that scenario to get updates for those. More info on generic system images: https://developer.android.com/topic/generic-system-image https://developer.android.com/topic/generic-system-image. This mechanism allows to have universal Android images that work across all of the ecosystem, and can be used for GNU/Linux distributions on phones too if there's motivation to do so.
Narushia 5y ago
I thought they had moved security updates to be delivered via Google Play so that users could keep receiving them even when the OEM doesn’t deliver OS updates anymore? Or are those separate security updates from the "normal" firmware security patches?
- fencepost 5y ago
  Some things moved into Google Play, which is a mixed blessing. On the upside, they may get updates longer. On the downside, there's an argument that moving things from AOSP into Google's proprietary blobs is not so great.
- orra 5y ago
  Somewhat? The browser and presumably the webview is distributed through Google Play, yes. But kernel upgrades are not.
  - tomComb 5y ago
    Almost all attack services are now updated remotely by Google for security issues. In the kernel only video drivers can be updated remotely (and support for this depends on the vendor). I think it is a much better way to do security updates than the Apple model - security issues shouldn't have to wait for the next firmware update and for the user to apply them.
- Kye 5y ago
  I thought that too with my last Android. It never got them, so my next phone was a 6S Plus in 2018 (launched in 2015) that still gets updates.
  - tomComb 5y ago
    How do you know you didn't get them? They are silent. Also, I don't think that 'not getting them' is an option other then with video drivers. The whole idea is that security updates should be pushed immediately to all devices and not require user action. You get them even if you don't want them.
sillyinseattle 5y ago
> they've cut off security upgrades Same reason I switched to Apple last year -- after being android only since original Motorola Droid (2009).

by x0x0 5y ago

kyrra 5y ago

Googler opinions are my own. At least they fixed this with the pixel 6 with a 5 year upgrade plan.

jiggawatts 5y ago
I gave my 6-year old iPhone to elderly relatives and it still gets security upgrades. Google “upgraded” to less than any other mainstream computing platform. Windows gets about 10 years of security updates for each major version, up to 15 if you pay extra.
- cogman10 5y ago
  And that is just for the OS itself. Hardware wise, you can easily pull out 20 years or longer simply by constantly bumping up the OS version.
mdoms 5y ago
No. Google is the operating system vendor. They either fix this with all Android phones or they haven't fixed anything at all.
- Andrex 5y ago
  They've been at it for years, but it's been a difficult problem to solve. Tangible progress has been made in the last 2 or so OS updates, however. https://arstechnica.com/gadgets/2018/06/talkin-treble-how-android-engineers-are-winning-the-war-on-fragmentation/ https://arstechnica.com/gadgets/2018/06/talkin-treble-how-an... https://arstechnica.com/gadgets/2020/12/qualcomm-promises-three-years-of-android-updates-for-its-entire-soc-lineup/ https://arstechnica.com/gadgets/2020/12/qualcomm-promises-th... https://arstechnica.com/gadgets/2020/07/android-10-has-the-fastest-update-rate-ever-hits-16-of-users-in-10-months/ https://arstechnica.com/gadgets/2020/07/android-10-has-the-f...
- vetinari 5y ago
  Google is not operating system vendor for all Android phones. They release a generic template, other vendors then apply platform kits for the SoCs they use and they release the operating system for their devices. Google has no idea what it runs on, or what is needed to make it run on specific devices. It is the vendor's task. Mobile devices have no UEFI, no bus enumeration, so the OS image has to be taylored for each device. It is similar to Raspberry or Odroid or similar SBCs: althrough both are arm, you cannot use Ubuntu (or other disto) image intended for one on another.
  - jiggawatts 5y ago
    That’s the cause of the problem, not the excuse for it.
  - my123 5y ago
    (disclaimer: I work at Qualcomm) > Mobile devices have no UEFI Since the Snapdragon 835, Android devices with Qualcomm processors use UEFI all the way to the kernel. However, custom UEFI binaries aren't part of the boot flow, with an Android UEFI boot application running instead. > no bus enumeration It's device tree instead of ACPI, but apart from that the situation isn't _that_ different from PCs today. We aren't in the ATAGS era anymore. The reflashing interface nowadays is standardised through fastboot too. > so the OS image has to be taylored for each device Thankfully a lot of progress has been done on that. Since Treble, the BSP proper has been untied from Android releases. Since devices shipping with Android 12, a Google-built kernel with a stable kernel module ABI has been shipping (for a given major kernel + Android version release combo). This allows kernel security updates to be identical across the whole ecosystem. > althrough both are arm, you cannot use Ubuntu (or other disto) image intended for one on another That used to be true, but across the whole Android device fleet (even between SoC vendors) it's not true anymore. However, there's a catch still: there isn't a central update service. So while you might use a custom OS that way, you'll still need to update the vendor partitions (with the drivers, both kernel and user-mode ones) out of band in that scenario to get updates for those. More info on generic system images: https://developer.android.com/topic/generic-system-image https://developer.android.com/topic/generic-system-image. This mechanism allows to have universal Android images that work across all of the ecosystem, and can be used for GNU/Linux distributions on phones too if there's motivation to do so.

Narushia 5y ago

I thought they had moved security updates to be delivered via Google Play so that users could keep receiving them even when the OEM doesn’t deliver OS updates anymore? Or are those separate security updates from the "normal" firmware security patches?

fencepost 5y ago
Some things moved into Google Play, which is a mixed blessing. On the upside, they may get updates longer. On the downside, there's an argument that moving things from AOSP into Google's proprietary blobs is not so great.
orra 5y ago
Somewhat? The browser and presumably the webview is distributed through Google Play, yes. But kernel upgrades are not.
- tomComb 5y ago
  Almost all attack services are now updated remotely by Google for security issues. In the kernel only video drivers can be updated remotely (and support for this depends on the vendor). I think it is a much better way to do security updates than the Apple model - security issues shouldn't have to wait for the next firmware update and for the user to apply them.
Kye 5y ago
I thought that too with my last Android. It never got them, so my next phone was a 6S Plus in 2018 (launched in 2015) that still gets updates.
- tomComb 5y ago
  How do you know you didn't get them? They are silent. Also, I don't think that 'not getting them' is an option other then with video drivers. The whole idea is that security updates should be pushed immediately to all devices and not require user action. You get them even if you don't want them.

sillyinseattle 5y ago

> they've cut off security upgrades Same reason I switched to Apple last year -- after being android only since original Motorola Droid (2009).