6 ms·

Fyi, this is related to the story from 2 days ago: https://news.ycombinator.com/item?id=33823946 https://news.ycombinator.com/item?id=33823946 An important co

by kyrra 4y ago

Fyi, this is related to the story from 2 days ago: https://news.ycombinator.com/item?id=33823946 https://news.ycombinator.com/item?id=33823946 An important comment from the original story: > OEMs have mitigated the issues above in previous updates. A new security update from Android is not required to mitigate these issues. Ensuring your device is running the latest version of Android is a general best security practice for users. Though the ars story says Samsung is signing their first party apps with it still. So who knows.

mattl 4y ago
It’s my understanding that most Android devices don’t get OEM updates for very long
- neodymiumphish 4y ago
  This is true in the sense that most android devices are small/cheap off brand or Chinese devices sold across low-income markets, like Africa and the Middle East. Any mid- or top-tier Android devices, such as Pixels and Galaxy devices which compete directly with Apple, are usually on a monthly security update cadence for at least 3 years.
  - hnra 4y ago
    3 years of support sounds like the bare minimum you can expect, and that is what the most expensive brand offer?
    - celsoazevedo 4y ago
      A new Samsung Galaxy S22 (and above) has 5 years of support. 4 major Android updates and 1 year of security updates. For the Pixel 6/7/Pro (including the cheaper 6a), it's also 5 years, but only 3 major Android upgrades and 2 of security updates. Not as good as an iPhone (5-6 years), but it's improving.
      - GeekyBear 4y ago
        If you include years where you only get a security update, but not an OS update, then the 2014 iPhone 5s is still supported today, since it's last update was in August.
        officialjunk 4y ago
        that's an important distinction. i don't have an android, but i get the sense that by "supported" we are talking about continuing to receive security updates. i am not sure my assumption is correct, though. do new samsung phones stop receiving security updates in 5 years?
        celsoazevedo 4y ago
        You get at least 5 years of security updates with a new Samsung flagship[0]. During those 5 years, you'll use 4 major Android versions (there's a new one each year, like iOS). The last year of support is essentially security patches for the Android version released in the previous year. On top of this, since Android 10 (2019), some security and feature updates come directly from Google (delivered via the app store) and continue after the brand stops supporting the device. These security updates Apple, Samsung, etc, release years after the phone reaches end-of-life are a bit misleading. The update for the iPhone 5S fixed an exploit on Webkit, but everything else remains unpatched. Same with the update Samsung released for the Galaxy S7 (released before they had a 5 year support policy)... it fixed a GPS bug. That's it. So while these updates are better than nothing, it's important to understand that the device is not up-to-date or secure. --- [0] The 50-100 dollars device sold in low income markets won't have the same level of long term support as $500+ devices. We can't compare them to Apple here as Apple doesn't compete in that market.
        GeekyBear 4y ago
        The OG $499 iPhone SE from 2016 got six years of OS updates and is still supported with security updates today. You really can't compare full OS updates AND security updates to years where you just got security updates.
    - loeg 4y ago
      It used to be only ~18 months for top-end Android phones.
  - yakubin 4y ago
    3 years of updates is no competition for Apple.
    - celsoazevedo 4y ago
      It got better in the past 2 years. The latest Pixel or Samsung gives you 5 years of support. 3 major updates + 2 years of security updates on the Pixel and 4 major updates + 1 year of security updates on a Samsung. An iPhone gets you 6 major iOS updates, I think.
      - dylan604 4y ago
        It's taken them up to the past 2 years to still be this much less than a competitor? We've had smart devices like this since 2007. It took 13 years to get to a point of still being inferior. You're not impressing me at all here.
        nkozyra 4y ago
        It's probably not a huge priority, given the replacement cadence of most phone users. https://www.statista.com/statistics/619788/average-smartphone-life/ https://www.statista.com/statistics/619788/average-smartphon.... If, on average, people are replacing their phone within three years, 5 years or more of support is largely marketing.
        jshzglr 4y ago
        I agree with this. 5 years seems like plenty until smartphones sufficiently plateau resulting in longer ownership. I believe this is another case of HN's biases versus the 80-90% that the major players actually build for. And ironically, I highly doubt the majority of the users here on HN use their devices through their EOL. They just like the idea, philosophically.
        dylan604 4y ago
        I'm still using my iphone 6s plus from 2015. Smartphones sufficiently plateaued for me a long time ago. It's a shame the rest of you fine folks find everything so inefficient ;-) I'm guessing there's a generational aspect to this as well, and if the devices are the person's only compute device. The assumption on my part is that the younger users are the ones to upgrade quickly as it is upgrading their only compute device. For someone like me, I'll always prefer a desktop/laptop to use for the sheer usability aspect. I just hate the small screen and hunched over posture of using a phablet-like device. That's me and my opinion, and we all like different things.
  - bombolo 4y ago
    Samsung generally takes several months to fix 0days. source: have owned a samsung and took notice of when the update came
    - Shraal 4y ago
      Samsung improved it's update process (and probably pipeline?) dramatically in the past years[1] and the software became much better and more polished. I received the Android 13 update in November and less than two weeks later another security update. This indicates to me that they roll out updates as fast as possible. Normally I get the monthly security update in the first half of the month. EDIT: I should probably mention that I usually only buy Samsung's flagships but the midrange device are getting the same treatment AFAIK. [1] https://www.androidpolice.com/2021/02/22/samsung-solidifies-its-place-as-android-update-king-with-bold-new-commitment/ https://www.androidpolice.com/2021/02/22/samsung-solidifies-...
      - bombolo 4y ago
        > I should probably mention that I usually only buy Samsung's flagships but the midrange device are getting the same treatment AFAIK. I really don't have that kind of money to just drop on a phone that will inevitably fall from my pocket and break because it's too damn big. My phones cost less than 200€, and since they aren't samsung they get timely updates.
- ThrowawayTestr 4y ago
  My S9 was getting updates as late as a few weeks ago.
  - FeistySkink 4y ago
    What's the latest security update? I just checked S9 I have in a drawer and it's from March 2022.
    - clsec 4y ago
      My ultra cheap, as in free, Samsung is running Android 12 with security updates from October 1 2022.
      - bouke 4y ago
        “Free” means paid through your contract though, so that doesn’t really add anything to your point.
  - Tijdreiziger 4y ago
    That was just a GPS (?) update. I have an S9 too, if you check the security patch level (Settings > About phone > Software information), it’s still at March 1, 2022 (and there aren’t any further updates scheduled).
  - mattl 4y ago
    When did that come out?
- jeroenhd 4y ago
  Manufacturers have been extending the support life cycle for the past few years. Samsung provides five years of updates for most phones, for example, with four years of Android updates. Still not great, but a lot better than the single year of updates you used to get. Extremely cheap brands don't tend to do updates much, especially Android version updates. Mid-range phones land somewhere in the middle; some have budget hardware with decent support, but other brands get good hardware for dirt cheap in exchange of basically no software support after buying the phone. The latter is great if you're planning on using custom ROMs to extend the life time of your dirt cheap hardware, but quite terrible for people who are used to buying phones four times the price and expecting the same level of support, thinking they just scored a good deal.
criddell 4y ago
Can they revoke the key?
fulafel 4y ago
Sounds like the mitigation might be just blacklisting the publically seen malware sideloadable APKs, that's a pretty weak mitigation if the keys have leaked.

by kyrra 4y ago

mattl 4y ago

It’s my understanding that most Android devices don’t get OEM updates for very long

neodymiumphish 4y ago
This is true in the sense that most android devices are small/cheap off brand or Chinese devices sold across low-income markets, like Africa and the Middle East. Any mid- or top-tier Android devices, such as Pixels and Galaxy devices which compete directly with Apple, are usually on a monthly security update cadence for at least 3 years.
- hnra 4y ago
  3 years of support sounds like the bare minimum you can expect, and that is what the most expensive brand offer?
  - celsoazevedo 4y ago
    A new Samsung Galaxy S22 (and above) has 5 years of support. 4 major Android updates and 1 year of security updates. For the Pixel 6/7/Pro (including the cheaper 6a), it's also 5 years, but only 3 major Android upgrades and 2 of security updates. Not as good as an iPhone (5-6 years), but it's improving.
    - GeekyBear 4y ago
      If you include years where you only get a security update, but not an OS update, then the 2014 iPhone 5s is still supported today, since it's last update was in August.
      - officialjunk 4y ago
        that's an important distinction. i don't have an android, but i get the sense that by "supported" we are talking about continuing to receive security updates. i am not sure my assumption is correct, though. do new samsung phones stop receiving security updates in 5 years?
        celsoazevedo 4y ago
        You get at least 5 years of security updates with a new Samsung flagship[0]. During those 5 years, you'll use 4 major Android versions (there's a new one each year, like iOS). The last year of support is essentially security patches for the Android version released in the previous year. On top of this, since Android 10 (2019), some security and feature updates come directly from Google (delivered via the app store) and continue after the brand stops supporting the device. These security updates Apple, Samsung, etc, release years after the phone reaches end-of-life are a bit misleading. The update for the iPhone 5S fixed an exploit on Webkit, but everything else remains unpatched. Same with the update Samsung released for the Galaxy S7 (released before they had a 5 year support policy)... it fixed a GPS bug. That's it. So while these updates are better than nothing, it's important to understand that the device is not up-to-date or secure. --- [0] The 50-100 dollars device sold in low income markets won't have the same level of long term support as $500+ devices. We can't compare them to Apple here as Apple doesn't compete in that market.
        GeekyBear 4y ago
        The OG $499 iPhone SE from 2016 got six years of OS updates and is still supported with security updates today. You really can't compare full OS updates AND security updates to years where you just got security updates.
  - loeg 4y ago
    It used to be only ~18 months for top-end Android phones.
- yakubin 4y ago
  3 years of updates is no competition for Apple.
  - celsoazevedo 4y ago
    It got better in the past 2 years. The latest Pixel or Samsung gives you 5 years of support. 3 major updates + 2 years of security updates on the Pixel and 4 major updates + 1 year of security updates on a Samsung. An iPhone gets you 6 major iOS updates, I think.
    - dylan604 4y ago
      It's taken them up to the past 2 years to still be this much less than a competitor? We've had smart devices like this since 2007. It took 13 years to get to a point of still being inferior. You're not impressing me at all here.
      - nkozyra 4y ago
        It's probably not a huge priority, given the replacement cadence of most phone users. https://www.statista.com/statistics/619788/average-smartphone-life/ https://www.statista.com/statistics/619788/average-smartphon.... If, on average, people are replacing their phone within three years, 5 years or more of support is largely marketing.
        jshzglr 4y ago
        I agree with this. 5 years seems like plenty until smartphones sufficiently plateau resulting in longer ownership. I believe this is another case of HN's biases versus the 80-90% that the major players actually build for. And ironically, I highly doubt the majority of the users here on HN use their devices through their EOL. They just like the idea, philosophically.
        dylan604 4y ago
        I'm still using my iphone 6s plus from 2015. Smartphones sufficiently plateaued for me a long time ago. It's a shame the rest of you fine folks find everything so inefficient ;-) I'm guessing there's a generational aspect to this as well, and if the devices are the person's only compute device. The assumption on my part is that the younger users are the ones to upgrade quickly as it is upgrading their only compute device. For someone like me, I'll always prefer a desktop/laptop to use for the sheer usability aspect. I just hate the small screen and hunched over posture of using a phablet-like device. That's me and my opinion, and we all like different things.
- bombolo 4y ago
  Samsung generally takes several months to fix 0days. source: have owned a samsung and took notice of when the update came
  - Shraal 4y ago
    Samsung improved it's update process (and probably pipeline?) dramatically in the past years[1] and the software became much better and more polished. I received the Android 13 update in November and less than two weeks later another security update. This indicates to me that they roll out updates as fast as possible. Normally I get the monthly security update in the first half of the month. EDIT: I should probably mention that I usually only buy Samsung's flagships but the midrange device are getting the same treatment AFAIK. [1] https://www.androidpolice.com/2021/02/22/samsung-solidifies-its-place-as-android-update-king-with-bold-new-commitment/ https://www.androidpolice.com/2021/02/22/samsung-solidifies-...
    - bombolo 4y ago
      > I should probably mention that I usually only buy Samsung's flagships but the midrange device are getting the same treatment AFAIK. I really don't have that kind of money to just drop on a phone that will inevitably fall from my pocket and break because it's too damn big. My phones cost less than 200€, and since they aren't samsung they get timely updates.
ThrowawayTestr 4y ago
My S9 was getting updates as late as a few weeks ago.
- FeistySkink 4y ago
  What's the latest security update? I just checked S9 I have in a drawer and it's from March 2022.
  - clsec 4y ago
    My ultra cheap, as in free, Samsung is running Android 12 with security updates from October 1 2022.
    - bouke 4y ago
      “Free” means paid through your contract though, so that doesn’t really add anything to your point.
- Tijdreiziger 4y ago
  That was just a GPS (?) update. I have an S9 too, if you check the security patch level (Settings > About phone > Software information), it’s still at March 1, 2022 (and there aren’t any further updates scheduled).
- mattl 4y ago
  When did that come out?
jeroenhd 4y ago
Manufacturers have been extending the support life cycle for the past few years. Samsung provides five years of updates for most phones, for example, with four years of Android updates. Still not great, but a lot better than the single year of updates you used to get. Extremely cheap brands don't tend to do updates much, especially Android version updates. Mid-range phones land somewhere in the middle; some have budget hardware with decent support, but other brands get good hardware for dirt cheap in exchange of basically no software support after buying the phone. The latter is great if you're planning on using custom ROMs to extend the life time of your dirt cheap hardware, but quite terrible for people who are used to buying phones four times the price and expecting the same level of support, thinking they just scored a good deal.

criddell 4y ago

Can they revoke the key?

fulafel 4y ago

Sounds like the mitigation might be just blacklisting the publically seen malware sideloadable APKs, that's a pretty weak mitigation if the keys have leaked.