3 ms·

A phone (or any kind of internet-connected computer) that's been completely unsupported for years will presumably be low-hanging fruit for even the cheapest and

A phone (or any kind of internet-connected computer) that's been completely unsupported for years will presumably be low-hanging fruit for even the cheapest and crustiest of exploit kits.

arsome 4y ago
Most code that interacts with the internet is updated via other mechanisms. For example, web browsers are kept up to date via Play Store: Firefox for Android, Chrome and even the embedded WebView are all updated there.
- caconym_ 4y ago
  https://www.cvedetails.com/version-list/1224/19997/1/Google-Android.html https://www.cvedetails.com/version-list/1224/19997/1/Google-...
userbinator 4y ago
That is, to put nicely, forced-obsolescence FUD. They want to scare you away with words like "unsupported" so they can keep you on their leash. With the state of software development today, I'd be more worried about how many other holes they've added in the process of fixing something or introducing unwanted new "features"[1]. Here's some interesting statistics to look at and compare... https://www.cvedetails.com/product/462/Microsoft-Windows-98se.html?vendor_id=26 https://www.cvedetails.com/product/462/Microsoft-Windows-98s... - 30 RCEs in 7 years https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.html?vendor_id=26 https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.... - 276 RCEs in 20 years https://www.cvedetails.com/product/32238/Microsoft-Windows-10.html?vendor_id=26 https://www.cvedetails.com/product/32238/Microsoft-Windows-1... - 664 RCEs in 8 years https://www.cvedetails.com/product/102217/Microsoft-Windows-11.html?vendor_id=26 https://www.cvedetails.com/product/102217/Microsoft-Windows-... - 157 RCEs in 2 years More relevantly: https://www.cvedetails.com/version-list/1224/19997/1/Google-Android.html https://www.cvedetails.com/version-list/1224/19997/1/Google-... [1] https://news.ycombinator.com/item?id=28449607 https://news.ycombinator.com/item?id=28449607
- caconym_ 4y ago
  Are you claiming that unpatched software is more secure than patched software?
  - armada651 4y ago
    He's claiming with the amount of features being added for every security bug fixed in an update a bunch more are added. However that ignores the fact that publicly known exploits are more dangerous for the average user than zerodays.
    - caconym_ 4y ago
      It ignores a whole lot more than that. For instance, are we seriously going to pretend that the threat landscape in the Windows 98 and XP eras was anything like what it is today? Well, I'm not. If he wants to daily drive Windows 98 because it had fewer documented RCE vulns, godspeed to him---and he probably will be more secure, just by virtue of good ol' security through obscurity---but that is not a reasonable solution for 99.999howevermanyninesyouwant% of computer users today.
      - arsome 4y ago
        The threat was arguably exponentially worse during the XP era - Windows boxes with a huge default attack surface were directly connected with public facing IPs to a 32-bit IP space that could be trivially brute-forced by worms. There's a reason we haven't seen anything as bad as Blaster in the past decade: NAT. The rate of finding exploits and what the definition of a vulnerability is really what has changed - now the definition of is much broader while at the same time, exploitability has dropped off due to mitigation in modern operating systems, compilers and CPUs. Overall, we get far more exploits, but far less of significance.
        caconym_ 4y ago
        Yes, it was not my intention to imply that those old operating systems were fundamentally more secure in some way. You're getting at it here: the space has broadened, and asserting that old software is more secure than new software based solely on documented RCE counts is laughable.

A phone (or any kind of internet-connected computer) that's been completely unsupported for years will presumably be low-hanging fruit for even the cheapest and crustiest of exploit kits.

arsome 4y ago

Most code that interacts with the internet is updated via other mechanisms. For example, web browsers are kept up to date via Play Store: Firefox for Android, Chrome and even the embedded WebView are all updated there.

caconym_ 4y ago
https://www.cvedetails.com/version-list/1224/19997/1/Google-Android.html https://www.cvedetails.com/version-list/1224/19997/1/Google-...

userbinator 4y ago

That is, to put nicely, forced-obsolescence FUD. They want to scare you away with words like "unsupported" so they can keep you on their leash. With the state of software development today, I'd be more worried about how many other holes they've added in the process of fixing something or introducing unwanted new "features"[1]. Here's some interesting statistics to look at and compare... https://www.cvedetails.com/product/462/Microsoft-Windows-98se.html?vendor_id=26 https://www.cvedetails.com/product/462/Microsoft-Windows-98s... - 30 RCEs in 7 years https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.html?vendor_id=26 https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.... - 276 RCEs in 20 years https://www.cvedetails.com/product/32238/Microsoft-Windows-10.html?vendor_id=26 https://www.cvedetails.com/product/32238/Microsoft-Windows-1... - 664 RCEs in 8 years https://www.cvedetails.com/product/102217/Microsoft-Windows-11.html?vendor_id=26 https://www.cvedetails.com/product/102217/Microsoft-Windows-... - 157 RCEs in 2 years More relevantly: https://www.cvedetails.com/version-list/1224/19997/1/Google-Android.html https://www.cvedetails.com/version-list/1224/19997/1/Google-... [1] https://news.ycombinator.com/item?id=28449607 https://news.ycombinator.com/item?id=28449607

caconym_ 4y ago
Are you claiming that unpatched software is more secure than patched software?
- armada651 4y ago
  He's claiming with the amount of features being added for every security bug fixed in an update a bunch more are added. However that ignores the fact that publicly known exploits are more dangerous for the average user than zerodays.
  - caconym_ 4y ago
    It ignores a whole lot more than that. For instance, are we seriously going to pretend that the threat landscape in the Windows 98 and XP eras was anything like what it is today? Well, I'm not. If he wants to daily drive Windows 98 because it had fewer documented RCE vulns, godspeed to him---and he probably will be more secure, just by virtue of good ol' security through obscurity---but that is not a reasonable solution for 99.999howevermanyninesyouwant% of computer users today.
    - arsome 4y ago
      The threat was arguably exponentially worse during the XP era - Windows boxes with a huge default attack surface were directly connected with public facing IPs to a 32-bit IP space that could be trivially brute-forced by worms. There's a reason we haven't seen anything as bad as Blaster in the past decade: NAT. The rate of finding exploits and what the definition of a vulnerability is really what has changed - now the definition of is much broader while at the same time, exploitability has dropped off due to mitigation in modern operating systems, compilers and CPUs. Overall, we get far more exploits, but far less of significance.
      - caconym_ 4y ago
        Yes, it was not my intention to imply that those old operating systems were fundamentally more secure in some way. You're getting at it here: the space has broadened, and asserting that old software is more secure than new software based solely on documented RCE counts is laughable.