5 ms·

> they rarely ship security fixes more than two major versions Every flagship iPhone since 2011 has gotten at least five years of OS updates, with additional y

> they rarely ship security fixes more than two major versions Every flagship iPhone since 2011 has gotten at least five years of OS updates, with additional years of security updates after that. For instance, the original version of the iPhone SE is currently in its eighth year of support, and just got another security update a couple of weeks ago.

hedgehog 2y ago
Two different things, Apple provides a pretty long window of OS updates for each device but doesn't ship updates for older OS versions. For example the 1st gen SE shipped with iOS 9 which has not been getting updates for a few years, but it can run iOS 15 which still seems to be getting security updates.
- GeekyBear 2y ago
  It probably seems odd when you're coming from a history of devices with a very short support window, but you don't need to worry about years when you only get a security update until you run out of years when you get the OS AND security updates first. For instance, that original iPhone SE came out in 2016, the same year as the original Pixel phone. The iPhone is still supported by Apple today, while the Pixel phone was dropped from support by Google five years ago. Google had to come up with a way to backport features to older unsupported versions of the OS because their support window was so abysmally short. Hopefully, this won't be an issue going forward, with Google promising a comparable support window in the future.
JohnTHaller 2y ago
One issue with iOS vs Android is that iOS has the browser tied to the OS ala Internet Explorer. Once iOS is no longer supported, you're now using an unsupported insecure browser. And all other iOS browsers sit atop the unsupported insecure browser in iOS. On Android, the browser is separate and you can install alternative browsers. The current release of Chrome for Android works with Android 8 which was released in August 21, 2017 and dropped January 2021. Android System Webview (the browser engine that other apps can use so they don't have to ship their own) works the same way and is independently updated from the OS.
- GeekyBear 2y ago
  Updating an app doesn't fix an issue that requires a security update, or a replacement driver. > Virtually any Android, Linux, or Windows device that hasn't been recently patched and has Bluetooth turned on can be compromised by an attacking device within 32 feet. It doesn't require device users to click on any links, connect to a rogue Bluetooth device, or take any other action, short of leaving Bluetooth on. The exploit process is generally very fast, requiring no more than 10 seconds to complete https://arstechnica.com/information-technology/2017/09/bluetooth-bugs-open-billions-of-devices-to-attacks-no-clicking-required/ https://arstechnica.com/information-technology/2017/09/bluet... A browser update doesn't fix that and that and Blueborne was disclosed during the era when an Android device only had a support window of two of three years. iPhones from over a decade ago were getting security updates, including for the browser, for seven or eight years.
  - daghamm 2y ago
    This was from 2017, and nothing came out of it. Every month or so someone (usually a security company that wants to sell something) find a domesday exploit for android that is unpatchable, and then it gets patched or turns out to be a non issue.
- toast0 2y ago
  > the browser tied to the OS ala Internet Explorer. Internet Explorer was usually only loosely tied to the OS. Yes, many versions of Windows came with some version of IE, but you could usually install a newer version if you wanted. Every once in a while, a newer version of IE required a newer version of Windows, but that wasn't typical. As I understand it, on Apple systems, Safari comes with the OS and is updated together --- Safari updates come in OS updates. Mobile IE was very similar though, at least on Windows Phone 7 and newer.
  - JimDabell 2y ago
    > Safari comes with the OS and is updated together --- Safari updates come in OS updates. That’s true on iOS but not exactly true on macOS. Upgrading macOS also upgrades Safari, but you can also install newer versions of Safari on older versions of macOS. You just can’t have older versions of Safari on newer versions of macOS.

hedgehog 2y ago

Two different things, Apple provides a pretty long window of OS updates for each device but doesn't ship updates for older OS versions. For example the 1st gen SE shipped with iOS 9 which has not been getting updates for a few years, but it can run iOS 15 which still seems to be getting security updates.

GeekyBear 2y ago
It probably seems odd when you're coming from a history of devices with a very short support window, but you don't need to worry about years when you only get a security update until you run out of years when you get the OS AND security updates first. For instance, that original iPhone SE came out in 2016, the same year as the original Pixel phone. The iPhone is still supported by Apple today, while the Pixel phone was dropped from support by Google five years ago. Google had to come up with a way to backport features to older unsupported versions of the OS because their support window was so abysmally short. Hopefully, this won't be an issue going forward, with Google promising a comparable support window in the future.

JohnTHaller 2y ago

One issue with iOS vs Android is that iOS has the browser tied to the OS ala Internet Explorer. Once iOS is no longer supported, you're now using an unsupported insecure browser. And all other iOS browsers sit atop the unsupported insecure browser in iOS. On Android, the browser is separate and you can install alternative browsers. The current release of Chrome for Android works with Android 8 which was released in August 21, 2017 and dropped January 2021. Android System Webview (the browser engine that other apps can use so they don't have to ship their own) works the same way and is independently updated from the OS.

GeekyBear 2y ago
Updating an app doesn't fix an issue that requires a security update, or a replacement driver. > Virtually any Android, Linux, or Windows device that hasn't been recently patched and has Bluetooth turned on can be compromised by an attacking device within 32 feet. It doesn't require device users to click on any links, connect to a rogue Bluetooth device, or take any other action, short of leaving Bluetooth on. The exploit process is generally very fast, requiring no more than 10 seconds to complete https://arstechnica.com/information-technology/2017/09/bluetooth-bugs-open-billions-of-devices-to-attacks-no-clicking-required/ https://arstechnica.com/information-technology/2017/09/bluet... A browser update doesn't fix that and that and Blueborne was disclosed during the era when an Android device only had a support window of two of three years. iPhones from over a decade ago were getting security updates, including for the browser, for seven or eight years.
- daghamm 2y ago
  This was from 2017, and nothing came out of it. Every month or so someone (usually a security company that wants to sell something) find a domesday exploit for android that is unpatchable, and then it gets patched or turns out to be a non issue.
toast0 2y ago
> the browser tied to the OS ala Internet Explorer. Internet Explorer was usually only loosely tied to the OS. Yes, many versions of Windows came with some version of IE, but you could usually install a newer version if you wanted. Every once in a while, a newer version of IE required a newer version of Windows, but that wasn't typical. As I understand it, on Apple systems, Safari comes with the OS and is updated together --- Safari updates come in OS updates. Mobile IE was very similar though, at least on Windows Phone 7 and newer.
- JimDabell 2y ago
  > Safari comes with the OS and is updated together --- Safari updates come in OS updates. That’s true on iOS but not exactly true on macOS. Upgrading macOS also upgrades Safari, but you can also install newer versions of Safari on older versions of macOS. You just can’t have older versions of Safari on newer versions of macOS.