28 ms·

> such devices often run on outdated Android versions, Ah the new economical divide. Most "real people" also have phones which aren't receiving updates for a

> such devices often run on outdated Android versions, Ah the new economical divide. Most "real people" also have phones which aren't receiving updates for a few years by now. In south america the median android version is 8. And phones are not optional as most countries already jumped into both digital government and money transfer.

kome 2y ago
mobile first was a mistake
jmyeet 2y ago
Updates for Android continue to be a huge problem. Android OEMs have historically been terrible at releasing timely updates (it can take months), releasing updates at all (particularly cheap Android phones get EOLed long before an admittedly way more expensive iPhone would) and such updates aren't typically pushed in the same way. One big problem with Android is the way driver updates work. It's a nontrivial process to add hardware support for a later Android version because of the Linux roots and having no stable ABI. I think back to how Windows has changed over the last 2 decades. Once Windows updates were all paid and people would hang on to old versions of Windows forever. Microsoft eventually realized this was a problem for them so paid upgrades aren't what they once were. Additionally, driver instability used to be a massive problem on Windows. Microsoft to their credit spent a lot of effort improving their driver situation to isolate drivers and have a stable ABI. Windows is way more stable than it was 20 years ago. Even OSX has adopted user space drivers (DriverKit). By the way, the above reasons is why some at Google have pushed Fucshia as essentially an Android ecosystem and architecture reset. It's been close to 10 years now. I don't see this going anywhere despite billions being poured into it at this point.
- wappieslurkz 2y ago
  May I ask what mobile OS you use?
- 1oooqooq 2y ago
  Fuchsia was a backup plan. Google is now the only option for phone manufacturers. No backup needed. Plan A worked.
  - saghm 2y ago
    I'm not sure I understand how having a second OS would hedge against people not wanting to use their first OS, but Fuschia being some sort of backup plan would at least explain why it didn't really ever get used. My guess was always that it just didn't ever have full support as a replacement due to turf wars with people in charge of Android-related things.
  - throwaway48476 2y ago
    Fuchsia is a jobs program to prevent OS devs from making something that fan compete with android.
- tannhaeuser 2y ago
  > Windows is way more stable than it was 20 years ago. The problem with Windows today is more that it wants to opaquely update itself all the time, and the user gets undesired mandatory "updates" such as ads in menus and sending "telemetry" home (ie user activity data for MS' machine learning ambitions). But of course the most important thing is to keep fucking web browsers up-to-date with laughable and undesired CSS or WASM features (including subsequent exploit/fingerprinting fixes) all the time and even more often than actual content, or what's left of it anyway on the extant web.
  - afavour 2y ago
    This just reads as a grab bag of complaints about modern tech with little relevance to the topic at hand
    - kasabali 2y ago
      Modern tech has everything to do with the topic at hand.
  - secondcoming 2y ago
    Ubuntu and Debian both have unattended-uogrades running by default
- ajross 2y ago
  > Updates for Android continue to be a huge problem. As is being pointed out elsewhere, this isn't a vulnerability in an "Android" product. These are TVs running vendor-maintained AOSP builds. They get updates when and how the vendor decides to do it. It's not related to the (fairly reasonable, though often spun) arguments about updates in the phone licensee ecosystem.
  - jmyeet 2y ago
    This is a distinction without a difference. It's not like you can take your Android hardware and move to a different software supplier. You're stuck with whatever your OEM chooses to do or not do. It's also something you don't necessarily have knowledge of when you purchase a phone. It's one reason why people (myself include) prefer Apple. You know you're going to get 4-5+ years of updates.
    - ajross 2y ago
      > This is a distinction without a difference. No? For a licensed Android phone there's a clean split between OEM and OS updates, a clear declaration for support period and a OS-managed tracking of updates with clear visibility to the customer. I get that there are constant platforms flames about whether this is acceptable or inferior to Apple's offering, yada yada yada. But the point is that none of that is relevant here, because these aren't phones and aren't running a licensed "Android" variant. They're just TVs running vendor-custom firmware that happens to be based on AOSP, and clearly can't be expected to conform to any update regime except whatever the integrator put together. Basically, the story here is saying "I hacked product A" and you're trying to have an argument like "That's because this unrelated product B is bad". It's a non-sequitur.
- Krssst 2y ago
  I am using an Android phone which gets timely updates. However the vendor does not seem to do enough testing for major versions and has ended up with at least one significant bug upon release twice. I could do with less timely updates that come with less bugs.
donkeybeer 2y ago
Its a self created problem of locked down user hostile devices. Operating system and software upgrades are not locked to the hardware manufacturer in the laptop world (not yet, for the most part). It is a pipe dream of mine that someday these attacks are used as an excuse by some government perhaps the EU to force opening up devices for install of other operating systems, maybe forced to open sourcing firmware etc.
- ThatMedicIsASpy 2y ago
  It is the reason why I have Windows tablets not Android ones. I know there are OS updates. And once they are dead I have options for Linux tablets now.
  - shakna 2y ago
    Windows 8 stopped receiving updates in January last year, which killed my Surface for me.
    - prmoustache 2y ago
      couldn't you install/upgrade win10 ( and possibly win11 ) on it? Last time I checked you could totally use drivers built for windows 7 on a win 10 OS.
- F7F7F7 2y ago
  Fragmentation used to be touted as a feature of Android, not a … well, you know. “Freedom”, I believe they called it. Also, hardware standardization in the PC world is pretty much a thing. Not so much in the mobile (and mobile offshoot) world.
  - donkeybeer 2y ago
    And honestly I doubt 99.9% of these attacks are anything hardware specific but rather generic software bugs like buffer overflows in the kernel, so hardware is in any case a moot point.
  - 2y ago
yas_hmaheshwari 2y ago
Out of curiosity, where did you find this data (genuine question) After reading your comment, I was trying to find that for India, and landed on this page: https://gs.statcounter.com/android-version-market-share/all/india https://gs.statcounter.com/android-version-market-share/all/..., and thought that India it is Android 13 But then for South America, the same page (https://gs.statcounter.com/android-version-market-share/all/south-america https://gs.statcounter.com/android-version-market-share/all/...) tells should be Android 13 as well India also has the same setup - digital money transfer happens via phones (in some ways, your phone number is your identity)

kome 2y ago

mobile first was a mistake

jmyeet 2y ago

Updates for Android continue to be a huge problem. Android OEMs have historically been terrible at releasing timely updates (it can take months), releasing updates at all (particularly cheap Android phones get EOLed long before an admittedly way more expensive iPhone would) and such updates aren't typically pushed in the same way. One big problem with Android is the way driver updates work. It's a nontrivial process to add hardware support for a later Android version because of the Linux roots and having no stable ABI. I think back to how Windows has changed over the last 2 decades. Once Windows updates were all paid and people would hang on to old versions of Windows forever. Microsoft eventually realized this was a problem for them so paid upgrades aren't what they once were. Additionally, driver instability used to be a massive problem on Windows. Microsoft to their credit spent a lot of effort improving their driver situation to isolate drivers and have a stable ABI. Windows is way more stable than it was 20 years ago. Even OSX has adopted user space drivers (DriverKit). By the way, the above reasons is why some at Google have pushed Fucshia as essentially an Android ecosystem and architecture reset. It's been close to 10 years now. I don't see this going anywhere despite billions being poured into it at this point.

wappieslurkz 2y ago
May I ask what mobile OS you use?
1oooqooq 2y ago
Fuchsia was a backup plan. Google is now the only option for phone manufacturers. No backup needed. Plan A worked.
- saghm 2y ago
  I'm not sure I understand how having a second OS would hedge against people not wanting to use their first OS, but Fuschia being some sort of backup plan would at least explain why it didn't really ever get used. My guess was always that it just didn't ever have full support as a replacement due to turf wars with people in charge of Android-related things.
- throwaway48476 2y ago
  Fuchsia is a jobs program to prevent OS devs from making something that fan compete with android.
tannhaeuser 2y ago
> Windows is way more stable than it was 20 years ago. The problem with Windows today is more that it wants to opaquely update itself all the time, and the user gets undesired mandatory "updates" such as ads in menus and sending "telemetry" home (ie user activity data for MS' machine learning ambitions). But of course the most important thing is to keep fucking web browsers up-to-date with laughable and undesired CSS or WASM features (including subsequent exploit/fingerprinting fixes) all the time and even more often than actual content, or what's left of it anyway on the extant web.
- afavour 2y ago
  This just reads as a grab bag of complaints about modern tech with little relevance to the topic at hand
  - kasabali 2y ago
    Modern tech has everything to do with the topic at hand.
- secondcoming 2y ago
  Ubuntu and Debian both have unattended-uogrades running by default
ajross 2y ago
> Updates for Android continue to be a huge problem. As is being pointed out elsewhere, this isn't a vulnerability in an "Android" product. These are TVs running vendor-maintained AOSP builds. They get updates when and how the vendor decides to do it. It's not related to the (fairly reasonable, though often spun) arguments about updates in the phone licensee ecosystem.
- jmyeet 2y ago
  This is a distinction without a difference. It's not like you can take your Android hardware and move to a different software supplier. You're stuck with whatever your OEM chooses to do or not do. It's also something you don't necessarily have knowledge of when you purchase a phone. It's one reason why people (myself include) prefer Apple. You know you're going to get 4-5+ years of updates.
  - ajross 2y ago
    > This is a distinction without a difference. No? For a licensed Android phone there's a clean split between OEM and OS updates, a clear declaration for support period and a OS-managed tracking of updates with clear visibility to the customer. I get that there are constant platforms flames about whether this is acceptable or inferior to Apple's offering, yada yada yada. But the point is that none of that is relevant here, because these aren't phones and aren't running a licensed "Android" variant. They're just TVs running vendor-custom firmware that happens to be based on AOSP, and clearly can't be expected to conform to any update regime except whatever the integrator put together. Basically, the story here is saying "I hacked product A" and you're trying to have an argument like "That's because this unrelated product B is bad". It's a non-sequitur.
Krssst 2y ago
I am using an Android phone which gets timely updates. However the vendor does not seem to do enough testing for major versions and has ended up with at least one significant bug upon release twice. I could do with less timely updates that come with less bugs.

donkeybeer 2y ago

Its a self created problem of locked down user hostile devices. Operating system and software upgrades are not locked to the hardware manufacturer in the laptop world (not yet, for the most part). It is a pipe dream of mine that someday these attacks are used as an excuse by some government perhaps the EU to force opening up devices for install of other operating systems, maybe forced to open sourcing firmware etc.

ThatMedicIsASpy 2y ago
It is the reason why I have Windows tablets not Android ones. I know there are OS updates. And once they are dead I have options for Linux tablets now.
- shakna 2y ago
  Windows 8 stopped receiving updates in January last year, which killed my Surface for me.
  - prmoustache 2y ago
    couldn't you install/upgrade win10 ( and possibly win11 ) on it? Last time I checked you could totally use drivers built for windows 7 on a win 10 OS.
F7F7F7 2y ago
Fragmentation used to be touted as a feature of Android, not a … well, you know. “Freedom”, I believe they called it. Also, hardware standardization in the PC world is pretty much a thing. Not so much in the mobile (and mobile offshoot) world.
- donkeybeer 2y ago
  And honestly I doubt 99.9% of these attacks are anything hardware specific but rather generic software bugs like buffer overflows in the kernel, so hardware is in any case a moot point.
- 2y ago

yas_hmaheshwari 2y ago

Out of curiosity, where did you find this data (genuine question) After reading your comment, I was trying to find that for India, and landed on this page: https://gs.statcounter.com/android-version-market-share/all/india https://gs.statcounter.com/android-version-market-share/all/..., and thought that India it is Android 13 But then for South America, the same page (https://gs.statcounter.com/android-version-market-share/all/south-america https://gs.statcounter.com/android-version-market-share/all/...) tells should be Android 13 as well India also has the same setup - digital money transfer happens via phones (in some ways, your phone number is your identity)