4 ms·

This needs more coverage. Perfectly good phones are getting thrown out because of a software update.

deng 2y ago
Google ended security updates for the Pixel 4a in August 2023, so running this as your daily driver was already problematic. Fortunately, LineageOS officially supports the 4a, and v22 (aka Android 15) was just released for it.
- red_trumpet 2y ago
  That point is so weird: Why offer a "performance update" 1.5 years after the end of security updates?
  - bdndndndbve 2y ago
    Given the sudden urgency and pulling the old software, I'm assuming they're trying to avoid aging batteries exploding.
    - patall 2y ago
      But then they should indicate that. Which they don't.
      - ikiris 2y ago
        They did as much as they would.
- alistairSH 2y ago
  Isn't that just 3 years after release? Is that normal for Google phones? Yikes.
  - mananaysiempre 2y ago
    For older Google phones (as well as most other Android ones) it is the standard. (AFAIU this was mostly due to Qualcomm’s policies and lack of pushback from Google et al.) Newer Google ones get 5–7 years[1], and Samsung has also switched to a similar support term (but keep in mind that only Samsung’s flagships get monthly security updates). [1] https://support.google.com/pixelphone/answer/4457705 https://support.google.com/pixelphone/answer/4457705
- ndriscoll 2y ago
  This attitude (and the word "problematic") is so tiring. What is the actual problem with running it as your daily driver? What specific vulnerability are you actually concerned about? Unless there's something like an arbitrary code execution bug in one of the networking/radio stacks, "there aren't updates" is a statement with approximately zero useful information.
  - deng 2y ago
    OK, let me google it for you: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-43096 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-43096 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43770 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4377... https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43771 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4377... https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49747 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49747 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49748 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49748 These are just the RCE bugs without user interaction that were fixed with the January update. They are in the Bluetooth stack.
    - chasil 2y ago
      Just curious, does current LineageOS close these CVEs? I know they pull firmware from disparate devices when possible.
      - deng 2y ago
        I didn't check each one explicitly, but it looks promising https://review.lineageos.org/q/gatt_sr.cc https://review.lineageos.org/q/gatt_sr.cc
    - ndriscoll 2y ago
      So I'm not terribly familiar with Bluetooth. Are these something that can be exploited by an unpaired device? "Google Android on a Pixel 4a is vulnerable to remote code execution by arbitrary nearby wireless devices" is certainly a better reason to not use one than "security updates have ended".
dont__panic 2y ago
There's been a lot of activity on Reddit and Android tech news websites. /r/Pixel4a has been absolutely busy with activity lately, lots of people asking for help. Decent summary post here: https://www.lambdalatitudinarians.org/techblog/2025/01/09/the-day-google-killed-the-pixel-4a/ https://www.lambdalatitudinarians.org/techblog/2025/01/09/th...
toast0 2y ago
My experience was kid dropped my old phone on holiday, we tried to remember why my spouse's old phone got replaced, and remembered she had a pixel 4a and the battery life had gotten really poor. There was some news at the time that the 4a would be getting a 'battery performance update' and that it would result in some users getting a warning about their battery performing poorly and some would be eligible for $50 or a repair. When I eventually got around to prepping the phone for the kid, lo and behold, the update was ready, I did it, and the battery was bad, and it linked me to the battery performance campaign page... Which needed the IMEI, then said I could get $50, a $100 coupon or bring it in for repair, and there was a shop reasonably near me. I brought it in and they swapped the battery in about 2 hours with no extra drama. I don't know why you would throw your phone out from this update... Although I wouldn't be surprised if you had already thrown it out because the battery performance was an issue before the update too.

deng 2y ago

Google ended security updates for the Pixel 4a in August 2023, so running this as your daily driver was already problematic. Fortunately, LineageOS officially supports the 4a, and v22 (aka Android 15) was just released for it.

red_trumpet 2y ago
That point is so weird: Why offer a "performance update" 1.5 years after the end of security updates?
- bdndndndbve 2y ago
  Given the sudden urgency and pulling the old software, I'm assuming they're trying to avoid aging batteries exploding.
  - patall 2y ago
    But then they should indicate that. Which they don't.
    - ikiris 2y ago
      They did as much as they would.
alistairSH 2y ago
Isn't that just 3 years after release? Is that normal for Google phones? Yikes.
- mananaysiempre 2y ago
  For older Google phones (as well as most other Android ones) it is the standard. (AFAIU this was mostly due to Qualcomm’s policies and lack of pushback from Google et al.) Newer Google ones get 5–7 years[1], and Samsung has also switched to a similar support term (but keep in mind that only Samsung’s flagships get monthly security updates). [1] https://support.google.com/pixelphone/answer/4457705 https://support.google.com/pixelphone/answer/4457705
ndriscoll 2y ago
This attitude (and the word "problematic") is so tiring. What is the actual problem with running it as your daily driver? What specific vulnerability are you actually concerned about? Unless there's something like an arbitrary code execution bug in one of the networking/radio stacks, "there aren't updates" is a statement with approximately zero useful information.
- deng 2y ago
  OK, let me google it for you: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-43096 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-43096 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43770 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4377... https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43771 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4377... https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49747 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49747 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49748 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49748 These are just the RCE bugs without user interaction that were fixed with the January update. They are in the Bluetooth stack.
  - chasil 2y ago
    Just curious, does current LineageOS close these CVEs? I know they pull firmware from disparate devices when possible.
    - deng 2y ago
      I didn't check each one explicitly, but it looks promising https://review.lineageos.org/q/gatt_sr.cc https://review.lineageos.org/q/gatt_sr.cc
  - ndriscoll 2y ago
    So I'm not terribly familiar with Bluetooth. Are these something that can be exploited by an unpaired device? "Google Android on a Pixel 4a is vulnerable to remote code execution by arbitrary nearby wireless devices" is certainly a better reason to not use one than "security updates have ended".

dont__panic 2y ago

There's been a lot of activity on Reddit and Android tech news websites. /r/Pixel4a has been absolutely busy with activity lately, lots of people asking for help. Decent summary post here: https://www.lambdalatitudinarians.org/techblog/2025/01/09/the-day-google-killed-the-pixel-4a/ https://www.lambdalatitudinarians.org/techblog/2025/01/09/th...

toast0 2y ago

My experience was kid dropped my old phone on holiday, we tried to remember why my spouse's old phone got replaced, and remembered she had a pixel 4a and the battery life had gotten really poor. There was some news at the time that the 4a would be getting a 'battery performance update' and that it would result in some users getting a warning about their battery performing poorly and some would be eligible for $50 or a repair. When I eventually got around to prepping the phone for the kid, lo and behold, the update was ready, I did it, and the battery was bad, and it linked me to the battery performance campaign page... Which needed the IMEI, then said I could get $50, a $100 coupon or bring it in for repair, and there was a shop reasonably near me. I brought it in and they swapped the battery in about 2 hours with no extra drama. I don't know why you would throw your phone out from this update... Although I wouldn't be surprised if you had already thrown it out because the battery performance was an issue before the update too.