4 ms·
Might as well say it since nobody else commented about it, but modem/soc vendors are huge limiting factor on longterm android support. Qualcomm maintains these
by joecool1029 1y ago
Might as well say it since nobody else commented about it, but modem/soc vendors are huge limiting factor on longterm android support. Qualcomm maintains these updates for only a few years, basically nothing earlier than around 2020-2021 gets kernel driver or modem updates.
Of course it's still up to phone manufacturer to integrate these changes, but it puts an effective security support timeline on even 3rd party ROM's like lineageos. They can cherrypick, but it's not as secure once that support ends.
Apple has almost everything in-house (except until recently, modems). So they have a ton of flexibility in continuing to provide updates.
- loeg 1y agoSure, but like, this is a fundamental flaw with the Android model. It's valid to criticize Android for this.
- worthless-trash 1y agoThe other fundamental flaw in the iphone market is that NOBODY can fix bugs in ios but apple, I have personally fixed bugs in my android builds.
- testdelacc1 1y agoThat’s great for you. But it doesn’t make a difference to the other 99.999999% of users who only install whatever is available from automatic system updates. It’s the equivalent of saying in response to a political issue that affects all of society - doesn’t really affect me because I flew to my private island. We’re happy for you, but how does that advance the conversation?
- worthless-trash 1y agoJust because everyone doesn't do what I do, doesn't make it wrong.
- testdelacc1 1y agoI’m not saying you’re wrong. It’s just irrelevant. So what if you can patch the issue on your phone, how does that affect the rest of society? It just sounds like you’re bragging about your technical chops, like a person with a private island would be flexing their wealth.
- worthless-trash 1y agoNot at all, anyone can do what I do, they just dont care most of the time.
- heavyset_go 1y agoAll it takes is for one person to fix a bug for it to potentially be a solution for others. That option is not on the table for anyone using iOS.
- jb1991 1y agoI question your use of the word “fundamental“.
- worthless-trash 1y agoSame as OP's fundamental.
- jb1991 1y agoUsername makes sense.
- treesknees 1y agoMy problem with this argument is many of these types of CVEs have nothing to do with baseband firmware or drivers or anything else controlled by Broadcom. Google could still patch security issues in the parts of the system most exposed to attackers, namely the libraries and apps in the OS itself. I’d be more afraid of a zero day image parsing bug in messages, where I could be exploited with a drive-by spam text or hyperlinked image, than some theoretical baseband attack by someone in a privileged cell network system.
- lloeki 1y agoThe problem is that baseband or whatever drivers are made in kernel trees that are essentially forks of the kernel at a certain point in time. This means that any fix needs to be backported to that special tree, irrespective of whether the Broadcom code is impacted, which may prove challenging when you end up having not just one but many trees, each at slightly different levels of outdatedness. The approach clearly does not scale. The solution would be for Broadcom to be diligent and forward port their tree to current mainline or current LTS at a minimum but they won't do that. See how the RPi kernel is generally stuck at a special old version (e.g 6.6 for pi4, which is quite reasonably a LTS but then there's 6.12 as LTS already)
- saagarjha 1y agoThey do; many of the system apps and libraries are updated via the Google Play Store.
- jeroenhd 1y agoThat's part of the reason why Google is pulling more and more stuff out of AOSP and into Google Play. They started with the WebViews that vendors refused to update leading to all kinds of exploitation. These days, system components like the bytecode runtime and the Bluetooth stack can be updated by Google, unless the manufacturer actively prevents Google from doing that. Firmware remains an issue, and IOMMU protections aren't all that great on every single device, but more and more Android internals get maintained by Google these days. As for messages, there is always a risk in the pipeline between modem and the system service, but the Messages app is just another app you can update through Google Play or whatever store you prefer. Same with the dialer app and plenty of other apps. The super-integrated components that make for preferred exploitation targets on iOS aren't set up the same way on Android (not that Android doesn't have other attack vectors, of course).
- chillfox 1y agoSounds like something Google could solve with contracts and money if they wanted to.
- hsbauauvhabzb 1y agoI pay a vendor for something in my product and the vendor support period is limited, as a consumer, that should not be your problem.
- JustExAWS 1y agoEspecially seeing that Microsoft has the same business model with Windows and PCs don’t have this problem.
- deleted 1y ago[deleted]
- qalmakka 1y agoWhich is insane if you think about it. 20 year old NICs are still supported by the kernel. Hardware drivers should be GPLd, no ifs and no buts. As if having closed source drivers gave OEMs a competitive advantage, it's basically all for planned obsolescence
- yjftsjthsd-h 1y agoI believe the hardware drivers usually are GPL, the problem is that they are... at best, they are downstream patches that require ongoing work to port to newer kernel versions (since Linux doesn't do stable ABIs or APIs for drivers).
- hamandcheese 1y agoApple depends on Qualcomm just like everyone else (except for the new iPhone Air)... so this really doesn't seem like a valid excuse for Android manufacturers.
- joecool1029 1y agoThey don't though (also the 16e has in-house apple modem, I have no idea what the fate of the intel modems was). The majority of other vendors' designs get full qualcomm soc's with dsp, modem, security processor firmwares. Apple literally has the scale to go to Qualcomm and buy slightly customized variants (the X71, for instance). And those modems are integrated with their custom Apple designed chips. I don't see any other vendor able to do that.
- pjmlp 1y agoWhat puts down that common excuse, is that there is this legal thing called contracts, that can force to provide updates as long as customers (OEM) want. We do them all the time in enterprise consulting, regarding how long to provide support after the project is considered delivered.