Hacker News Reader

Comment by pedrocr | Hacker News Reader

Manufacturers could do a better job at making screen replacements easy, as that's what breaks a lot. Other than that, having software updates for a long time is a much more important missing piece on Android than this. For anyone that cares about security Android phones become outdated far faster than the hardware becomes broken. Android One is a step in the right direction but there aren't enough manufacturers and models:

https://en.wikipedia.org/wiki/Android_One

Nokia is the only manufacturer that seems to have a whole range on it, and even they are messing with Android.

View on HN

Fairphone employee here.

I totally agree with your assessment. So does Fairphone. That's why we trying to address both issues with a modular design for ease of repairs and long lasting software updates.

Have a look at our current effort to bring continued software updates to our five year old predecessor Fairphone 2: https://www.fairphone.com/en/2020/06/18/fairphone-2-gets-and...

The problem is that updating Android this way doesn't fix the prevalent security issues in proprietary firmware from Qualcomm, e.g. the QualPwn vulnerabilities [1] from that allows remote takeover of the modem. Countless vulnerabilities like these are found every year, and currently-supported phones will get patches for them on a monthly basis, but those without BSP (board support package, i.e. drivers) updates will be left in the dust.

I suspect that the outdated downstream 3.4 kernel isn't even getting security fixes, so the QualPwn root takeover vulnerability (among many others) would be unpatched.

A big step in the right direction would be to work with Linaro, postmarketOS, and other parties actively involved in mainlining Qualcomm chipsets to forward-port the old SoC to a mainline kernel, or at least to a newer downstream Qualcomm kernel version. It's not trivial, but it's possible; I've ported my Pixel 2 XL with a Snapdragon 835 (kernel 4.4) to the 855's kernel version (4.14) with most features working. I never got around to finishing it and polishing it for daily use, but an actual company like Fairphone should have the resources to do so. In fact, there is already a WIP port of the FP2 to pmOS with a mainline kernel [2], and there's more mainlining work for it that has a decent amount of features working [3].

While this doesn't solve the firmware problems (which really can't be dealt with as even OEMs don't get a lot of the source code for the firmware), it still improves security (and performance!) by a lot since most severe vulnerabilities that users are most likely to be hit by are in the kernel. I think this is ultimately going to be the right way to go if Fairphone wants to keep updating devices for so long and patching as many security issues as possible.

Perhaps Fairphone could also negotiate a long-term support contract with Qualcomm? I noticed that the mid-range Snapdragon 660 that started on kernel 4.4 was officially forward-ported to kernel 4.14, probably due to some vendor requesting it.

Don't get me wrong: it's already much better than other manufacturers, and the BSP support problem is out of Fairphone's control, but it's still possible to make the best of the situation on the software side without relying on Qualcomm as much.

[1] https://blade.tencent.com/en/advisories/qualpwn/

[2] https://wiki.postmarketos.org/wiki/Fairphone_2_(fairphone-fp...

[3] https://wiki.postmarketos.org/wiki/Qualcomm_Snapdragon_800/8...

Yup, I totally agree with you. There are many issues — especially in firmware — which we are not able to address. We do backport linux security patches but that gets harder with each release.

We did indeed talk to other interested parties and attempted forward ports of the Qualcomm specific kernel features to LTS versions. I am not directly involved in that team anymore and sadly cannot tell you the exact reasons, but this failed to yield a usable kernel.

I do like your suggestion of long-term support from Qualcomm which was unfortunately not possible for the Snapdragon 801. For Fairphone 3, this is hopefully on the table again (especially, if — as you are saying — other customers also show interest in LTS support).

In summary, you make many great suggestions most of which we also attempted at some point. Unfortunately, the devil is often in the details.

That seems like a 2015 problem. Glass is much stronger now.

Reply on news.ycombinator.com