Hacker News Reader

Comment by scaladev | Hacker News Reader

> The cherry on top was to stop paying each year for a new smartphone, that does nothing more than the previous one

Why were you buying new phones every year? This is such a non-argument. I've been using the same Android phone for almost 7 years. It does everything I want it to do. Sure, I spent a couple of days trimming down the system, and carefully selecting applications (for example, the Google Clock from 2015 weighs about 3 MB and is very fast, while the same application from 2020 is about 30 MB and is extremely slow to start, despite having the same feature set).

View on HN

There are only a tiny handful of Android phone models that get security patches after 2–3 years are up, and they are generally rather expensive phones. Sometimes phones are supported for longer by LineageOS, but the LineageOS devs emphasize that they are only a group of hobbyists, they don't work for you, and they can drop support for a phone any time they want (because they e.g. lost their phone of that model, or simply lost interest).

That's still not every year though.

I don't think so

It could be. I have twice been burned by LineageOS. I wanted a deGoogled Android phone, but the only LineageOS-supported models that were available in my region, and which I could afford, had been initially released already 1.5–2 years before. Not only was my new phone soon abandoned by the manufacturer, it was also suddenly dropped by LineageOS after only about a year of my owning it.

The prospect of truly long-term support for years and years is one reason I bought a PinePhone and have been keeping track of its development. But sadly the current PinePhone has too ancient and underpowered a CPU to be useful.

guess the reasoning is that there is a lot less attack surface when used in a way where number of apps is reduced to 2-3 (I have such a set-up and for my purpose even an older non-smart motorola flip phone would do the trick).

as soon as I want to do video calls at reasonable speeds, it's probably in my interest to have moderately new hardware and chipsets supporting things like beamforming or other things that only more recent hardware can give me. but even here my 8 yro phone does everything I want it to so that argument kicks only in for truly ancient hardware (e.g. LTE support etc)

Many people I know, who are much smarter than me, keep their Android phones for 3, 4, 5 years. So I'm not sure this is an issue.

It's totally an issue.

There have been tons of critical Android vulnerabilities over the last years that cannot be fixed by app updates, e.g. remote code execution via Bluetooth stack or MMS.

are there really people hunting around preying on old, vulnerable Androids? The argument is, there are too few of them for any serious actor to waste time trying to hack one. It's just not worth it. This makes them pretty secure, for the simple reason they are ignored. Obviously old Androids are only scarce because the general population keep buying the latest. They are essentially a buffer zone to protect the Hackers..

> are there really people hunting around preying on old, vulnerable Androids?

Yes. Because like windows the ecosystem is huge, and there are plenty of grandmas who don't know how or why to update things.

Much of the world can't afford to replace their phone every 2 years.

Yes. There are active Android malware campaigns sending out links via text message. I know because I recently received one.

Right now you can get vanilla Android on most recent devices, same image for all of them thanks for the Treble project, that separated kernel and hardware drivers from Android system.

https://github.com/phhusson/treble_experimentations

Here's something horrifying for you. I ran Android 5.x with updates blocked for 5 years, and even now that phone works unchanged! I also disable Spectre/Meltdown mitigations in Windows and undervolt my processors! I have no antivirus! I don't lock my door at night and my dog is going deaf with old age!

Oooh, even I shudder when reading that! :D

It's all fun and games until you get some huge charges in your credit card, or your bank details leaked, or some fraud is commited in your name with you details and everything...

After the Target credit card leak and the Equifax leak it really doesn't matter anymore. Besides, Visa typically just refunds you.

It's really about someone taking an undetected loan out in your name, credit card fraud is not a big deal to the regular consumer anymore.

If you really believe that give me your social security number and credit card details.

I won't do anything with em, pinky-promise, but if something did happen, it doesn't matter, right? Just talk to Visa.

Like, why lock my car and house doors when insurance will pay for it?

> Like, why lock my car and house doors when insurance will pay for it?

Because you'll have a really hard time with a claim if there's no sign of forced entry, since many insurance policies are void in this situation?

> Just talk to Visa.

Yes, just call them. By regulation, you're not liable for unauthorized use of credit card (specifically, credit card). As a consumer you have zero concerns about card theft.

Name one big leak that would have been stopped by patching his phone, patching Windows, running AV, or locking his door at night...

It's enough to name hundreds of thousands of personal leaks that have happened by not doing those things...

If your attitude to security is "I can run my computer with unpatched XP with a public IP and sync it to a 7 year unpatched phone because once in a blue moon some credit card company or major business can leak my account data there too", then sure...

If its enough to name hundreds of thousands of leaks that have been caused by those behaviors, then you should be able to name one.

Sorry, you want me to name a person who had their info/data leaked because of unpatched OS/broswer/mobile?

Might as well ask me to name "one" covid victim, lest they're all "actors".

My uncle, for one, had a randomsware attack 3 years ago, crippling his (small, construction services) company for weeks.

You are aware that there are tons of malware attacks, computers controlled as bots (doing mining, DDoS, etc.), ransomware, etc, right? Or is this some episode of the Twilight Zone?

https://www.csoonline.com/article/2923557/many-ransomware-vi...

https://krebsonsecurity.com/2019/12/ransomware-gangs-now-out...

https://www.securityweek.com/google-sophisticated-apt-group-...

https://www.securityweek.com/sierra-wireless-says-ransomware...

The Fappening, for one.

It's for this reason that I do online banking and investing on my personal laptop. Seeing as how I pretty much open both apps twice a month max, I have no need to install the mobile app.

I don't use Google/Samsung Pay either. They literally do the same thing as the credit + debit card in my wallet. But their advertisements would have you believe they've somehow reinvented consumer finance.

None of that can happen if you don't enter your credit card or bank info into your phone. Treat it as just a phone and it doesn't matter.

Phone operating systems have so many issues that there's no way I'll trust them with any important data.

I keep hearing this argument but I don't understand it. What does not having security patches do?

I am using an HTC Desire 826 from 2016 running Android 6, while my father is using a Galaxy Note 3 Neo running Android 4.3.

I personally don't have much issues with regards to not having security patches.. the phone itself does most of what I want, although I am having issues with other things unrelated to security patches -- it's getting a bit sluggish, the 16GB storage does get annoying, and the battery barely lasts two hours of web browsing. Also, it no longer accepts SIM cards for whatever reason. But it's not a big deal to warrant spending money (I don't get called at all and I do have a dumb phone that I go out with for emergencies. Besides, I no longer get annoying messages and calls from my carrier)

Similarly, my father's is doing alright, and the issues he is facing are unrelated to security patches -- many apps don't support Android versions older than 6.. some of them are essential things like Google stuff. YouTube and Gmail for instance outright don't work, and Chrome occasionally brings up messages along the lines of "Please update your Chrome version". But nothing is caused by not having security patches.

What am I missing? This is a genuine question.

That you have not noticed problems as a result of not having security problems doesn't mean that there aren't problems, and doesn't mean that there won't be problems. Maybe you've lucked out and haven't actually gotten malware yet, and maybe tomorrow you open your phone to a ransomware message, or maybe you've had spyware for 3 months and just not noticed.

Good point, but wouldn't there have been more pressure on the OEMs to increase security patch support if this were a widespread issue? Because most do 2 - 3 years.

If I'm not mistaken, LineageOS support is good but not good enough. Vulnerabilities in the higher level Android system will be fixed, but updates to the kernel must be provided by the vendor on many (most? all?) devices.

This is true. Most Android devices run forked kernels supplied by manufacturers. Once the manufacturers stop updating the kernel, the device is stuck using the old kernel forever. I have several phones running LineageOS that I use as remotes for my TVs, and they'll never see a kernel beyond the 3.x fork the manufacturers released 5+ years ago.

This issue is indicative of the larger problem ARM SoCs pose to consumers: manufacturers choose not to design ARM boards with SBSA-like features[1] because it's cheaper to do so. While x86 machines have enumerable buses for hardware discovery, as well as ACPI support, ARM SoCs don't. As a result, mainline Linux kernels won't boot on them, they require a kernel fork, and a kernel fork must be maintained. Manufacturers have no incentive to maintain that fork for more than a year or two.

As ARM SoCs take over what are considered general purpose computing devices, like laptops, devices that we once thought of as being upgradable, software-wise, suddenly aren't. Apple's M1 Macs are an example of this. To get Linux running on them is a massive undertaking, and running Linux on them in the long-term means relying on a third party to build and maintain M1-specific images in perpetuity, because the SoCs can't run the generic ARM images that ARM servers can run.

There are mitigations against this problem in Linux, like Device Tree[2] support, but that is only one small part of the big[2] undertaking when it comes to porting Linux to ARM SoCs.

[1] https://en.wikipedia.org/wiki/Server_Base_System_Architectur...

[2] https://en.wikipedia.org/wiki/Device_tree

[3] https://elinux.org/images/a/ad/Arm-soc-checklist.pdf

I use iPhones (the SE type versions) because they receive updates for like 5 years. Ideally it’d be more like 10 years, but this is still much better than typical Android and WAY better than “once a year.”

Yep! New iPhone SE for five years is the way forward. They are powerful enough to use day-to-day with pretty much zero lag, have screens large enough to read comfortably, and have the useful features (Apple Pay) of the pricier phones. The camera is still decent, but I prefer my mirrorless anyway.

Does your 7 year old android phone receive security patches?

Maybe I've been lucky here but my Oneplus One (April 2014), now flashed with lineageOS is still receiving updates.

Android version: 10.

Android security patch level: March 5 2021.

> now flashed with lineageOS

Your device is not stock and is, therefore, an exception.

How old is the kernel?

Kernel version: 3.4.113-lineageos-g168ab7a #1 Thu Mar 11 08:34:55 UTC 2021

Does an Android phone without security patches cease to function?

OS security patches are less of a concern for older devices because the majority of the OS was still moved into Google Play Services and as long as the apps are still updated (eg, Chrome), the risk is very low.

At least for me, I don't do banking on my phone and my main email is not tied to my phone.

At the end of the day, that's really the only safe way to use a phone.

My 14 year old Motorola Razr doesn't receive any security patches.

Sad how gadgets become ever more brittle and unreliable as they get newer.

Not to mention that if you know people who are constantly upgrading their phones, then you have a supply of free phone upgrades anyway, just a year or two behind everyone else.

You can get excellent quality refurbished(aka renewed) phones for incredibly cheap that are only a year or two behind the current models. I don't think I've ever bought a brand new phone and paid full price. In fact, I only buy a new phone when the battery starts to die and it's not serviceable. I can't honestly say I understand why people believe they need to buy the latest phone every year or two.

Same with cars. I fail to understand why anyone would spend 20k on a brand new Focus, for example, when for the same money you can get a 5 year old Mercedes c (also an example)

I'm fairly confident in terms of total cost of ownership and reliability of a new Focus will outlast the 5 year old C class.

Buy one for 15k. It will still be better and i doubt the difference will come to more than "total cost of ownership".

of course it's a bigger car so more expensive to run. so buy a 5yo focus and get the best of both worlds.

Yeah, was my thought too. A 2018 Focus will probably be pretty reliable, still have some parts under warranty, and have a lower TCO than having to insure and repair an older Mercedes.

Maybe outside of North America. The automatic transmission had big problems here. Ford tried to game the fuel economy with a cheap unreliable transmission. Unlike other regions which got torque-converted autos and popular manual options, almost all the Foci were sold with a dry Dual Clutch Transmission (DCT). This worked on the highway, but around town is was programmed to "crawl" like an automatic, slipping the dry clutch and wearing out very fast. Big class actions happened and now Ford quit selling cars here, only Mustangs and trucks.

Some older Mercedes might have a lower TCO than a 2018 focus, but only because the focus is disastrously unreliable.

I'm pretty sure this isn't as true as it once was. All of the used cars I've purchased that were manufactured in the last 15 years have been nearly impossible to destroy (without outright crashing them) even with extreme negligence. Not only that, but they were always in pretty good shape. That's just my experience, though. I've still not even come close to the cost of buying new versions of any of the cars I've owned.

> Why were you buying new phones every year? This is such a non-argument. I've been using the same Android phone for almost 7 years.

Most Android phones run forked kernels, so even if you put LineageOS on them for security updates, they're still stuck on ancient kernels. I have phones with LineageOS on them that will never see a Linux kernel newer than the 3.0 fork the manufacturer released.

Google's target is for three years of OEM support on Android. In practice even that minimal standard is all too frequently not met.

>Why were you buying new phones every year? This is such a non-argument.

Many people do. You'd be surprised.

Right, but it's a choice. I still run an iPhone 6, and I really haven't felt limited by it.

I miss my iPhone 6. I thought the SE would fill it's shoes, but the lack of headphone jack makes me constantly regretful. I'm shocked by how many people tell me to "Just put a new stereo in your car" or "Upgrade to a Bluetooth receiver" or "Buy new headphones" or "Just carry that shitty adapter around with you all the time..." Not only should I spend $600 on my phone, but I should also apparently upgrade every single audio device that I own so that smart phone makers can save $1 on each phone they sell.

> so that smart phone makers can save $1 on each phone they sell

What Apple mentioned in the iphone 7 reveal, which was when they made headlines for removing the jack, was that it is a bulky component that extends quite far into the phone, competing for precious real estate with other components.

Right, which makes the phone easier to build and thus saves money. There's no getting around the fact that money is the #1 reason they have started omitting the jack. Apple has no other reason to leave out a feature that adds a convenient redundancy to a common use-case. There's literally no other negative to leave out the jack other than cost.

> There's literally no other negative to leave out the jack other than cost.

I believe there is. When designing a product, one always operates within a given set of contraints. Removing one of the constraints of the design makes it easier to hit the rest of the objectives. You might argue that easier design = reduced costs but IMO that would be too loose of a definition of "costs" in this case.

Consider the lower end of the market: budget phones have cheaper cameras, cheaper screens, cheaper processors - why? Because these are indeed good targets for cost cutting. They all have headphone jacks though. To me, that suggests that cost is not the issue here.

But none of those ultra budget phones are trying to hit the weight or form-factor targets that Apple is.

People are different. Perhaps he tends to go down slippery slopes with this kind of things. I know I do.

Yeah, I buy new phone when old breaks or is not sufficient for my needs. No reason to buy more often.

Reply on news.ycombinator.com