Hacker News Reader

Comment by signal11 | Hacker News Reader

> Meanwhile, my flagship android phone from 2018, the Samsung Galaxy S9, is stuck on the last version of Android.

That's inexcusable, and this attitude carried over to security updates is a big reason some corporates left Samsung and went to Apple -- e.g. the A5, a midrange phone comparable with the iPhone SE, lost access to updates when the device was perfectly usable.

Samsung must've felt the feedback, because this year they announced a formal policy on security updates -- too late for the S9, but customers from S10 onwards ought to benefit[1]. They've been a lot better with Android updates on newer phones too -- Project Treble probably played a role.

> Galaxy devices will now receive regular security updates for a minimum of four years after the initial phone release. By extending support for security updates delivered on a monthly, quarterly or biannual basis

[1] https://news.samsung.com/global/samsung-takes-galaxy-securit...

View on HN

The only reason I buy a new phone at this point is because it falls out of security support.

I'm at the point of thinking of ditching the android ecosystem for the apple ecosystem for my next phone precisely because no android carrier seems to want to support devices for much longer than 3 years.

There are no hardware problems which keep me from using the phone, just the lack of software updates.

The other issue is that we seem to be at somewhat of a plateau of phone performance. My pixel 5 is not significantly faster than my old pixel 2XL.

It's worth noting that Apple also sometimes releases security updates for devices that no longer support the latest iOS. For example, Apple released security update iOS 12.5.4[1] on June 14, 2021 for the iPhone 5s and iPhone 6.

[1]: https://support.apple.com/en-us/HT212548

That's the sort of thing that buys a LOT of good will for me.

But does it really do anything to secure a device that’s past EOL? Or is it a marketing action?

Long official support is absolutely a benefit when looking at smartphones, however, articles keep popping up about Apple basically buying and sitting on vulnerabilities for latest and greatest iOS, because that’s what works economically.

What? Yes, Security updates for eol devices is clearly better than doing nothing. Apple’s externally facing vulnerability management program has a bunch of issues but I don’t see how that is relevant

Better for whom? It’s EOL. Are they just plugging high-visibility issues? That’s not doing anything for individual device’s security. They need a giant INSECURE sign instead of giving that false hope for people: “they might patch me past EOL if it’s bad enough”.

Better for the users and for Apple. "less bad" is another way to put it, but it's the same result. I don't see what you're not getting: one security fix is good, even if there's 3 other huge security gaps. Makes the overall situation less bad (or "better"). You can debate about the magnitude of the improvement, but I really don't see how it can be argued there is no improvement...

Leaving updates up to carriers makes it super hard to test mobile apps. You get a bug where it only happens on Samsung Whatever on Android 11, but the phone you bought for QA hasn't yet gotten that update. So you test on an emulators which, of course, don't reproduce the bug.

We had an issue at my previous company where our mobile game was crashing for like, one user. He had this whatever model of Samsung phone, but we had hundreds of people using that phone and no one else had issues.

Turns out that, despite the model numbers and identifiers being identical, this one phone in this one country in SE Asia had a slightly different GPU setup and there was a bug in the drivers it shipped with that was crashing our game.

So even though we worked with this user for like two weeks to try and figure out why it was just him, it turns out that it was because the Android manufacturer/carrier partnership situation is a gigantic mess for no discernible reason; the manufacturer didn't distinguish between two phones that had technically different specs, and the carrier didn't give a shit enough to ship the updated driver that would fix the issue.

That... that is nightmare fuel right there.

>Samsung must've felt the feedback, because this year they announced a formal policy on security updates -- too late for the S9, but customers from S10 onwards ought to benefit[1].

Well yea. The longer the lifespan of a phone, the higher the resale value, and the higher the retail price you can support. If you want to sell at AAPL prices, you should be able to support devices for AAPL durations.

Quarterly and biannual are still a joke. It's not like Google is keeping all patches and releases them at once without notifying vendors. Nokia was a little known a few years ago for releasing security patches before Google did for their Pixel models. Sadly, this has changed.

Now the million dollar question: did they change because they stopped caring, or did they change because Google made them?

Send regards to the Android architecture team at Google. The fact that OS is tightly coupled to the underlying hardware has no justification. Not does the fact that they have not yet reviewed the architecture…

MS Windows is Heaven on earth in this regard.

Microsoft managed to sufficiently standardize / commoditize the hardware running Windows to the point where supporting old devices was fairly easy. Android devices have more in the firmware.

Reply on news.ycombinator.com