Comment by hagbard_c | Hacker News Reader

Comment by hagbard_c | Hacker News Reader

Parent Full thread

This is not as big a problem as you make it out to be due to the availability of alternative Android distributions. A quick search shows that LineageOS 20 already runs well on this device which means it should be possible to keep it up to date for a long time. I'm using a Samsung SIIIneo from 2014 with LineageOS 18.1 (Android 11) for which LineageOS 20 is available as well while Samsung dropped support at Android 4.4. Since I prefer the 'clean Android' experience over whatever vendor embellishments have been added I tend to switch to LineageOS as soon as I get a new (or "new") device anyway. I'm using LineageOS as an example but there are plenty of alternative AOSP-derived distributions for those who want something else.

What I'd actually like to see is an updated Motorola Defy [1], a waterproof/shockproof device with a 3.7" screen, a user-changeable battery, headphone jack, a good loud speaker, uSD card slot, etc. Just give it enough battery capacity to last for a week with mild use like the Defy+ offered, enough memory and storage to last for 10 years of Android development and make sure the bootloader can be unlocked by the user. That is one device I'd buy as a 'working' phone (i.e. a device which can withstand the rigours of farm life), what I use that Samsung SIIIneo for now. It already survived three falls from a 8.5m high barn roof while I was installing solar panels, my daughter's Defy+ survived going through a full wash/spin cycle when she left it in her trouser pocket. That is what I want from a phone, not some silly 'AI' gimmicks.

[1] https://en.wikipedia.org/wiki/Motorola_Defy

I used LineageOS on a number of devices for a number of years, and had to upgrade to a new device every year due to either performance, bugs, or official support being dropped. Can't tell you the number of various bugs I ran into that completely made it unusable, until the point I just started getting two of every device to be able to have a backup, and be able to do clean version updates.

Being able to just get one device and use it for 5+ years is such a relief, and gives me a lot less to worry about day to day. Custom roms are best left to tinkerers who are okay with their device randomly breaking with no rhyme or reason, and spending hours either trying to fix it or reflash/restore to stock and set everything back up again.

You got unlucky with your devices (having unfortunate hardware compatibility) or the ROM maintainers (being inexperienced or just not good). LOS is really great and rarely has any issues coming from the pure source of the OS.

My experience mirrors yours. I have it on two tablets and they're the most stable and lightweight in terms of a software experience of anything I've ever used.

I can’t even imagine what brands they’re buying where support is dropped that quickly.

Motorola dropped support for the moto g within 6 months of me buying it. I got either one or zero android version updates iirc.

“A year and a half of OS updates” rapidly becomes 6 months of OS updates if you don’t buy on launch day, wait for prices to drop a little bit and inventory to normalize, etc.

I run Lineage on a Pixel 3a xl (no google), and a OnePlus 5 (mind the gapps).

I have found both to be completely stable.

My first Cyanogen phone was an HTC Incredible, and I don't remember any stability problems.

Same. LineageOS is what allowed me to use devices I liked for as long as the hardware lasted, instead of being forced to buy the new crap.

If you use apps that require security (like payment apps) you might run into problems here. My company might need to exclude phones like this one soon because more and more CVEs are coming up. Alternative ROMs are often not the solution here because Play Integrity and Key Attestation no longer work.

For general messaging and browsing this hardware likely work quite well.

Btw I had the Motorola Defy and flashed it every month with a new ROM back in the days :D

I wouldn't use the phrase "require security" to describe such apps, since to fulfill what they actually require, you often end up being less secure. For example, most such apps will be fine with you running them on a phone with 20 critical CVEs from a year ago, but not on a phone that you unlocked the bootloader of to install a version of Android that fixes said CVEs.

The challenge is trust, can you trust that an third party ROM hasn't been tampered with, and that third party maintaining the build for your device is often some guy on the internet you probably only know as a pseudonym. It might be the latest version, it might have some modifications that 'distro' of ROM applies to all their builds, some required per-device changes to make it work, but what degree of confidence is there that nothing else changed and the OS is lying to them?

The same applies to most open source efforts, but I think it's understandable for institutions with consequences to what their apps do (like handling money and bank accounts) to opt out of potentially being undermined by the OS when they have the means. There's also elements of phones being general purpose computers now vs locked down appliances, GPL3 vs tivoization, and so on.

But if you're going to worry that a custom ROM might be compromised, shouldn't you also be worried that you know that the stock ROM contains unfixed critical security vulnerabilities? Wouldn't any reasonable argument to forbid the former also forbid the latter?

I'd say when something like a bank is involved, they need something more substantial to point at for their insurance arrangements if/when something goes wrong. "Our app allowed a $5000 transfer on the user's stock Samsung" is easier to grasp the state of the system they're playing in than a user modified one.

Also knowing what security risks are in play with N year old OS lets them decide if they want to allow the user to proceed or work around. Some applications are more aggressive in what version OS they need and that's a driver for upgrading phones, pushing the OEM to keep a phone in support for longer, or third party ROMs if this catch22 wasn't part of it.

> I'd say when something like a bank is involved, they need something more substantial to point at for their insurance arrangements if/when something goes wrong. "Our app allowed a $5000 transfer on the user's stock Samsung" is easier to grasp the state of the system they're playing in than a user modified one. Also knowing what security risks are in play with N year old OS lets them decide if they want to allow the user to proceed or work around. Some applications are more aggressive in what version OS they need

I've seen plenty of apps need a minimum major version of Android, but never any that have needed a minimum security patch level.

There are cases every day where an employee of a company can demonstrate that A is at least as good as B, but trying to get permission to do B is impossible.

There's simply no universe where an employee at a typical F500 company is going to be able to convince the IT team that they should permit custom code on phones even if the logic of the argument is sound. Even if they found the person, persuaded them, got them to persuade their management, in house legal teams, compliance teams etc., I seriously doubt whether the MDM solutions (eg InTune) would even have a checkbox to override the policy on one phone. To say nothing of the ongoing cost of tracking that one employee's specific setting.

This also plays a bit into the argument of why integrating your personal device into the corpo ecosystem of your employer is not a decision to be taken lightly.

> There's simply no universe where an employee at a typical F500 company is going to be able to convince the IT team that they should permit custom code on phones even if the logic of the argument is sound.

That's my point: I know that's how it is today, but the reasons for it being that way are illogical.

> If you use apps that require security (like payment apps) you might run into problems here

Works fine for me, two banking apps and two digital ID apps running on a Google-free device. About those CVEs, you do realise LineageOS offers OTA updates? Not everyone will install them but the same goes for vendor updates, probably even more so since those sometimes sneak in unwanted 'features'.

If 'your company' 'might need to exclude [my devices]' I will just steer away from 'your company' just like I steered away from the many 'Windows only' companies. I survive, nay I thrive without having to use Windows and the same goes for Google et al.

Nae kings, nae lairds, nae quinns, we are free men!

It's only not a problem if you don't use banking apps, or anything else that cares about SafetyNet. I'm not willing to install something like Lineage and then figure out which brittle, unreliable hack will get SafetyNet to pass. Certainly not for my daily driver.

Sure, some people don't care about things like Google Pay, but many many many of us do. I really miss the days of CyanogenMod, before SafetyNet was a thing, when I never worried about losing access to functionality I care about when installing a third-party Android OS.

Even though the Pixel 8 is larger than I'd like, and the Pixel line has its share of problems, I'm thrilled that my new phone will get 7 years of security updates, and probably -- hopefully, if Google doesn't renege -- OS updates for those 7 years as well. That's incredibly important to me.

I find it hard to universally recommend LineageOS because it can be a true 'your mileage may vary' situation depending what you use it for, which is fair enough for the fruits of a volunteer project. It's great if your aim is to get an old phone on a more recent release, but as they're not pretending that they're official firmware some apps won't work with that if they want the integrity check. Those apps can be broadly useful, and the whole reason you're updating in the first place.

Sorry to hear that. Like others in this thread, LOS has been great for me (Essential phone model)

Former SGS3 user here (non-neo, AFAIK). IIRC Samsung only managed one year of upgrades for it. The device had a, for that time, nice AMOLED screen and some flagship features. Custom ROM I ran on it (CM, probably, back in the days, or LOS) rather slow. And you get no baseband firmware/SoC upgrades anymore, since like 2015 or so. After this debacle I said never again Samsung smartphone. I gave mine away to Fairphone (they like to have smartphones of competitors to study design pros and cons).

That’s the first I’ve heard of the S III Neo. What an odd product. Came out 2 years after the original S III, in practically the same chassis, but with a few parts swapped.

I wonder why it was made.

Popping some cheaper drop in replacement chips in an already existing product sounds quite cost effrctive to me :)

Reply on news.ycombinator.com