Hacker News Reader

Security is the big reason to want 17 over 16, though I believe 16 is getting a lot of those features backported still.

Otherwise, I preferred 16. The UX, AI, and all the other garbage I really could do without. I don't love it. My phone (pixel 9) feels slower and the battery is now draining like crazy.

Android 17 is required for full Android security updates. Only a subset of patches are backported to older versions and that's decreasing. Android 17 is also required for the latest and greatest privacy/security protections which are not backported. There have been massive privacy and security improvements in each yearly Android release.

Since about 12 or so, it's been a series of cosmetic changes, bugfixes, and "AI" features.

This is largely untrue.

You would be missing out on:

- Minimum Target SDK Enforcement Blocks installation of apps that target ancient versions of Android and legacy APIs.

- Restricted settings for sideloaded apps

- Null-Cipher rejection and 2G disabling

- Cell Network Surveillence Alerts

- Platform Rust Migration

- Scoped Media

Among many many unpatched Med and Low severity CVEs that don't get backported.

> Minimum Target SDK Enforcement Blocks installation of apps that target ancient versions of Android and legacy APIs.

Funny to list a user-hostile change as the first “improvement” that comes to mind.

I guess GP should have said “series of cosmetic changes, and breaks in your UI habbits and a few of your apps deemed too old”.

Minimum Target SDK is the opposite of user hostile. Privacy and security changes are added to the SDK consistently. Apps that fail to comply with that SDK are much more of a privacy risk.

Feel free to look at the AOSP SDK changes for each major version that's released and you will see many of these examples.

Apps that failed to keep up with these changes, regardless of licensing, should be avoided and ultimately removed from availability.

The deprecation of 32-bit apps is another example of this.

Android 17 is required for full Android security updates. Only a subset of patches are backported to older versions and that's decreasing. Android 17 is also required for the latest and greatest privacy/security protections which are not backported. There have been massive privacy and security improvements in each yearly Android release. There have also been far more improvements than those. Being unaware of it doesn't mean it hasn't been done.

Getting security updates for issues that are not marked high/critical. These are not your typical RCE, but they are used in exploit chains.

For those not aware, Android Security Bulletins only cover high/critical vulnerabilities. There are also rumors that Google will soon stop fixing vulnerabilities in not-actual versions that were discovered by Google in LLM-driven vulnerability discovery. There was recently a GrapheneOS thread about it.

> Getting security updates for issues that are not marked high/critical. These are not your typical RCE, but they are used in exploit chains.

Aren't those back-ported for a while?

No, they are not.

https://grapheneos.social/@GrapheneOS/114101511604296440

You need new releases or QPRs to get other patches.

Android Security Bulletins are a list of the High and Critical severity patches backported to older Android versions. At the time a bulletin is published, the patches have been available to OEMs to ship for 2-4 months. Fairphone is nearly always 1-2 months behind the latest bulletin but it can get much worse over time.

Android Security Bulletins do not cover the vast majority of Linux kernel security patches. They only cover an extremely small subset tied to Android. The Linux kernel has a massive tsunami of security patches on an ongoing basis. Fairphone 5 and earlier have an end-of-life Linux kernel without security support. They're close to not updating the kernel at all anymore. Their more recent devices will end up in the same situation.

The Linux kernel is not the only component ending up unmaintained while the devices are still presented as supported.

> There are also rumors that Google will soon stop fixing vulnerabilities in not-actual versions that were discovered by Google in LLM-driven vulnerability discovery.

These are not rumors. It's an official announcement from Google to OEMs and we have access to it.

Android 17 is required for full Android security updates. Only a subset of patches are backported to older versions and that's decreasing. Android 17 is also required for the latest and greatest privacy/security protections which are not backported. There have been massive privacy and security improvements in each yearly Android release.

16 is fine if you don’t connect your phone to rhe internet, or use sms.