Comment by grapheneos | Hacker News Reader

Comment by grapheneos | Hacker News Reader

Parent Full thread

Fairphone provides very poor updates much worse than iPhone, Pixel, Samsung flagship or many other devices. They lag far behind partial backports of security patches to older releases of Android. They lag a year or more behind full security patches which are not all backported to older Android releases, similarly to iOS. Fairphone 5 and earlier have an end-of-life kernel without security support and the same fate awaits the newer devices.

Unlike AOSP, SailfishOS has a largely closed source user interface and application layer. They still have their own UI and application layer so it's strange to portray Android using a different one than desktop Linux as a problem and a closed source alternative to it as a solution. SailfishOS drastically reduces privacy, security, usability, battery life and app compatibility compared to simply using AOSP. It's not possible to build a project like GrapheneOS on top when so much of the OS code is closed source rather than only many mainstream apps people want to use.

> Fairphone provides very poor updates much worse than iPhone, Pixel, Samsung flagship or many other devices. They lag far behind partial backports of security patches to older releases of Android. They lag a year or more behind full security patches which are not all backported to older Android releases, similarly to iOS.

How can we verify all those claims?

Easy to see they don't have Android 17 yet on their website so cannot get all security patches. The claimed patch level is about a month late.

Search online and see reports updates slow down cause they're busy. Maybe newer phones get faster updates for a year then slow down to every few months. I found that by googling.

Found a post on the FP forum. FP4 was released with support for 5 years but SoC was only going to be supported for 2 more years so no firmware updates for 3 of them.

idk why you ask GOS these questions. They know their stuff and shouldnt have to do research for people like a LLM. I didn't know and used Google and found enough to believe what they say.

They lag 1-2 months behind the Android Security Bulletins which are months behind when patches can first be shipped by vendors. Verifying their kernels for the FP5 and earlier are end-of-life can be done by looking at the code. It's straightforward to verify they're a year or more behind on major updates and that those are required for full security patches. It's clear from a basic glance at the Android Security Bulletins that Low and Moderate severity patches are not backported. It's harder to demonstrate they don't backport all High and Critical severity patches but it's true and the gap of what's not backported is growing with recent changes. They made an announcement to OEMs about only the most recent 2 major yearly versions getting most High and Critical severity backports along with even those no longer getting a large portion of High and Critical internally found bugs which were found with LLMs.

> idk why you ask GOS these questions

It's called a discussion forum. This isn't GOS' personal press release website. They can use their own website for that.

> They know their stuff

They can link to sources then to show their confidence, as any decent academic would do

Reply on news.ycombinator.com