My iPhone 6 still says that 10.3.3 is the latest available. Anyway, I'm not sure I'd upgrade to iOS 11 because they're removing 32 bit app support.

I should not have to accept anti-features to get security fixes.

Your phone will warn you about 32-bit apps on 10.3.3. They’re so rare right now I’m sure it should be fine.

Nobody is forcing you to do anything you don't want to do.

Android users (depending on who updates their devices, and how often) should also be safe[1]

1: https://source.android.com/security/bulletin/2017-07-01#broa...

Basically only those rich enough to buy Google devices every three years.

Google promises 3 years only if you buy the device on release day. Our Nexus device at the office got ~18 months.

But yep, the mid/low end devices are often basically abandoned soon after release, or get 1-2 midlife updates so that December OTA has April's security patch level etc.

Or those smart enough to root their device to run a "post market OS" such as LineageOS or postmarketOS. Though the caveat of rooting your device could arguably be less security.

That attitude is the genesis of GNU/Linux desktop failure.

Workarounds that regular users don't have to endure with companies that actually care about them.

I wouldn't expect any 'normal' user to go though any of this. This is for Android enthusiasts that can get access to good hardware on the cheap and run the latest software.

It isn't at all ideal; it is a hack around the problem of terrible software support in the embedded computer industry. Once you got LineageOS on your phone, you can use OTA updates.

Meanwhile the OEM that got your money will happily keep selling devices without updates.

I know, and I very much dislike that as well. That is one of the reasons why I got a Fairphone 2, with long term support.

I also bought a Xiaomi for my partner (cause the FP2 would be an old SoC for the same price it cost 2 years ago) with specs which otherwise would've cost us more than double. I expect the device to last 1,5 years. Hopefully by that time the FP3 is on the horizon.

I have a Sony phone from 2015 and have that security update, not sure what you're talking about. 7.1.1 has been out for a while already.

Not everyone has a bugdet to keep buying flagship expensive phones.

I own a LG device, bought in January, stuck on Android 6.

There are only 1.6% of people in the world that own an Android device with 7.1.1, consider yourself lucky.

I am so happy I bought a Galaxy J5 (6) that can be flashed with Lineage OS 7.1.2. It's a really good phone, and even better with LOS.

Yeah, but it is quite bad that computers with the same price as mobile phones do get updates, while Android is at the whims of bean counters at OEMs.

All because Google don't want actually sort it out.

Given that OEMs are expected to push updates themselves on Treble certified devices, I don't have any hopes that the whole update chaos will improve.

You're only half secure though. You aren't getting the SoC patches so you'll still be vulnerable to Wifi driver holes etc

Yeah but knowing Samsung no phones will get the fixes besides the current flagship and MAYBE the previous one, all too expensive for most people in 2nd world.

You don't need to buy expensive mobile for latest android. I recently purchased 7.1 device for Rs 3000 about 50 bucks.

I like my ZenFone 2 but it's stuck on 5.0 :(

> Basically only those rich enough to buy Google devices every three years.

Or when you buy a phone buy a phone that supports Lineage OS. My Samsung Galaxy S2 runs an up to date Lineage OS.

When I complain, I do it from the point of view of regular consumers.

Hacking devices is a workaround, not a solution.

It is this type of advices that made GNU/Linux fail at desktop adoption.

And yet the standard advice when anyone buys a Windows computer is to wipe it and install a fresh copy directly from Microsoft to remove all the crap your OEM put on it.

Is is really so strange that the advice for older phones would be similar?

what is a solution?

It'll still be vulnerable to a degree then. Android itself will have patches, but the SoC won't because Lineage don't have source code for that, only the binary blobs.

Don't get me wrong, Lineage is great, but fully secure it isn't.

Well it's the same case either side.

11.0.1 it’s a separate update. Not included in the main update. Very confusing.

No, not confusing as your statement isn’t accurate. The iOS 11.0.0 security release notes from 9/19 specifically identify these CVEs as fixed.

[1] https://support.apple.com/en-us/HT208112

According to Apple, 11.0.1 contains the same security content as 11. I think Apple sent a second email to their product security mailing list to add these vulnerabilities.

Maybe or maybe not. I waited and got 10.3.3 -> 11.0.1 as a single OTA update.

Yes I thought the title was a bit click bait...

The bug is fixed precisely because of the research in the article, coupled with responsible disclosure and Apple's ability and willingness to fix it. It's not clickbait, it's the system working well.

Perhaps click bait was not the correct term, I more noticed that it’s exploiting previous versions of software - not the current stable release.