I, like the parent poster, am running the latest update for my phone. Yes, I know I'm a walking vulnerability, but short of purchasing a new phone, there is nothing I can do about it. IIRC, updates for my device were cut off before it was even out of warranty, and I'm sorry, I'm not dropping — I can't drop — $600 every year and a half on new hardware just to get new software. Vendors need to support devices for the actual lifetime of the device.

It's really not your fault. But collectively we should care more about this and hold vendors accountable for continued security of devices they sold us.

AFAIK Microsoft and Red Hat are the only ones who do a good job of patching security bugs on older OSes.

You don't have to drop $600 every year and a half. Which would only be $34 a month over that period.

You can drop $600 every 3 years with google devices and have monthly security updates. You could save $17 every month for that 3 year time to buy the next phone.

If you want to stay secure you will, if it not a priority you wont.

Which is a waste of money for a device that otherwise is fully working.

The beauty of consumist society and digital waste.

Except Google stopped selling $600 devices.

The Pixels are incredibly overpriced given the hardware. I bought a Nexus 6P when they got under $400 and I honestly don't know what I'll do a year from now.

Or you can spend $200 and get a pretty good, non-flagship phone, with software that's (usually almost) as up-to-date as the flagships.

KRACK is essentially irrelevant, the security models of the OS and any sane applications will assume that the network is compromised (e.g. starbucks wifi).

Blueborne on the other hand, is very scary.

Most wifi router vendors have STILL not fixed the KRACK vulnerability. Looks like most companies dont care about user security at all.

From that side, this is why I insist on only buying devices 'supported' by OpenWRT / LEDE.

LEDE, thanks to being open source, had a patch within days, which worked across all supported devices.

I would honestly just prefer the manufacturers 'give up' in house router software and instead contribute to the community software.

KRACK only compromises the client, not the AP (unless you have one in relay mode or something)

So? The issue is on the client side. Unless you use wlan client, or repeater stuff with your AP.