Four whole years?

It should be outrageous that we might consider such a short period acceptable for devices as expensive and otherwise long-lasting as a high-end Samsung phone. That it is not really surprising at all is a sad reflection on how normalised shipping insecure connected devices with inadequate support has become.

Obviously we don't yet know how to build 100% secure devices of this complexity but we are talking about some of the biggest businesses in the world here. There is little excuse not to require (by law if necessary) essential security updates for a much longer period given the reasonable useful life of the hardware and the rest of the software on it.

I mean, yes, but it wasn’t that long ago that Google had to get everyone to agree to at least 18 months. And the market would correct for that, but everyone was doing the same thing - abandoning a device mere months after its release.

And from the manufacturers side it’s not hard to understand why the finance dept doesn’t want you to spend more money on a product that’s already been purchased.

Given that many new phones were bundled with two-year contracts it seems likely that consumer protection laws in many places would have meant a phone that was not properly supported for at least that long after the time of purchase would have fallen foul of fitness-for-purpose rules and potentially entitled customers to partial refunds or updated replacements.

And from the manufacturers side it’s not hard to understand why the finance dept doesn’t want you to spend more money on a product that’s already been purchased.

Sure but again that's why we need consumer protection rules. Any security patch implies that the original product was defective. Buyers are entitled to reasonable corrective action if a defective product was sold to them. It may be unrealistic to release a product with no defects, and the corrective actions are typically intended to compensate for actual loss of value rather than being punitive, but the basic rules still apply.

That's really, really poor. I mean it's good for the Android ecosystem but their biggest competitor is at six+.

edit: replaced "almost twice that number of years" with "six+".

That's terrible.

Debian's EOL comes to mind, even Ubuntu LTS isn't supported for much longer, CentOS was supposed to be the more stable option but that didn't work out either.

Though for some reason mobile devices are somewhat crippled in regards to upgrading to new OS releases versus their desktop counterparts: not being update from Android X to Android Y is the real terrible bit here.

Not sure why on earth that should be acceptable or why the drivers should be such an insurmountable problem, wherein using anything but flagship phones with third party ROMs is a total mess (i've personally had everything from the touch screen to radio, to even Wi-Fi stop working).

So when Google issues a kernel patch for an actively exploited zero day you aren't vulnerable?

Don't be ridiculous.

Software zero days can be patched and on Android even the vendors with the best support policies only cover half as many years.

Cheap Android phones don't even get that.

The OG iPhone SE is on it's sixth year of OS updates.

The iPhone 5s just got it's eighth year of security updates.

Even if it's a software flaw that can easily be patched, but the vendor prefers to force you to buy another device and toss the first into a landfill.

$250 is about the max I would consider spending on a smartphone.

It’s not as flexible but my end cost for the phones is usually $5 more a month in plan cost and being stuck to a big 3 carrier, I haven’t paid much for a phone since I started doing this after Att paid T-Mobile equivalent of $4B in break up fees a decade ago and that pushed for more competition. Though back then I was rocking webOS then Windows Phone before sadly going from iPhone to iPhone. I believe it was iPhone 6 to 8 to 13 Pro. So 3 year and 4 year gaps waiting for deals where I wouldn’t pay anything except a trade in and being tied to the carrier.

I also use a ton of data. Except during the first 1.5 years of the pandemic. During that time period I for sure was wasting money.

I would rather have a 10/month phone bill than a 40-50 one.