Many people would buy a phone that will never receive a single update. The software it came with is the only software it'll ever run. And they're fine with that. They see software updates as an annoyance and I fully understand them.
I you look at that data then you can see that the oldest version with any significant usage is v8.1. But even that is quite low, and you might do quite well in not supporting anything older than v9.0.
How do you say this without any knowledge whatsoever about the type of app they work on, or their target audience? v6.0 alone is almost 2% of users based on that chart. In fact if you include everything before v8.1, you seem to get something like 8% of users. What if their app, say, provides the poorest people access to public transportation? Would you really just drop 8% of people on the floor in any scenario?
Is it a pain to support old SDKs? Yep. But that doesn't make it inherently a waste of time to do so.
But most of that can be done with polyfills and transpilers, which the android gradle plugin does automatically nowadays.
But the apps still work and get updated and that for her and most people is enough.
It's not ideal and as she is not tech-literate, the day might come where she clicks on something which exploits an unpatched vuln :/
Malware can indeed be worse than hell. Have you ever had your bank account hacked? Or your email account broken into? Or your identity stolen and had to deal with dozens of credit cards being registered and then hit the limit under your name?
I’ve had friends (and family) deal with such things, and you know what? I’ll do anything to minimize the risk for myself, including throwing away an expensive gadget that can no longer receive updates for some totally arbitrary reason.
I've never been to hell (I think?)... I suppose I can't assume you're the same, but I'm pretty confident I would much rather deal with, say, a stolen identity, than go to hell.
Most people's risk-tolerances including many life-threatening dangers they face on a daily basis... like getting hit while jaywalking, having their phone igniting in their hands and burning their homes down, dying in an earthquake, etc. If you can't tolerate the same risks as most other people, then great, you have lots of alternative options to choose from. It's not like Nokia is preventing you from imposing your will on yourself or your family.
To be honest - as an older-phone user, that's part of why I never access email on my phone, nor my bank account. I see my phone as something that's basically insecure, and take into account (no pun intended) the possibility that other people will be able to access its contents.
I realize, though, that many old phone users don't hold this view necessarily.
This collective delusion is the main justification for SaaS which is what the tech industry in current year is dependent on .
Do you wish to hear the endless stream of CVE numbers that allow remote exploitation, including Wi-Fi and Bluetooth module vulnerabilities that don't even require an active Internet connection?
Have you ever tried to expose a new server to the Internet and watched the endless barrage of probing requests coming seemingly within seconds?
Have you been a target of DDoS coming from unpatched appliances and modems?
The only place for an unpatched phone is offline, within Farady cage.
It's a dangerous life given phones are now used for everything from banking and 2FA.
Nope, you don't.
It's just that somehow techies seem to have gotten this meme into their heads that an unpatched life isn't worth living. Can't update my phone within 1 microsecond of a patch being released? I guess I might as well just die. Much safer than risking the << 1% chance of getting malware on it, and everyone knows malware is worse than hell.
> The repairability sounds nice, but it is very irrelevant compared to the limited software updates.
I had an Android phone that didn't have OS updates for several years and... it was just fine. I was only forced to finally upgrade to get better reception on other bands it didn't support. If the hardware could keep pace I would've easily kept it with its current OS for another half decade, until apps just got so bloated that I couldn't use it anymore.
> Imagine buying a Windows laptop and only receiving three years of security updates
That's a bad analogy for so many reasons. Android's security is WAY more hardened than Windows's, your phone's apps (including your [likely] Chrome browser) would still get security updates, and even with Windows this isn't as horrifying as you're suggesting. (I've done much worse.)