According to Wikipedia the Pixel 2 received security updates for less than 3 years. None of their devices got more than 3 years 3 months of updates. That should be illegal honestly, couldn't be more clear that they don't care about sustainability.

https://en.m.wikipedia.org/wiki/Google_Pixel

If you could demonstrate harm from a vulnerability, you could probably ask a court for some compensation.

Just like if your lawnmower exploded with a known flaw, you would sue the lawnmower manufacturer.

Qualcomm's lack of support for older chipsets has been blamed for the short lifecycles of these phones. Pixel 6 and 7, which don't use Qualcomm SoCs, both get at least 5 years of security updates.

Google is ten times the size of Qualcomm— there's no way they wouldn't be able to extract those commitments upfront.

Google is, but most of Google isn't (wasn't) purchasing SoCs from Qualcomm. Its hardware division is tiny.

I still remember when phones did not receive any updates, and the few lucky models required developer tools to manually upload the firmware updates, which most of those few selected models only got one in their lifetime.

Not sure if you’re referring here to the BlackBerry era or right back to side-sliders and razr flips, but either way, both the stakes and the attack surface were way lower back when there were no apps and phones really were just for calling and texting.

Brew, Symbian, Java ME and Windows CE/ Pocket PC, Palm era.

Plenty of apps and networking in Europe and Asia.

Fair, okay— as soon as email, payments, or banking is involved then you have a juicy target and you need a device that's secure end-to-end.

The iPod Touch Gen 7 lasted just under 3 years from release. They may be better than many others but I just got bit by that one.

That is unfortunate. Certainly the trend has been for them to lengthen the support window over time— see this article for a decent summary: https://www.macworld.com/article/675021/how-long-does-apple-...

I wonder if Apple views the "iPod" branding as being more associated with gaming and consumption and therefore less important from a security standpoint. I don't think I necessarily would agree with such a stance when the exact same hardware can carry sensitive stuff like a password manager, banking and medical apps, and so-on. But I imagine their telemetry showed that that overwhelmingly wasn't the case, so it was easy not to prioritize it.

No, it's more that Apple has always released iPod with older chips, and in this case it also decided to discontinue that product line, which meant that they dropped software support for it relatively soon.

Every flagship iPhone since 2011 has gotten at least five years of both OS updates and security updates, with some newer devices (including the $399 iPhone SE) getting as many as seven years.

Even after official support completely ends, Apple tends to go back and issue patches for active exploits. The nine year old iPhone 5s just got another security update a couple of months ago.

This may be a special case: "With the release [of iOS 16], Apple dropped support for iPhone and iPod Touch models with A9 and A10 Fusion chips (the iPhone 6S/6S Plus, the 1st gen iPhone SE, the iPhone 7/7 Plus and the 7th gen iPod Touch) due to hardware limitations and Chinese government's border stringent in response of COVID-19 pandemic." https://en.wikipedia.org/wiki/IOS_version_history#iOS_16_/_i...

> The iPod Touch Gen 7 lasted just under 3 years from release.

It was released May 2019, and it just received its latest security update (15.7.3) January 23, 2023. Presumably that is not the last security update for iOS 15.

That’s an important note— getting the latest iOS is nice, but Apple continues to patch the 3-4 most recent versions.

I’m not aware that Android gets anything like this, even in the era of Google Play Services.