News for hackers. Stuff that matters.
Re:Shortening the Let's Encrypt Chain of Trust by paxys on Monday July 10, 2023 @07:25PM (#36674431)
> Seems like Apple is doing a better job of convincing / allowing folks to move to a more recent version of their operating system.

Apple isn't selling $10 phones in developing countries. If you compare phones at the same price points from major manufacturers/carriers the difference won't be nearly as drastic.

Re:Shortening the Let's Encrypt Chain of Trust by redox99 on Monday July 10, 2023 @07:35PM (#36674535)
Meh. Samsung (and Huawei) are still the best selling phones in developing countries.

Samsung could definitely both reduce the unnecessarily large number of SKUs, and better unify their software stack so they could update for 5 years all of their phones.

It's crazy how we went from PCs having the right abstractions, where you can easily keep a 10 year old PC updated, to this awful Android situation.

Re:Shortening the Let's Encrypt Chain of Trust by paxys on Monday July 10, 2023 @07:40PM (#36674583)
There is a very long tail of Android smartphone manufacturers that most people in western countries haven't even heard of. Xiaomi, Oppo, Vivo and Realme for example all have double digit market shares globally. The "others" section in most graphs is >30%. If you narrow down the price range to say <$100 there is an even larger spread.
Re:Shortening the Let's Encrypt Chain of Trust by redox99 on Monday July 10, 2023 @07:47PM (#36674645)
Sure. I don't know enough about those companies so I'm not complaining about them.

But I know Samsung has the money and manpower to drastically improve the situation, yet they don't care.

With the right abstractions, they would only have a single version of "Samsung OS", like you only have a single version of Windows/Ubuntu. And all devices within reason would be able to immediately update to the latest version of Samsung OS, like PCs can.

Re:Shortening the Let's Encrypt Chain of Trust by paxys on Monday July 10, 2023 @07:49PM (#36674663)
Go to a developing country and see the share of PCs that are running Windows XP and you will realize that things aren't that simple. The majority of the world doesn't care about OS updates, and they are definitely not spending money on it. They simply want stuff to continue to work exactly as it did when they bought it. Mobile phones already get updated at a much higher rate than PCs. The vast majority of PCs in the world stay on the version that the manufacturer installed throughout their lifetime.

And say in your example Samsung does get its shit together and spends a ton of money to upgrade every phone in the world...that's still ~25-30% of the Android population. What about the rest?

Re:Shortening the Let's Encrypt Chain of Trust by redox99 on Monday July 10, 2023 @07:52PM (#36674681)
I already live in a developing country lol
Re:Shortening the Let's Encrypt Chain of Trust by pdpi on Monday July 10, 2023 @09:41PM (#36675467)
The situation is understandable for budget phones sold in developing countries, but that's almost entirely irrelevant to what companies like Samsung and Google do for their flagship products.
Re:Shortening the Let's Encrypt Chain of Trust by rkagerer on Monday July 10, 2023 @10:26PM (#36675739)
They simply want stuff to continue to work exactly as it did when they bought it.

My hammer can do this but I have never had a smartphone that achieved it.

Re:Shortening the Let's Encrypt Chain of Trust by bombolo on Tuesday July 11, 2023 @02:30AM (#36677127)
Android updates change the UI and inevitably make the phone slower.

As a user, I don't really appreciate all the menus moving around, just because some designer in california needs a promotion.

Unfortunately, currently, updating a device might mean making it useless.

Re:Shortening the Let's Encrypt Chain of Trust by kelnos on Tuesday July 11, 2023 @05:41AM (#36678512)
* * *
Re:Shortening the Let's Encrypt Chain of Trust by bandrami on Monday July 10, 2023 @09:01PM (#36675222)
I've got a stack of Xiaomi phones because they randomly don't work with various south- and southeast-Asian countries' carriers, but not in any predictable or documented way. So I have my Sri Lanka phone and my Maldives phone and my Bangladesh phone, plus two different India phones because of course West Bengal has to be different.
Re:Shortening the Let's Encrypt Chain of Trust by SOLAR_FIELDS on Monday July 10, 2023 @09:17PM (#36675317)
Doesn’t this have more to do with the hardware bands available in the device rather than the carrier software installed on the phone? Perhaps as part of the race to the bottom on price Xiaomi forgoes hardware components that allow a given phone to operate on bands that are common outside the region it was sold in or the carrier it partners with. It would make sense if that was the case, because the people spending $20 USD on a phone typically aren’t going to be traveling a lot anyway
Re:Shortening the Let's Encrypt Chain of Trust by unmole on Tuesday July 11, 2023 @07:54AM (#36679701)
> plus two different India phones because of course West Bengal has to be different.

This makes no sense whatsoever. West Bengal has the same carriers and bands as the rest of the country.

Re:Shortening the Let's Encrypt Chain of Trust by bandrami on Tuesday July 11, 2023 @09:02AM (#36680383)
> This makes no sense whatsoever

Neither does a 1:5 scale model of Big Ben, but Kolkata has that too.

I'm sure there's a knob I can tweak somewhere that makes it work, but a Xiaomi handset is like $20 so I never bothered.

Re:Shortening the Let's Encrypt Chain of Trust by bombolo on Tuesday July 11, 2023 @02:27AM (#36677102)
> that most people in western countries haven't even heard of. Xiaomi, Oppo and Vivo

Never heard of vivo. The other 2 are well known phone brands in italy.

Re:Shortening the Let's Encrypt Chain of Trust by sofixa on Tuesday July 11, 2023 @05:41AM (#36678518)
> that most people in western countries haven't even heard of. Xiaomi, Oppo and Vivo

Please stop considering US+Canada == "most western countries". Xiaomi and Oppo are big brands, quite popular in Europe (especially Southern Europe), and FFS Oppo are one of the major sponsors of the Champions League, one of the biggest and most popular football competitions in the world.

Re:Shortening the Let's Encrypt Chain of Trust by hospitalJail on Monday July 10, 2023 @10:42PM (#36675825)
Classic popular=/= Good

Samsung is garbage tier and on my list of Never Buy.

They have big marketing campaigns and their phones at max brightness with a cool default wallpaper. The crapware is annoying and the performance is average at best.

I feel its my duty to warn people about Samsung.

Re:Shortening the Let's Encrypt Chain of Trust by stOneskull on Monday July 10, 2023 @11:38PM (#36676158)
they can be good but i think they're too expensive. oppo is pretty equivalent but half the price.
Re:Shortening the Let's Encrypt Chain of Trust by KronisLV on Tuesday July 11, 2023 @02:04AM (#36676952)
> It's crazy how we went from PCs having the right abstractions, where you can easily keep a 10 year old PC updated, to this awful Android situation.

I feel like TPM and some modern OSes and software requiring it would like a word in that regard. :(

But yes, it feels like PCs are generally more open to both updates and running different OSes instead of smartphones getting turned into e-waste because of the more closed ecosystem (drivers, bootloaders, support).

Re:Shortening the Let's Encrypt Chain of Trust by nerdbert on Monday July 10, 2023 @08:40PM (#36675068)
Both of the Android phones I bought (not particularly cheap ones) were unsupported with new updates within three years. Never again.
Re:Shortening the Let's Encrypt Chain of Trust by rollcat on Tuesday July 11, 2023 @10:01AM (#36681103)
Yep. The "median" Android phone is abandoned by the manufacturer within a few years, and sometimes doesn't even see a major OS update. Given the variety of available models, projects like LineageOS can't even keep up with providing an alternative.
Re:Shortening the Let's Encrypt Chain of Trust by dan-robertson on Monday July 10, 2023 @08:55PM (#36675177)
I don’t know about percentages but I looked up Samsung galaxy phones[1], assuming that would be reasonably fair towards your claim (similar price points, etc). I observe:

- support lifetimes are better than before (now at 4 years by standard).

- but they don’t match up well with versions, eg the S8 support ended earlier this year running an android major version from 2018 (four and a half years earlier), the S9 will[2] stop later this year with a major version that will be four years old, the S10 stops next year with a major version that will be 3 years old.

That’s just what is available rather than what actually runs on existing devices.

For comparison, everything from the iPhone 8 onwards (released nearly 6 years ago) can run the latest OS version, much of it does, and some older hardware still gets the occasional security update.

My understanding of the android ecosystem is that pixel phones are much more likely to be updated than iPhones, though they’re at a lower price point which is why I didn’t look into them.

[1] https://en.wikipedia.org/wiki/Samsung_Galaxy_S_series

[2] I may be misreading the table here. It could be that the column is ‘current latest version’ and might change before the EOL date.

Re:Shortening the Let's Encrypt Chain of Trust by organsnyder on Monday July 10, 2023 @09:15PM (#36675307)
> My understanding of the android ecosystem is that pixel phones are much more likely to be updated than iPhones

I don't remember the specifics, but I migrated to iOS after being appalled at how quickly my Pixel phone was losing OS updates, including security updates. IIRC, it was due to lose updates after it was less than three years old.

Re:Shortening the Let's Encrypt Chain of Trust by hospitalJail on Monday July 10, 2023 @10:37PM (#36675798)
Yeah but iPhones are the least secure phones. You might get 6 years of security, but the amount of 0 click exploits that were seen in the wild have caused death(Khashoggi at a minimum) and nude leaks(Bezos).

Its security theatre.

Re:Shortening the Let's Encrypt Chain of Trust by bombolo on Tuesday July 11, 2023 @02:25AM (#36677094)
Re:Shortening the Let's Encrypt Chain of Trust by KingMachiavelli on Tuesday July 11, 2023 @04:33AM (#36678038)
I think all the Pixel devices had at least 3 years of security updates at least from the US release date. There may have been a few variants that released later in the year so they technically had less.

At least now now with Google's own chips (Pixel 6+) the guarantee is 5 years of security updates but still only 3 of Android version updates.

Re:Shortening the Let's Encrypt Chain of Trust by jkaplowitz on Tuesday July 11, 2023 @04:57AM (#36678208)
And how long after Google stops directly selling units as new anywhere in the world does Google offer security updates? That’s the more relevant number, no?

At the very least, marketing and packaging for units sold as new near the end of the security lifecycle should have a disclosure like: “We will try to keep this phone secure until [EOL DATE]. Beyond that date, use of this phone may leave you vulnerable to cyberattacks.” Honestly, that would be a great disclaimer to make a legal requirement for all phones, or even all connected devices for which the concept even makes sense.

(Disclosure: I used to work for Google over 8 years ago. But I never had any involvement with Android in any way, other than trying some versions of Android before they were released outside of Google and maybe giving some feedback internally. I’m certainly not speaking for anyone but myself here.)

Re:Shortening the Let's Encrypt Chain of Trust by ori_prior on Tuesday July 11, 2023 @05:01AM (#36678233)
> 3 years of security updates at least from the US release date

Which means that after an initial period of half a year of "production is still slow, you have to wait" and another half year of "we maybe start selling this to Europe now", for the device I've bought today, updates will last a mere 2 years.

Re:Shortening the Let's Encrypt Chain of Trust by dan-robertson on Tuesday July 11, 2023 @09:19AM (#36680571)
Oh that was a typo from me. I meant to say more updated than Samsung. Sorry!
Re:Shortening the Let's Encrypt Chain of Trust by bombolo on Tuesday July 11, 2023 @02:21AM (#36677066)
Samsung adds an advertising screen overlay on my old galaxy if i update it. So I need to keep it to factory default and not update it.

They claim they don't do that, and it's 3rd party apps. Perhaps, but it's apps they force onto users with their update process.

I imagine I'm not the only one blocking updates to avoid ads.

Re:Shortening the Let's Encrypt Chain of Trust by xinayder on Tuesday July 11, 2023 @04:26AM (#36677999)
Don't forget that Apple deliberately slows down your old iPhone when it decides its no longer useful for them to have a bunch of their userbase using old phones.

Plus, Apple users simply don't care about switching their phones, if Apple says they HAVE TO, they will.

Re:Shortening the Let's Encrypt Chain of Trust by throw0101a on Tuesday July 11, 2023 @07:06AM (#36679277)
> Don't forget that Apple deliberately slows down your old iPhone when it decides its no longer useful for them to have a bunch of their userbase using old phones.

Alternatively: Apple lowers battery drain to reduce the odds of your phone crashing:

* https://techcrunch.com/2017/12/20/apple-addresses-why-people...

* https://en.wikipedia.org/wiki/Batterygate

The main problem with Apple's actions were: not being transparent about what they were doing (and why), and not giving users a choice (toggle) on whether they preferred speed or longevity.

Re:Shortening the Let's Encrypt Chain of Trust by Dah00n on Tuesday July 11, 2023 @04:35AM (#36678050)
The cheapest Galaxy is less than $200 so still not a fair comparison.
Re:Shortening the Let's Encrypt Chain of Trust by dan-robertson on Tuesday July 11, 2023 @09:21AM (#36680591)
I only looked at the S series, as per the link.
Re:Shortening the Let's Encrypt Chain of Trust by wkat4242 on Tuesday July 11, 2023 @05:27AM (#36678411)
I have an S8, while the support may have officially ended this year, it has not received security updates for years.

The only thing I got in the last year was a gps firmware update. Security patch level is still April 1, 2021 so really it's been out of support for over 2 years now.

It's a shame because apart from this huge incompetence from Samsung it's the best phone I've ever had. The latest S23 is far inferior in terms of features. No notification led, no 3,5mm jack, lower resolution display than S8, cameras sticking out of the case, much heavier, no 3D glass, no heart sensor, no pressure sensitive screen. Oh and it's double the price I paid for the S8.

The few things where the S23 is better (CPU speed and photo quality) happen to be things I don't care about. But I do care about security updates.

Re:Shortening the Let's Encrypt Chain of Trust by lbriner on Tuesday July 11, 2023 @06:31AM (#36678973)
100% this! I was bemoaning this earlier, I am using the S8 to do exactly the same as I did 6 years ago when I bought it but not only is it much slower than it was when I first bought it (for some reason) but various apps and integrations are already stopping support for Android 9 which is the latest version that Samsung have made available to the phone.

Only the other day, I got a message from Slack telling me their client won't support Android 9 any more, even though, like most apps, I still use the same features I always did.

Groan!

Re:Shortening the Let's Encrypt Chain of Trust by OtherShrezzing on Tuesday July 11, 2023 @10:48AM (#36681784)
I've got a 2017 flagship Samsung Galaxy, and it only ever received 1 update in 2018 - so it was considered defunct by Samsung before my contract even expired. The earlier iPhone 7 it replaced got major version update support to 2021, and still gets minor patches, including one a couple of weeks ago.

Even comparing like-for-like on flagship products, the androids perform poorly when it comes to Long Term Support.