News for hackers. Stuff that matters.
Re:Shortening the Let's Encrypt Chain of Trust by JoshTriplett on Monday July 10, 2023 @07:45PM (#36674628)
> Seems like Apple is doing a better job of convincing / allowing folks to move to a more recent version of their operating system.

Much simpler than that: Apple doesn't allow third parties to make iPhones, while Google allows third parties to make Android phones. Devices don't get updated because manufacturers stop providing updates for them.

Re:Shortening the Let's Encrypt Chain of Trust by alwillis on Monday July 10, 2023 @09:05PM (#36675260)
> > Seems like Apple is doing a better job of convincing / allowing folks to move to a more recent version of their operating system.

Apple is doing a better job with operating system updates. On June 21, Apple released a bunch of iOS updates including iOS 15.7.7 [1] for devices going back to the iPhone 6s which was released September 2015--nearly 8 years ago.

There's no reason why the large Android OEMs couldn't do the same if they wanted to.

And that's with 81% of iPhone bought in the last 4 years running a version of iOS 16 [2] five months ago. When iOS 17 is available to be installed in two months, over 90% the installed base will be running iOS 16.

[1]: https://support.apple.com/en-us/HT213811

[2]: https://www.macrumors.com/2023/02/16/ios-16-adoption-stats-f...

Re:Shortening the Let's Encrypt Chain of Trust by folkrav on Monday July 10, 2023 @10:17PM (#36675687)
I think OP's point was that Google/Android don't have much to do with OEMs choosing to update their older devices or not.
Re:Shortening the Let's Encrypt Chain of Trust by tadfisher on Monday July 10, 2023 @11:16PM (#36676034)
They do, actually, via the Open Handset Alliance and Google Play. They are tied by what Qualcomm is willing to deliver in their BSPs, and that's basically 2 years of Linux LTS kernels. So the minimum support level is 3 years; two Android versions and one year of security patches.

Samsung and Google can do 5 years of support because of Exynos/Tensor, and Samsung basically spends the money to support older Qualcomm devices themselves.

Re:Shortening the Let's Encrypt Chain of Trust by thrdbndndn on Tuesday July 11, 2023 @12:36AM (#36676464)
Lots (probably even a majority, if we do headcount) of Android phones don't give a fuck about Open Handset Alliance or having Google Play frameworks installed at all.
Re:Shortening the Let's Encrypt Chain of Trust by KingMachiavelli on Tuesday July 11, 2023 @04:39AM (#36678071)
Supposedly newer Snapdragon chips should get 4 years of security and Android OS compatibility from Qualcomm. I wonder when that 4 years starts because if it takes a year for phones to use a new chip, then it's still more like 3 years.

https://www.qualcomm.com/news/releases/2020/12/qualcomm-and-...

Re:Shortening the Let's Encrypt Chain of Trust by mcfedr on Tuesday July 11, 2023 @12:52AM (#36676546)
The large OEMs do, there is a long tail of much smaller (and often cheaper) ones out there
Re:Shortening the Let's Encrypt Chain of Trust by kelnos on Tuesday July 11, 2023 @05:52AM (#36678618)
> There's no reason why the large Android OEMs couldn't do the same if they wanted to.

Wrong, there's a big reason: Qualcomm. Newer Android releases often bump the minimum required version of the Linux kernel. If Qualcomm stops supporting a particular chipset, they won't give you new binary blobs (part of what's known as a "board support package" or BSP) for the new minimum kernel version, so you can't update.

Google managed to negotiate with Qualcomm to get them to support old chipsets for longer, but it still falls far short of what Apple does. And now Google is making their own chips for Pixel phones and are doing 5 years of security updates (though still only 3 for major OS updates, boo).

And really, it just boils down to a shitty planned-obsolescence business decision. Apple knows that they will have enough people to buy (either first-time or upgrade) their newest shiny iPhone come release time every year, even if they continue to support 8-year old phones. Google doesn't have that confidence, so they don't put as much effort into upgrades for older devices. And that's Google, who makes fairly high-end phones; the makers of low-end devices know their users are price-sensitive and won't upgrade phones unless they have to.

So it's really two things: one is that they don't want to, and there's no market or regulatory force that pushes them to. And the other is that they truly are limited in how far they can support upgrades, much more limited than Apple is, since Apple controls the entire hardware and software stack.

Having said all that, do understand that I don't endorse or like the current situation here. My Pixel 4 stopped getting security updates (technically last fall, but Google pushed out a roll-up update a few months ago), and I'm frankly not ready to upgrade. The hardware is fine, the software is snappy, and it does everything I want it to. The Pixel 7a is probably my next best bet, but it is yet again a physically larger phone, and I hate that. But this is the situation, and these are the reasons for it.

Re:Shortening the Let's Encrypt Chain of Trust by pas on Tuesday July 11, 2023 @08:16AM (#36679919)
OEMs could ship their own security patches. (They are already running frankenkernels. They have some in-house expertise for patching the kernel, making the image, etc.) They don't, because they don't want to spend money on it. (And probably a smaller factor is that they don't want to cannibalize the sales of their newer devices.)

As far as I understand price sensitive users will stop using apps that don't support their device instead of upgrading. (Or will try to roll back the update of said apps.) Providing base security updates wouldn't change this logic.

Re:Shortening the Let's Encrypt Chain of Trust by jowea on Tuesday July 11, 2023 @08:29AM (#36680042)
> And really, it just boils down to a shitty planned-obsolescence business decision. Apple knows that they will have enough people to buy (either first-time or upgrade) their newest shiny iPhone come release time every year, even if they continue to support 8-year old phones. Google doesn't have that confidence, so they don't put as much effort into upgrades for older devices. And that's Google, who makes fairly high-end phones; the makers of low-end devices know their users are price-sensitive and won't upgrade phones unless they have to.

I'm not convinced. Apple controls the iPhone market and can do this, but no Android manufacturer controls the Android market. A brand that deliberately reduces its own devices' lifespan can't trust that its consumers will buy another device from the same brand. I think it's just a matter of not offering support being cheaper than some plan to reduced lifespan leading to new purchases.

Re:Shortening the Let's Encrypt Chain of Trust by JoshTriplett on Tuesday July 11, 2023 @03:20PM (#36685967)
> If Qualcomm stops supporting a particular chipset, they won't give you new binary blobs (part of what's known as a "board support package" or BSP) for the new minimum kernel version, so you can't update.

This is the biggest reason Google is pushing for there being one version of the Android kernel, across all vendors: to make updates always possible.

Re:Shortening the Let's Encrypt Chain of Trust by coder543 on Monday July 10, 2023 @10:00PM (#36675594)
Microsoft allows third parties to make Windows computers. Windows computers still get updates, and the manufacturer doesn't have to push Windows updates.
Re:Shortening the Let's Encrypt Chain of Trust by morepork on Monday July 10, 2023 @10:50PM (#36675879)
But Microsoft doesn't make Windows open source and allow customers to fork the OS.
Re:Shortening the Let's Encrypt Chain of Trust by asadotzler on Monday July 10, 2023 @11:15PM (#36676029)
Windows OEMs replace significant components of the Windows stack from the trackpad drivers and well beyond. One of my machines is a Dell and they've basically replaced Windows Update because they serve more driver and other updates than Microsoft (slight exaggeration).

Open source isn't the differentiator, IMO. OEM fuckwittery is. Just as Dell can junk up this $3,000 laptop with shitty drivers and shell extensions that are markedly worse than what Windows offers natively, so could other Windows OEMs.

The major difference here I think is that until the recent era, MS wasn't competing with those OEMs so they had little reason to try to one-up MS and every reason to leverage MS for as much of the update infra as possible. For the last 5-10 years, with the Surface line, Microsoft has been increasingly encroaching on the top OEM user base and some are fighting back by trying to outdo MS (and failing).

But I don't think anyone is putting the right blame here on Android. It's not the OEMs not serving enough software updates, it's that in many parts of the world, a 10 year old device can still connect to the network and the carriers are OK with that. That device, even it it was from Apple, would not be getting updates that late in its lifetime but large swaths of the world aren't so fucking hung up on phones as jewelry that they update every year, or even every two, or even every 5. Those ancient Android phones in Bangladesh, they're working just fine for their users and even Apple wouldn't be serving them any better with software updates.

Re:Shortening the Let's Encrypt Chain of Trust by coder543 on Monday July 10, 2023 @11:05PM (#36675961)
Canonical allows third parties to make Ubuntu computers. Ubuntu computers still get updates, and the manufacturer doesn't have to push Ubuntu updates.
Re:Shortening the Let's Encrypt Chain of Trust by morepork on Monday July 10, 2023 @11:07PM (#36675977)
But Canonical isn't responsible for the Ubuntu forks, it's up to the community to get Kubuntu, Mint, etc. updates out
Re:Shortening the Let's Encrypt Chain of Trust by coder543 on Monday July 10, 2023 @11:10PM (#36675996)
Regardless, the updates do still flow. Any case where updates aren’t happening is the exception, not the rule.

Android being open source isn’t the problem.

Re:Shortening the Let's Encrypt Chain of Trust by morepork on Monday July 10, 2023 @11:13PM (#36676014)
Fortunately the community doesn't have the perverse incentive of a hardware manufacturer. If updates stop flowing it encourages people to buy new devices.
Re:Shortening the Let's Encrypt Chain of Trust by coder543 on Monday July 10, 2023 @11:15PM (#36676031)
I'm not talking about "the community". There are multiple manufacturers/distributors of Linux laptops. They do nothing to stymie the flow of updates, even though your assertion about selling new hardware would theoretically apply just as much there.
Re:Shortening the Let's Encrypt Chain of Trust by morepork on Monday July 10, 2023 @11:26PM (#36676083)
It's a good comparison. I would speculate that it's the target market. If you're buying a Linux laptop you are likely very technical, and know about and want the latest updates. I doubt System76 would get many sales if Pop OS was based on Ubuntu 20.04 and wouldn't get any updates.

However with Android, companies sell 100s of millions of devices to consumers that are more concerned about price point than updates. There just doesn't seem to be the incentive for OEMs to care about it, if the majority of consumers refused to buy devices based on old OS versions or ones that didn't get updates, those devices wouldn't get made.

Re:Shortening the Let's Encrypt Chain of Trust by PhilipRoman on Tuesday July 11, 2023 @02:53AM (#36677307)
Guess that explains why there are companies still using windows xp
Re:Shortening the Let's Encrypt Chain of Trust by SAI_Peregrinus on Monday July 10, 2023 @10:17PM (#36675681)
Rather Google allows manufacturers to control the OS on the phones. If they had kept control of Android instead of allowing dozens of manufacturer forks the update situation would be better (but Android probably wouldn't have been adopted by those same manufacturers).
Re:Shortening the Let's Encrypt Chain of Trust by JoshTriplett on Tuesday July 11, 2023 @03:21PM (#36685994)
They're currently trying to move some of that control back to the OS, precisely to enable updates. But unfortunately, in the process they're also moving many core pieces of functionality into Google Play Services and making them proprietary.