Literally the only reason I stopped using my last two phones was that the security updates stopped streaming in. Even now they sit in a drawer, perfectly functional, abandoned by Google.
And… that's it. Just like that, no more updates. Less than two years after I bought it.
Yeah, you're not gonna get baseband / blob / firmware updates or security patches outside of platform, but the damn thing is 8 years old.
It's not like you can just hack updates together yourself. Not always anyway.
Look at Samsung Galaxy S7 Edge - 5 years old device:
- Released with Android 6.0.1. - Received 7.0 and 8.0 major updates. - Has unofficial 11 support. - Received September 2020 security update.
Cheap device manufacturers unable or unwilling to support software updates should be banned by law. It should be a part of their job. Instead, they often seem to release one "proof-of-work" initial release and then don't care and work on the the next model to repeat the same. Pretty sad.
Just because security updates stop doesn't mean your device is immediately insecure and cannot be safely used.
The majority of the phone's actual updates come through Google Play Services.
Meanwhile, I can show you an exploit in the wild that affects virtually all iOS devices even though they're regularly patched up: Jailbreak methods and iMessage zero clicks.
I'm not going to argue that iOS is some super secure fortress of impenetrableness, or that Android is some kind of digital petri dish that becomes immediately infected with the 500 Viruses of Bartholomew Cubbins the moment it connects to wifi. But there are Android exploits documented routinely, some of them are serious, and some of them have been found in the wild.
I have a Nubia phone which runs Pie.
Its last security patch is dated August 5th, 2019.
Play Services and Chrome are fully updated.
Where is there an in the wild exploit that you can point me to? Proof of concept or otherwise. I'll happily load it up in Chrome on my phone and let it compromise my system.
Meanwhile there's a zero click iMessage exploit article still on the first page of HN.
Let's ask ourselves this basic question: If Play Services and Chrome could keep an Android Pie system secure, why does Google bother with a separate security patch date?
> Meanwhile there's a zero click iMessage exploit article still on the first page of HN.
Maybe because it's news and critical Android remote exploits are found often enough to not be news.
Then you should have no problem being able to find one that will exploit my phone. I even gave you the specific Android version AND security patch level to target.
Get at it instead of pointing to the sky and saying "look!"
https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
https://source.android.com/security/bulletin
Enjoy your phone. Or don't. None of us are your mom, so we can't tell you what to do.
> Get at it
Abrasive demands are unpleasantly childish. Not being your mom also means that I don't care if you suffer from your own negligence. You can either keep yourself abreast of Android platform security woes or not. As Captain Planet says, the power is yours.
Thanks for proving my point.