"security" is just used as an excuse, in practice there's very little in the way of remotely exploitable vulnerabilities. In fact the "security" of newer devices seems to be squarely aimed against the user, so make of that what you will...
So really, you've made an absurd comment. If the phone is to be usable past 3-4 years it must have security patches. Otherwise there will be a pool of devices which are still in use and easily targetted.
There already are, and the world hasn't ended yet...
It's your paranoia that's absurd (and what these companies are relying on to keep the masses under their control, so keep drinking the kool-aid...)
The fact that so many here are going on about updates and support, when in fact there's plenty of people who don't give a shit and the world works fine for them, just shows what a corporate-authoritarian shitshow this cursed industry has become.
Just goes to show, you can lead a horse to security patches (or vaccination, or the effects of climate change) but you can't make him apply them.
I don't agree with the poster but he has one thing right - our industry is a shitshow.
The soviet government handled Chernobyl better than we handle security.
Its impossible, even for most proffeshionals, to tell if a device is secure It would be easier for me to measure radiation.
The british government had Mi5 check Huawei source code and even couldn't be sure.
Practically a fully patched iPhone or Pixel without sketchy apps is a very hard target and exploits have a limited lifetime. There is a vast gulf between that and a phone running a 5 year old release without patches.
Why are governments so bad at mandating security? Paralysis in Congress and the EU?
Re Huawei, they were sure there were exploits that could be used against it, and they could never be sure it was exploit-free. (We know that major vendors like Cisco have bugs constantly, so it only requires early access to the code to discover them to produce a ready stream of exploits.) Which is totally what we would expect.
Yes, those are two well-known quantities, and possibly best in the world.
Now try to tell security of something random - if I take a random Linix server, or a wifi-connected bosh dishwasher, ir smart TV, and I ask 100 IT proffeshionals, which one is insecure, how many of them can tell?
> Why are governments so bad at mandating security? Paralysis in Congress and the EU
Why are corporations so bad at securiry?
My internet provider ships a router so obsolete, first google search explains how to PWN it, eith instructions any 12 year old can follow
The problem is the whoke industry is engaged in deception, "we are taking security seriously".
If they were selling garage locks, there would be lawsuits seeking conpensation for stolen car due to negligence in design and lying to the customer
Just goes to show, you can lead a horse to security patches (or vaccination, or the effects of climate change) but you can't make him apply them.
Many of us would rather continue fighting for our freedom instead of advocating for and cheering on the rise of dystopia.
https://nvd.nist.gov/vuln/detail/CVE-2017-5116
Fortunately, this was patched. Not sure if there are newer ones
Not surprisingly, it's another JS one.
I use JS whitelisting not only on my PCs for that reason.
The majority of Android devices will have updated Chrome and web view soon after the Chrome team released a fix.