No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

So, to the author's assertion that "Apple does a good job supporting old hardware", they may give some security patches but interoperability between current and previous versions is seemingly deliberately broken.

That reads very much like X's are not supported. The 2nd sentence even says it explicitly.

Doesn't sound better today does it?

At least on Windows they didn't prevent you from installing a different browser.

Obsession with zero day patches and security hypochondria is mostly a HN/tech-workers thing as if they're under attack by state actors using Pegasus. The average joe doesn't care not is he very likely to be impacted, unless using Android Jellybean or something, since most malware in the wild out to get them is script kiddie level not state-actor level.

And anyway, someone correct me if I'm wrong, but from my knowledge and experience with Android security, most Android critical vulns that can impact the day to day security of the Average Joe are covered by updating Google Play services and Chrome or whatever browser you use as those are the main attack surfaces for (non state sponsored) malware based on what people do with their phones, and those services keep getting updates from Google long after the manufacturers stopped pushing OS updates.

Here's a though exercise: Most people use their device for browsing the web and messaging people, right? So as long as you keep your Play Services, browser and messenger apps up to date, how will malware get to the outdated layers of your OS to PWN you? Especially that modern web browsers and Andorid use sandboxing for apps and web tabs. I'm talking about realistic documented scenarios from the wild that have happened and are likely to repeat again, not state actors or scenarios from research labs where they hack you through the firmware vulns of the baseband modem.

Like I said, I'm not recommending you still use unpatched devices, but the realistic risk from using an Andorid device that stopped getting updates a year or so is relatively minimal in practice, otherwise there would be mass hacks and credential thefts left and right on a daily basis considering how many unpatched Android phones are out there.

[0] https://www.lineageos.org/ [1] https://grapheneos.org/ [2] https://calyxos.org/ [3] https://download.lineageos.org/devices/sailfish/changes

Google no longer offers security patches directly, but since you control the phone sufficiently to install your own OS, the community can come together and keep security updates flowing. You could do it yourself if you wanted.

Apple devices make this sort of community maintainership effectively impossible.

I know this means practically nothing since only nerds can actually install a third-party ROM, so for the general populace only the "default" security patch window matters, but for the hacker news crowd it seems like it might be a meaningful difference.

Come on.

The wildcard here is local LLM use cases and any new hardware that increases their speed by orders of magnitude.

This isn't a debate about what company is better. The word "now" is used for Google's promises for a reason.

And how many are there, then?

Google is not promising this out of the goodness of their heart. They're just getting ahead of what the EU is planning to mandate [0], and doing that to get some good marketing while they're at it.

So, while Google's track record leaves a lot to be desired, in this, I think they'll keep their promise, either because they actually care, or because the EU will force them to. Either way, we, the end users, will benefit from it.

And this will apply to all electronic device makers. That's probably why Samsung also increased their updates policy to five years as well.

[0]: https://www.insideprivacy.com/cybersecurity-2/eu-publishes-d...

> "The requirements apply for the lifetime of a product or five years from its placement on the market, whichever is shorter."

Do you really think the cost of the class action lawsuit and settlement and the bad publicity for not adhering to their 7 years of support would not exponentially exceed the cost of a team of engineers tasked with supporting updates for their Pixel phones?

As for "promises" - why hasn't any other OEM matched or exceeded Google? Apple should have been the first one to step up the very next day.

It seems typical for vendors use "EOL" to refer to end of support life, not merely discontinuing sales of the produce. Most notably, that's how Microsoft generally frames EOL for major Windows releases, hence expectation of jumps in PC sales corresponding to EOL of XP, 7, and 10.

I feel like Apple changed the dynamics of smartphone market from company-issued devices like BlackBerry to BYO with the iPhone essentially on purpose so they don’t get stuck providing decades of enterprise support promises like companies like Microsoft.

Companies purchasing bulk orders of hardware probably wouldn’t tolerate a vendor unwilling to make any sort of concrete support promise for the contract. But a company who employs iPhone users can basically put the responsibility on the user and simply block access to non-compliant devices.

No, I’m not implying there’s something wrong with shipping the occasional update to EOL devices.

Don't sell crap you can't support for a decent amount of time. Stop ruining this planet we live on by creating immense amounts of e-waste every few years.

We both know your argument is dishonest or at least naive, though. They could easily support updates if they want to. But it's about money. This way they are forcing people to buy a new phone every few years. It's clever, shame about the planet.

Think about how many devices Microsoft has to support in Windows, it’s orders of magnitude more.

Apple doesn’t want to support older devices because they don’t see a benefit to themselves.

5 years of support is pitifully short. Pretty much everything I own lasts longer than 5 years, my phone is one of the things I have to replace most often, not because the hardware is broken, but because it stops receiving updates.

Again, bugs are this are not hardware specific. You are not supporting "devices". You are supporting the OS which all of them run. Ideally (I'm not familiar with OSX/iOS internals) all they have to do is push out an update that contains the newly fixed libwebkit.so or whatever. They control everything on their own platform so they don't even have to deal with glibc breaking backcompat like we have to in the GNU/Linux world.

If they can't figure out a way to make changes like this universal across devices, it's either deliberate negligence or incompetence.

With each phone I have always taken steps to reduce battery usage, disabled background refresh, and manually turn on low power mode after charging every single time.

> you can argue that it's "easy" to install Linux on it

In my experience, the average Linux install wizard is less technically involved than the MacOS one. So yeah, maybe I would argue that.

If the page body can read a file, then it can just execute an XmlHttpRequest to send that data to the origin server, which is the attacker in this scenario. This is just how the web works, nothing more to say about it, and no need to prove it.

I hate that I wrote that lol. It reeks of the kind of cybersecurity whataboutism that leads to people inconveniencing the SHIT out of themselves for the sake of security.