Comment by saidnooneever | Hacker News Reader

Comment by saidnooneever | Hacker News Reader

Parent Full thread

They do not block unupdated phones because that will force users to buy exceptionally expensive devices to keep updated. Another thing is actually supportability. Just like any enterprise software, it targets a set of common devices so they can provide support and QA on it.

Now, that isn't to say there aren't security issues, nor that QA is perfect on devices they do support (like with any enterprise software projects), but it is a valid reason from a business perspective to not support everything.

Why do you think generally OpenBSD and such platforms aren't supported by commercial software, nor most open-source software? It adds a lot of burden for testing and QA on developers who will need to become intricately familiar with yet another platform.

People stare blindly at some customer support answers and hinge everything on those words, but if you think carefully about how software, compatibility and support work, this all makes perfect sense.

> They do not block unupdated phones because that will force users to buy exceptionally expensive devices to keep updated.

Hardly true, if they permitted Lineage and so on.

> Just like any enterprise software, it targets a set of common devices so they can provide support and QA on it.

Not really, there are a myriad of devices and they're not testing on all of them. A "pound sand if you're on an unsupported device and it isn't working" policy would be perfectly acceptable, as long as the issue isn't directly caused by the developer purposefully breaking the application for a subset of users that fail Play Protect check or whatever.

> Hardly true, if they permitted Lineage and so on.

GrapheneOS have written about (in)security of LineageOS:

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

I have read the first comment in your link and just replied to it. Pretty sure it's incorrect as I've seen a LineageOS device in September with a September security update level, and you can see in Gerrit[0] that the version string bumps are merged every month, with the commit messages including which CVEs were fixed. New images are built weekly[1].

What I think happened is that GrapheneOS assumed the blog post meant that those updates happened at the time of the post, while the post is actually announcing things that were done in the last few months.

[0] https://review.lineageos.org/q/subject:%22release:+Bump+Secu...

[1] https://download.lineageos.org/devices/frankel/builds

That's just a string, it doesn't mean that you actually have all the latest patches:

> Most non-Google-certified operating systems are setting an inaccurate Android security patch level by ignoring the non-AOSP portion of the patches. GrapheneOS doesn't do that but most of the other AOSP-based projects not being certified by Google are doing it. OEMs were caught doing it too but it's not clear if it was intentional in most cases as it is with the alternate operating systems.

https://news.ycombinator.com/item?id=49768635

I'm sure they're completely unbiased source. But seriously, the real question is whether lineage is more or less secure than the stock ROMs that are currently allowed.

"Hardly true, if they permitted Lineage and so on."

I agree, but that is also totally unrealistic for normal people.

Btw, My son has a 200 eur Samsung Galaxy A26, very fine device for the price I have to say, and supported until feb 2031.

This bank claims "security is very important to them". In another, the poster reports getting training spam every week.

Installing Lineage isn't that hard. If they're going to badly inconvenience some customers / force hardware purchases, why not start with the ones who are most likely to get their accounts drained?

If any of what you were saying were true, then this wouldn't be just a discussion about banking software all the time, and we would see it happen with all kinds of other software, scaling with the complexity of the application or the level of provided customer support or the intended sophistication of the user or how "enterprise" the target market sounds... but none of this is the case, and if you tried to cluster products that do this along some axes the ones that stick out like a sore thumb are all of the form "controls something sensitive": money (banking, payments, investing, etc.), health data, copyrighted media (streaming), and multiplayer gaming (due to cheating issues). All of these people are very open about why they think they do it, and while we know they are incompetent, they are not doing it to be malicious and they have no incentive to lie to you about this: if a bank were truly not supporting your device because it was rare, they'd just say it, and we have ample evidence of this from banks choosing to not support "niche" browsers (including an era of "anything other than IE6" omg ;P). So: "cool story bro", but it is clearly wrong, lol.

Reply on news.ycombinator.com