5 ms·

it's not that simple to promise 5 year of security updates your SoC needs to also have that support for that time frame + part of your developmeant/production

it's not that simple to promise 5 year of security updates your SoC needs to also have that support for that time frame + part of your developmeant/production time (as you can't the last steps of development/production before that chip is released). Lastly you need to add the duration during which you promise the 5 years security updates. to put it simple for a 5 year guarantee you need ~8 better 10 year support for the SoC, measured from is release date a lot of phone SoC (which tend to get Android porting priority by their producer) have shorter support. Hence why the fp5 had a SoC from a product line designed for industrial embedded appliances instead of a phone SoC... but the main reason is likely simpler: They are relatively small and likely will updated FP5, 6,6+ to Android 16 roughly at the same time to not have to support multiple major Android versions for the same time. Still as long as Android 15 still gets security this doesn't matter too much. Recent major Android version IMHO often have been more disruptive then helpful. At least for me, but my guess it's this applies widely for the kind of audience which pay more because they plan to actual have the same smartphone in use for more the 3 years ;)

artisinal 12d ago
That sounds horrible. I can understand why Apple makes their own chips with the practices that these SoC manufacturers are getting away with. Perhaps the EU can step in and force these SoC companies to change their way of working so that a user can simply install Android 17 with a few clicks regardless of their hardware (to a point). Like how desktop computers work.
- ValdikSS 12d ago
  Desktop computers work because Intel and AMD provide support to their chips to Windows and Linux, because these chips are used for desktop and servers, and these OS are what their customers use. Mobile chips are not used for desktop and servers, not used for Windows and Linux. They are used for Android, and that's a 98% of the market. The customers of the chips (the companies which develop devices on the chips) just don't use Windows or Linux, that's why there's no reason for a chip company to support it. Android does not use desktop/server firmware, desktop/server bootloader, and even desktop/server stock Linux kernel. They have their own Generic Kernel Image with the Android patches on top, strict Google requirements for the booting and working process, etc. PC operating systems are supplied by third parties that are not part of the computer manufacturer, motherboard or processor vendor. All component manufacturers must write drivers for Windows, certify them with Microsoft, and make sure that their device works properly ideally on any computer. You, the user, buy (or obtain) a copy of the operating system from the operating system company. The operating system for a appliance (smartphone) comes with the appliance itself (as a bundle), and is supplied by the appliance manufacturer, not by operating system manufacturer. The manufacturer of electronic components does not need to contact the creators of the operating systems, they write a driver for Android kernel (yes, for Android kernel, with all its wakelock subsystems and such in mind) and gives it to the manufacturer of the appliance directly (and sometimes only supplies hardware, and the driver must be made by the manufacturer of the appliance).
- grapheneos 12d ago
  It's inaccurate information. Qualcomm is willing to provide 8 years of support from SoC platform launch. Android also fully supports using a newer userspace on top of an outdated device support platform. Treble provided a very good implementation of it. Fairphone chose to use T2Mobile as their ODM designing and making their devices. They chose to use the SoC platforms they did. They chose to focus very little on providing updates to the point that the Fairphone 5 and earlier have an end-of-life Linux kernel without security support. Fairphone 5 is still presented as supported with many years to come but it's not getting a large portion of the high importance security patches anymore.
microtonal 12d ago
Still as long as Android 15 still gets security this doesn't matter too much. It does matter, because Android Security Bulletins only contain fixes for high/critical vulnerabilities. But all the other vulnerabilities can be useful in exploit chains. Add to that that ASBs have a three month embargo, but GrapheneOS and Samsung roll all/some patches out before they are in a security bulletin. So phones like the Fairphone have critical/high CVEs have been known for up to three months for anyone that looks. but the main reason is likely simpler: I think the main reason is that they do not do most hardware and software development by themselves, it's done by their Chinese ODM T2Mobile, for which Fairphone is probably just another customer. Everything is at glacial speed. For instance, Android 16 on FP6 has some IPv6 bugs that breaks WiFi connections after a few minutes for a substantial number of their customers [1]. Six months later, they still haven't been able to properly fix it. [1] The issues itself is probably not restricted to WiFi, it's that some brands of WiFi routers trigger one or more of the condition. One of which is sending a router advertisement with a lifetime of 0 for the IPv6 prefix used by the network. The connection handling code goes in a state where it misses the next prefix advertisement.
deleted 12d ago
[deleted]
grapheneos 9d ago
Qualcomm provides 8 years of support from platform launch. OEMs/ODMs need to choose to pay for it. Fairphone doesn't ship proper updates from the beginning due to lagging months behind on incomplete backports and years behind on complete updates. It's entirely possible to port to a new kernel LTS branch regardless of what the SoC vendor provides, but they don't either way. Fairphone 5 and earlier have an end-of-life Linux kernel branch without security support. The Linux kernel is an immensely important part of security on a device against both local, proximity and fully remote attacks. Not having security support for the kernel means the device lacks real ongoing security support. Android 15 does not receive most privacy/security patches but rather backports of many High and Critical severity patches. Only the latest OS releases receive Low and Moderate severity patches. A growing number of High and Critical severity patches are no longer backported due to how many vulnerabilities are now being discovered.

artisinal 12d ago

That sounds horrible. I can understand why Apple makes their own chips with the practices that these SoC manufacturers are getting away with. Perhaps the EU can step in and force these SoC companies to change their way of working so that a user can simply install Android 17 with a few clicks regardless of their hardware (to a point). Like how desktop computers work.

ValdikSS 12d ago
Desktop computers work because Intel and AMD provide support to their chips to Windows and Linux, because these chips are used for desktop and servers, and these OS are what their customers use. Mobile chips are not used for desktop and servers, not used for Windows and Linux. They are used for Android, and that's a 98% of the market. The customers of the chips (the companies which develop devices on the chips) just don't use Windows or Linux, that's why there's no reason for a chip company to support it. Android does not use desktop/server firmware, desktop/server bootloader, and even desktop/server stock Linux kernel. They have their own Generic Kernel Image with the Android patches on top, strict Google requirements for the booting and working process, etc. PC operating systems are supplied by third parties that are not part of the computer manufacturer, motherboard or processor vendor. All component manufacturers must write drivers for Windows, certify them with Microsoft, and make sure that their device works properly ideally on any computer. You, the user, buy (or obtain) a copy of the operating system from the operating system company. The operating system for a appliance (smartphone) comes with the appliance itself (as a bundle), and is supplied by the appliance manufacturer, not by operating system manufacturer. The manufacturer of electronic components does not need to contact the creators of the operating systems, they write a driver for Android kernel (yes, for Android kernel, with all its wakelock subsystems and such in mind) and gives it to the manufacturer of the appliance directly (and sometimes only supplies hardware, and the driver must be made by the manufacturer of the appliance).
grapheneos 12d ago
It's inaccurate information. Qualcomm is willing to provide 8 years of support from SoC platform launch. Android also fully supports using a newer userspace on top of an outdated device support platform. Treble provided a very good implementation of it. Fairphone chose to use T2Mobile as their ODM designing and making their devices. They chose to use the SoC platforms they did. They chose to focus very little on providing updates to the point that the Fairphone 5 and earlier have an end-of-life Linux kernel without security support. Fairphone 5 is still presented as supported with many years to come but it's not getting a large portion of the high importance security patches anymore.

microtonal 12d ago

Still as long as Android 15 still gets security this doesn't matter too much. It does matter, because Android Security Bulletins only contain fixes for high/critical vulnerabilities. But all the other vulnerabilities can be useful in exploit chains. Add to that that ASBs have a three month embargo, but GrapheneOS and Samsung roll all/some patches out before they are in a security bulletin. So phones like the Fairphone have critical/high CVEs have been known for up to three months for anyone that looks. but the main reason is likely simpler: I think the main reason is that they do not do most hardware and software development by themselves, it's done by their Chinese ODM T2Mobile, for which Fairphone is probably just another customer. Everything is at glacial speed. For instance, Android 16 on FP6 has some IPv6 bugs that breaks WiFi connections after a few minutes for a substantial number of their customers [1]. Six months later, they still haven't been able to properly fix it. [1] The issues itself is probably not restricted to WiFi, it's that some brands of WiFi routers trigger one or more of the condition. One of which is sending a router advertisement with a lifetime of 0 for the IPv6 prefix used by the network. The connection handling code goes in a state where it misses the next prefix advertisement.

deleted 12d ago

[deleted]

grapheneos 9d ago

Qualcomm provides 8 years of support from platform launch. OEMs/ODMs need to choose to pay for it. Fairphone doesn't ship proper updates from the beginning due to lagging months behind on incomplete backports and years behind on complete updates. It's entirely possible to port to a new kernel LTS branch regardless of what the SoC vendor provides, but they don't either way. Fairphone 5 and earlier have an end-of-life Linux kernel branch without security support. The Linux kernel is an immensely important part of security on a device against both local, proximity and fully remote attacks. Not having security support for the kernel means the device lacks real ongoing security support. Android 15 does not receive most privacy/security patches but rather backports of many High and Critical severity patches. Only the latest OS releases receive Low and Moderate severity patches. A growing number of High and Critical severity patches are no longer backported due to how many vulnerabilities are now being discovered.