FP Security Updates need to be more frequent

@LibrePhoner

no, the CIP branches are largely geared towards industrial/automotive/partner specific usage.

It can be used as a source for backported patches, but cannot be used directly for Android devices.

It should be noted that the issue with FP3 will happen to FP4, as FP4 claims support until 2026 but 4.19 is only supported until end of 2024.

1 Like

The page I mentioned is an official page of aosp which was updated on the 20 march 2023 according to the information at its bottom. Even if it is not today, it is far from being outdated.

You want to argue about how they don’t always maintain their documentation?

The only 4.9 branch not labeled EOL on your linked page is android-4.9-q which IS deprecated here: refs/heads/deprecated/android-4.9-q - kernel/common - Git at Google

and no commits since January 2023

1 Like

Do you know the snapdragon 750g is 2,5 years old ? Do you think Qualcomm will patch it forever ?

Why are you changing goal posts?

And yes, Qualcomm only provides 3 years of support for such SoCs, yet another support lie from Fairphone.

2 Likes

Could you explain what you mean ? The topic is about the FP4 and somebody talked about the FP3 kernel.

I go back to the topic asking a question about the fp4 blobs and I wonder how people will bear the fact that Qualcomm will not correct the security holes concerning the 750g.

The vast majority of people won’t care. Why?

1 Like

Not caring about security issues doesn’t shield people from those issues being exploited.

Isn’t that the whole point of this discussion, raising awareness and demanding action, so people know about the current (worrying) state and can make an informed decision whether or not to still trust their devices?!

If people really don’t care, which most probably don’t, then it’s even more important that they are reasonably safe by default.
And, I don’t know about you, but I’m tech support for family and friends. They ask me what to buy and these issues directly influence my recommendations, which at the moment means I don’t recommend Fairphones to people.

8 Likes

Oh I never said they were shielded. All I meant to do was counter his statement that Fairphone would somehow have to explain themselves why they aren’t patching their phones. They won’t have to, because clearly most people don’t care about that.

1 Like

Most people don’t care about the production conditions either? So what’s the point with a fair phone?

How do you define a sustainable phone:

  • Working over the expected lifetime or

  • Securely usable over the expected lifetime?

If you go for the second answer Faiphone would have to explain “why they aren’t patching their phones” since they advertise a sustainable product?

1 Like

I would rather say it’s both plus having an expected lifetime as much extended as possible.
And during this lifetime, keep the phone securely patched.
That’s what I would define a sustainable phone.

5 Likes

The Fairphone itself appeals to people that want a phone made either environmentally friendly or without children working 70 hours a week at a factory.

Why would they have to explain that? The average user doesn’t care about updates. I’ve had more friends tell me that it’s annoying that their “phones want to update all the time” than I’ve heard people say they are behind on security updates. Frankly, the average user doesn’t know what a security update even is. And they don’t care.

4 Likes

I can’t hold a discussion like previous posts…
But I can state that in my family (4 persons), me I pay attention on security patch; my wife and my sons instead have phones with latest security update one or more years ago.
So I trust FP with their ethical and sustainability hardware (that I hope last 4-5 years) and installed other ROM (eOS suits me) for software update.
This is my experience and my point of view.

Please understand if the vendor hasn’t updated, an aftermarket cannot fix those issues.
I describe this here: Patch Levels - DivestOS Mobile

/e/OS also currently hasn’t updated the system webview in 5 months and is a year behind PSB patches.

6 Likes

Thanks for the link. I will read it.

Unfortunately your family is an exception.
I’m with @AvidAlbatross, in my family the general consensus is “Updates suck!”, and thus they are postponed till kingdom come (or till I force them to do them).
Never assume everybody is just like yourself… In the epic ongoing battle of convenience vs. security, convenience wins (almost) every time. You could pay some people, they would still not bother. :frowning_face:

I don’t think their family is different …

… I read that as the devices not having been updated for 1 - 2 years.

At that point I’d move all their devices to a (physically) separate wifi network with no access to the rest, so they at least don’t become a danger to everyone else.

5 Likes

LineageOS 20 seems to be the more sensible choice regarding updates. Along with the respective MindTheGapps package you also can use stuff like banking apps (at least in my case all the apps I need work fine even without locked bootloader) and you get Android 13, working Bluetooth AptX, Material You, working “recent apps” button also with 3-button-navigation and third-party launcher, a good camera app based on CameraX and so on. Only Google Pay won’t work since it has more strict requirements like working SafetyNet and locked bootloader.

So far I did not regret the change to LineageOS.

yet another monthly security updates have been released by google/android, July 2023 update just
shipped even yesterday with high/critical bugs without any user interaction necessary

fairphone really needs to get its act together and invest in their software staff.
please. seriously. this cant be happening that the only fairphone (fp4) product, that is still the retail market, being also your flagship product, is this badly supported for security updates.

we are not even speaking about dang bugs and silly features here any more. this is fundamental security basics.

https://source.android.com/docs/security/bulletin/2023-07-01?hl=en

2 Likes

But think of the workers!

Speaking of nothing, I’m a beta tester and I actually do have the 5 June patch. It would seem this update has been delayed due to a (rare) mobile data issue another beta tester reported 23 June.