FP Security Updates need to be more frequent

[yvmuell]

Its most times rolled out the next month, i.e. march beginning of April. So beside the fact that feb was not published, for march its not late yet.

[KurtF]

@Spongebob

It’s April and the monthly update was not distributed on time.

Which monthly update are you talking about? The February one, or the March one?

My phone is still on “Security update: January 5th” and claims I have the latest version.
For the record, today is April 3rd.
I’ll refrain from commenting, lest I get accused of being judgmental and/or negative…

[Spongebob]

You know yourself that the security update is always a month behind. This is nothing new and is also the case with almost all other manufacturers. Nevertheless, there was an update in February (Big Camera Update). There’s no need to dramatize it now.

[KurtF]

I think you missed the point: I’m talking about Security Updates, and I’m still waiting for the February security update.
The fact they updated the camera is nice, I’m very thankful they did, but it’s irrelevant here since it doesn’t replace Security Updates.

[yvmuell]

And this is connected

December Android updates fix critical zero-click RCE flaw

Easy (and fair) question, difficult answer I will try to keep it grounded and simple, and here are the main reasons why monthly updates come sometimes “late” compared to other manufacturers: Non-security changes: there are often changes and fixes released together with security updates that make the whole release process slower, as those changes need to be thoroughly verified and they sometimes disrupt the acceptance process with our partners. As you noticed, sometimes we consci…

[loseyourself]

@Spongebob

I think it will be something more than just a security update.

As a beta tester I’m just gonna say one thing: don’t get your hopes up

A bit strange that the February update is this late though.

[Lidwien]

I am on FP5.TT46.A.144.20240205. The security date is 5th February 2024.

[Meaghan]

Yes, but FP4 is still unfortunately on January one.

[Meaghan]

Can you say whether the beta released a week or so had February security patch included?

[yvmuell]

In general: beta info is not for the public.

For this: its the march patch level not feb.

So to repeat myself:

https://forum.fairphone.com/t/fp-security-updates-need-to-be-more-frequent/91035/283?u=yvmuell

[peci1]

But with this pace of updates, FP users can be super sure they won’t get hit by the recent xz library backdoor

[fairuser5]

That many FP users who run SSH servers on their phones, huh?

[Lars_Hennig]

@peci1

xz library backdoor

Who says that xz is only used in SSH servers? This is how the backdoor is exploited, but it can also happen in other ways

see The XZ Backdoor: Everything You Need to Know | WIRED
or in German: https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2024/2024-223608-1032.pdf?__blob=publicationFile&v=4

[UPPERCASE]

The backdoor uses a hardcoded key and remote code execution to make the authentication happen. SSH seems to be be the target for this backdoor.

GitHub - amlweems/xzbot: notes, honeypot, and exploit demo for the xz...

[Spongebob]

@loseyourself

@Spongebob

I think it will be something more than just a security update.

As a beta tester I’m just gonna say one thing: don’t get your hopes up

A bit strange that the February update is this late though.

All right :D, could have been

[Spongebob]

@KurtF

I think you missed the point: I’m talking about Security Updates, and I’m still waiting for the February security update.
The fact they updated the camera is nice, I’m very thankful they did, but it’s irrelevant here since it doesn’t replace Security Updates.

You always get the update from the previous month. If the update had been released in March, you would have received it. If it comes in April, it should contain the security update from March. It’s not new breaking news that this is the case.

This time it is noticeable that no update was released in March that included the February security update.
It’s not the end of the world.

[KurtF]

@Spongebob

If it comes in April, it should contain the security update from March.

And what about the Security updates from February? It’s not like there haven’t been any…

I sure hope they will eventually release the February ones, maybe alongside the March ones. It doesn’t bode well if they start just randomly dropping some. Security updates are a must-have, not optional goodies, and one of the main reasons I bought a Fairphone, because of their promise of “long-term support and software updates”.

[Spongebob]

Because of the update for the month of March, which contains the February security patch, we are here to ask why the update has not been released.
If you have read the last post, one of the beta testers wrote that this time it is taking a little longer than usual.

And the long-term update promise from Fairphone does not mean that you will get an update every month. It can also be every 3 months at some point. By the way, this is also the case with older Lineage OS versions.

So everything is fine

[loseyourself]

@Spongebob

So everything is fine

Everything is fun and games until the work profile stops working due to being too far behind on security updates.

[KurtF]

@Spongebob

wrote that this time it is taking a little longer than usual.

I almost noticed…
My point was, and still is, that this is taking too long. That’s all.

@Spongebob

And the long-term update promise from Fairphone does not mean that you will get an update every month.

Don’t mix apples and oranges: “Update” is too vague a term, covering very different things. There are:

1. Security Updates, which should come every month, else it’s pointless
2. Bug Fixes, which should come eventually (if the company is serious)
3. Feature Updates or Upgrades, which are nice to have, but optional

The “Big Camera Update” we had recently was a “Type 3” update: I was happy to get it, but despite what you seem to think, it doesn’t replace the essential “Type 1” update, much like a free ice cream doesn’t replace medication.