FP Security Updates need to be more frequent

Discuss The Products
,
892

Well, security indeed extremely important and getting more important by the day since IT crime has become a huge market with stunning profits and next to no risk. Why bother with complicated and risky drug trafficking when you can make twice the money with a couple keystrokes? So more and more organized criminal structures start turning towards what some years ago was still the turf of some “hackers”. Those criminal organizations expect results, so racketeering the hapless has become a major business.

The problem is that companies (and not only Fairphone) are ruled by short-sighted marketing managers who only care about short-term profits and their resulting bonus. Spending money for security is like buying fire extinguishers, managers see it as wasted money since if something bad happens, they’ll just need to say “Our client’s security is very important to us” and everything is forgiven and forgotten… :roll_eyes:

896

Where is the October 2026 security update for the Fairphone 5? Looking at the long list of vulnerabilities, this is not an acceptable situation!

897

The next Fp5 update is only due in November

898

Thanks for your reply. OK, I hadn’t realized that Fairphone is switching to a two-month cycle for security updates for the Fairphone 5. I don’t think this is a good decision on Fairphone’s part; I could live with updates arriving toward the end of the month, but now I’ll have to consider how to handle this.

899

This road map is known since almost the beginnig.

900

This may have been acceptable in 2020 or even in 2024.

It is now 2026.

The big difference is the AI tools that did not exist two years ago - it is now possible to turn the code fix diff into a fully weaponised attack in hours after release. Not weeks like before, and not even days.

Thus, lagging with updates by multiple days exposes all users to risks, and this will come to bite sooner rather than later. Lagging by multiple weeks is… honestly unthinkable in the current security climate. A lag this big is basically equivalent to the device being abandoned at this point.

I understand why it takes this long right now, but explanation is not an excuse. FP needs to rethink and then rework how it gets updates from upstream to devices to eliminate the delay.

I really like my FP6, but if it is not possible to use the device due to it effectively not being maintained any more I will have no choice but to either switch to Apple, Pixel, or just build a phone myself around a traditional ARM stack. :frowning:

901

What are you talking about? Somthing happening in 7 years? If you really suggest the monthly updates are the same as not maintained, yes go ahead and use Apple or Pixel.

902

If you are going to respond to my message please have the courtesy of reading it first. :folded_hands:

I am not complaining about the monthly update cadence - that is roughly the same frequency as the upstream releases.

I am complaining about the delay between vulnerabilities being publicly disclosed with code available and fixes reaching the devices.

During that gap devices remain vulnerable.

Let’s look how that compares to other software:

  • Typical major Linux distribution / WIndows / Mac OS: Usually 0 - 12 hours
  • Typical minor or downstream distribution: Typically 12 hours - 1 day
  • 1st party Android / iPhone: Typically 0 hours to 3 days
  • Fairphone: 3-6 weeks
  • /e/OS: 5-9 weeks

In recent weeks the “12 hours” figure above prompted a sizable portion of the Internet to be taken offline due to php2shell, and that is already proving too long for the modern security climate.

Molly (de-Googled Signal client) made tech site front pages in recent days due to being 2 weeks late behind Signal fixes.

So, yes, I stand by my claim that being weeks behind the rest of the industry when the period between upstream published fix and exploitation is measured in hours is really, really bad.

I do not want to move away from Fairphone. I like Fairphone. A lot.

However, the Internet is changing, and Fairphone needs to keep up, which it is not currently doing.

903

I read it several times and the part I reacted to still does not make a lot sense to me, or when this is your conclusion reg. monthly updates philosphy of FP than yes go ahead and use something different as it is just not matching your expectations and most likely never ever will.

904

You should not choose a Google pixel since my son’s pixel 7a received it’s last security update on the 5th October (writing this 10 November).

905

Graphene images for Pixel that came out on 2nd of November have the 1st of November monthly security patches included.

That is however off topic, other than showing that it can be done for Android devices by other teams.

I hear what @yvmuell is saying though, the device may not be a good fit, sad as it is.

906

How does this work? Android has the monthly updates. Do some manufacturers get even more proactive and issue patches more often than Google?

907

CalyxOS or DiamaneOS seem to provide Android SPL updates much sooner than FPOS or e/OS for FP6, but they still depend on FP firmware for vendor security patch. These may be options to consider if you want faster android SPL.

908

Just adding my broken record, as we enter this part of the never ending repeating circle again: Custom ROM dont need Google approval, thats comparing apples with oranges. And you are free to just switch to a custom ROM.

909

That’s definitely better than Fairphone, since my FP4 is on patch level “September 5th”, and I’m writing this on November 11th… :laughing:

I would have loved to have the October security patches… But I don’t expect anything to come before end of this month at the earliest, and when it comes it will be already outdated.

Yes, as this thread shows, security updates are the weakest point of Fairphone, and they don’t intend to change that anytime soon. Certainly considered a waste of money, why spend money on devices already sold?

As for you, yvmuell, you need to accept that this (or a similar) thread will live for as long as Fairphone sells devices and new users discover that the “plenty of updates” cornucopia comes with provisos and addenda: Older users progressively resign and stop posting, but new users will constantly replace them.

910

You made my day with talking about acceptance.

And to add another broken record: i have to stand unhappy peoples opinions here and unhappy people have to stand my opinion here. Thats how life and conversation works :man_shrugging:

And for the records for those who are new and dont now: the FP4 is, since a very long time already, on a bi-monthly update cycle and in the meantime also the FP5 is on a bi-monthly update cycle.

911

For the third time, I am not talking about the frequency of updates. I am talking about the delay between the time the source code comes out, and time at which people are able to install the updates with the security fixes in them.

During this time it is trivial for an attacker to build an exploit based on the fix source code, as the fix pinpoints exactly where the bug is.

Before it is published it is not known to attackers, and they cannot trivially build the exploits without independently finding the flaw.

Unless it is a 0-day that is being actively exploited I do not especially care about getting more frequent updates - what I do care about is the known security vulnerabilities that have been fixed upstream being patched in a timely manner.

912

You probably haven’t understood my question. You said Android has updates within minutes up to 3 days. I was asking how is that possible, given the fact that Android releases patches once a month. I know you talk about delay and I talk about frequency, but if the delay is said to be much shorter than the frequency, then it doesn’t make sense (counting the delay from the day of publishing the exploit).

913

My understanding is, its expected that the SP is provided monthly within hours/days after its published, as Google is doing for Pixel phones instead of after 3 weeks as FP is doing it.

914

Exactly this!

Let’s say a Google publishes fixes to a vulnerability on 1st of September.

Google publishes another fix on 1st of October.

There are two vendors, A and B.

A publishes a fix to the first vulnerability for their device on 2nd of September., and the fix to the second vulnerability on 2nd of October.

B publishes the fix to the first vulnerability on 1st of October, and to the second vulnerability on 1st of November.

The frequency of updates for both A and B is the same - 1 month.

The delay for vendor A is 1 day, and for vendor B is 1 month.

I want FP to work like vendor A, and not like vendor B, which is its current behaviour.

This is because the vulnerable period is the same as delay minus the time to weaponsie the fix.

If it takes 3 weeks to weponise the fix, then for vendor A the vulnerable period is 0 days per month, and for vendor B it is about 1 week per month.

If it takes 6 hours then for vendor A the vulnerable period is about 18 hours, and for vendor B it is about 30 days, depending on the length of month.

Historically the situation has been closer to the former, so the users were not vulnerable most of the time for both vendors, although vendor A was preferable.

These days the conditions are the latter, so vendor A is struggling, but vendor B’s users are vulnerable pretty much the entire time.

This is what I am repeatedly trying to say, although as evident my communication skills are not the greatest. :smiley:

I hope the above example makes it clear.