FP Security Updates need to be more frequent

It is clear that you need a pixel then…

I like Fiarphone’s repairability, and in day to day use the device is an absolute joy to use, so I am not very keen on replacing it with a pixel… :laughing:

Yes yes, I know, I want to have my pie and also eat it.

No I think your point is fair. Update frequency is an important topic and is a legitimate cause of concern. Just that yes if you want Fairphone you cannot have lightning fast updates as on Pixel. But there are alternatives, especially on Fairphone. CalyxOS is doing pretty good in terms of update speed, and the new DiamaneOS seems to do even better though it’s a young project without much history. That is for the android SPL at least. Those OS still rely on fairphone for vendor patches, there is simply no way around that I guess. Can’t judge for the update frequency of FPOS but at least on e/OS, updates arrive generally 15-20 days (with exceptions for 0-day vuln.) after being released by Google. This may sound like a lot but it is actually on paar if not better than what Samsung is doing, at least on non flagship devices. I’m also not sure how much real life impact has such a delay on security. I am way more worried with delay in updates for the browser and system webview as this is the main attack surface. That is why I’m using Google webview instead of the still outdated builtin webview in e/OS. But again, if you want a higher level of security, you’ll probably be happier on CalyxOS and possibly DiamaneOS though I have no experience with the latter.

You are completely right. 2-3 weeks delay is on par with Samsung, but that is because Samsung are also really really bad! :grinning_face:

Real life impact has historically been low, which is why no one (me included) used to pay much attention to it. These days the biggest attack vectors are still the browser and the messaging apps, so as long as those get timely updates everything ought be fine. Maybe. Also as none of these devices have external IPs it is not like there can be a worm, unless it rides push notifications around.. Anyway, in these days of AI-boosted attacks it is time to start taking Android security at least semi-seriously, It is where the banking apps now insist on running, for one.

I will investigate CalyxOS and DiamanteOS, thanks for the suggestions!

Sorry, no. You have missed a little detail: When you accepted to be a moderator, you ceased to be “yvmuell, a user with an opinion”. Much like policemen aren’t allowed to pick a fight (or even sides) while on duty, a moderator is here to moderate, not to express personal opinions. If you want to do that, make yourself a second account, but do not speak as a Fairphone employee (unpaid volunteer or not doesn’t matter, currently you work and thus speak for Fairphone).

TL;DR: A moderator is not some free spirit with a license to kill: Being Fairphone’s forum caretaker, you are officially one of the voices of Fairphone in this forum.

https://forum.fairphone.com/tos

6. Moderator and enforcement

Our moderators are community members who volunteer their time to help keep the Forum healthy, and we’re thankful for their contributions. They are not employees, agents, or representatives of Fairphone and act independently in a personal capacity. As such, their views, decisions, and statements are their own and do not represent Fairphone’s official position.

So no I’m still me with free mind and speach.

Of course a good moderator will always moderate her/his own posts with the very same approach as other user’s posts.
I have been moderator in a forum for quite some time and I am really thankful that we do have the volunteers to do that work. I am more than happy that I do not have to do this anymore as you are always “in the line of fire” in discussions and usually cannot make it right for everyone.

I find it a bit strange to put the moderators here (and namely yvmuell) close to FP employees only because they are / she is doing here volunteer job with passion. BTW, it will not work to perform such task without passion, IMHO.
Just my 2ct…

It is possible, that the update time of a “third party” Android is quite closely to the ones of Pixels. As stated in another post, the vendors get the patches BEFORE they are publicly released.

But, as yvmuell already stated, the Android certification must still be done, and FP is small (and may not have much priority in the waiting line of certification). Therefore a bit of a delay will ALWAYS be there, no matter how fast FP would be with the fixes. Maybe this bit will get smaller (AI → faster cert?! :thinking:), maybe it will get larger (AI → more work, more vulnerabilities?!) - we never know.

Maybe this bit will get smaller (AI → faster cert?! :thinking:), maybe it will get larger (AI → more work, more vulnerabilities?!) - we never know.

Both, hopefully! We are already seeing more vulnerabilities! :laughing:

This problem is certainly not confined to Fairphone, it is an Android ecosystem issue in general.