this post was submitted on 01 Dec 2024
1 points (100.0% liked)
Android
0 readers
5 users here now
Android news, reviews, tips, and discussions about rooting, tutorials, and apps.
General discussion about devices is welcome. Please direct technical support, upgrade questions, buy/sell, app recommendations, and carrier-related issues to other communities.
Rules
Rules
- Stay on topic: All posts should be related to the Android operating system or ecosystem.
- No support questions/rants/bug reports: All posts should benefit the community rather than the individual. Please refrain from posting individual support questions, rants, or bug reports.
- Describe images/videos: Please provide an explanation in the self-post body when sharing images or videos. Memes are not allowed.
- No self-promotional spam: Only active members of the community can post their apps, and they must participate in comments. Please do not post your own website, YouTube, or blog.
- No reposts/rehosted content: Submit original sources whenever possible, unless the content is not available in English. Reposts about the same content are not allowed.
- No editorializing titles: Do not change article titles when submitting. You may add the author if relevant.
- No piracy: Do not share or discuss pirated content.
- No unauthorized polls/bots/giveaways: Do not create unauthorized polls, use bots, or organize giveaways without proper authorization.
- No offensive/low-effort content: Avoid posting offensive or low-effort content that does not contribute positively to the community.
- No affiliate links: Posting affiliate links is not allowed.
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
@[email protected] @[email protected]
Thanks for your detailed explanation. And as already said, #GrapheneOS is always my first choice if possible. You're doing a great job!
Do you know where to find a brief overview of all unpatched CVE for Pixel4a?
The only summary I'vr found is on
https://app.opencve.io/cve/?vendor=google&product=pixel_4a
A search on the NIST cve database was noch successful.
@[email protected] @[email protected]
Look at each of the Android and Pixel security bulletins for September 2023 and later. You're missing all the fixes in the YYYY-MM-05 section and the Pixel security bulletin page. You're also missing nearly all of the Moderate/Low severity AOSP patches since Android 14 was initially released because only Critical/High severity patches are backported to older releases in general. The monthly, quarterly and yearly releases of Android have many extra privacy/security patches.
@[email protected] @[email protected] For the YYYY-MM-05 sections, anything about Qualcomm or Broadcom is generally relevant. Most driver/firmware related vulnerabilities are not listed in the Android Security Bulletin. Pixel Security Bulletins list all the vulnerabilities tied to hardware components in Pixels, such as the GPU, radios (cellular, Wi-Fi, Bluetooth, NFC, GNSS and UWB radios) and various other components. Similarly to the ASB, look for Qualcomm and Broadcom components there among others.
@[email protected] @[email protected] thanks for the hints. This might help to perform a very personal risk analysis :)
@[email protected] @[email protected] There are Critical tier remote code execution vulnerabilities for the GPU, cellular, Wi-Fi and Bluetooth drivers. There are also critical remote code execution vulnerabilities for the cellular, Wi-Fi and Bluetooth firmware. It doesn't really get much worse than the kinds of things which have been fixed regularly. Current Tensor Pixels have dramatically better hardening and security features too, not only receiving current patches. A lot more to privacy/security than patches.
@[email protected] @[email protected] Simply due to being on Android 13, you're missing 2 years of privacy/security improvements to Android, over a year of our privacy/security improvements in GrapheneOS and 2 years of Moderate/Low security patches. The missing Critical/High severity hardware/driver patches is a whole separate problem that's not fixable even if we received a massive influx of resources specifically for reviving support for older devices, which we would not do for ethical reasons anyway.
@[email protected] @[email protected] We would not accept substantial money and developers given to us to both revive support for insecure devices and improve the rest of the project to justify it. Why? We do not want to encourage people to use highly insecure devices. We do not want to be the cause of people being harmed because they wrongly believed they were safe because we kept releasing updates for insecure devices where we cannot patch important vulnerabilities. It is not just about lack of resources.
@[email protected] @[email protected] We're no longer going to be providing extended support in the future. We only did it because 3 years of support was highly inadequate. We're fine with 5 years of support and 7 years of support is fantastic. Even if someone reaches end of 5 years of support, they can purchase a 2 year old device as a used device which has 5 of the 7 years of support remaining. Devices having 7 years of support means people will be able to cheaply get used devices with lots of support ahead,
@[email protected] @[email protected] We're no longer going to be providing extended support in the future. We only did it because 3 years of support was highly inadequate. We're fine with 5 years of support and 7 years of support is fantastic. Even if someone reaches end of 5 years of support, they can purchase a 2 year old device as a used device which has 5 of the 7 years of support remaining. Devices having 7 years of support means people will be able to cheaply get used devices with lots of support ahead.
@[email protected] @[email protected] Pixel 8a was the first device in the budget line with the 7 years of support. It's still significantly less than a year old, but once it's around 2 years old we think the whole issue of people not being able to afford devices to run GrapheneOS will be largely solved. It'll get even better as it gets a bit older. Buying a Pixel 8a when it's 4 years old and has 3 years of support left would not be ideal but would still be fine as long as people are prepared to replace it in 3y.
@[email protected] @[email protected] Pixel 5a is end-of-life since after August 2024. Qualcomm SoC related vulnerabilities no longer get listed in Pixel security bulletins for September 2024 onwards since there are no Qualcomm SoC devices remaining. Pixel 6 and later are the Tensor SoC which is heavily based on Exynos including a Mali GPU and they have a Samsung cellular radio instead of Qualcomm. Still Broadcom Wi-Fi other than 7a which is standalone Qualcomm, but also Broadcom/Samsung GNSS instead of Qualcomm.
@[email protected] @[email protected] You're missing a couple dozen Critical/High severity patches and hundreds of Moderate/Low severity patches. You will not get any of those moving to DivestOS or LineageOS. We think it would be harmful for us to continue providing regular legacy extended support releases where people mislead themselves into believing it's fine and they don't really need to listen to us about it. Perhaps this helps you understand why we're trying to get people to stop using these devices.
@[email protected] @[email protected] Current Pixels have 7 years of support from launch rather than 3. Get a Pixel 9 or Pixel 8a, use it for 7 years and then replace it with another new device. You can send back the Pixel 4a to them as part of buying it directly from them they'll pay you around $30 for it despite it being so old because they accept everything from the Pixel 1 with a floor on how low they go for the trade-in value.
Pixels even have longer support than iPhones do now unless Apple ups their game.
@[email protected] @[email protected] Current Pixels have 7 years of support from launch rather than 3. Get a Pixel 9 or Pixel 8a, use it for 7 years and then replace it with another new device. You can send back the Pixel 4a to them as part of buying it directly from them they'll pay you around $30 for it despite it being so old because they accept everything from the Pixel 1 with a floor on how low they go for the trade-in value.
Pixels even have longer proper support than iPhones now unless Apple extends it.