by jcgl | 2025-09-15 13:18:44+00:00
> You are aware that a lot of Android's security-relevant stuff is provided in one or more "apps" [0] that get regularly updated.

Yes, I am aware.

> 1) Do you know how much security-relevant stuff is contained in the base OS vs those "apps"?

No, I'm not very knowledgeable about where the lines get drawn, especially for non-Play-related components. It is a relevant point to make though, and is definitely crucial to this topic. However, from what I can infer (e.g. from blogs and mastodon threads by the GrapheneOS folks), there is plenty of security-relevant OS-level stuff that needs patching over the lifecycle of a device. And firmware-level stuff is almost equally as important. Both these OS-level and firmware-level things are out of scope for these apps that Google pushes.

> 2) Were you aware that Android 14 is still a supported version of Android?

> 3) Were you aware that Android 13 is also still supported?

> 4) Did you know that those split out "apps" that I was talking about support all the way back to Android 6?

Yes. I couldn't have told you that it was Android 6 off the top of my head, but that timeline sounds about right.

> You can select laptops that have components that don't work with Linux, or only work with particular kernel versions. That "lot" of work in the Linux kernel that you refer to? A fair chunk of it is "just" working with the various device manufacturers to open source and mainline their drivers.

That is a good chunk of what I'm referring to, yes. Also in-scope is working with manufactures (of both the device and its components) to provide firmware updates e.g. via fwupd. Afaiu, the baseband for mobile handsets is especially important because it's a highly-privileged component that is

> If Google gave a shit about e-waste, they would have at minimum gotten the relevant phone manufacturers to give Google a source code license to the drivers & etc for the relevant phones and permission to adapt that software to newer kernels and ship compiled binaries in AOSP and Google Android.

> But, they didn't do that. So, they clearly don't care.

I more or less agree with you. But my point isn't that Google cares about e-waste. Rather, my point is that devices with longer lifecycles (e.g. Pixels) are superior to devices with short lifecycles (e.g. Unihertz devices). Which is a pity, because I love so much about the Unihertz design. Almost perfect for me.

> We could have seen 10+ year software-support-lifetimes from the phones that shipped with the first commercially-released version of Android. Go take a gander at the huge array of weird-ass one-off device drivers in Linux mainline. "Phone hardware was too immature for it to be adapted to later kernel versions" is a bogus statement.

I think you've picked out some very specific parts of my response and fixated on those. What I'm saying is that you cannot, in fact, pick up a 10 year-old handset and use it with up-to-date software and firmware[0]. My requirement/desire (which others may not share) is that I should be able to buy a new handset and use it for a bare minimum of 5+ years. As far as I can see, Unihertz's devices do not meet even that pitifully low bar.

[0] Tbh, firmware update support varies greatly for laptop and desktop hardware too. I'm no expert, but seems like lots of room for improvement there.