Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Fairphone built the Fairphone Gen 6+

arstechnica.com

Post reply on HN
Print view View original

201–210 of 254 posts

Re: How Fairphone built the Fairphone Gen 6+

#201

Post by grapheneos »

mapontosevenths wrote: post #60
artisinal wrote: post #43

The recently released Fairphone 6+ runs on Android 16. I had to look that up on Wikipedia, their website doesn't even clearly state that. Android 16 is 14 months old at the moment. Android 17 was released to manufacturers 6 months ago and had a general release 2 months ago. So why does a brand new phone run an operating system from over a year ago? Does it really take over 6 months to update a phone to a new version…

I am a user. What does Android 17 do for me that 16 doesn't?

Android 17 is required for full Android security updates. Only a subset of patches are backported to older versions and that's decreasing. Android 17 is also required for the latest and greatest privacy/security protections which are not backported. There have been massive privacy and security improvements in each yearly Android release.

Re: How Fairphone built the Fairphone Gen 6+

#202

Post by grapheneos »

cogman10 wrote: post #98
mapontosevenths wrote: post #60

Earlier quoted context omitted.

I am a user. What does Android 17 do for me that 16 doesn't?

[flagged]

Android 17 is required for full Android security updates. Only a subset of patches are backported to older versions and that's decreasing. Android 17 is also required for the latest and greatest privacy/security protections which are not backported. There have been massive privacy and security improvements in each yearly Android release.

Re: How Fairphone built the Fairphone Gen 6+

#203

Post by grapheneos »

microtonal wrote: post #99
mapontosevenths wrote: post #60

Earlier quoted context omitted.

I am a user. What does Android 17 do for me that 16 doesn't?

Getting security updates for issues that are not marked high/critical. These are not your typical RCE, but they are used in exploit chains. For those not aware, Android Security Bulletins only cover high/critical vulnerabilities. There are also rumors that Google will soon stop fixing vulnerabilities in not-actual versions that were discovered by Google in LLM-driven vulnerability discovery. There was recently a Grap…

> There are also rumors that Google will soon stop fixing vulnerabilities in not-actual versions that were discovered by Google in LLM-driven vulnerability discovery.

These are not rumors. It's an official announcement from Google to OEMs and we have access to it.

Re: How Fairphone built the Fairphone Gen 6+

#204

Post by grapheneos »

stymaar wrote: post #113
microtonal wrote: post #99

Earlier quoted context omitted.

Getting security updates for issues that are not marked high/critical. These are not your typical RCE, but they are used in exploit chains. For those not aware, Android Security Bulletins only cover high/critical vulnerabilities. There are also rumors that Google will soon stop fixing vulnerabilities in not-actual versions that were discovered by Google in LLM-driven vulnerability discovery. There was recently a Grap…

> Getting security updates for issues that are not marked high/critical. These are not your typical RCE, but they are used in exploit chains. Aren't those back-ported for a while?

Android Security Bulletins are a list of the High and Critical severity patches backported to older Android versions. At the time a bulletin is published, the patches have been available to OEMs to ship for 2-4 months. Fairphone is nearly always 1-2 months behind the latest bulletin but it can get much worse over time.

Android Security Bulletins do not cover the vast majority of Linux kernel security patches. They only cover an extremely small subset tied to Android. The Linux kernel has a massive tsunami of security patches on an ongoing basis. Fairphone 5 and earlier have an end-of-life Linux kernel without security support. They're close to not updating the kernel at all anymore. Their more recent devices will end up in the same situation.

The Linux kernel is not the only component ending up unmaintained while the devices are still presented as supported.

Re: How Fairphone built the Fairphone Gen 6+

#205

Post by grapheneos »

dsr_ wrote: post #63
mapontosevenths wrote: post #60

Earlier quoted context omitted.

I am a user. What does Android 17 do for me that 16 doesn't?

Since about 12 or so, it's been a series of cosmetic changes, bugfixes, and "AI" features.

Android 17 is required for full Android security updates. Only a subset of patches are backported to older versions and that's decreasing. Android 17 is also required for the latest and greatest privacy/security protections which are not backported. There have been massive privacy and security improvements in each yearly Android release. There have also been far more improvements than those. Being unaware of it doesn't mean it hasn't been done.

Re: How Fairphone built the Fairphone Gen 6+

#206

Post by grapheneos »

artisinal wrote: post #75
dathinab wrote: post #70

Earlier quoted context omitted.

[flagged]

[flagged]

It's inaccurate information. Qualcomm is willing to provide 8 years of support from SoC platform launch. Android also fully supports using a newer userspace on top of an outdated device support platform. Treble provided a very good implementation of it.

Fairphone chose to use T2Mobile as their ODM designing and making their devices. They chose to use the SoC platforms they did. They chose to focus very little on providing updates to the point that the Fairphone 5 and earlier have an end-of-life Linux kernel without security support. Fairphone 5 is still presented as supported with many years to come but it's not getting a large portion of the high importance security patches anymore.

Re: How Fairphone built the Fairphone Gen 6+

#207

Post by yjftsjthsd-h »

palata wrote: post #168
yjftsjthsd-h wrote: post #93

Earlier quoted context omitted.

[flagged]

> However, GOS's threat model very specifically treats the user as a thing to defend against Can you elaborate? GOS mostly honours the Android security model, which many alternatives don't do (many times they don't have a choice because the device doesn't allow them to relock the bootloader, so they just defeat the whole security model from the moment you install). There is absolutely nothing that can be done on a St…

[flagged]

Re: How Fairphone built the Fairphone Gen 6+

#208

Post by skorp01 »

ValdikSS wrote: post #33
Valodim wrote: post #10

Not an expert, but I recently heard that apparently not everything is perfect in fairphone land: https://discuss.grapheneos.org/d/24134-devices-lacking-stand...

GrapheneOS is like a veteran and war zone expert: for them, not only the external environment is considered extremely hostile that you should leave your house only wearing an armor and with bodyguards, but also the internal environment is hostile: your bodyguards could be bribed and work against you, that's why you need to somehow be protected against that as well. Just as physical security, digital security most of…

This is not an apt analogy.

A couple of the tenets of computing security are:

- Defense in depth - Principle of least privilege

It is a foundational reality that software (especially in unsafe languages) will invariably have vulnerabilities. Defense in depth and least privilege have compounding effects by forcing attackers to chain multiple exploits to achieve a compromised device, rather than a single vulnerability.

GrapheneOS shows how much can be accomplished on top of relatively secure platforms to begin with (AOSP, Pixel Stock OS, etc.) without sacrificing nearly any usability to the end user (barring manufactured hurdles like Play Integrity). It makes it more damning that many "privacy" OSes and devices cannot even meet the baseline level of privacy and security that AOSP provides, but degrade it.

Firmware and driver neglect and the lack of secure element utilization is not "reasonble security for the price".

Re: How Fairphone built the Fairphone Gen 6+

#209

Post by realusername »

palata wrote: post #173
realusername wrote: post #32

Earlier quoted context omitted.

[flagged]

> they also compare the security to the "Android Open Source Project" as if it's a real thing It is very much a real thing. You can build AOSP from sources and install it on a phone. Many Android devices run that (e.g. drone controllers). > Is certainly much better than my Samsung flagship Oh yeah, that's for sure. To share my experience, in terms of updates for me it has been GrapheneOS >>> Stock Android > /e/OS. I…

No you can't, AOSP doesn't even include a functional keyboard not a functional call manager nowadays. And I'm not even talking about the firmware side of things

Sure that might be enough for very basic hardware like your drone controller example but not a phone

Re: How Fairphone built the Fairphone Gen 6+

#210

Post by realusername »

grapheneos wrote: post #185
realusername wrote: post #32

Earlier quoted context omitted.

[flagged]

Android Open Source Project userspace code runs on any devices with Treble. That means it runs on any certified Android devices with the ability to install another OS. Updates and security features for the Linux kernel, drivers, firmware and hardware are still needed. Fairphone 5 and earlier have end-of-life Linux kernel branches without security support. Those lag multiple years behind on providing full Android secu…

[flagged]
Post reply on HN