Earlier quoted context omitted.
What's really needed here is for the tech press to make this a priority when reviewing devices, which they currently don't. Right now consumers aren't aware of how important it is for the device to have drivers in the mainline kernel tree to avoid getting pwned. Not having that should be an absolute bar to a device making it onto anyone's "recommended" list. At which point device makers would prioritize not getting p…
> Right now consumers aren't aware of how important it is for the device to have drivers in the mainline kernel tree to avoid getting pwned. Customers are actively hostile to updates, because they hate UI changes. If you want customer uptake of updates to be higher, uncouple them from UI updates.
Right now most Android devices come with a custom Linux kernel, and you can't just use the vanilla kernel instead because it doesn't have the drivers for the hardware. Which means that when the OEM stops supporting the custom kernel and it has vulnerabilities in it, you can't replace it with anything on that hardware, so your choices are to stay vulnerable or throw away the hardware.
If they'd spend a minimum effort to get their drivers into the mainline kernel tree, the hardware would work with any version of the kernel without needing special support from the OEM, so then it would keep working with new third party kernels indefinitely -- even if the OEM goes out of business.
But reviewers don't distinguish between the devices that have this and the ones that don't, and don't tell consumers why it's important, so consumers buy devices as if it doesn't matter, when it does.