Seems that we're generally looking at longer device "lifetimes" now?

Samsung 4 years of major upgrades and 5 years of security fixes

Fairphone are giving "at least" 5 major upgrades for the fairphone5

Google previously gave 3 years for both,
currently give 3 years and 5 years,
the rumour is from the upcoming pixel8 they're going to going to get 7
years of major upgrades

[No need to drag a**le into this, the subject concerns android devices]

Andy Burns <usenet@andyburns.uk> wrote

> Seems that we're generally looking at longer device "lifetimes" now?
> Samsung 4 years of major upgrades and 5 years of security fixes
> Fairphone are giving "at least" 5 major upgrades for the fairphone5

Frank Slootweg's Samsung went from 10 to 13, my Galaxy A32-5G (Released
2021, January 22) went from 11 to 13 with recently Sept security fixes.

How are your Pixel's doing?

> Google previously gave 3 years for both, currently give 3 years and 5 years,
> the rumour is from the upcoming pixel8 they're going to going to get 7
> years of major upgrades

I wonder how "important" the security patches are that happen during the
Project Mainline (aka "Google Play system updates") & Treble updates?

While Android 10 started with something like a dozen (or so) modules,
Android 13 is up to 34 (I think) and Android 14 something like 37.

The unanswered question is what's the relative importance of the so-called
"Security Updates" vs Mainline updates (which include security updates).

As far as you and I have been able to determine, the Mainline updates
are forever (where forever means we can't find any EOL date anywhere).
--
> [No need to drag a**le into this, the subject concerns android devices]

youse' tawcin' t'me? :)

Apple supports one release & one release only, which almost nobody knows.

Wally J wrote:

> Frank Slootweg's Samsung went from 10 to 13, my Galaxy A32-5G (Released
> 2021, January 22) went from 11 to 13 with recently Sept security fixes.

If you buy a Pixel8 this week, it'll arrive with 14 and go all the way
to 21, rumour seems to be they'll cease the "a" series pixels after the
7a, but with that number of years I wouldn't object to buying an 8 in
maybe 6-9 months time, should be discounted by then (still don't like
the huge camera bulge).

> How are your Pixel's doing?

Pixel 5a, doesn't feel 'old' yet, only issue I've had was one bad
monthly update that hurt daily battery life, fixed the following month,
will receive updates until August 2024 (I doubt whether the 15 upgrade
will come out during that timescale)

>> Google previously gave 3 years for both, currently give 3 years and 5 years,
>> the rumour is from the upcoming pixel8 they're going to going to get 7
>> years of major upgrades
>
> I wonder how "important" the security patches are that happen during the
> Project Mainline (aka "Google Play system updates") & Treble updates?

The Play updates seem somewhat behind the security updates, e.g. it's on
1st Sept security fixes and 1st Aug Play updates right now. Would
normally expect a new security fix during the first week of Oct, but
that's likely to be the v14 major upgrade instead this month.

Andy Burns <usenet@andyburns.uk> wrote

>> How are your Pixel's doing?
>
> Pixel 5a, doesn't feel 'old' yet, only issue I've had was one bad
> monthly update that hurt daily battery life, fixed the following month,
> will receive updates until August 2024 (I doubt whether the 15 upgrade
> will come out during that timescale)

Good for you on the Pixels as you taught me about the A/B partitions and
the OTA updates, which we don't have on my free Samsung Galaxy A32-5G.

I stress particularly that it was free because I love that darn thing!
I didn't pick it though - T-Mobile picked it for me. I buy cheap phones.
<https://forum.xda-developers.com/t/tmo-us-is-giving-away-this-phone.4265127/#post-89033675>

However, the size is right (most of the time it's two feet tall on my PC
monitor anyway) and the 5AH battery lasts forever (where I know how to keep
the radios off unless I need them), and the CPU & display does everything I
need it to do - so it too does not feel old in the least to me either.

Unless I break it, or lose it, or if I move to the slums and it gets
stolen, I can't imagine what they'll have to do to make me want a new one.

But my main question is how to differentiate between Project
Mainline/Treble "security updates" and the Android "security updates".
<https://artihe.com/heres-what-you-need-to-know-about-project-mainline-on-android-14-and-later/>
>>> Google previously gave 3 years for both, currently give 3 years and 5 years,
>>> the rumour is from the upcoming pixel8 they're going to going to get 7
>>> years of major upgrades
>>
>> I wonder how "important" the security patches are that happen during the
>> Project Mainline (aka "Google Play system updates") & Treble updates?
>
> The Play updates seem somewhat behind the security updates, e.g. it's on
> 1st Sept security fixes and 1st Aug Play updates right now.

My update status is documented here but I have many updates turned off.
<https://forum.xda-developers.com/t/is-it-just-me-or-is-samsung-google-t-mobile-who-updating-the-heck-out-of-this-free-samsung-galaxy-a32-5g-sma32-6u-phone-lately-who-is-doing-it.4629997/>

Note that I have almost all Google packages disabled but they're _still_
updating my phone even though I have a ton of the updaters turned off.
<https://forum.xda-developers.com/t/for-how-long-are-the-over-two-dozen-android-core-modules-updated-over-the-google-play-system-update-mechanism-aka-google-system-updates.4455927/post-88995551>

> Would
> normally expect a new security fix during the first week of Oct, but
> that's likely to be the v14 major upgrade instead this month.

I tried to stop all security fixes but they still keep coming!
<https://forum.xda-developers.com/t/can-i-prevent-an-update-or-at-least-stave-it-off-or-must-i-accept-the-upcoming-update-i-dont-want-the-baseband-to-increment-for-rooting.4532085/#post-87902917>

You seem to know this stuff better than anyone else on this newsgroup.
Me? I can't figure out why they even bother to separate the updates.
<https://forum.xda-developers.com/attachments/galaxy_update_upgrade-jpg.6008295/>

a. There is the "Android Security Patch Level"
b. There are the "Google Play system updates" (aka Project Mainline/Treble)
c. There seem to be Google Play Store system updates (mine are disabled)
etc.

A critical question we should know the answer to are what the differences
are between the security patches in the Project Mainline/Treble updates
(which happen, as far as we can tell, almost monthly forever) and the
specific entity called the "Android Security Patch Level".

Google is apparently frustrating that effort by not documenting it well.
<https://www.androidpolice.com/project-mainline-android-14/>

Mainly, I can't figure out how to differentiate between Project Mainline
security updates and the rest of the Android security updates.

Andy Burns <usenet@andyburns.uk> wrote:
> Seems that we're generally looking at longer device "lifetimes" now?
>
> Samsung 4 years of major upgrades and 5 years of security fixes
>
> Fairphone are giving "at least" 5 major upgrades for the fairphone5
>
> Google previously gave 3 years for both,
> currently give 3 years and 5 years,
> the rumour is from the upcoming pixel8 they're going to going to get 7
> years of major upgrades

There seem to be updates and updates. Some OEMs don't ship all the security
updates, or they ship them late (eg quarterly not monthly).

Fairphone is in a class of their own because they ship updates beyond when
Qualcomm have stopped supporting the hardware - that necessarily means they
can't ship updates for the parts they don't have source for, and are stuck
on the last version of Qualcomm's codebase (which I think means they're on
the last QC kernel, although I'm not sure how Mainline/Treble plays here).
They deliver 'updates' but not don't fully patch everything (or so I'm
told).

For vendors who offer N years of version updates and N+1 years of security
updates, I'm not clear if the +1 is just supporting the final release for
it's year of currency - ie if version X is released in October, it'll be
supported until the following September, and then X+1 comes out which the
phone doesn't get. So the +1 is more accurately described as +0.99

One thing mentioned when discussing this elsewhere is whether Google will
maintain 'LTS' versions of Android for the +2, +3 or whatever years of
security updates. It may be it's easier for them to just ship new Android
versions than have to backport updates to very old versions of Android. In
particular the Pixel 6 and 7 series are on 3+2 years, and maybe it's easier
for them to make that 5+0 (or 4+1) than offer 2 years of backports. It's
possible Google have under-promised here to minimise risks around getting
used to their own(ish) silicon, and they could yet over-deliver.

It will be interesting to see what Google say in the Pixel event tomorrow...

Theo

Theo wrote:

> Fairphone is in a class of their own because they ship updates beyond
> when Qualcomm have stopped supporting the hardware - that necessarily
> means they can't ship updates for the parts they don't have source for,
> and are stuck on the last version of Qualcomm's codebase

Never looked seriously at them before, the SoC in the fairphone 5 seems
to be some type of "LTS" chipset ...

> For vendors who offer N years of version updates and N+1 years of security
> updates, I'm not clear if the +1 is just supporting the final release for
> it's year of currency - ie if version X is released in October, it'll be
> supported until the following September, and then X+1 comes out which the
> phone doesn't get. So the +1 is more accurately described as +0.99

Google were sort of guilty of that, e.g. my previous Pixel3, launched
with android 9, got three upgrades to android 12, then theoretically
support stopped the moment it got that upgrade ... in practice google
weren't that harsh and it did get a 12.0.1 type upgrade to fix all the
initial bugs in 12, and then one more fix a couple of months after that,
but doing a major upgrade then slamming the door does feel like a daft
policy.

Andy Burns <usenet@andyburns.uk> wrote:
> Theo wrote:
>
> > Fairphone is in a class of their own because they ship updates beyond
> > when Qualcomm have stopped supporting the hardware - that necessarily
> > means they can't ship updates for the parts they don't have source for,
> > and are stuck on the last version of Qualcomm's codebase
>
> Never looked seriously at them before, the SoC in the fairphone 5 seems
> to be some type of "LTS" chipset ...

It has 5 years of support from Qualcomm, but FP are touting up to 5+5.
But the +5 may be patchy for what they can actually patch. Basically it's
the same kind of hackup as LineageOS does: the patches are necessarily
incomplete because they don't control everything.

> Google were sort of guilty of that, e.g. my previous Pixel3, launched
> with android 9, got three upgrades to android 12, then theoretically
> support stopped the moment it got that upgrade ... in practice google
> weren't that harsh and it did get a 12.0.1 type upgrade to fix all the
> initial bugs in 12, and then one more fix a couple of months after that,
> but doing a major upgrade then slamming the door does feel like a daft
> policy.

Did you get security updates for that year, or did they stop when 12 was
released?

Does anyone apart from Fairphone offer security updates >1 year after the
version updates stop? I think Samsung is 4+1, and aside from FP I can't
think of anyone else.

Theo

Theo wrote:

> Did you get security updates for that year, or did they stop when 12 was
> released?

They stopped after Oct21, it just happened to get a few of bugfixes in
Jan22, Feb22 and Jun22.

> Does anyone apart from Fairphone offer security updates >1 year after the
> version updates stop? I think Samsung is 4+1, and aside from FP I can't
> think of anyone else.

Google do 3+2 years, starting with the Pixel6

<https://support.google.com/pixelphone/answer/4457705?hl=en-GB#zippy=%2Cpixel-and-later-including-fold>

Andy Burns <usenet@andyburns.uk> wrote:
> Theo wrote:
>
> > Did you get security updates for that year, or did they stop when 12 was
> > released?
>
>
> They stopped after Oct21, it just happened to get a few of bugfixes in
> Jan22, Feb22 and Jun22.

Ah, that's interesting. I suppose in that era it was '3 years of version
updates' full stop, with no promise of security updates. Those are on
Qualcomm silicon, and when QC stop supporting it them I suppose there's
nothing the downstream OEMs (which includes Google here) can do. Unless
you're Fairphone and willing to keep going with only duct tape and string.

Hopefully things are better when QC is out of the picture.

> > Does anyone apart from Fairphone offer security updates >1 year after the
> > version updates stop? I think Samsung is 4+1, and aside from FP I can't
> > think of anyone else.
>
> Google do 3+2 years, starting with the Pixel6

Yes, I mentioned that. But Google are 'special' because they develop
Android, so they can make their own rulebook. I'm interested what 'normal'
OEMs do. What's Sony's policy, for example? Or Xiaomi, Oppo, Oneplus,
Huawei, ...?

Theo

Theo <theom+news@chiark.greenend.org.uk> wrote

> There seem to be updates and updates. Some OEMs don't ship all the security
> updates, or they ship them late (eg quarterly not monthly).

Not only are their those types of security updates which are explicitly
named as such but Google _also_ ships security updates via Proj. Mainline.

The question nobody seems to know the answer yet to though is...
(in terms of security) ... what's the difference between the two?

> Fairphone is in a class of their own because they ship updates beyond when
> Qualcomm have stopped supporting the hardware - that necessarily means they
> can't ship updates for the parts they don't have source for, and are stuck
> on the last version of Qualcomm's codebase (which I think means they're on
> the last QC kernel, although I'm not sure how Mainline/Treble plays here).
> They deliver 'updates' but not don't fully patch everything (or so I'm
> told).

I do NOT know the frequency of the Qualcomm Project Treble updates.

But we recently looked up the frequency of Project Mainline updates.
*How to find out what�s actually new in Google Play System Updates*
<https://www.esper.io/blog/building-a-google-play-system-update-changelog>
And we know the frequency of the typical old-style security updates.

Both of those have a frequency of about monthly (or bimonthly at times).
But what about the content?

Is it as simple as the Mainline security updates are to the mainline
modules, while the rest of the security updates are to other modules?

> For vendors who offer N years of version updates and N+1 years of security
> updates, I'm not clear if the +1 is just supporting the final release for
> it's year of currency - ie if version X is released in October, it'll be
> supported until the following September, and then X+1 comes out which the
> phone doesn't get. So the +1 is more accurately described as +0.99

Even so, the Project Mainline security updates appear to go on forever [1].

> One thing mentioned when discussing this elsewhere is whether Google will
> maintain 'LTS' versions of Android for the +2, +3 or whatever years of
> security updates. It may be it's easier for them to just ship new Android
> versions than have to backport updates to very old versions of Android. In
> particular the Pixel 6 and 7 series are on 3+2 years, and maybe it's easier
> for them to make that 5+0 (or 4+1) than offer 2 years of backports. It's
> possible Google have under-promised here to minimise risks around getting
> used to their own(ish) silicon, and they could yet over-deliver.
>
> It will be interesting to see what Google say in the Pixel event tomorrow...

Indeed. Please keep us informed as the update information for Google &
Samsung (and the rest of the Android 10+ phones via Mainline) is murky.
--
[1] Forever here means nobody can find an EOL date and even so they're all
donated to the AOSP so forever is at least the device hardware life.

Andy Burns <usenet@andyburns.uk> wrote

> doing a major upgrade then slamming the door does feel like a daft
> policy.

They didn't "slam the door" so much as slam one of the three doors...
a. Security updates (which are named as such)
b. Security updates (via Google Play services update)
c. Security updates (via Project Treble updates)

What we need to figure out is how to differentiate between those three.

This article that Wolff found may hold the key as Google is circumspect.
*How to find out what's actually new in Google Play System Updates*
<https://www.esper.io/blog/building-a-google-play-system-update-changelog>

The way esper goes about it is to take apart the donated AOSP src code.
<https://android.googlesource.com/platform/system/timezone/+/refs/tags/aml_tz4_331012050>

This can work because all the Mainline modules are donated to the AOSP.

On 03/10/2023 16:57, Wally J wrote:
> Andy Burns <usenet@andyburns.uk> wrote
>
>> doing a major upgrade then slamming the door does feel like a daft
>> policy.
>
> They didn't "slam the door" so much as slam one of the three doors...

I thought I'd given the Pixel3 away, but actually I've still got it, it
probably hasn't been turned on since whatever day the UK did a test of
the Emergency Alert system*

> a. Security updates (which are named as such)
> b. Security updates (via Google Play services update)
> c. Security updates (via Project Treble updates)

can you suggest some modules which you think have been recently updated
via non security update methods?

> What we need to figure out is how to differentiate between those three.
>
> This article that Wolff found may hold the key as Google is circumspect.
> *How to find out what's actually new in Google Play System Updates*
> <https://www.esper.io/blog/building-a-google-play-system-update-changelog>
>
> The way esper goes about it is to take apart the donated AOSP src code.
> <https://android.googlesource.com/platform/system/timezone/+/refs/tags/aml_tz4_331012050>
>
> This can work because all the Mainline modules are donated to the AOSP.

[*] 23rd April

Andy Burns <usenet@andyburns.uk> wrote

>> They didn't "slam the door" so much as slam one of the three doors...
>
> I thought I'd given the Pixel3 away, but actually I've still got it, it
> probably hasn't been turned on since whatever day the UK did a test of
> the Emergency Alert system*

Good you have it. I have a bunch of old Androids lying around also.
They're good for test beds I guess.

As for the Emergency Alerts, we get a bunch here (even for earthquakes,
but, um, er... by the time you get an earthquake alert, you already know.)

I've turned them all off except the one you can't turn off in the USA.
Even though I live in California where earthquakes & fires abound.

>> a. Security updates (which are named as such)
>> b. Security updates (via Google Play services update)
>> c. Security updates (via Project Treble updates)
>
> can you suggest some modules which you think have been recently updated
> via non security update methods?

Every once in a while Google makes the news for updating billions of
Android 10+ devices, which we've covered in detail in the past.

For example, there was a link just last week in someone's post (I don't
remember if it was the Apple or Android newsgroup) of Google updating
everyone on Android around the world for a particularly nasty bug.

But I agree with you and with the author of the Esper blog that Google is
circumspect about what they update in Mainline modules & when they update.

But we saw a link just this week in someone's post of the list of Google
updates & their frequency so we know Google updates via Mainline ~monthly.

Still... I agree with you that it's not clear which security updates come
via the "security update" moniker versus which come with Mainline modules.

I'd start with the Esper blog since that seems to be asking what we want to
know, which is what the heck is google adding to these 37 Mainline modules.

*How to find out what's actually new in Google Play System Updates*
<https://www.esper.io/blog/building-a-google-play-system-update-changelog>

On 10/3/23 11:51, Wally J wrote:
> As for the Emergency Alerts, we get a bunch here (even for earthquakes,
> but, um, er... by the time you get an earthquake alert, you already know.)

Earthquakes are their own alert :D

> I've turned them all off except the one you can't turn off in the USA.
> Even though I live in California where earthquakes & fires abound.
>

Ouch, try to stay safe!
--
user <candycane> is generated from /dev/urandom

candycanearter07 <no@thanks.net> wrote

>> I've turned them all off except the one you can't turn off in the USA.
>> Even though I live in California where earthquakes & fires abound.
>>
>
> Ouch, try to stay safe!

The problem with these alerts is they are almost all bogus, e.g., what good
does it do for me to see a "Silver Alert" for some guy down at the border
with Mexico when I live hundreds of miles away (which on the East Coast
would be about five to ten states away from the missing person).

Offhand we have Amber Alerts, Silver Alerts, Earthquake Alerts, PG&E
Alerts, Unknown Tracker Alerts, Wireless Emergency Alerts, and probably a
few others I don't offhand recall.

The only one, to my knowledge, we can't turn off are Presidential Alerts.

Back to the topic at hand, I think none of us know (yet) how Android
updates security, where two major security updates are what Google calls

1. System Security Updates
2. Google Play system updates

We need to work together to learn more about how they differ given both are
released roughly about monthly but one only goes for a few years while the
other seems to go on forever (for all devices on Android 10 or above).
<https://duckduckgo.com/?va=n&hps=1&q=how+often+does+%22google+play+system+update>

For example:
*Google Will Publish Monthly Changelog For Google Play System Updates*
<https://www.androidheadlines.com/2022/01/google-monthly-changelog-play-system-updates.html>

*Now you can learn what's new in each Google Play system update for Android*
<https://9to5google.com/2022/01/10/whats-new-android-google-play-system-updates/>

*How to find out what's actually new in Google Play System Updates*
<https://www.esper.io/blog/building-a-google-play-system-update-changelog>

Wally J wrote:

> The problem with these alerts is they are almost all bogus

Yes, since I got a warning for a tropical storm half the planet away
from me I've turned them all off (supposedly we don't have a $GOD level
that can't be turned off)

On 10/3/23 13:29, Andy Burns wrote:
> Wally J wrote:
>
>> The problem with these alerts is they are almost all bogus
>
> Yes, since I got a warning for a tropical storm half the planet away
> from me I've turned them all off (supposedly we don't have a $GOD level
> that can't be turned off)

Supposedly :)
--
user <candycane> is generated from /dev/urandom

Andy Burns <usenet@andyburns.uk> wrote

>> The problem with these alerts is they are almost all bogus
>
> Yes, since I got a warning for a tropical storm half the planet away
> from me I've turned them all off (supposedly we don't have a $GOD level
> that can't be turned off)

I wonder if they get the $GOD level reference you just made... :)
<https://duckduckgo.com/?&q=windows+god+mode>

For example...
*How to enable Windows God Mode*
<https://www.tomshardware.com/how-to/enable-god-mode-windows-11>

Back to the topic of what's the security update lifetime, I think there are
two answers (venn diagram) to that question - one of which is "forever"
and the other of which is about three to five years for Google/Samsung.

Notice though that the two types of security updates are both the same and
different at the same time - which I think is the source of confusion...
"If you don't already know, security patches and Google System updates
aren't the same. You might be familiar with the former because those
arrive as a software update for your phone. Unless you have auto-updates
turned on, you have to manually download and install the monthly security
patches. They fix various privacy and security vulnerabilities found on
Google's version of Android as well as custom skins supplied on top
by your phone's manufacturer.

Google System updates, meanwhile, are fully automated.

Originally referred to as Project Mainline, these updates fix bugs
discovered in various OS components like device connectivity,
location services, media services, Emergency alerts, and others.
Sometimes, they may also bring new features or enhancements."
<https://www.androidheadlines.com/2022/01/google-monthly-changelog-play-system-updates.html>

What it says is that Google is publishing _monthly_ a changelog of both
a. Security updates via security updates, and,
b. Security updates via Google Play system update updates.
*What's new in Google System Updates*
<https://support.google.com/product-documentation/answer/11412553>

Notice that says "Every week, the Google Play Store provides...", so the
update frequency is literally weekly, forever (as far as anyone knows).

The latest appears to be the October Google Play system updates update.
"Available through Google Play Store v37.8 updated on 10/2/2023"

In summary, "some" security updates on Android last only five years,
while other security updates last forever (Android 10 and above).
--
Forever here means nobody knows of any EOL date and even if there were an
EOL date, all Google Play System updates are donated to the AOSP community.

Andy Burns wrote:

> Would normally expect a new security fix during the first week of Oct,
> but that's likely to be the v14 major upgrade instead this month.

Sideloading v14 OTA now ...

Andy Burns wrote:

> the rumour is from the upcoming pixel8 they're going to going to get 7
> years of major upgrades

Confirmed in the pixel8 presentation today,
7 years of version updates and security fixes.

Andy Burns <usenet@andyburns.uk> wrote

>> Would normally expect a new security fix during the first week of Oct,
>> but that's likely to be the v14 major upgrade instead this month.
>
> Sideloading v14 OTA now ...

You have 37 project mainline (Google Play system update) modules now!

Please let us know how Android 14 feels.

Normally I don't see much of a change between Android releases. Do you?

Wally J wrote:

> You have 37 project mainline (Google Play system update) modules now!

Unfortunately too much 'real life stuff' to investigate much these days.

> Please let us know how Android 14 feels.

scrolly/slidy animations feel smoother (but can't think why they should,
not like this phone has 90Hz display or anything).

> Normally I don't see much of a
> change between Android releases. Do you?

Not really, a few status bar changes, lock screen extras,
new styling for on/off toggles

Andy Burns <usenet@andyburns.uk> wrote

>> Normally I don't see much of a
>> change between Android releases. Do you?
>
> Not really, a few status bar changes, lock screen extras,
> new styling for on/off toggles

Do you plan on using the native satellite features of Android 14?
<https://www.androidauthority.com/android-14-satellite-support-3204024/>

I guess the Android 14 "bloatware finder" could be useful for some people.
<https://www.androidauthority.com/android-14-uninstall-bloatware-3281078/>

Given battery cycles matter for overall life, this is new.
<https://www.androidauthority.com/android-14-features-3280726/>
"Android 14 allows you to see new battery information
such as its manufacturing date and cycle count.
The info can be found in Settings > About Phone > Battery Information"

Don't know how I'm supposed to use this BT feature though...
"When you connect a Bluetooth device to an Android 14 device,
you will be able to select its 'audio device type.'
You can choose between Speaker, Headphones, Car Kit, Hearing Aid,
or Other."

Wally J wrote:

> Do you plan on using the native satellite features of Android 14?

No hardware support yet?