Snapdragon chip flaws put >1 billion Android phones at risk of data theft

[erek]

"In a statement, Qualcomm officials said: “Regarding the Qualcomm Compute DSP vulnerability disclosed by Check Point, we worked diligently to validate the issue and make appropriate mitigations available to OEMs. We have no evidence it is currently being exploited. We encourage end users to update their devices as patches become available and to only install applications from trusted locations such as the Google Play Store.”

Check Point said that Snapdragon is included in about 40 percent of phones worldwide. With an estimated 3 billion Android devices, that amounts to more than a billion phones. In the US market, Snapdragons are embedded in around 90 percent of devices.

There’s not much helpful guidance to provide users for protecting themselves against these exploits. Downloading apps only from Play can help, but Google’s track record of vetting apps shows that advice has limited efficacy. There’s also no way to effectively identify booby-trapped multimedia content."

https://arstechnica.com/information...billion-android-phones-at-risk-of-data-theft/

 

[Aurelius]

My concern isn't so much about the flaw itself as that many of those phones, even ones just two or three years old, will likely never get a fix because of how Google and OEMs handle Android updates. Yeah, you probably won't be attacked if you are vulnerable, but I wouldn't be thrilled about having that threat lingering in the background.

 

[sleepeeg3]

Would rather have Exynos chips with unlocked bootloaders in the US than Snapdragon.

 

[Zarathustra[H]]

Jesus.

So judging by the lack of model numbers in the article, I guess we have to just assume that this impacts ALL Snapdragon chips?

I have a Pixel 3. Google is pretty good about getting security patches out to their devices. They are not super fast, but they at least get pushed out on a monthly or so basis.

Many other phone brands may just be SOL. I have always felt that it is completely inexcusable to have any device with software on it that doesn't get security updates to the core OS on a regular basis.

Something has to change. We need to start treating phones with the desktop OS model, where security aptches are owned by and pushed out by the OS developer, without any involvement from the handset OEM. The extent of the OEM's involvement with the software should be to provide drivers. That's it.

 

[Lakados]

As much as I hate to like Apple they at least update their stuff regularly. I fear anybody who isn’t using a Pixel device is just going to be left to the wolves. There are enough of these chips out there that there is a pretty strong economic incentive for it to be targeted.

 

[Zarathustra[H]]

As much as I hate to like Apple they at least update their stuff regularly. I fear anybody who isn’t using a Pixel device is just going to be left to the wolves. There are enough of these chips out there that there is a pretty strong economic incentive for it to be targeted.

Apple is far from good.

They are EXTREMELY opaque when it comes to vulnerabilities, and they don't issue standalone security patches, just major updates every few months.

Google is better in this regard on their Pixel devices, where they are open about vilberabilities and patch roughly monthly.

Still not good by desktop standards, but much better.

All the Android based OEM's other than Google themselves get big fat F's in this regard. Samsung, LG, HTC, you name it. They are absolutely failing in this regard.

Security needs to be central to every design and maintained throughout the lifecycle.

The only truly excellent security patching I have seen in the phone industry, has been when I was using LineageOS, when vulnerabilities are patched on a fast, regular cadence.

 

[Dan_D]

Apple is far from good.

They are EXTREMELY opaque when it comes to vulnerabilities, and they don't issue standalone security patches, just major updates every few months.

Google is better in this regard on their Pixel devices, where they are open about vilberabilities and patch roughly monthly.

Still not good by desktop standards, but much better.

All the Android based OEM's other than Google themselves get big fat F's in this regard. Samsung, LG, HTC, you name it. They are absolutely failing in this regard.

Security needs to be central to every design and maintained throughout the lifecycle.

The only truly excellent security patching I have seen in the phone industry, has been when I was using LineageOS, when vulnerabilities are patched on a fast, regular cadence.

Well said. I was about to say the same things about Samsung, LG, etc. Also, I was about to say something similar about Apple as well. It is not a good company. It never has been.

 

[Sycraft]

As much as I hate to like Apple they at least update their stuff regularly. I fear anybody who isn’t using a Pixel device is just going to be left to the wolves. There are enough of these chips out there that there is a pretty strong economic incentive for it to be targeted.

Nah, Samsung updates their S series monthly, often as fast as the pixel. Most of the rest aren't quite as fast, but Android updates have gotten much better. Still not where they need to be, but better.

 

[UnknownSouljer]

Nah, Samsung updates their S series monthly, often as fast as the pixel. Most of the rest aren't quite as fast, but Android updates have gotten much better. Still not where they need to be, but better.

How many gens back? Is the Note 5 still getting updates?
That's a major difference. This is why this vulnerability is a big deal. Apple is currently supporting 6 years worth of hardware (and it's about to be 7 as the next gen launches. All currently supported hardware will be able to update to iOS14). There isn't a single Android vendor that I know of, including Google themselves, that is doing that level of support.

 

[DWolvin]

And that is why I want an actual Nexus device again... Something that doesn't need corporate approval to ave a patch when available. Heck, the (defunct) essential phone i had ran stock android and had updates before toe Pixels (and OS versions also). I would actually feel some loyalty (some) to a company that committed to as decent hardware package and stock android.

 

[Lakados]

Apple is far from good.

They are EXTREMELY opaque when it comes to vulnerabilities, and they don't issue standalone security patches, just major updates every few months.

Google is better in this regard on their Pixel devices, where they are open about vilberabilities and patch roughly monthly.

Still not good by desktop standards, but much better.

All the Android based OEM's other than Google themselves get big fat F's in this regard. Samsung, LG, HTC, you name it. They are absolutely failing in this regard.

Security needs to be central to every design and maintained throughout the lifecycle.

The only truly excellent security patching I have seen in the phone industry, has been when I was using LineageOS, when vulnerabilities are patched on a fast, regular cadence.

Yeah my apple complaints list is long, and fortunately I have a rep that gets that list monthly. But they at least feign an attempt at it, and they at least support going back like 6 years at this point. I would be hard pressed to find another vendor going back that far on hardware updates.

 

[T4rd]

I see these things as inevitable after seeing the Spectre/Meltdown vulnerabilities that affected all the older Intel chips. It's probably only a matter of time before someone discovers whatever zero-day vulnerabilities there currently are on other existing chips, whether they're by AMD, Apple, Samsung, etc. But of course those other OEMs will at least patch/support their current and affected hardware, while most of the ones affected by this will most likely go unpatched.

And that is why I want an actual Nexus device again... Something that doesn't need corporate approval to ave a patch when available. Heck, the (defunct) essential phone i had ran stock android and had updates before toe Pixels (and OS versions also). I would actually feel some loyalty (some) to a company that committed to as decent hardware package and stock android.

The Pixel 3a/4a are the new Nexus devices and I would probably recommend the 4a over any previous Pixel phone now. It's hard to beat at $350 with 3 years of software support/updates and still-decent specs. The Pixel 5 us rumored to be more reasonably priced this year too at around $650.

 

[Starfalcon]

How many gens back? Is the Note 5 still getting updates?
That's a major difference. This is why this vulnerability is a big deal. Apple is currently supporting 6 years worth of hardware (and it's about to be 7 as the next gen launches. All currently supported hardware will be able to update to iOS14). There isn't a single Android vendor that I know of, including Google themselves, that is doing that level of support.

I still have a Note 5 and I havent seen an update in 2 years. I keep putting off my next upgrade because the phones just keep getting more expensive, but my slowly dying battery will make the choice for me soon.

 

[mufcfan]

I still get the monthly security updates on my Nokia 7 Plus, because it is in Android One and it was released on the 25th of February, 2018. It has a Snapdragon 660, so I hope a fix will be provided in the September security patch!
I wish there were more Android One devices to choose from! The vanilla Android is perfectly good as evidenced by many devices, and I can't justify paying for stuff I don't want (custom UIs and launchers). Rather I paid for the steady stream of updates and upgrades.

 

[Deleted member 243478]

My concern isn't so much about the flaw itself as that many of those phones, even ones just two or three years old, will likely never get a fix because of how Google and OEMs handle Android updates. Yeah, you probably won't be attacked if you are vulnerable, but I wouldn't be thrilled about having that threat lingering in the background.

Such companies should be legally obligated to patch them. Blows my mind how anyone can spend so much on android phones when get get obsoleted in 12-24 months.

 

[emphy]

... Yeah, you probably won't be attacked if you are vulnerable, but I wouldn't be thrilled about having that threat lingering in the background.

This looks to me to be the sort of thing that, together with facebook's (and other companies') wonderful decision to have autoplay enabled by default in its applications, is going to be taken advantage of to cause quite a bit of havoc.

 

[Deleted member 243478]

Jesus.

So judging by the lack of model numbers in the article, I guess we have to just assume that this impacts ALL Snapdragon chips?

I have a Pixel 3. Google is pretty good about getting security patches out to their devices. They are not super fast, but they at least get pushed out on a monthly or so basis.

Many other phone brands may just be SOL. I have always felt that it is completely inexcusable to have any device with software on it that doesn't get security updates to the core OS on a regular basis.

Something has to change. We need to start treating phones with the desktop OS model, where security aptches are owned by and pushed out by the OS developer, without any involvement from the handset OEM. The extent of the OEM's involvement with the software should be to provide drivers. That's it.

This already happened... its called iPhone.

Until someone else mans up like Apple and has the balls to tell telcos etc to cut the BS bloatware or take a hike, it will never change...

 

[vegeta535]

Nah, Samsung updates their S series monthly, often as fast as the pixel. Most of the rest aren't quite as fast, but Android updates have gotten much better. Still not where they need to be, but better.

Has something changed then? I haven't used Samsung phones in years but when I did I got like two updates a year.

 

[Aurelius]

This looks to me to be the sort of thing that, together with facebook's (and other companies') wonderful decision to have autoplay enabled by default in its applications, is going to be taken advantage of to cause quite a bit of havoc.

I can't help but think Google is setting itself up for a situation like the Blaster worm for Windows XP -- that is, malware so vicious that it highlights fundamental failings in the platform's approach to security. I hope it doesn't get to that point, but I am worried that there could be millions of people with compromised phones simply because Google and OEMs didn't deliver consistent, long-term security updates.

 

[sharknice]

You always need to be careful what apps you install, even if they're from the official stores. This is just one of many things an app could do to get data you don't think it has access to.

But this seems way more concerning than that. They didn't explain the details so I don't know for sure. But the way they describe it, it may be possible to exploit this vulnerability in a web browser just by visiting a website that plays a video rendered on that chip, and maybe it doesn't even need to be a video.

 

[Aurelius]

Such companies should be legally obligated to patch them. Blows my mind how anyone can spend so much on android phones when get get obsoleted in 12-24 months.

I know Play Services offsets that to some extent, and some phones get security updates after two or even three years. Still, it's a poor situation. The maddening part isn't even so much the length as the consistency of it. Buy a brand new flagship? We'll give you two, no, three years of OS features and security updates every month. You live in a developing country and had to get a budget phone? Be thankful if we give you any major updates and a security patch once every few months. Hope you don't get hacked in between updates!

 

[blackmomba]

How many gens back? Is the Note 5 still getting updates?
That's a major difference. This is why this vulnerability is a big deal. Apple is currently supporting 6 years worth of hardware (and it's about to be 7 as the next gen launches. All currently supported hardware will be able to update to iOS14). There isn't a single Android vendor that I know of, including Google themselves, that is doing that level of support.

No, Note 5 isnt supported, but the S7 is still getting updates (4 years) which is pretty much good enough for anyone on an 2-3 year upgrade cycle. Been getting monthly updates on my Note10 and wives S10 and the monthly updates go back to the S8

Tbf it's not asking much of someone to upgrade their 5+ year old phone in order to benefit from security updates. You pay less in general for Android phones and therefore should be okay with that IMO.

Things have changed since 2010

 

[Sycraft]

Has something changed then? I haven't used Samsung phones in year but when I did I got like two updates a year.

They seem to be doing 1 a month for their S series and 4 a year for their A series. Latest update tracker has them doing them fast.

 

[DWolvin]

The Pixel 3a/4a are the new Nexus devices and I would probably recommend the 4a over any previous Pixel phone now. It's hard to beat at $350 with 3 years of software support/updates and still-decent specs. The Pixel 5 us rumored to be more reasonably priced this year too at around $650.

Not really- Google is running apps that are not base Android, and that goes so far as some skinning of the UI. Both updates that happened while I had the Essential were on my phone they were released. Both times I had the OS update before the Pixels (other than people running beta), because it was completely stock.

 

[T4rd]

Not really- Google is running apps that are not base Android, and that goes so far as some skinning of the UI. Both updates that happened while I had the Essential were on my phone they were released. Both times I had the OS update before the Pixels (other than people running beta), because it was completely stock.

Pixels get updates pushed on the first Monday of the month. Them not running "stock" Android had nothing to do with it and arguing about getting an update only a couple days before a Pixel is pretty pedantic.

 

[UnknownSouljer]

Tbf it's not asking much of someone to upgrade their 5+ year old phone in order to benefit from security updates. You pay less in general for Android phones and therefore should be okay with that IMO.

I would disagree. Flagship Samsung pricing is right in line with Apple pricing (in fact, Samsung has new ultra premium devices like the Fold 2 which cost 25-35% more than any Apple offering). It has been for several years and Samsung has still failed to provide timely updates and support their devices for a reasonable time frame. Nor support them anywhere near what Apple is doing, again, especially considering their cost.

It's now possible to buy an iPhone SE 2 for $400 (that's retail no discounts). With a lot of carrier subsidies that can easily be zero or BOGO (it's on sale all the time). And it has a flagship processor (the same as is found in the XS Max) and will more than likely be supported for 5+ years. Android in general and Samsung in particular don't really have an argument on cost or levels of support. Especially considering how many billions of dollars they're making a year in their phone department (meaning they could afford to make 5% less and support their phones way more). And they have the luxury of literally manufacturing all the hardware themselves, meaning their hardware costs them far less to make than Apple or anyone else through vertical integration (they make their own ram, flash, and processors as well as displays, Apple literally has to buy all of that from everyone else including from Samsung).

If you're buying any lie that they cost less so therefore it's okay that you get less, then you've been fooled from more than one angle. Samsung has plenty of devices that cost the same or more. And their devices cost them much less to make.

Finally I reject the notion that I should have to update my hardware every 3 years in order to have devices I own be supported. And that's a bad business model. My phone shouldn't be a commodity anymore than my desktop is. Especially considering how fast a computing device phones are at this point. From a "speed" perspective, there is no reason why a device shouldn't be able to get OS updates for years other than planned obsolescence. As well as hardware manufactures wanting you to upgrade at their cadence rather than your own.

Things have changed since 2010

Debateable. Improved perhaps. To me, if you're on Android you should either just buy a Google device or if you don't mind doing all the work yourself, getting a phone that has an unlocked bootloader. Everything else is a compromise in terms of updates and security.

 

[blackmomba]

I would disagree. Flagship Samsung pricing is right in line with Apple pricing (in fact, Samsung has new ultra premium devices like the Fold 2 which cost 25-35% more than any Apple offering). It has been for several years and Samsung has still failed to provide timely updates and support their devices for a reasonable time frame. Nor support them anywhere near what Apple is doing, again, especially considering their cost.

Eh somewhat. Upon initial release, yes both companies price their flagships similarly, but we've seen that the S series / Note lineups get heavily discounted very shortly after release, while the iPhone doesn't. Not sure why you keep repeating the updates FUD. Monthly updates for devices like the S8 up until current devices. Good enough for most.

It's now possible to buy an iPhone SE 2 for $400 (that's retail no discounts). With a lot of carrier subsidies that can easily be zero or BOGO (it's on sale all the time). And it has a flagship processor (the same as is found in the XS Max) and will more than likely be supported for 5+ years. Android in general and Samsung in particular don't really have an argument on cost or levels of support. Especially considering how many billions of dollars they're making a year in their phone department (meaning they could afford to make 5% less and support their phones way more). And they have the luxury of literally manufacturing all the hardware themselves, meaning their hardware costs them far less to make than Apple or anyone else through vertical integration (they make their own ram, flash, and processors as well as displays, Apple literally has to buy all of that from everyone else including from Samsung).

If you're buying any lie that they cost less so therefore it's okay that you get less, then you've been fooled from more than one angle.

Actually I didn't say you get less. I did say you get enough because most are going to upgrade at the end of their agreements anyway (many people do this). Of course they can be better, but I don't think they're lacking to the point that some make it out. They've been pretty good IMO

Finally I reject the notion that I should have to update my hardware every 3 years in order to have devices I own be supported. And that's a bad business model. My phone shouldn't be a commodity anymore than my desktop is. Especially considering how fast a computing device phones are at this point. From a "speed" perspective, there is no reason why a device shouldn't be able to get OS updates for years other than planned obsolescence. As well as hardware manufactures wanting you to upgrade at their cadence rather than your own.

So I don't really follow here because I understand what you're saying as "my phone should receive updates forever, or for as long as I decide I need the phone", which I think is ludicrous. Do you have the same requirement of the OS you run on your desktop? For me, a phone is nothing like a desktop. For the most part, a desktop is modular. You choose what goes into it. You choose what software it runs, whether it be your own or something you purchased. That's not at all the case for a mobile phone. You're buying a package, software and hardware. The vendor decides what software can run on which hardware for the most part. That's the deal

Debateable. Improved perhaps. To me, if you're on Android you should either just buy a Google device or if you don't mind doing all the work yourself, getting a phone that has an unlocked bootloader. Everything else is a compromise in terms of updates and security.

I'm no expert but I'm not sure there are many phones left that allow for bootloader unlocking out of the box like Google used to back in the day.

I use both brands, iPhone 8 for work and Note10 as a personal device. Happy with both, update both. Keeping my nose clean

 

[UnknownSouljer]

Eh somewhat. Upon initial release, yes both companies price their flagships similarly, but we've seen that the S series / Note lineups get heavily discounted very shortly after release, while the iPhone doesn't. Not sure why you keep repeating the updates FUD. Monthly updates for devices like the S8 up until current devices. Good enough for most.

iPhones have plenty of carrier deals that drop the iPhone in price.
I'm only repeating what I see.

So I don't really follow here because I understand what you're saying as "my phone should receive updates forever, or for as long as I decide I need the phone", which I think is ludicrous. Do you have the same requirement of the OS you run on your desktop? For me, a phone is nothing like a desktop. For the most part, a desktop is modular. You choose what goes into it. You choose what software it runs, whether it be your own or something you purchased. That's not at all the case for a mobile phone. You're buying a package, software and hardware. The vendor decides what software can run on which hardware for the most part. That's the deal

Okay, so then what are we even talking about then? If any level of support is okay it should be just as okay with all cellphone manufacturers not bothering to release any security or OS updates at all. Because that's the deal. Then we should also just close this thread because who cares? Just be SOL with your lack of updates.
If that isn't the deal then what we're really discussing is at what level is it okay or not okay. I didn't say infinite either, but Apple is definitely ahead here and when you consider cost over time Apple is also still ahead. This is especially considering buying 1-2 year old non-flagship phones or previous gen flagship phones (bought new from a carrier) at much lower prices (EG: iPhone XR). And to my point, if this sort of issue cropped up on Apple's side (which with all things electronic is more than a possibility) I can expect that Apple would have a great lion's share of its customer base supported with a patch in a timely manner. Whereas it's highly doubtful that even 50% of these 1 billion devices as purported in the article will get a security patch. I'd honestly be surprised if it's over 25%.

Samsung is doing 'okay' with updates on flagships is basically what you're saying, but anyone on their midlevel stuff (like say the Galaxy A) is getting the shaft. Whereas there are multiple Apple options that will last much longer from both a hardware and software standpoint and in fact everything they make receives the same level of support. And that isn't really debatable. If Samsung is the bright, shinning, non-Google, star on the Android side; I can only imagine how bad it is on every other Google device.

I'm no expert but I'm not sure there are many phones left that allow for bootloader unlocking out of the box like Google used to back in the day.

There aren't. But some like the now defunct Essential allows people to install whatever ROM they want. I haven't checked recently but OnePlus for a long time was also a bastion of custom ROMs.

I use both brands, iPhone 8 for work and Note10 as a personal device. Happy with both, update both. Keeping my nose clean

Cool.

 

[blackmomba]

Okay, so then what are we even talking about then? If any level of support is okay it should be just as okay with all cellphone manufacturers not bothering to release any security or OS updates at all. Because that's the deal. Then we should also just close this thread because who cares? Just be SOL with your lack of updates.
If that isn't the deal then what we're really discussing is at what level is it okay or not okay. I didn't say infinite either, but Apple is definitely ahead here and when you consider cost over time Apple is also still ahead. This is especially considering buying 1-2 year old non-flagship phones or previous gen flagship phones (bought new from a carrier) at much lower prices (EG: iPhone XR). And to my point, if this sort of issue cropped up on Apple's side (which with all things electronic is more than a possibility) I can expect that Apple would have a great lion's share of its customer base supported with a patch in a timely manner. Whereas it's highly doubtful that even 50% of these 1 billion devices as purported in the article will get a security patch. I'd honestly be surprised if it's over 25%.

Were talking about Samsung being pretty good at updates when you consider how many devices and variants of each device they keep support for. It's not as good as Apple, but it's good enough, especially when you consider all the variants they make. I wouldn't call having a Monthly and Quarterly update schedule as lacking and I wouldn't be willing to pull numbers out of my ass as to how many devices would be affected by this and stay vulnerable. I just know that Samsung deserves more credit than they get for their support and updates

Samsung is doing 'okay' with updates on flagships is basically what you're saying, but anyone on their midlevel stuff (like say the Galaxy A) is getting the shaft. Whereas there are multiple Apple options that will last much longer from both a hardware and software standpoint and in fact everything they make receives the same level of support. And that isn't really debatable. If Samsung is the bright, shinning, non-Google, star on the Android side; I can only imagine how bad it is on every other Google device.

Well, this is essentially what I was trying to say earlier. The midlevel and budget stuff is really inexpensive and you have to go to previous gen iPhones to get something comparable in price. The owner of a 4+ year old mid-range or budget Android phone should have no problem moving to the current gen mid-range or budget option. You're the one that started saying they're equivalent in price when that's only the case for Samsungs flagship lines

I'm not sure how it is on every other device, but I know that Samsung represents a large proportion of Android phones in the wild and they're doing good so far

 

[UnknownSouljer]

Well, this is essentially what I was trying to say earlier. The midlevel and budget stuff is really inexpensive and you have to go to previous gen iPhones to get something comparable in price. The owner of a 4+ year old mid-range or budget Android phone should have no problem moving to the current gen mid-range or budget option. You're the one that started saying they're equivalent in price when that's only the case for Samsungs flagship lines

I'm not sure how it is on every other device, but I know that Samsung represents a large proportion of Android phones in the wild and they're doing good so far

No, I'm saying that Apple currently has Samsung beat at all pricing levels.
Samsung has the Galaxy Fold 2 and Galaxy Fold Z that are ultra premium devices that cost absurd amounts of money.
Then there is the both Apple's top end regular flagship devices both of which get discounted.
My point with buying last gen flagships or even last gen phones in general is that they will still have way more years of support than a current flagship Samsung phone while costing less and likely being faster (I'm fairly certain there isn't a Snapdragon or Exynos based processor that's as fast as A12).
And then at the bottom there is the iPhone SE2 which can often be had for free, half-off, or BOGO.

At every level Apple has a product that meets pricing requirements while being better supported and faster. There is no Samsung budget option that is nearly as good as an iPhone SE2. Nor as fast. And when considering "free" only possibly equally as cheap. And with it's A13, no device that will be supported nearly as long. And there are those head to head comparisons down the list.

It's incredibly hard to justify Samsung's cost, speed, or lack of support versus Apple's lineup. The irony of you saying in an earlier post that this isn't 2010 anymore is that Samsung doesn't have a pricing advantage, nor even the ability to trade blows in terms of speed, or the flexibility of a bootloader.
Other Android devices are much more competitive. Where you're at least getting other major advantages even if Snapdragon and Exynos are lagging behind Apple A-series processors. Generally in stability and support or other features like Google's image processing and cameras in Pixel.

In any case, you let me know when Samsung has their user based patched up. It will be really interesting to see their response. It won't really make a difference either way though. As much as Samsung users don't want to admit it, they're just as zealous as Apple users are. Samsung users have been burned way more on phones (sometimes literally) and they keep buying them anyway. I guess to your point maybe this whole thing just comes down to mentality: Samsung users are okay with no support and they're still willing to buy anyway so it doesn't really matter if they only support their devices for a short time.

 

[blackmomba]

No, I'm saying that Apple currently has Samsung beat at all pricing levels.
Samsung has the Galaxy Fold 2 and Galaxy Fold Z that are ultra premium devices that cost absurd amounts of money.
Then there is the both Apple's top end regular flagship devices both of which get discounted.
My point with buying last gen flagships or even last gen phones in general is that they will still have way more years of support than a current flagship Samsung phone while costing less and likely being faster (I'm fairly certain there isn't a Snapdragon or Exynos based processor that's as fast as A12).
And then at the bottom there is the iPhone SE2 which can often be had for free, half-off, or BOGO.

At every level Apple has a product that meets pricing requirements while being better supported and faster. There is no Samsung budget option that is nearly as good as an iPhone SE2. Nor as fast. And when considering "free" only possibly equally as cheap. And with it's A13, no device that will be supported nearly as long. And there are those head to head comparisons down the list.

It's incredibly hard to justify Samsung's cost, speed, or lack of support versus Apple's lineup. The irony of you saying in an earlier post that this isn't 2010 anymore is that Samsung doesn't have a pricing advantage, nor even the ability to trade blows in terms of speed, or the flexibility of a bootloader.
Other Android devices are much more competitive. Where you're at least getting other major advantages even if Snapdragon and Exynos are lagging behind Apple A-series processors. Generally in stability and support or other features like Google's image processing and cameras in Pixel.

In any case, you let me know when Samsung has their user based patched up. It will be really interesting to see their response. It won't really make a difference either way though. As much as Samsung users don't want to admit it, they're just as zealous as Apple users are. Samsung users have been burned way more on phones (sometimes literally) and they keep buying them anyway. I guess to your point maybe this whole thing just comes down to mentality: Samsung users are okay with no support and they're still willing to buy anyway so it doesn't really matter if they only support their devices for a short time.

Alright my dude I'll let you know

 

[DWolvin]

Pixels get updates pushed on the first Monday of the month. Them not running "stock" Android had nothing to do with it and arguing about getting an update only a couple days before a Pixel is pretty pedantic.

Fair enough, but my point is that even though they own the code they could be outrun (even if only by a tiny amount) by any company willing to not skin. Add-ons can be packages from the store, and I believe that's Google's stated goal.

 

[Grimlakin]

Phones today are what the vast majority do all of their personal day to day device use on. More than desktops and more than laptops. They are on their phones, they are banking, they are buying shit, and phones are getting more powerful than PC's in many peoples homes that even HAVE laptops or desktops. you want to see a DOS attack. Wait until you have every unprotected snapdragon in the WORLD DOSing someone. China's great wall firewall won't stand a chance. Neither will any business that doesn't pay the people targeting them with a DOS attack of that magnitude.

 

[UnknownSouljer]

So if we are all completely vulnerable, then we are safe. Strength in numbers.

Yeap. A great example of this is what happened during world war 2.

I don’t want to be anywhere near your idea of safe.

 

[HockeyJon]

Another serious Android security vulnerability? Sorry to hear.

- sent from my iPhone

 

[kamikazi]

You know some people don't like the locked down apple "experience".

I challenge you to find me an approved apple app that will let you do a true wifi site survey where you can see all surrounding networks and the traffic on each channel. Several months ago, I was trying to help a friend of mine set up his wireless router and find the clearest channels. His ISP router couldn't do it and neither could his iPhone. We searched and searched and no apple store apps could do a site survey. All the wifi apps were just auto optimazation garbage.

I give apple props for not unlocking phones for the fbi.

Model wise, Apple only needs to support a fraction of what Samsung does. Don't get me wrong, Samsung needs to throw more money at supporting their multitude of phones. However, has Samsung been caught nerfing older phones to push users to newer models? Samsung pushes older phones out by not updating them, Apple was doing it by making them slower. Tomato, Tomato.

 

[UnknownSouljer]

You know some people don't like the locked down apple "experience".

I agree. There are tradeoffs with everything. If you're referring to me personally, that's why I've recommended people go with specifically Pixel devices or devices you can update yourself through custom ROMs.

I challenge you to find me an approved apple app that will let you do a true wifi site survey where you can see all surrounding networks and the traffic on each channel. Several months ago, I was trying to help a friend of mine set up his wireless router and find the clearest channels. His ISP router couldn't do it and neither could his iPhone. We searched and searched and no apple store apps could do a site survey. All the wifi apps were just auto optimazation garbage.

You're right. We probably can't. But this is also an application that is extremely specific and esoteric. 99.9% of people aren't looking for an application that's capable of doing this. Still, if that's a function you need, kudos to Android.

Model wise, Apple only needs to support a fraction of what Samsung does. Don't get me wrong, Samsung needs to throw more money at supporting their multitude of phones.

I somewhat disagree. It's true that Samsung has way more model numbers than Apple. But Apple does have a complete product stack from $0-$1000+ (the iPhone SE's existance in the first place was to be a lower costed phone that could be solid in places like India and China in order to gain marketshare. So there is more than one way to skin a cat). It's Samsung's choice to produce as many model numbers as they do. Even Samsung's Android competitors don't do this. OnePlus, Google, et al are just fine without making a bunch of model numbers.

Also, directly to the contrary, if you choose to make that many models and you can't support them all, whose fault is that? No one has forced Samsung to do so.

However, has Samsung been caught nerfing older phones to push users to newer models? Samsung pushes older phones out by not updating them, Apple was doing it by making them slower. Tomato, Tomato.

They have and they haven't. Battery gate effects Samsung devices just as much as on Apple. But your entire premise is wrong. The purpose of "nerfing" wasn't specifically to older models, it's to devices with more worn batteries. There are two options when it comes to dealing with the issue of old batteries: either have your phone randomly reset under load or limit the power draw an old battery is capable of using (which has the effect of making the device slower). Apple choose the latter, Samsung more or less chose the former. For most, I'd say Apple's approach is better since it actually allows you to use your device rather than have it reset on you.
However for either case the problem is solved simply by installing a new battery. I know, because I have done it. I had one of the "affected devcies" the iPhone 6S+ and I used that phone for over 4 years replacing the battery twice. And I got all my performance "back" both times. And neither time was I "forced" to upgrade. I would probably still be using that phone if other items in it didn't break, making it easier to just upgrade rather than repair (in my case, it was the rear camera that essentially had broken IBIS).

A lot of people still don't understand this issue, and there is a lot of FUD surrounding it. I still hear people complain about the cost of replacing a battery so they just instead upgrade their device with another $700-$1000 device? That makes no sense to me. Batteries are by their nature disposable, there isn't any chemistry that won't degrade over time. And the smart batteries found in these phones are incredibly good at managing them (and they're expensive and require a tech to replace). Spending $70-$120 every 2 years to maintain a $1000 device and use it for another 2 years is more than reasonable. Again considering the initial cost of the device and the fact that at some point it has to be replaced.

EDIT: Also as an FYI this is why Apple has become more transparent about it's battery preserving features, with the "battery health" section as well as the ability to turn on and off power management, and turn on and off smart charging. Battery gate has basically been eliminated from a number of angles, but that doesn't prevent the issue of needing to replace a battery when it comes time. For most that's after about 2 years. Again, replacing your battery after two years seems like a more than reasonable alternative to buying a new phone, especially for those of us who feel their current devices are fast enough and don't want to have to spend another $700-$1000 on another phone.

 

[kamikazi]

Also, directly to the contrary, if you choose to make that many models and you can't support them all, whose fault is that? No one has forced Samsung to do so.

I'm with you there. As I said in my post, they need to put more resources there.

 

[Aurelius]

I'm with you there. As I said in my post, they need to put more resources there.

It's a bit classist the way it is right now, quite frankly. Like the quality of support you get is directly tied to how privileged your life is. For all its flaws, Apple at least makes sure that someone buying a $399 iPhone gets about the same OS support as someone buying a $1,449 model... good support.

 

[GoodBoy]

Qualcomm has released a fix for the flaws, but so far it hasn’t been incorporated into the Android OS or any Android device that uses Snapdragon, Check Point said. When I asked when Google might add the Qualcomm patches, a company spokesman said to check with Qualcomm. The chipmaker didn’t respond to an email asking.

Then why the fuck has this been publicly announced...

I do know I already have the August 1st Android patch...