My friend at the time had an iPhone 5, I noticed her phone worked without issue while my Nexus 5 was constantly draining its battery.

I finally bought an Apple device and 11 years later never looked back. Finally said goodbye to Windows & Linux as well. I presume this is how many Apple conversions happen.

Back when Pixel came out I used to argue with a friend because it supposedly had a better camera: I'd always point out that the Pixel phone has its own Wikipedia article describing all its issues: https://en.wikipedia.org/wiki/Pixel_(1st_generation)#Issues

Its been like 12 years since the G1? They are still playing games till this day. Give it a rest already.

I'll believe Google's promises after they keep them, not before.

I had 3 pixels over the years. all 3 died after 1-2 years tops. And repairability is zero. absolutely would not recommend if you're a digital nomad. meanwhile my iphone 14 is still going strong. Battery life has gone down but still acceptable.

looks like Pixel 8 was released October 2023, so not even 2 years ago. not sure I'd put much stock in what Google says about support after <30% of the stated time.

> Pixels 6-7 got 5 years.

looks like Pixel 6 was released October 2021, so not even 4 years ago.

Pixel 8 gets 7 years of OS updates, not security updates. That's actually more than the 5-6 years that Apple commits to.

7 to 10 years is a 50% increase. Diminishing marginal returns dents that. But it still represents huge quantities of metal and resources.

Android is abandonware IMV

The Apple patch in the OP is in regards to a zero-interaction exploit that compromised the device to install spyware etc.

> Impact: Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

- The apps you run get exploited and your outdated OS can't protect you - An app you install exploits your OS - Someone attacks a system component and exploits your OS

The first risk can be mitigated mostly by just updating your browser/email client/webview engine/etc, which Google supports long past an OS version's lifetime. Android apps typically get updated for five or six versions behind the latest one.

The second attack vector is always a risk (0days do exist), but probably won't harm you if you have a set of trusted apps. There's always the risk of a supply chain attack, but I haven't heard of that in practice outside of cracked apps or that shitty spamware you find on Google Play.

The third vector probably won't affect you either because most system components aren't directly exposed. iOS has a history of getting exploited through simple MMS messages but on Android those processes are harder to exploit (and can often be updated years later through Google Play if you use the Google ones).

There was a huge flaw in Google's Bluetooth stack which pretty much allowed RCE on any phone with Bluetooth enabled. If your phone hasn't been patched against that, you have to be careful about leaving Bluetooth oh. Same goes for WiFi, but those bugs are harder to exploit.

There's a risk, but in practice millions to billions of people use outdated Android versions and malware strains abusing that fact aren't very common, especially not if you don't install weird third party apps from shady sources.

Part of the challenge of exploiting Android devices in practice is that there are endless combinations of firmware versions+device models+system app versions+kernels. iOS, on the other hand, generally has a handful of models, often running predictable software stacks because of Apple's decent track record when it comes to software updates.

Android exploitations does exist: various spyware companies use remote attack vectors, including WhatsApp or MMS like on iOS, to deploy targeted exploit chains to their victims. In practice, that's a risk to journalists, human rights activists, and other people The Government Doesn't Like Very Much (any government, really). Outdated phones are also easily dumped by law enforcement, so if you do anything that could be considered illegal, better not take your phone across international borders.

They started with the WebViews that vendors refused to update leading to all kinds of exploitation. These days, system components like the bytecode runtime and the Bluetooth stack can be updated by Google, unless the manufacturer actively prevents Google from doing that.

Firmware remains an issue, and IOMMU protections aren't all that great on every single device, but more and more Android internals get maintained by Google these days.

As for messages, there is always a risk in the pipeline between modem and the system service, but the Messages app is just another app you can update through Google Play or whatever store you prefer. Same with the dialer app and plenty of other apps. The super-integrated components that make for preferred exploitation targets on iOS aren't set up the same way on Android (not that Android doesn't have other attack vectors, of course).

This means that any fix needs to be backported to that special tree, irrespective of whether the Broadcom code is impacted, which may prove challenging when you end up having not just one but many trees, each at slightly different levels of outdatedness.

The approach clearly does not scale.

The solution would be for Broadcom to be diligent and forward port their tree to current mainline or current LTS at a minimum but they won't do that.

See how the RPi kernel is generally stuck at a special old version (e.g 6.6 for pi4, which is quite reasonably a LTS but then there's 6.12 as LTS already)

Apple literally has the scale to go to Qualcomm and buy slightly customized variants (the X71, for instance). And those modems are integrated with their custom Apple designed chips. I don't see any other vendor able to do that.

Why in the world would you think that? Who do you think governments target, Bond villains?

There are plenty of people who get hacked by governments. A smattering of targets got leaked here: https://www.occrp.org/interactives/project-p/#/

I wouldn't expect a Kazakh artist/activist to have the money for the latest and greatest iPhone. Nor would I expect an activist against an industrial plant on the US side of the Mexican border to need to worry about nation-state level malware.

And frankly, my PC has been used safely since much longer than iOS has been supported, and I don't know why I shouldn't expect my phone to last that long. The rate at which phones got performance improvements has stagnated into gimmick-level power increases (like "AI accelerators") a long time ago.

Also my company, as well as at least 1 other I know of that uses iPads, don’t sell the iPads to the stores, they replace or buy their iPads directly from Apple. Smaller places handle it all themselves, larger might use MDM but they are buying them at-cost.

I’m not saying everyone does that, just that I’m not aware of it.

I assume they know just how long their customers keep their phones and maintain them accordingly.

No huge deal breakers _personally_ as I don’t need banking on my phone anyway (I have an iPad at home, and also checked that the banks offer authentication devices like TAN generators if I really need to get out of the iOS/Android ecosystem).

Apple Pay still works fine.

I hope that small phone has a long life ahead of it still :)

And yes, you get a full blown Linux with it. So you can, like me, repurpose your smartphones into pretty much everything. I have removed their batteries and have them solar powered as Freifunk routers and even offline-ready kiwix media servers among other things.

[1] https://wiki.postmarketos.org/wiki/Devices