I'm (we all are) constantly reminded to update our phones to latest available updates, but sh*t like this is what teaches users to instead disable and ignore updates indefinitely, under the premise of "if it works don't touch it" (addendum: "... because most probably an update will break it")
And here I am, ignoring updates on my Pixel 6a since October 2024 (there were reports of crashes or bricking, what a surprise) and planning to keep doing that for the foreseeable future.
Sucks having to choose between a potentially (even likely, seeing the trend) broken device or an unsecured one. Pick your poison.
I was visiting my parents for the holidays and came across this exact mindset. I usually push them to update for security, but I learned that they stopped doing that this year. Apparently some update broke/removed/changed an accessibility feature on their phone in a way that I couldn’t figure out how to revert. My mom had updated her phone first so only she was affected. My dad now refuses to update his phone and both of them have completely stopped updating for fear that something else will “break”. I can’t really blame them, but it does worry me and now I’m trying to think of what I can do to secure their devices if they’re not going to update.
The software industry has known how to do this for a very long time, but some companies refuse to do it. You maintain a "sustaining" branch just for security and other legitimately urgent fixes, and a main branch for everything else. Users are nudged more strongly to apply the sustaining fixes and the main update branch should be optional.
We have immensely powerful version control and branching at developers' disposal, much better than at any past time I can think of. Yet, most companies insist on having a single release that increments, and users must take everything or nothing whenever they update.
Phone/OS manufacturers are actually better than most, and both major operating systems do provide security updates in parallel with major (feature) updates, but only for a very short amount of time.
But it isn't this simple, because you wouldn't need a single "maintaining" branch. You would need one for each feature release that the user may stop at.
So if you release the feature branch every 3 months after a few years you will have a dozen maintaining branches to backport fixes to, and in which to carefully test that the fix actually works. The problem is linearly worse if you release the feature branch more often.
> So if you release the feature branch every 3 months after a few years you will have a dozen maintaining branches to backport fixes to, and in which to carefully test that the fix actually works. The problem is linearly worse if you release the feature branch more often.
This has been solved by LTS releases for some time. You have a newest release branch that gets feature updates immediately and an LTS branch which has a full release e.g. once every two or three years, at which point it catches up on features to the then-current newest release branch. The newest release branch doesn't have long-term support and you're expected to take the latest feature update, the LTS branch gets only security updates, the user can choose between the two or three LTS releases currently in the support window or the newest release branch.
Only if it hasn't actually been solved. LTS releases resolve the conflict between providing a stable system that receives only security updates and separately maintaining dozens of separate branches.
They don't solve the problem, though, they merely reduce its scope. Ubuntu's LTS versions only last five years for free users, and they currently have to maintain seven of them.
And now instead of having a small update every now and then that you can perhaps try to adapt to, you have a massive update every 5 years or whatever (or less if you happened to start out just before the next LTS) that'll basically guaranteed wreck everything (by design even!!) and for all intents and purposes might as well not exist cause there's no way you're upgrading to the horrible "new" mess. And we're back at people being stuck on outdated software, but now there's just absolutely no way whatsoever you'll get them to upgrade.
Never mind the problem of if you started out on a non-LTS version.
And also the problem of not getting the actually nice updates, and perhaps losing app compatibility.
This was, I believe, the problem that Microsoft wanted to resolve with their gradual burndown of WSUS - a lot of shops (including one I used to work at) would selectively roll out updates based on whether they thought they were relevant, resulting in an explosion of configurations that Microsoft had absolutely never tested against, and naturally, a lot of breakage.
This doesn't really jive with reality as Windows is plenty buggy in the presence or absence of the latest updates. Microsoft has slowly eliminated end user controls over updates because it would interfere with their ability to monetize their customer base. You can't really push a telemetry update, if updates aren't being applied.
Frankly, even the scarequotes around break feel misplaced. Your Mom can't use the device like she wants to. An accessibility feature is gone to the point you can't get it back. That feels pretty broken to me.
Yeah, you’re probably right. I just wanted to write my anecdotal experience in a way that would avoid the “you’re holding it wrong” crowd because the point is how this leads to broken trust, not whatever broken feature it is.
Gotcha. That might help somewhat but it wouldn’t solve the “never update Android or any other app” problem. I’d also have to get them used to using a new browser. It’s a larger problem that their trust in tech was easily (possibly irreversibly) broken after years of me slowly convincing them and getting them used to letting their devices update. They are even older now and having had a stint working in the senior care tech space, I know that trying to tech the older generation to use tech safely is a very high hurdle. Now that I don’t live near them, I’m not sure that’s a hurdle that can be easily overcome.
Google 4a user here. They pushed an update while I was on a ski trip in Korea - I updated an hour before getting on my bus and.. the application launcher started crashing on unlock. I couldn't open any apps.
Thankfully, I was able to get into the settings and switch to Lawnchair without a working "desktop UI", but without a second application launcher I would have been totally screwed. I checked the Play Store afterwards and saw hundreds of people with the same issue.
On Linux I can choose which "security" updates to install, and only install those. Why can't Windows and Android provide such a feature?
Stuff like this is why I keep printing entrance tickets and the like. I don't want to end up in a situation where I have to trust software that is known to have new bugs every months to get into a place without any sort of backup.
>Stuff like this is why I keep printing entrance tickets and the like.
I almost got completely screwed by my pixel updating right before a concert while I was already out of town. Luckily my wife was able to login to my computer and forward the tickets to someone else that I was with, but it was a close call because she was walking out the door to do something herself when I managed to get ahold of her.
In this case, if you don’t have a phone that can display Ticketmaster’s code, you’re just SOL, since they decided to break being able to just print out your code.
> Why can't Windows and Android provide such a feature?
Windows does.
Android "can't" because the OS is a partition image with libraries not intended to be updated piecemeal, not a collection of loosely related external projects like Linux is.
Desktop Linux doesn't actually do that unless you're trying to use a rolling release distribution. The way stable distributions work is that the packages largely remain the same for a given major version throughout its lifespan, but individual packages can still receive security updates.
I've had "stable" distributions fall over upgrading between their major versions.
But you missed the point that Android's system image is immutable and updates are atomic. A user can't screw it up. This is not an insignificant feature, and it's something you also get with something like Fedora Silverblue. Which then also doesn't let you pick and choose what updates to get.
Major version upgrades occasionally break things because they're a new feature release but are then trying to migrate configuration from the existing system. But the same thing happens with "atomic" upgrades if you're trying to migrate existing configuration, because the bug is really in the migration system that didn't properly handle that configuration variance, not because the packages aren't upgraded atomically. Which is why phones sometimes do break on major version upgrades for the same reason.
Piecemeal updates are also absolute hell to support - they rapidly lead to an untestable combinatorial explosion of possible software loadouts. Even Ubuntu doesn't officially support installing packages from a mixture of point releases (e.g. installing Ubuntu 24.10 packages on the 24.04 LTS); it might be technically possible, but if anything breaks, you get to keep the pieces.
>Google 4a user here. They pushed an update while I was on a ski trip in Korea - I updated an hour before getting on my bus and.. the application launcher started crashing on unlock. I couldn't open any apps.
I had that happen like a year ago while I was getting ready to go to a concert in another state. Luckily I was able to call my wife have her login to my gmail and forward my digital tickets to someone else in my party.
Apple also has an advertising company. And they track you, but they get money by selling you stuff mostly. I’m deep into the Apple ecosystem system and they don’t force updates, try to upsell me every time updates are installed. I have no ads on the apps I use. They are quite happy for you to fork over gobs of money and call it a day.
Googles primary source of income is ads. All this stuff they do is the primary way they get money. People need to stop being surprised this is where they ended up.
> I’m deep into the Apple ecosystem system and they don’t force updates
My iPad is pretty naggy to install updates, moreso than my Pixel phone even. iOS doesn't automatically update like Android does, but if anything that seems less like it's because Apple disagrees with that and more because their update system is so shit they can't get away with it. It's inexcusably slow to apply updates.
> try to upsell me every time updates are installed
They are the only ones to have lost a lawsuit for doing literally this. Batterygate wasn't that long ago, surely you didn't forget about it already? Heck class actions about it are still happening in various countries!
Basically, Google tracks peopple everywhere. They track what news you read, where you shop, and what political party you support. Apple does none of this. No one tracks people on the Internet like Google. Facebook doesn't. Amazon doesn't. X doesn't. Microsoft doesn't (the own Bing). Apple certainly doesn't.
You will get tracked by those even if you use an Apple device. The key difference between Android and iOS is that Android gives users the ability not to be tracked. iOS (even MacOS) doesn't even let you uninstall Apple News. iOS won't let you get your location or install an app without telling Apple. It won't even let you run a browser other than Safari, which has known data leaking vulnerabilities. User control is the key privacy feature.
Apple does it one way, Google does the same thing but another way. Instead of locking everything down, preventing you to use any other browser than safari for instance, they push you to use their spyware. Android might be open source, but the Google play services are not and if you ever tried to do anything without them, you'd know it's impossible.
Both tracks you by forcing you to use their app that works as spyware.
Also, you missed the point of my comment. The comment I replied to basically was saying Apple and Google are equivalent because Apple sells ads (they sell search listings in the App store search and may run an optional advertising service for apps). My point was they are not equivalent because Apple does not track people around the web like Google does. The other things is Apple has released a lot of privacy features which interfere with the advertising spying machine.
At best, Google pretends to improve privacy. Google's business is basically building a profile on each individual so they can serve the most relevant ads to that person. They make more money when they serve relevant ads (ads people will see, and maybe buy something based on the ad). Google has no interest or incentive to protect privacy because their business depends on invading privacy.
> My point was they are not equivalent because Apple does not track people around the web like Google does.
That's a pittance of privacy. Apple sells your search results out to Google, cooperates with NSA surveillance and institutes online DRM for your apps. They do not care about protecting you from tracking because tracking users is official policy for Apple in both iOS and MacOS.
It is pathetic to watch people on this site rush out to defend Apple like they aren't part of the problem. If you have witnessed Tim Cook's behavior over the past 10 years and still hold hope for Apple, you are not paying close enough attention.
> At best, Google pretends to improve privacy.
Google still published AOSP source code. That's not "pretending" to improve anything, it's an outright statement about the transparent security of their product. I hate AdSense and consider it an anticompetitive scourge on the internet, but I don't see Apple making commitments to security on the level of Google. Last I checked they were still trying to sue security researchers...
If you think Google is "pretending" to improve privacy, how can you deny that Apple pretends too? The reason people drill down on this isn't to defend Google, it's to prove beyond a shadow of a doubt that you do not actually know what Apple's stance is on this and cannot confirm it with hard evidence. You are repeating marketing and whitepapers, hoping that it's correct.
It's crazy- I feel like outside of videogames, and sometimes programming languages, almost every single "update" makes things worse.
They shuffle the UI around, or put in more ads, or recently- add some new AI feature. Genuinely can't remember the last OS or App update I've been happy about.
Makes me sad to think of all the developers working long hours just to make their users upset.
The way Google botched the Android 11 update to my Pixel 4a was the nail in the coffin in convincing me to go back to iPhone. I don't want to upgrade my Android and see a totally different UI every single time. I want consistency and I don't want Google to mess with things that already work. This is very childish on their side and just shows that Google engineers and managers don't use their own products.
I think security updates are mostly BS designed to make users voluntarily give up control. Almost nobody would ever be affected by these CVEs but the ceding of control affects everyone.
If you ignore updates, you will get hacked. If you think a bad update is a problem, wait until you have to clean up a hack. It will cost more money and take more time than buying a new phone.
My advice is to buy phones from reputable manufacturers. I have had an iPhone for over 10 years and I have been very happy. The work well, last, and the performance is always good. My current goal is to keep my current phone 7 years. I will update it when Apple stops supplying updates.
> My advice is to buy phones from reputable manufacturers.
You mean those slowing down your phone on updates [0] and not providing critical security updates in time [1] while not allowing existing more secure alternative browsers [2]?
The true alternative is phones running mainline Linux. Sent from my Librem 5.
My iPhone is over 5 years old and has not slowed down. When Apple did slow down phones, it was because the battery was aging and it could not produce enough power to power the CPU at full speed. Apple had two choices:
1) Reduce the CPU speed so the phone did not crash
2) Not reduce the CPU speed and let the phone crash when the battery could not produce enough power.
I would rather have the right to know what happens with "my" phone and choose my own action. The result was that non-technical people thought the phone was too old and needed replacement.
And here I am, ignoring updates on my Pixel 6a since October 2024 (there were reports of crashes or bricking, what a surprise) and planning to keep doing that for the foreseeable future.
Sucks having to choose between a potentially (even likely, seeing the trend) broken device or an unsecured one. Pick your poison.