Basically only those rich enough to buy Google devices every three years.

Google promises 3 years only if you buy the device on release day. Our Nexus device at the office got ~18 months.

But yep, the mid/low end devices are often basically abandoned soon after release, or get 1-2 midlife updates so that December OTA has April's security patch level etc.

Or those smart enough to root their device to run a "post market OS" such as LineageOS or postmarketOS. Though the caveat of rooting your device could arguably be less security.

That attitude is the genesis of GNU/Linux desktop failure.

Workarounds that regular users don't have to endure with companies that actually care about them.

I wouldn't expect any 'normal' user to go though any of this. This is for Android enthusiasts that can get access to good hardware on the cheap and run the latest software.

It isn't at all ideal; it is a hack around the problem of terrible software support in the embedded computer industry. Once you got LineageOS on your phone, you can use OTA updates.

Meanwhile the OEM that got your money will happily keep selling devices without updates.

I know, and I very much dislike that as well. That is one of the reasons why I got a Fairphone 2, with long term support.

I also bought a Xiaomi for my partner (cause the FP2 would be an old SoC for the same price it cost 2 years ago) with specs which otherwise would've cost us more than double. I expect the device to last 1,5 years. Hopefully by that time the FP3 is on the horizon.

I have a Sony phone from 2015 and have that security update, not sure what you're talking about. 7.1.1 has been out for a while already.

Not everyone has a bugdet to keep buying flagship expensive phones.

I own a LG device, bought in January, stuck on Android 6.

There are only 1.6% of people in the world that own an Android device with 7.1.1, consider yourself lucky.

I am so happy I bought a Galaxy J5 (6) that can be flashed with Lineage OS 7.1.2. It's a really good phone, and even better with LOS.

Yeah, but it is quite bad that computers with the same price as mobile phones do get updates, while Android is at the whims of bean counters at OEMs.

All because Google don't want actually sort it out.

Given that OEMs are expected to push updates themselves on Treble certified devices, I don't have any hopes that the whole update chaos will improve.

You're only half secure though. You aren't getting the SoC patches so you'll still be vulnerable to Wifi driver holes etc

Yeah but knowing Samsung no phones will get the fixes besides the current flagship and MAYBE the previous one, all too expensive for most people in 2nd world.

You don't need to buy expensive mobile for latest android. I recently purchased 7.1 device for Rs 3000 about 50 bucks.

I like my ZenFone 2 but it's stuck on 5.0 :(

When I complain, I do it from the point of view of regular consumers.

Hacking devices is a workaround, not a solution.

It is this type of advices that made GNU/Linux fail at desktop adoption.

And yet the standard advice when anyone buys a Windows computer is to wipe it and install a fresh copy directly from Microsoft to remove all the crap your OEM put on it.

Is is really so strange that the advice for older phones would be similar?

what is a solution?

It'll still be vulnerable to a degree then. Android itself will have patches, but the SoC won't because Lineage don't have source code for that, only the binary blobs.

Don't get me wrong, Lineage is great, but fully secure it isn't.

Well it's the same case either side.