I want to discuss a practical problem with Android's security update policy, particularly for people who buy budget and mid-range phones.
Smartphones have become increasingly expensive, and not everyone can afford to replace a perfectly functional phone every few years. For many people, a mid-range phone is already a substantial purchase, and keeping it for four, five, or even more years is a matter of affordability rather than preference, especially in today's climate where phone prices are skyrocketing. For example I purchased a Redmi Note 13 Pro 5G in August of 2024 for around ₹23,000 which rounds off to about $274 at the time. This year the latest model in the same line of phones i.e the Redmi Note 17 Pro 5G costs ₹40,000 ($421) for identical RAM and storage configurations. The prices have basically doubled in a matter of 2 years.
However, manufacturers often provide security updates for a limited period. Once that support ends, users are effectively left with a choice between continuing to use a functional device with an increasingly outdated security patch level or spending money on a replacement they might not otherwise need.
As I understand it, Google can independently update certain Android components through Google Play system updates (Project Mainline), while Google Play services can also receive updates without requiring a full OTA update from the phone manufacturer.
This raises a few questions for me:
What exactly does a full Android security update patch that Google Play system updates and Google Play services updates cannot?
If Google can independently patch many Android components, why are regular manufacturer-provided security updates still necessary? Is the main difference the Linux kernel, hardware drivers, vendor-specific code, bootloader, and firmware?
If a phone has the latest Google Play services and Google Play system update but an outdated Android security patch level, how much protection does it actually have against newer vulnerabilities?
Can Google Play updates mitigate or completely fix certain vulnerabilities on an otherwise outdated Android device, or do they only cover a relatively limited subset of Android's security issues?
How secure is a phone if the user is mindful about how they use it? i.e Regularly updating all their apps via the Play Store, making sure they aren't downloading any APKs from shady websites or connecting to public Wi-Fi etc.
I'm not suggesting that Google Play updates can replace full security updates. I'm trying to understand precisely where their capabilities overlap and where the limitations are.
submitted by /u/Basic-Movie-3387[link] [comments]