how long will the pixel 5 be supported? Is it a good choice?

Please don't buy a Pixel 5 for Graphene. It is EOL, which means that it is no longer supported. It currently receives some support, but this is not complete and is only intended for users who already have the device, to reduce harm until they switch.

Here are the GrapheneOS recommended devices:
https://grapheneos.org/faq#recommended-devices

Not to mention the 6th gen devices have an upgraded secure element which still to this day can't be exploited by forensic companies as opposed to 5th gen.
https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation

Meow2099 As others have said, please don't buy a 5th gen device.

Please buy one of the devices listed here:

https://grapheneos.org/faq#recommended-devices

Extended support is provided for harm reduction, but we actively recommend against it because we cannot provide actual security on those devices (nobody can).

We try to be very clear about that.

Simple but realistic scenario:
Someone has little money, not enough for a supported model, but enough for a really good old Pixel 5.

In that case, it's still better to take that and run it with GOS than to buy some crappy Chinese thing cheaply and use an ancient Chinese ROM. Or is it?

Well, I don't think it's right to reject it across the board. It depends on the individual case.

AlphaElwedritsch You have two situations where the device you're buying is insecure.

Either the Pixel 5 with GrapheneOS that is EOL and cannot receive full updates no matter what OS you run on it, or the "cheap phone" that's likely extremely insecure from the get-go.

We are not going to be misleading interested users about the degree of security we can provide on EOL devices.

This is an issue that'll largely resolve itself with time, given that current generation are supported for 7 years from launch. I imagine that one of those Pixels 4 years into its lifespan will be fairly affordable, all things considered, especially if bought used.

matchboxbananasynergy We are not going to be misleading interested users about the degree of security we can provide on EOL devices.

you are absolutely right. it has to be mentioned.
but sometimes there is no other way and it is still better than nothing.
but enough of the words. it remains an individual decision that has to be made by oneself

At that point, the less bad choice would be an extended support GrapheneOS device than a non-eol cheap device.

matchboxbananasynergy Is it a full security update because of firmware update? Or is there something else that is also missing?

[deleted] Firmware, also device drivers. Both are subject to exploits in the real world, including remote exploits. If there is a bad bug in the GPU firmware or the GPU kernel driver, a web site might be able to infect a device by serving a carefully formatted video file.

Once a device is EOL, that doesn't mean people stop finding exploits, but it does mean that Google etc. stop reporting them to users. So it is very impractical for a user of an EOL device to know which threats the device is vulnerable to.

de0u Thanks!