Is it ok to update GOS seldom?

SovereignCopper

It would make more sense to at least update whenever an update comes out with the upstream security updates and then cherrypick whether you update to other releases depending on whether the changes directly relate to your use.

However, the updater is extremely barebones and doesn't give you the option to see the current and new version number (ideally with changelog) before you update, so any deliberate update policy you'd personally want to adhere to gets thrown out of the window because of that.

So with that in mind, I would say it isn't a good policy to only update whenever you want to.

DeletedUser433

cool2go I wouldn't call a GOS phone lagging behind by several months secure. The protections would probably still work against low-competence adversaries though. I've checked the changelog occasionally and it seems that new releases go through a couple of cycles before they're published in the stable releases channel. If your backup phone has little confidential data, that would probably be fine

Probably9857

cool2go one of them is a backup one, which I have most of the time powered off

I think this is the important part.

For a daily driver device, it would be recommended to update frequently to have the latest security patches.

For a device that is rarely even powered on, it should be reasonably safe to just update it when you do use it.

Skipping updates should not break things, but may cause the updates to take longer.

DeletedUser433

Probably9857 For a device that is rarely even powered on, it should be reasonably safe to just update it when you do use it.

This is a good point, an offline phone has significantly fewer attack vectors

Skipping updates should not break things, but may cause the updates to take longer.

I'm terrible at tech stuff, so I want to ask if it's possible to immediately update from 20240510 (a random example) to 20250810? Could it be done in a single mega update?

userofgos

Probably9857 For a device that is rarely even powered on, it should be reasonably safe to just update it when you do use it.

So long as one's threat model does not include accounting for the device being physically tampered with by a high-level adversary while it is currently out of date and potentially vulnerable to some exploit that was patched in the new update - though that is a small minority.

Probably9857

DeletedUser433 possible to immediately update from 20240510 (a random example) to 20250810? Could it be done in a single mega update?

Yes. In the worst case you will just end up downloading the full OS, but the updater will attempt to do incremental updates when possible.

The updater will use incremental (delta) updates to download only changes rather than the whole OS when one is available to go directly from the installed version to the latest version. As long as you have working network connectivity on a regular basis and reboot when asked, you'll almost always be on one of the past couple versions of the OS which will minimize bandwidth usage since incrementals will always be available.

https://grapheneos.org/usage#updates

DeletedUser433

userofgos I want to add that even though the OP hasn't mentioned it, the second user said

I do this as I travel every now and then so I pause updates as the last thing I'd want is for them to break the phone while away. Never had issues between bigger updates, even months difference.

It's far more likely that a phone which travels through borders will be inspected by a high level adversary (border agents). I don't know what exactly they do with these phones, but if they're from a wealthy country it's likely that they could tamper with the phone or take advantage of a recent exploit

userofgos

DeletedUser433 For sure, one would definitely want to take that into account if the offline phone is being used while traveling, what countries/airports might do with the phone during customs/border crossings.

Van-de-GraaffeneOS

cool2go

Why? What will you gain from not updating it? It would help to understand your motivations.

aw22

Van-de-GraaffeneOS Why? What will you gain from not updating it?

Updating frequently increases the probability of unintentional bugs breaking functionality or bricking your device.

If everything is working properly, I only update once every couple months and to a version that's already been released for at least a week.

Grapi

aw22 I only update once every couple months and to a version that's already been released for at least a week.

How can you postpone an update? Just not to reboot your device or can you stop updates at all?

I also prefer a "not updated" device instead of bricked device.

Thanks!

Van-de-GraaffeneOS

aw22 Updating frequently increases the probability of unintentional bugs breaking functionality or bricking your device.

Are you speaking generally, or have you personally experienced one or more of your devices being "bricked" by a system update of GrapheneOS?

GrapheneOS

cool2go aw22 hooram95 We recommend against delaying updates for so long. It will result in not having current patches for serious privacy and security flaws fixed in recent updates. Consider enabling charging optimization (80% charging limit) and leaving it plugged in so it mainly powers itself from the charger and doesn't wear out the battery but still stays updated. You can enable the automatic reboot feature in Settings > System > System updates so it will automatically reboot after installing a new update to start using it. That way you can simply leave it there connected to Wi-Fi and it will be keep itself fully updated. That's exactly why we added the opt-in automatic reboot while idle toggle.

Falling way behind won't cause anything to break since backwards compatibility is meant to go all the way back to the initial release for the device. However, updates from recent releases are much more thoroughly tested than doing it from a much older release multiple major versions of Android behind such as updating from Android 12 to Android 16 on a Pixel 6. This isn't applicable to falling behind a few months and it's meant to work even for going from a much older release to a newer one.

Every release in the Stable channel goes through public Alpha and Beta testing. It usually takes a day for a small release to go through public testing and reach the Stable channel. It takes longer for quarterly or yearly releases or major changes to GrapheneOS. New releases are made to fix issues discovered in testing and those releases get their own public testing time period, although it doesn't have to be as long if the changes to fix the previously discovered issues are small. It took around a week of public testing for an Android 16 release to reach our Stable channel after the initial public release on June 30th.

You'll use significantly more overall bandwidth if you update every 1.5 months since we typically only provide delta updates going 2 to 4 weeks back. Instead of regular 10MB to 80MB delta updates and then around 300MB to 600MB delta updates for quarterly/yearly releases, you'll be downloading a huge 1200MB update if you fall too far behind.

aw22

Grapi I can't speak to the official builds. I have always built my own patched userdebug builds, so just make a new build whenever I want to update.

aw22

Van-de-GraaffeneOS

No, I've never had problems with GrapheneOS updates, but that may be because I've never had automatic updates enabled, or maybe their quality really is that high.

I base my opinions on past experiences installing too frequent updates on my laptop and breaking it at critical moments.

Ammako

aw22 wild. Userdebug misses the point of GrapheneOS entirely.

thure

I have been using GOS for about three years, installing updates as soon as they reach a stable version to ensure that I have the latest security updates. I only use GOS on my productive system: first 6a, and now, for a couple of weeks, 9a. I have never had a single problem, nor has anything broken.

GOS has pretty good quality management, and you can expect stable releases to be stable without anything breaking. Make sure not to use developer options, as this can sometimes cause problems.

While using LineageOS, I always checked the forums before updating because their quality management isn't as good as GOS'. Sometimes, updates broke something. With GOS, however, I update as soon as my phone offers an update.

Thank you GOS team for always providing high quality :)

other8026

People who stick to the stable channel will be fine. All OS and app releases are tested, go through alpha and beta channel testing, then finally go to the stable channel. Updating the OS is very painless and most of it is done in the background. My phone always updates overnight and is ready to go in the morning. Updates don't bother me at all.

Depending on which updates are postponed, you may be missing out on patches potentially addressing very serious vulnerabilities. It's far better to install updates when they come in.

hooram95

Yeah, that's totally fine! Updating every 1–3 months is a solid approach, especially for a backup phone that isn't used daily.

aw22

Ammako Userdebug misses the point of GrapheneOS entirely.

No it doesn't, not for me. I still get the benefits of a de-googled phone with sandboxed (or completely removed) Play Services, granular control over network permissions, contact and storage isolation, etc.

Bing able to plug my phone into my laptop and make a full backup of the entire filesystem is worth the trouble of making a custom build.