D

dmadhatr

dmadhatr Still let me know when legacy support gets dropped for the 4a and when it may be best to change out the 5a.

The last full-support release for the 4a was 2023-09-06. As of 2023-09-18 the official statement was "Pixel 4, Pixel 4 XL and Pixel 4a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction" (emphasis added). The fact that the 4a has received some updates to the upper layers of the software stack does not mean that firmware bugs (likely including remote-code-execution bugs) have been fixed, or even tracked.

Firmware support for the 5a may end as soon as August 1. Even assuming GrapheneOS issues some legacy-support updates after August 1, the end of firmware support is arguably a good inflection point for "may be best to replace", as opposed to the point where the device is no longer getting any updates of any kind.

Replacing devices that still run fine is frustrating. But as long as there are bad firmware bugs, and as long as device manufacturers stop fixing bad firmware bugs while devices still run fine, users who want reasonable security may be forced to replace devices while they are still running fine.

dmadhatr Both of the phones mentioned above will go to the shop, I'll have both USB-C connections replaced on those ports and the batteries.

Hopefully the shop fixes the problem, but since the phones are older models and people are working on them, it becomes harder to say with certainty that the issue is with the OS.

dmadhatr If the issue still occurs, I'll post a $1,000 bug bounty to fix this issue, OK? Alot of people are running into this problem, so it would be worth it to get it resolved.

I can't speak for the project, but in the past they have said on multiple occasions that they won't do work for bounties. This comment explains why: https://discuss.grapheneos.org/d/13298-bug-bounty-program/5

Also, I still have yet to hear of other people who are experiencing this problem. So far, it's just two people with three devices. One of those people hasn't elaborated, so it's entirely possible their phone was operating as it should, and was protecting itself from wet or dirty ports/cables.

dmadhatr
Since you work in critical infrastructure networks, its prob time to get secure devices.