About the security content of iOS 15.8.5 and iPadOS 15.8.5

Might as well say it since nobody else commented about it, but modem/soc vendors are huge limiting factor on longterm android support. Qualcomm maintains these updates for only a few years, basically nothing earlier than around 2020-2021 gets kernel driver or modem updates.

Of course it's still up to phone manufacturer to integrate these changes, but it puts an effective security support timeline on even 3rd party ROM's like lineageos. They can cherrypick, but it's not as secure once that support ends.

Apple has almost everything in-house (except until recently, modems). So they have a ton of flexibility in continuing to provide updates.

Sure, but like, this is a fundamental flaw with the Android model. It's valid to criticize Android for this.

My problem with this argument is many of these types of CVEs have nothing to do with baseband firmware or drivers or anything else controlled by Broadcom. Google could still patch security issues in the parts of the system most exposed to attackers, namely the libraries and apps in the OS itself.

I’d be more afraid of a zero day image parsing bug in messages, where I could be exploited with a drive-by spam text or hyperlinked image, than some theoretical baseband attack by someone in a privileged cell network system.

Sounds like something Google could solve with contracts and money if they wanted to.

I pay a vendor for something in my product and the vendor support period is limited, as a consumer, that should not be your problem.

Which is insane if you think about it. 20 year old NICs are still supported by the kernel. Hardware drivers should be GPLd, no ifs and no buts. As if having closed source drivers gave OEMs a competitive advantage, it's basically all for planned obsolescence

The other fundamental flaw in the iphone market is that NOBODY can fix bugs in ios but apple, I have personally fixed bugs in my android builds.

Apple depends on Qualcomm just like everyone else (except for the new iPhone Air)... so this really doesn't seem like a valid excuse for Android manufacturers.

They don't though (also the 16e has in-house apple modem, I have no idea what the fate of the intel modems was). The majority of other vendors' designs get full qualcomm soc's with dsp, modem, security processor firmwares.

Apple literally has the scale to go to Qualcomm and buy slightly customized variants (the X71, for instance). And those modems are integrated with their custom Apple designed chips. I don't see any other vendor able to do that.

That’s great for you. But it doesn’t make a difference to the other 99.999999% of users who only install whatever is available from automatic system updates.

It’s the equivalent of saying in response to a political issue that affects all of society - doesn’t really affect me because I flew to my private island. We’re happy for you, but how does that advance the conversation?

I question your use of the word “fundamental“.

Just because everyone doesn't do what I do, doesn't make it wrong.

Same as OP's fundamental.

I’m not saying you’re wrong. It’s just irrelevant. So what if you can patch the issue on your phone, how does that affect the rest of society?

It just sounds like you’re bragging about your technical chops, like a person with a private island would be flexing their wealth.

The problem is that baseband or whatever drivers are made in kernel trees that are essentially forks of the kernel at a certain point in time.

This means that any fix needs to be backported to that special tree, irrespective of whether the Broadcom code is impacted, which may prove challenging when you end up having not just one but many trees, each at slightly different levels of outdatedness.

The approach clearly does not scale.

The solution would be for Broadcom to be diligent and forward port their tree to current mainline or current LTS at a minimum but they won't do that.

See how the RPi kernel is generally stuck at a special old version (e.g 6.6 for pi4, which is quite reasonably a LTS but then there's 6.12 as LTS already)

They do; many of the system apps and libraries are updated via the Google Play Store.

Not at all, anyone can do what I do, they just dont care most of the time.

That's part of the reason why Google is pulling more and more stuff out of AOSP and into Google Play.

They started with the WebViews that vendors refused to update leading to all kinds of exploitation. These days, system components like the bytecode runtime and the Bluetooth stack can be updated by Google, unless the manufacturer actively prevents Google from doing that.

Firmware remains an issue, and IOMMU protections aren't all that great on every single device, but more and more Android internals get maintained by Google these days.

As for messages, there is always a risk in the pipeline between modem and the system service, but the Messages app is just another app you can update through Google Play or whatever store you prefer. Same with the dialer app and plenty of other apps. The super-integrated components that make for preferred exploitation targets on iOS aren't set up the same way on Android (not that Android doesn't have other attack vectors, of course).