"iOS Secuirty is fucked" -Zerodium Stops Accepting iOS Exploits Because of too Many Submissions

[Ashley MLP Fangirl]

1 minute ago, valdyrgramr said:

You can also easily put a different android ROM on yourself and keep updates going.  Plus that 2 years of security isn't always true.  It comes down to the phone maker and the cartier.  The OS might be limited to two versions after the original, but you can still get security updates beyond that.  Plus, you don't have to pay the same premium for a device with Android and put a custom ROM on a just as good phone which makes Android appealing to a lot.  The main thing Apple has going for them is marketing, and that was always a frustration of Woz's.

custom roms are a flaming heap of dogshit. i tried Lineage on my LG G3, as LTT demonstrated in a video and it was plagued with bugs. 

[Ashley MLP Fangirl]

Just now, valdyrgramr said:

How long ago, and you probably tried one of them not all.  That's like saying Linux is shit because of issues you had with it on a certain macbook.

recently. i keep that lg updated as a spare phone, it's still ridden with bugs. i don't have another phone to try rom's on and i'm not aware of any other roms. if you know a few please tell me because i want a better experience on that lg. 

[Ashley MLP Fangirl]

Just now, valdyrgramr said:

I haven't done custom ROMs personally since I was on an HTC phone years ago, but xda usually has several options on their forum unless things have changed.

Lineage is regarded as the best one last time i checked... 

[DeScruff]

On 5/14/2020 at 5:44 PM, mr moose said:

Some phishing emails are actually very convincing, especially to the average user who is tired/not with it for what ever reason.  Kids sometimes click things for all sorts of different reasons.   And what defines a reputable wifi network,  if malware can be injected into mainstream software that many tech enthusiasts (self proclaimed experts) are downloading then they can find ways to manipulate and use public facing wifi to do the same thing. 

Heck Ive had phishing emails that use my boss' name (Its a very common and generic name) and subject lines that totally would be something he would email us about (Things like retirement plans, 401K, exc.)
And yes Covid updates. - phishers very quickly learned to push "Covid updates" in their emails. - And why wouldn't the average person click on them if its related to their job.

Thankfully they usually mess up 1 or 2 things so I never click on the email.
 

[LAwLz]

1 hour ago, valdyrgramr said:

Or, are you just complaining about it without actual current/relevant experience?

Since he has several times brought up Dalvik, which hasn't been in use for 6 years, I'd say this is the most likely explanation.

 

 

48 minutes ago, Ashley said:

it's missing features. 

 

what applications are we talking about here. 

 

Android devices last less long if you want an up to date OS with security patches like most people. 

It's two different problems.

With Android, apps are backwards compatible for a very long time (because the APIs are more stable than on iOS) but the phones don't get OS updates for nearly as long.

With iOS, you get OS updates for far longer, but the APIs gets changed and deprecated far quicker as well.

 

Most Android apps work on Android version 5.0, and sometimes even older versions. So they work on devices that are running 6 year old software.

Most iOS apps works on iOS 10 or later (9 or older is rare). So they work on device that are running 4 year old software.

 

I think that's what Pineapple meant. Maybe @Curious Pineapple can verify if that's what he meant.

 

I think most people don't care about OS updates. If I ask my mom about OS updates she will probably not even know what version she is running, much less what's new in the newer versions.

It's mostly "techies" that care about updates. I think people should care about updates, but they don't.

[Ashley MLP Fangirl]

9 minutes ago, LAwLz said:

Most Android apps work on Android version 5.0, and sometimes even older versions. So they work on devices that are running 6 year old software.

Most iOS apps works on iOS 10 or later (9 or older is rare). So they work on device that are running 4 year old software.

except that iOS 10 is supported on the iPhone 5, which is an 8 year old device. so app support is longer for a specific device because Apple supports them for so long, by the time they get unsupported they still run recent enough versions to be relevant for a while. 

[LAwLz]

2 hours ago, Kisai said:

I work for myself, have several clients of which one is an office of a fortune 500 company worth about 20 billion dollars, and the other two are internet-only clients that I had previous to them, which their clients are primarily artists who make very little money because they are popular enough to have their content stolen by petty criminals on the internet.

 

I've done sysadmin, webdesign/development, C/C++/PHP/Perl/Java programming,  PC hardware replacement/builds. I've done a lot, and when I see babies on the internet jumping on bandwagons that were crushed years or even decades ago, I point out the folly of beating the dead horse again.

I don't really care what you do for work. I mean, anyone on the Internet can lie about what they do. I could say I am a system engineer at Microsoft if I wanted and nobody on this forum would actually be able to prove that I lied or told the truth.

 

I do think it's funny that you try to impress people by saying one of your clients are a fortune 500 company and how much it's worth, yet you don't actually say what you do. Just what you have done with others. "An office of a fortune 500 company" could mean anything as well. The cleaners at Microsoft's warehouse also have "a fortune 500 company as their clients".

If you have to pad out your resume (that can't even be verified) with "PC hardware replacement/build", which is the IT world's equivalence of "flipped burgers at McDonald's", I would say it doesn't seem that impressive.

 

 

Anyway, I highly recommend you try Android development again. It seems like it has changed a lot since you last tried it. If you want to write apps in C and C++ like you mentioned earlier, maybe you'll like the NDK. You don't have to write in Java if you don't want to. Maybe you'll enjoy Kotlin as well if you give it a try.

[LAwLz]

3 minutes ago, Ashley said:

except that iOS 10 is supported on the iPhone 5, which is an 8 year old device. so app support is longer for a specific device because Apple supports them for so long, by the time they get unsupported they still run recent enough versions to be relevant for a while. 

Good point.

[Kisai]

17 minutes ago, LAwLz said:

I don't really care what you do for work. I mean, anyone on the Internet can lie about what they do. I could say I am a system engineer at Microsoft if I wanted and nobody on this forum would actually be able to prove that I lied or told the truth.

 

I do think it's funny that you try to impress people by saying one of your clients are a fortune 500 company and how much it's worth, yet you don't actually say what you do. Just what you have done with others. "An office of a fortune 500 company" could mean anything as well. The cleaners at Microsoft's warehouse also have "a fortune 500 company as their clients".

If you have to pad out your resume (that can't even be verified) with "PC hardware replacement/build", which is the IT world's equivalence of "flipped burgers at McDonald's", I would say it doesn't seem that impressive.

 

 

Anyway, I highly recommend you try Android development again. It seems like it has changed a lot since you last tried it. If you want to write apps in C and C++ like you mentioned earlier, maybe you'll like the NDK. You don't have to write in Java if you don't want to. Maybe you'll enjoy Kotlin as well if you give it a try.

Because "I reinstall Windows on Dell laptops" for engineers, which I've said plenty of times on the forum didn't need repeating.

 

iOS and Android development, which I did when "everyone must have an app" phase in 2009, iPhoneOS 3 was easy, all you need was a Mac, and you sent the source code to your client and they hit compile and done. Android 1.5, was a massive hellhole that I felt embarrassed to give my client the source code to because the massive amount of crap needed to compile, let alone test it, and nobody wanted to pay for a dev device. I didn't pick up a smartphone until 2015. My client ultimately had problems publishing on the Apple store for content reasons, and it was abandoned. Someone far far bigger build a better app and platform and pretty much everyone that produces that content uses that app, or produces PDF's for that content.

 

24 minutes ago, valdyrgramr said:

Ironically, even people in the field and with degrees aren't always that good at what they do either.   The man who created the first person shooter genre with his buddies and was/is one of the top developers of engines, top coders, top animators, and basically can be a one man team never even went to college.   IIrc, he stole a computer from his grade school and to this day knows game development like the back of his hand.   And now, he's the lead engineer for the OR for FB after fixing the dev kit they sent him and explaining all the problems to the people who made it.

 

John Carmack is a pioneer in game engine development. Even smart people are not smart about "everything", and that's the problem when you see when you get a collection of nerds on a site like slashdot or LTT, is that there's this assumption that everyone is on your level. People who are below your level will either think you're bluffing or making stuff up, because you may as well be talking about magic. You have to realize that there is no stupid questions, just people behaving stupidly, like dilibertly jumping into threads and trying to correct the person that is above their level.  Don't do this.

 

Assume people are on your level and speak your language. Don't treat people like babies, or you will get the same treatment in kind.

[Koeshi]

3 hours ago, Kisai said:

the fact that all Android devices don't even last two years is just another reason why not to invest in the Google ecosystem.

You seem to have a unique understanding of what certain words mean.  I would like to refer to my earlier post:

 

45 minutes ago, Kisai said:

OS and Android development, which I did when "everyone must have an app" phase in 2009, iPhoneOS 3 was easy, all you need was a Mac, and you sent the source code to your client and they hit compile and done. Android 1.5, was a massive hellhole that I felt embarrassed to give my client the source code to because the massive amount of crap needed to compile, let alone test it, and nobody wanted to pay for a dev device.

I am not sure really how the situation from over a decade ago is relevant here.  Rolling out an app on iOS is definitely not like that anymore and Android has changed a lot as well.

46 minutes ago, Kisai said:

"I reinstall Windows on Dell laptops"

Hey, I do do that

[Curious Pineapple]

@LAwLz Yup that's what I meant. Wanted either an older Android device with AOA2.0 support, or an iPhone/iPod that I can use with my car stereo for music. As for some reason Apple devices stay stupidly expensive even when they're obsolete, and I'm not spending that kind of money on a 5 year old piece of shit that is going to be a glorified MP3 player, I got out my iPod Video (which is broken due to a common fault, previously repaired by Apple with a piece of fucking rubber jammed under the DAC) and used that instead.

 

Deezer will run on a Galaxy S2 even though it's 9 years old, when Apple decides that a device is no longer worth supporting, no new apps can run on the older device. Well, unless you simply edit the minimum version then it works fine because it's nothing but a softlock.

[Kisai]

1 hour ago, Koeshi said:

I am not sure really how the situation from over a decade ago is relevant here.  Rolling out an app on iOS is definitely not like that anymore and Android has changed a lot as well.

 

Apple's experience has not changed. You still need a mac.

 

Android, is still a hellhole to setup a working dev environment for, though at least things like Visual Studio and Unity will let you setup a project for it now. There's still no device-accurate simulator, so you're still largely building a PC app that is a shot in a dark if the performance will be reflected on a real device, and since there's a thousand different android combinations, you, as a dev, only need to make sure it works on the worst device people still use and expect to use your app. There is quite literately no consistent experience between Android devices.

 

For a while there I was having discussions with people building HTML5 games and, WebGL wasn't even a common capability on people's Android devices. In 2018. You still had to export assets twice due to some devices being obnoxious and not supporting standard audio formats. Android only got 64-bit versions of Unity last year.

https://blogs.unity3d.com/2019/03/05/android-support-update-64-bit-and-app-bundles-backported-to-2017-4-lts/ , and people I know who were playing gacha games from Japan all started complaining that the games don't work on their devices, because wouldn't you know it, they bought a 32-bit device, in 2018.

[mr moose]

3 hours ago, LAwLz said:

With iOS, you get OS updates for far longer, but the APIs gets changed and deprecated far quicker as well.

 

 

I've had this problem (or a related problem) with the first Ipad.  I bought it for student development.  There were only a handful of learning apps I used, the OS updated to the final version that apple would support on that device which meant the apps needed an update to work (or something along those lines), but they were updated to work with the next version of ios.  which meant I could no longer run the apps I had and could no longer download newer versions. Don't ask how this is possible or why it even happened because I don't know and couldn't get an answer at the time beyond people telling me The device couldn't handle the newer OS (that is barely a reason to drop support completely but whatever).  In hindsight maybe it was a specific part of the API changed before the final OS version my ipad supported.

 

Now I don't know if I am very unique or was just in a first gen issue that got sorted.  The perplexing part is I had just bought an ipad 2 for my eldest son to start high school with so it was less than 4 years old at this point.  It did leave a very sour taste in my mouth when I had a $1000 product that was now practically useless (all the apps in the store would not run on it).   By the time I found out I might have been able to roll back versions/updates And keep the current installed apps working it was really too late.   

 

With this, keep in mind I am not exactly tech illiterate and these were early days for the Ipad I spent a bit of time trying to resolve the issue.   

 

 

TL:DR

It might be better now, but some of us are still reluctant at the thought of spending big money on a premium product when it has a time limit. As a consumer that is considering workflow over 5-6 years of a child's schooling,  I'll take a slower OS with security issues that is cheaper over expensive and unusable. 

[Curious Pineapple]

2 hours ago, Kisai said:

Apple's experience has not changed. You still need a mac.

I wrote an iOS app without a Mac, or MacOS. Am I magic?

 

2 hours ago, Kisai said:

Android, is still a hellhole to setup a working dev environment for, though at least things like Visual Studio and Unity will let you setup a project for it now. There's still no device-accurate simulator, so you're still largely building a PC app that is a shot in a dark if the performance will be reflected on a real device, and since there's a thousand different android combinations, you, as a dev, only need to make sure it works on the worst device people still use and expect to use your app. There is quite literately no consistent experience between Android devices.

Apart from the fact that you just plug a device in via USB and deploy it within seconds. No need for a simulator. Why bother with a simulated device when you most likely own an actual one anyway. I would have no issue deploying an application to any Android device I needed to. Enable ADB over WiFi or USB and hit the debug button. Done.

[foldingNoob]

 

8 hours ago, LAwLz said:

It kind of is though.

For example I studied networking at college. Part of the curriculum was securing networks from common attacks. When learning about that, you obviously also learn how those attacks are made, and therefore can do them yourself.

 

A lot of knowledge about security comes from knowing the fundamentals of something and trying to find ways around it as well. A course at a university will never be able to teach you "here is how to hack 1) do this 2) do that 3) then do this 4) done!". But it will teach you "this is how memory is read by a program" and from that you can think of ways yourself on how to exploit it.

I just did introductory networking but I did do a post-grad paper which was really cool. We sat around doing presentations and talking about research. I presented a paper that cracked the Diffie-Hellman key exchange and defaced the FBI website. Those guys were geniuses. They exploited the old USA regulations meant to handicap the private sector by restricting encryption key sizes so the US government's supercomputers could crack anything. These guys exploited that by downgrading connections to smaller keys. They even showed how much it would cost in Azure cloud computing to hack a website. I can't remember the numbers off my head but it was very affordable.

[foldingNoob]

2 hours ago, Kisai said:

Android, is still a hellhole to setup a working dev environment for, though at least things like Visual Studio and Unity will let you setup a project for it now. There's still no device-accurate simulator, so you're still largely building a PC app that is a shot in a dark if the performance will be reflected on a real device, and since there's a thousand different android combinations, you, as a dev, only need to make sure it works on the worst device people still use and expect to use your app. There is quite literately no consistent experience between Android devices.

I'm not a professional developer but i did do some android development a few years ago at uni. You really need one device from each manufacturer. They each do their own thing with the UI, especially Sony & Samsung. It is what it is. They have that freedom to customize their product. The only exceptionally awful ones are the carrier branded phones. e.g. vodafone. Those things don't run anything and barely function as a phone.

[Kisai]

20 minutes ago, foldingNoob said:

I'm not a professional developer but i did do some android development a few years ago at uni. You really need one device from each manufacturer. They each do their own thing with the UI, especially Sony & Samsung. It is what it is. They have that freedom to customize their product. The only exceptionally awful ones are the carrier branded phones. e.g. vodafone. Those things don't run anything and barely function as a phone.

Yeah, and back when I was "suggested" about building an Android app, the experience was the absolute worst development experience on record. Until HAXM came out (which was one reason why I selected the CPU I had, so the Virtualization was available) you pretty much got a simulator that ran at 1/20th of the speed of an actual device. Now it's more like 1/4. Still rubbish, but emulators like MEMU can actually run an android program, where as bluestacks would be like "yep it's running, wait about 10 minutes before you get a splash screen", and the original simulator, would only run things written in Java IIRC.

 

However, as you said, because of the vendor customization, broken drivers, or vendors who don't update the OS, you really have no gaurantee that any device will work. Unless you own a varierty of common devices, or have access to them, it absolutely sucks to develop anything for Android, so if you're an indie/small-dev you may as well skip Android, it's not worth the development time unless you use an existing middleware (eg Unity) that reduces the amount of testing from "all devices" to "all devices of OS with X cpu and Y gpu type. So assuming that 32-bit is axed, that's reduced to Wintel 32-bit, Wintel (10 1903+) 64-bit, Mac (10.15) 64-bit, iOS 13/iPadOS 64-bit, and Android 9 64-bit. There are three GPU types for PC (Intel, nVidia, AMD), and three GPU types for Android(PowerVR,Mali(ARM),Adreno(Qualcomm)), and one for iOS (PowerVR).

[foldingNoob]

2 minutes ago, Kisai said:

Yeah, and back when I was "suggested" about building an Android app, the experience was the absolute worst development experience on record. Until HAXM came out (which was one reason why I selected the CPU I had, so the Virtualization was available) you pretty much got a simulator that ran at 1/20th of the speed of an actual device. Now it's more like 1/4. Still rubbish, but emulators like MEMU can actually run an android program, where as bluestacks would be like "yep it's running, wait about 10 minutes before you get a splash screen", and the original simulator, would only run things written in Java IIRC.

The simulator wasn't too bad for basic UI testing and that is all I would really use it for, and for that an entry level nokia does the same thing but gives the user a hands on experience the simulator will never do, so I dont expect them to improve on it.

10 minutes ago, Kisai said:

it absolutely sucks to develop anything for Android, so if you're an indie/small-dev you may as well skip Android

It also sucks to get into the apple store. This is the market. Walled garden vs dirty free for all.

 

[AndreiArgeanu]

I don't get what is the evidence behind Android's worse security?

I personally install a bunch of apps outside the play store and access all kinds of dumb and questionable websites I probably shouldn't access, and it's not now, it has been for years. But the funny part is that somehow, my accounts are perfectly fine with none of them stolen, my credit card info is secure, and I start to wonder why how this "questionable" and "bad security" that people claim is on Android didn't get my data stolen. Maybe because it works as it should. Like seriously, even looking back at a crappy slow, old table with android 4.2.2 jelly bean, I've never had an issue regarding security, even if I rooted it and messed around with apps that I didn't have any idea what they do.

 

I get that just because it didn't happen to me doesn't mean it won't happen to someone else but I can make a pretty confident assumption that my Android device is secure just like it has been for very long.

[Curious Pineapple]

4 hours ago, AndreiArgeanu said:

I don't get what is the evidence behind Android's worse security?

I personally install a bunch of apps outside the play store and access all kinds of dumb and questionable websites I probably shouldn't access, and it's not now, it has been for years. But the funny part is that somehow, my accounts are perfectly fine with none of them stolen, my credit card info is secure, and I start to wonder why how this "questionable" and "bad security" that people claim is on Android didn't get my data stolen. Maybe because it works as it should. Like seriously, even looking back at a crappy slow, old table with android 4.2.2 jelly bean, I've never had an issue regarding security, even if I rooted it and messed around with apps that I didn't have any idea what they do.

 

I get that just because it didn't happen to me doesn't mean it won't happen to someone else but I can make a pretty confident assumption that my Android device is secure just like it has been for very long.

They're chatting shite based on a personal experience from the early days of Android and a seemingly deep rooted love of the bleached fruit. Android is a piece of piss to develop for, but every point about it gets ignored.

[LAwLz]

9 hours ago, foldingNoob said:

The simulator wasn't too bad for basic UI testing and that is all I would really use it for, and for that an entry level nokia does the same thing but gives the user a hands on experience the simulator will never do, so I dont expect them to improve on it.

From what I know, testing the UI is basically the only thing you need the emulator for (try different form factors).

For everything else, it's best to load it to your phone. But I think the whole "you need a ton of devices to test on!" spiel is kind of overblown. You don't have to test every phone ever. If you get the UI right and don't use some of the lower level stuff (advanced camera controls, or hardware features like IR blasters for example) then if it runs on one phone it runs on all Android phones.

Android has tools for designing flexible UIs. Hell, even iOS has now too thanks to them having multiple resolutions and aspect ratios these days.

 

The Android APIs are as I said earlier, very stable so you don't really need to do as much testing on various phones as you might expect. It's mostly for performance tests, not bug or functionality tests, that you want to try a couple of phones.

 

 

In before someone comes in and says I am wrong because when they tried to develop an Android app 10 years ago it wasn't this way...

[suicidalfranco]

1 hour ago, LAwLz said:

From what I know, testing the UI is basically the only thing you need the emulator for (try different form factors).

For everything else, it's best to load it to your phone. But I think the whole "you need a ton of devices to test on!" spiel is kind of overblown. You don't have to test every phone ever. If you get the UI right and don't use some of the lower level stuff (advanced camera controls, or hardware features like IR blasters for example) then if it runs on one phone it runs on all Android phones.

Android has tools for designing flexible UIs. Hell, even iOS has now too thanks to them having multiple resolutions and aspect ratios these days.

 

The Android APIs are as I said earlier, very stable so you don't really need to do as much testing on various phones as you might expect. It's mostly for performance tests, not bug or functionality tests, that you want to try a couple of phones.

 

 

In before someone comes in and says I am wrong because when they tried to develop an Android app 10 years ago it wasn't this way...

When i tried developing for Android 8 years ago... lel

But yeah, back when i was Uni we were assigned to develop an app. 8 years ago all you add to do was download Android studio, pick the API you wanted to start with and code away. Then when you wanted to test the app, the first time, it would prompt you to set up an emulator. Wasn't awful, basically a VM instead of an emulator.

And that's about it. We developed our app in the span of a month, good a pretty good grade for the game we ended up making, and got no complaints about the experience of developing android apps. I'll add that eventually we would start testing on a physical device mostly because running the emulator on my macbook pro through bootcamp would turn it into a furnace, and the other members of my group didn't have powerful laptops tu do it with ease, and let's not even try to mention the lab's PCs.

 

[Bombastinator]

6 hours ago, AndreiArgeanu said:

I don't get what is the evidence behind Android's worse security?

I personally install a bunch of apps outside the play store and access all kinds of dumb and questionable websites I probably shouldn't access, and it's not now, it has been for years. But the funny part is that somehow, my accounts are perfectly fine with none of them stolen, my credit card info is secure, and I start to wonder why how this "questionable" and "bad security" that people claim is on Android didn't get my data stolen. Maybe because it works as it should. Like seriously, even looking back at a crappy slow, old table with android 4.2.2 jelly bean, I've never had an issue regarding security, even if I rooted it and messed around with apps that I didn't have any idea what they do.

 

I get that just because it didn't happen to me doesn't mean it won't happen to someone else but I can make a pretty confident assumption that my Android device is secure just like it has been for very long.

You think it is anyway.  

[justpoet]

I've mostly avoided posting here, since iOS vs Android is far beyond a dead horse, and what this thread quickly devolved into.

 

That being said, I just want to point out that you're all enthusiasts here, not "normal people".

 

While for you it is "easy" to keep Android up to date, or swap to another Android OS derivative when official support for your device runs out, that's not something that works well for your average random person.  Random Joe User barely knows how to send an emoji, meme, or photo of their food, and that's the coolest thing they can think of to do.  They also tend to not touch their home computer more than a couple times a week at most.  They certainly don't know, or care, at all about development.

 

So, for an enthusiast that wants to know the details, that wants to tinker, and can actually spend the time to learn the nuances and monitor their system (which is what a smart phone is)…Android can be quite good.  But, there's a reason iPhones are pretty much always the top user satisfaction smart phone in all the surveys and polls.  For your random "I just want to push some buttons, watch a video, send some emoji, post my meal, and maybe make a phone call once in a while" average user, iOS takes care of them a lot better, so they don't have to become a software enthusiast.

 

Neither platform is even close to perfect, but neither ever could be, because too many people want too many wildly opposite things.

[Curious Pineapple]

1 hour ago, justpoet said:

I've mostly avoided posting here, since iOS vs Android is far beyond a dead horse, and what this thread quickly devolved into.

 

That being said, I just want to point out that you're all enthusiasts here, not "normal people".

 

While for you it is "easy" to keep Android up to date, or swap to another Android OS derivative when official support for your device runs out, that's not something that works well for your average random person.  Random Joe User barely knows how to send an emoji, meme, or photo of their food, and that's the coolest thing they can think of to do.  They also tend to not touch their home computer more than a couple times a week at most.  They certainly don't know, or care, at all about development.

 

So, for an enthusiast that wants to know the details, that wants to tinker, and can actually spend the time to learn the nuances and monitor their system (which is what a smart phone is)…Android can be quite good.  But, there's a reason iPhones are pretty much always the top user satisfaction smart phone in all the surveys and polls.  For your random "I just want to push some buttons, watch a video, send some emoji, post my meal, and maybe make a phone call once in a while" average user, iOS takes care of them a lot better, so they don't have to become a software enthusiast.

 

Neither platform is even close to perfect, but neither ever could be, because too many people want too many wildly opposite things.

Not sure about anywhere else but in the UK we rarely buy devices upfront, instead they come with a 2 year contract and at the end we get the choice of a new phone and deal, cut ties and move provider or keep the same service plan but stop paying the device cost. Most people just get a new phone every 2 years or so. Keeping support for 5 years caters to the few here, we're overflowing with 2 year old phones that are perfectly usable but just got replaced as part of an "upgrade".