Security Updates

Privacy & Security
103

(I’m sorry, but I have not read the whole thread. Couldn’t find this response when searching this page, though.)

In inkOS, there’s the option for a “Settings Search {”.
If I search there for “security”, and then click on “Android security update”, amongst other things, it shows

Android version: 12
Android security update: November 25, 2025
Build number: MuditaOS K 1.4.0

So, yes, Android 12. But also: Security update from last month. This year - not 2021.

2 Likes
104

Worst case I’m going to tinker with this Android 16 GSI whatever. I’m too happy with the form-factor to let it go if security turns out too much hassle for the team - although I still hope MuditaOS K 2.0 would be something like Android version jump.

1 Like
105

I’m constantly reading here, that updates are planned for only 3 years as if that would be something good.

Is this even legal?

I was under the impression that according to EU regulations all manufacturers need to provide at least 5 years of updates.

1 Like
106

It was released just before those requirements came in

3 Likes
107

I see. Can be only a matter of days actually, since the phone was still in pre-order phase at end of May. I wonder what Mudita would’ve done if they had to postpone the release for just a month. After all, this regulation was decided by the EU in 2017.

Why would you make design decisions, where you cannot even garuantee that it is legal to sell something like this at the time of releasing the product?

108

It just says there was an update. Due to lack of transparency, we don’t know what was actually patched.

1 Like
109

Jumping in this thread. First off, I love my Kompakt so far and want to continue to use it for as long as I can. However, given the situation in the US, privacy is of utmost concern for me now.

I understand that the phone does not come pre-loaded with common points of attack, such as a browser. However, a significant portion of users have sideloaded apps, and one of the biggest selling features for me was the ability to customize my experience. For instance, I can download Signal, or a simple browser, or a maps app that supports public transit directions if I came to the mindful choice that my life is made better by having those things.

Mudita seems to acknowledge that a large portion of their user base has this interaction with the phone, as they’ve made sideloading easier via the Mudita Center. Because of this, I would hope that protecting those users’ privacy is also a top concern, not just the users that use the phone as-is out of the box.

I understand there will never be a privacy solution that is 100% effective at all times, but Mudita made the decision that sideloading would be supported (unlike, say, the Light Phone) and many users take advantage of this functionality. There needs to be a base level of security concern that covers all users, not just those using the phone with pre-installed apps. And to me, the best way to do that seems like upgrading the OS to use a newer version of AOSP that will continue to receive security updates.

5 Likes
110

Is there any way to get an update on this? Things in the US are looking more and more dire from a privacy/security standpoint and it would be a relief to know these concerns from the community are being taken seriously.

I get updating to a newer AOSP base would be a pain for developers, but especially with a closed-source OS that doesn’t have nearly as many eyes on it as AOSP, piecemealing together security updates is liable to let things slip through the cracks (or even unintentionally introduce entirely new security holes). This can hold true even for users without any sideloaded apps.

1 Like
111

@asmenyak Just to make sure we’re on the same page, your main concern is not just the security patches from other AOSP versions, you would like to see Mudita Kompkat upgrade the entire OS? Am I understanding this correctly?

112

Essentially, yes. At least to the extent of building it off of an AOSP version that has not reached EOL and will not require extensive backporting of security patches.

The problem here seems to me twofold:

  1. The idea that piecemealing together security patches by “choosing” the most relevant ones for the stock phone seems to me to be fundamentally flawed. From what I can gather, the team at Mudita is at least small enough where updating to AOSP 13+ would be a massive undertaking. If that is true, it’s a hard sell that the team is big enough to properly vet, test, and backport all relevant security patches while also not accidentally introducing entirely new vulnerabilities.
  2. The closed nature of Mudita OS K and the lack of details into the process by which these security patches are chosen makes it impossible for any customer to properly assess their threat level when deciding to sideload a certain app. It also makes it impossible to independently test the security of the phone. AOSP is massive and has thousands of eyes on it at all times, while Mudita is a relatively small, closed operation.

I understand how big of an undertaking updating to a newer AOSP base for Mudita OS K would be, but it’s hard to trust the security of an OS that is essentially a black box when it comes to security patches. Making this a priority would show Mudita really cares about community concerns when it comes to the security of their device. The way things are now, even with the best intentions that I’m sure the Mudita team has, I don’t see how things won’t slip through the cracks at some point with no way for us to check.

9 Likes