Chromebooks : End of Security Updates

[garethEds]

Good evening all,

 

One of our Chromebooks (HP 14) warned me today that the current update was the last it would ever receive. Oh! Nothing wrong with the device.

 

Got me thinking what others do when their Chromebooks reach end of software updates? Do you keep using them until they die? Clearly we cannot replace them as this happens.

 

I'm not worried - what could go wrong?

 

Gareth

[DrBeaker]

I believe when they end updates the device's life has ended.

 

Thought they had 2x years guaranteed and that was it?

 

Running it past without future updates is a security risk for management to decide on.

[3s-gtech]

I guess it’s possible, if a little shady, for them to simply fail to sign in eventually as Google shift their security standards further up, and things like certificates expire.

 

When support ends, they’re e-waste as far as I can see.

[jmak]

You can find the end of auto update date for any Chromebook model on this webpage:

https://support.google.com/chrome/a/answer/6220366?hl=en

 

All Chromebooks get 5 years of updates from release to market (not date of sale).

 

I'm terms of what to do at the end of auto update, I'd suggest Flex OS. If you want to manage them in your Google Workspace Admin Console, you'll need to buy another management licence, but they'll continue to get updates indefinitely.

 

Flex OS has a list of supported hardware, but I haven't found anything it doesn't run on yet.

[mavhc]

Keep using it until there's a security hole that affects you

[FN-GM]

 

what could go wrong?

 

 

As others have said you have a security issue. Potential loss of personal data being a big issue.

 

Also certain functions or the whole device might stop functioning without warning. For example, they might change the way they login and this requires a software update on the device.

 

 

Got me thinking what others do when their Chromebooks reach end of software updates?

 

The lifecycle of all devices is planned in advance and are removed from service before they reach end of life.

[free780]

Given the amount of Chrome CVEs I wouldn’t run EOL chromebooks. The expiry of root certificates will also start to cause issues.

[Theblacksheep]

EOL.

 

Keep an eye on the model you are buying, if it's heavily discounted, they might be clearing stock with only a few years left.

[Jaan]

A while back I had an old chromebook r11 acer i think it was. EOL so tried to put FlexOS (ChromeOS) onto it. i had to mess around and remove the write protection screw etc etc. anyway that didn't work, so i just did a manual restore using the ChromeOS recovery USB. It put the lastest ChromeOS build onto it which shocked me abit.

 

My parents are still using it, it still doesn't get AUTOMACTIC updates, however i assume that if you do it manually you'll get a more uptodate build.

 

Mind you i only witnessed this happening once, but might be worth a try. Looking at the Google support docs with regards to EOL and updates, it does say auto updates.

 

EDIT: it does have a nag screen that says something along the lines of it's EOL and can't do auto updates.

Edited September 23, 2022 by Jaan

[EssentialRug]

I asked this same question last year and got relatively relaxed opinions...

 

http://www.edugeek.net/forums/how-do-you-do/222824-chromebooks-reaching-eol.html

[jthompson]

The problem with running things into the ground is that by definition it's a future where devices are not working properly. If end of support for a Chromebook is not your EOL date for it, then you will want to decide on how far past the end of support you're prepared to go before considering it EOL. Personally, I would want that to be months, rather than years (i.e. arrange for it to be EOL by the start of the next academic year).

[jmak]

EOL.

 

Keep an eye on the model you are buying, if it's heavily discounted, they might be clearing stock with only a few years left.

This. I bought a Chromebook for a family member in January this year. There was an updated version of an Asus I'd bought in 2019 with EAU 2024 which has been a great machine. Most places were still selling the old version. The model name was the same, but part number was different. I tracked down the new version which cost £40 more, but EAU is 2029.

[dhicks]

Flex OS has a list of supported hardware, but I haven't found anything it doesn't run on yet.

 

I don't think it's possible to run it on the Asus Flip C100PA, which is a pity as we still have 140 of those in reasonable shape. We've retired them from use now, but we did use them for our early years groups (years -1 to 3) as basic kiosk devices for 18 months or so beyond their last-update date. No problems that we noticed, and probably okay for what we were using them for. If you can install ChromeOS Flex on your older devices that would be the best option.

[mavhc]

Do the chrome CVEs affect Chrome OS though?

[jthompson]

Are Chrome OS CVEs the only CVEs being addressed by Chrome OS updates? If for instance, there was something like OpenSSL included in Chrome OS, would a vulnerability being discovered for that result in a Chrome OS CVE?

[dhicks]

Flex OS has a list of supported hardware, but I haven't found anything it doesn't run on yet.

 

Something we were discussing here the other day: if you're buying new ChromeOS devices, complete with management license, before you deploy the devices are you better off installing ChromeOS Flex on them so you have a nice new device with effectivly no expiry date? You'd only have to pay the standard fee for the management license the once, too.

[jthompson]

I'd be surprised if that worked. Even if you could get Flex onto a Chromebook, is it going to auto update? Once it stops auto updating, your management license is presumably out of the window once you do a manual reinstall in order to upgrade.

[dhicks]

Even if you could get Flex onto a Chromebook, is it going to auto update?

 

I got the impression Intel / AMD Chromebooks could have ChromeOS Flex installed on them, although on most models you might have to remove a physical write-protect screw on the motherboard. Just checking the list-of-certified-devices for Flex that Google publish it would seem that past the "certified until" date your device /might/ still receive updates, but those updates might cause hardware issues. We have Flex running on 10-year old laptops at the moment, so my guess is that Flex would carry on (with updates) for a while past the official date.

 

Once it stops auto updating, your management license is presumably out of the window once you do a manual reinstall in order to upgrade.

 

Hence I'm thinking install Flex straight away, before you use up a management license. Admitedly, if you're buying new devices, it's probably best to budget for their replacements at the end of their expiry date anyway, if you get to that date and find that you can install Flex then another £30 per working device is still a bargain.