6 ms·

Google plans monthly security updates for Nexus phones

59 points by moviuro 11y ago

kolev 11y ago
So, stay unprotected for an average of half a month? If this is what Google can do best, imagine the others! I'm highly disappointed! Not to mention that Nexus updates, although Google doesn't have so many of them, usually take a whole week to roll out! Google is setting a really bad example here!
- moviuro 11y ago
  Still, it'll be far less worse than having the carriers take care of those up-//whats?// However, Google is moving in the right direction IMHO: don't forget that there is this weird thing named "No-Disclosure", so hopefully, you'll get a patched Android even before the bug/flaw is unveiled.
- slxh 11y ago
  You are basically unprotected 100% of the time anyways... as long as you are not a target, you should be ok. Also, I think that Microsoft have been doing monthly security updates for many years... and once in a while, they push an update early for very severe bugs.
- vetinari 11y ago
  If you knew how the wireless stack in the modern smartphone works, unpatched application OS would be least of your worries.
spiralpolitik 11y ago
How does this help the wider Android ecosystem or is Google pretty much saying it doesn't care about the non Nexus market ? Google holds all the cards in solving Androids security patch problem. The fact that they haven't done anything about it says volumes.
- nolok 11y ago
  They're giving the example and providing the fixes themselves in a "stable patch release" rather than let every other company figure out what and when to patch each in their own way. And it affects the ecosystem because two (for now) others major manufacturers are following it, as said in the very first paragraph of the article ... > The first update is being pushed out today, and the company said that other Androd handset manufacturers are planning to follow suit and provide monthly updates to carriers. [...] The change from Google, LG, and Samsung [...] Adrian Ludwig, lead engineer for Android security at Google, said the company plans more frequent updates for Nexus users and for other handset makers > From this week on, Nexus devices will receive regular OTA updates each month focused on security [...] Both LG and Samsung, two of the larger Android manufacturers, have committed to getting those updates to carriers more quickly
- jonnycowboy 11y ago
  Google certainly does not hold the cars in the security patch problem. The Carriers and other manufacturers do.
- Oletros 11y ago
  What card is that?
  - spiralpolitik 11y ago
    The Google ecosystem. If you want to ship a phone with Play, Maps, Gmail etc you have to commit to supporting it with patches for N years where N is greater or equal to 2. As has been pointed out, Google doesn't do this for the fear that the manufacturers will walk and as such has prioritized market share over security.
- kennydude 11y ago
  It currently can't do anything about the non-Nexus market. This is because the manufacturers and operators are responsible for dealing with sending anything out of the door. It would be fantastic if Google was able to have a version of Android that was the same across all capable devices and the manufacturer's customizations are all userland.
Aoyagi 11y ago
“With the recent security issues, we have been rethinking the approach to getting security updates to our devices in a more timely manner. Since software is constantly exploited in new ways, developing a fast response process to deliver security patches to our devices is critical to keep them protected." I don't think Mr Dong Jin Koh knows what "timely" and "fast" means. Then again, a month is better than months, except I don't think this changes too much if it took them a month to fix something they knew about. Nothing stops them from releasing a security patch in a fifth batch after discovery of a hole...
- nolok 11y ago
  They're moving from once or twice a year if you're lucky to monthly, so while it's not enough it certainly is a step in the right direction. It's easier to move from monthly to weekly than when starting where they are now.
- jsight 11y ago
  How does this turnaround time compare to the typical turnaround time for desktop operating systems?
  - Aoyagi 11y ago
    Well, Windows updates weekly with actually critical updates being pushed as they come. Not sure what it's like on OSX and various Linux distros.
    - Oletros 11y ago
      Windows updates were monthly, "patch Tuesday" being Tuesday the second week of the month
    - ac29 11y ago
      Linux: constantly. On a rolling release distro like Arch its rare to have less than a few updates a day. Security patches are often available within hours of upstream release if not earlier. YMMV based on distro.
thescrewdriver 11y ago
That doesn't help for 99.9% of Android devices out there (including mine) which aren't Nexus phones, and will only receive 1 or 2 updates, usually within 12 months of purchase and nothing after. The only way to stay current for Joe public is to buy a new phone every year. Lack of long-term updates (along with getting everything google shoved down my throat by default) are the primary reason's I'm actively considering alternatives to my current preference for buying Android phones.
- dragonwriter 11y ago
  > That doesn't help for 99.9% of Android devices out there (including mine) which aren't Nexus phones Right, it differentiates Nexus phones from non-Nexus phones and provides a reason to prefer the former (of course, there is no barrier to other phone vendors seeking to negate this advantage by duplicating the process.)
  - toomuchtodo 11y ago
    Or just buy an iPhone at this point? I don't jest. I owned the first Android phone from T-Mobile. I owned every Nexus phone after that up to the Nexus 5. I was tired of being the "abused spouse" who thought Google would change and one day release a product that would actually work properly for longer than a few months. Purchased an iPhone 5s, haven't looked back. The cost of current Nexus phones are on parity with iPhones (or close enough) that cost is no longer the deciding factor. Why do people continue to put faith in a product that continually fails to deliver? Google: I want to love your Nexus line and Android. But you're going to have to start treating customers like customers, and not just a necessary evil. Nexus 5 Android 5.1 Data Connection Issue: https://productforums.google.com/forum/#!topic/nexus/o-UyGECxh2k https://productforums.google.com/forum/#!topic/nexus/o-UyGEC... Nexus 5 Android 4.2.2 Data Connection Issue: https://code.google.com/p/android/issues/detail?id=63524 https://code.google.com/p/android/issues/detail?id=63524 Broken Bluetooth Audio Android 4.2.x: https://code.google.com/p/android/issues/detail?id=39633&q=dropped%20calls&colspec=ID%20Type%20Status%20Owner%20Summary%20Stars https://code.google.com/p/android/issues/detail?id=39633&q=d... Improper Handling Of Mobile Radio Causes Battery To Drain Quickly: https://code.google.com/p/android/issues/detail?id=165558&q=dropped%20calls&colspec=ID%20Type%20Status%20Owner%20Summary%20Stars https://code.google.com/p/android/issues/detail?id=165558&q=... All currently open (2767) Nexus issues: https://code.google.com/p/android/issues/list?can=2&q=nexus&sort=-stars&colspec=ID+Type+Status+Owner+Summary+Stars&cells=tiles https://code.google.com/p/android/issues/list?can=2&q=nexus&...
gambiting 11y ago
The idea that software updates have to be approved and released by carriers is still incredibly stupid and unnecessary.
- michaelmcmillan 11y ago
  What if it breaks some functionality the carrier has implemented?
  - vetinari 11y ago
    It can break also standard functionality, like the first iOS 8 release did. When things like this happen, both Apple and carriers scrable to fix things. However, Apple has a "special" position by the virtue of it's image, carriers are not going to do the same for everyone.
SchizoDuckie 11y ago
I'm more interested in what they're going to do to push updates to android 2.x+ devices. Will it even be technically possible without vendors?
deleted 11y ago
[deleted]
rplnt 11y ago
Considering how they can fuck up "feature" update.. no, thanks.
condescendence 11y ago
So basically, they're starting to do something they should've been doing?
yssrn 11y ago
Google claims that a security patch came out yesterday, yet my Nexus 6 still has no OTA update available. What, do they not have the bandwidth to send it out at once?
- francoisblavoet 11y ago
  I don't think it is a bandwidth issue. I think that they purposefully push the update to x% of the users first, wait for potential problems and then resume the rollout.
ikeboy 11y ago
Awesome! Can we get a fix for Logjam yet? It was first reported on May 20 [0], presumably Google knew about it earlier (I know Firefox was given advance notice [1]), yet the latest stable releases of chrome on both mobile and desktop are still vulnerable. Firefox fixed it on Jul 2 [2], Apple fixed it on June 30 [3]. Can someone explain to me why Google hasn't released a fix to something that affected 10% of popular websites on disclosure day [0]? [0] https://weakdh.org/ https://weakdh.org/ [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 [2] https://www.mozilla.org/en-US/security/advisories/mfsa2015-70/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-7... [3] https://support.apple.com/en-us/HT204941 https://support.apple.com/en-us/HT204941
- RobAtticus 11y ago
  [0] says I'm not vulnerable and I'm using Chrome 46 on Windows, so I guess it's on its way. (Chrome 44 on Android still vulnerable.)
  - ikeboy 11y ago
    46 is not stable (the current stable release is 44, see http://googlechromereleases.blogspot.com/ http://googlechromereleases.blogspot.com/). Also, if you want Chrome Beta on android you can go here: https://play.google.com/store/apps/details?id=com.chrome.beta https://play.google.com/store/apps/details?id=com.chrome.bet...
tempVariable 11y ago
I have bought a Nexus 4, it has giant issues where you are unable to hear recipients, intermittently until you reboot. This has been reported to Google via so many ways. Being able to talk on a phone is kind of important. Is it also important to Google ? Since I don't want to shell-out another two bills for a different phone - please let it be!
skybrian 11y ago
Samsung will be doing this as well. Perhaps that will encourage others? http://www.engadget.com/2015/08/05/samsung-montly-android-security-fixes/ http://www.engadget.com/2015/08/05/samsung-montly-android-se...
- aNoob7000 11y ago
  I'll believe it when I see it. As a Samsung Galaxy Note 4 owner, I'm still waiting for Android 5.1.1 on my handset.
acd 11y ago
One could engineer phones differently so they would be more secure. Having some fallback option if a phone update fails, which I think is a reason why manufacturers does not update. For example having a boot loader and two different flash areas. One primary area and one secondary then you tick tock boot between the different images. This how routers and CoreOS and XenServer does it. The kernel can be live patched as of Linux 4.0 It's either that or more open phones where the customers can install and maintain their own operating system. Android stock, Cyanogenmod, Ubuntu phone etc.
SCdF 11y ago
While this is just lovely news, I'll withhold my breathless excitement for the headline: "Google implements monthly security updates for Nexus phones"
brimoh 11y ago
Nexus phones are suffering from app crashes and frequent phone restarts, Security is important, but at the same time stability too matters. Google should take care of these issues first. Samsung, HTC and LG's build are more stable than google's stock android.
- jcastro 11y ago
  Lollipop has effectively made my Nexus 5 worthless. Battery barely lasts a day now and the phone is still continuously plagued by disconnecting from the network at seemingly random times. I've owned every generation Nexus and the 5 went from being the best phone they've ever made to the worst phone I've ever owned in one fell swoop. :( Ordered a Moto this time around to see if I can have better luck there.
fulafel 11y ago
Before Stagefright the situation about Android security was very strange. Google and the Android OEMs basically had ancient unpatched WebKit running on ancient unpatched Linux, both with huge swaths of unpatched serious vulnerabilities, on zillions of devices with some half assed sandboxing thrown in, and they were getting away with it. No widespread malware outbreaks. Maybe they were just experimenting how long they could keep this laissez faire thing going on until they had to react, and had a plan in the back pocket.

59 points by moviuro 11y ago

kolev 11y ago

So, stay unprotected for an average of half a month? If this is what Google can do best, imagine the others! I'm highly disappointed! Not to mention that Nexus updates, although Google doesn't have so many of them, usually take a whole week to roll out! Google is setting a really bad example here!

moviuro 11y ago
Still, it'll be far less worse than having the carriers take care of those up-//whats?// However, Google is moving in the right direction IMHO: don't forget that there is this weird thing named "No-Disclosure", so hopefully, you'll get a patched Android even before the bug/flaw is unveiled.
slxh 11y ago
You are basically unprotected 100% of the time anyways... as long as you are not a target, you should be ok. Also, I think that Microsoft have been doing monthly security updates for many years... and once in a while, they push an update early for very severe bugs.
vetinari 11y ago
If you knew how the wireless stack in the modern smartphone works, unpatched application OS would be least of your worries.

spiralpolitik 11y ago

How does this help the wider Android ecosystem or is Google pretty much saying it doesn't care about the non Nexus market ? Google holds all the cards in solving Androids security patch problem. The fact that they haven't done anything about it says volumes.

nolok 11y ago
They're giving the example and providing the fixes themselves in a "stable patch release" rather than let every other company figure out what and when to patch each in their own way. And it affects the ecosystem because two (for now) others major manufacturers are following it, as said in the very first paragraph of the article ... > The first update is being pushed out today, and the company said that other Androd handset manufacturers are planning to follow suit and provide monthly updates to carriers. [...] The change from Google, LG, and Samsung [...] Adrian Ludwig, lead engineer for Android security at Google, said the company plans more frequent updates for Nexus users and for other handset makers > From this week on, Nexus devices will receive regular OTA updates each month focused on security [...] Both LG and Samsung, two of the larger Android manufacturers, have committed to getting those updates to carriers more quickly
jonnycowboy 11y ago
Google certainly does not hold the cars in the security patch problem. The Carriers and other manufacturers do.
Oletros 11y ago
What card is that?
- spiralpolitik 11y ago
  The Google ecosystem. If you want to ship a phone with Play, Maps, Gmail etc you have to commit to supporting it with patches for N years where N is greater or equal to 2. As has been pointed out, Google doesn't do this for the fear that the manufacturers will walk and as such has prioritized market share over security.
kennydude 11y ago
It currently can't do anything about the non-Nexus market. This is because the manufacturers and operators are responsible for dealing with sending anything out of the door. It would be fantastic if Google was able to have a version of Android that was the same across all capable devices and the manufacturer's customizations are all userland.

Aoyagi 11y ago

“With the recent security issues, we have been rethinking the approach to getting security updates to our devices in a more timely manner. Since software is constantly exploited in new ways, developing a fast response process to deliver security patches to our devices is critical to keep them protected." I don't think Mr Dong Jin Koh knows what "timely" and "fast" means. Then again, a month is better than months, except I don't think this changes too much if it took them a month to fix something they knew about. Nothing stops them from releasing a security patch in a fifth batch after discovery of a hole...

nolok 11y ago
They're moving from once or twice a year if you're lucky to monthly, so while it's not enough it certainly is a step in the right direction. It's easier to move from monthly to weekly than when starting where they are now.
jsight 11y ago
How does this turnaround time compare to the typical turnaround time for desktop operating systems?
- Aoyagi 11y ago
  Well, Windows updates weekly with actually critical updates being pushed as they come. Not sure what it's like on OSX and various Linux distros.
  - Oletros 11y ago
    Windows updates were monthly, "patch Tuesday" being Tuesday the second week of the month
  - ac29 11y ago
    Linux: constantly. On a rolling release distro like Arch its rare to have less than a few updates a day. Security patches are often available within hours of upstream release if not earlier. YMMV based on distro.

thescrewdriver 11y ago

That doesn't help for 99.9% of Android devices out there (including mine) which aren't Nexus phones, and will only receive 1 or 2 updates, usually within 12 months of purchase and nothing after. The only way to stay current for Joe public is to buy a new phone every year. Lack of long-term updates (along with getting everything google shoved down my throat by default) are the primary reason's I'm actively considering alternatives to my current preference for buying Android phones.

dragonwriter 11y ago
> That doesn't help for 99.9% of Android devices out there (including mine) which aren't Nexus phones Right, it differentiates Nexus phones from non-Nexus phones and provides a reason to prefer the former (of course, there is no barrier to other phone vendors seeking to negate this advantage by duplicating the process.)
- toomuchtodo 11y ago
  Or just buy an iPhone at this point? I don't jest. I owned the first Android phone from T-Mobile. I owned every Nexus phone after that up to the Nexus 5. I was tired of being the "abused spouse" who thought Google would change and one day release a product that would actually work properly for longer than a few months. Purchased an iPhone 5s, haven't looked back. The cost of current Nexus phones are on parity with iPhones (or close enough) that cost is no longer the deciding factor. Why do people continue to put faith in a product that continually fails to deliver? Google: I want to love your Nexus line and Android. But you're going to have to start treating customers like customers, and not just a necessary evil. Nexus 5 Android 5.1 Data Connection Issue: https://productforums.google.com/forum/#!topic/nexus/o-UyGECxh2k https://productforums.google.com/forum/#!topic/nexus/o-UyGEC... Nexus 5 Android 4.2.2 Data Connection Issue: https://code.google.com/p/android/issues/detail?id=63524 https://code.google.com/p/android/issues/detail?id=63524 Broken Bluetooth Audio Android 4.2.x: https://code.google.com/p/android/issues/detail?id=39633&q=dropped%20calls&colspec=ID%20Type%20Status%20Owner%20Summary%20Stars https://code.google.com/p/android/issues/detail?id=39633&q=d... Improper Handling Of Mobile Radio Causes Battery To Drain Quickly: https://code.google.com/p/android/issues/detail?id=165558&q=dropped%20calls&colspec=ID%20Type%20Status%20Owner%20Summary%20Stars https://code.google.com/p/android/issues/detail?id=165558&q=... All currently open (2767) Nexus issues: https://code.google.com/p/android/issues/list?can=2&q=nexus&sort=-stars&colspec=ID+Type+Status+Owner+Summary+Stars&cells=tiles https://code.google.com/p/android/issues/list?can=2&q=nexus&...

gambiting 11y ago

The idea that software updates have to be approved and released by carriers is still incredibly stupid and unnecessary.

michaelmcmillan 11y ago
What if it breaks some functionality the carrier has implemented?
- vetinari 11y ago
  It can break also standard functionality, like the first iOS 8 release did. When things like this happen, both Apple and carriers scrable to fix things. However, Apple has a "special" position by the virtue of it's image, carriers are not going to do the same for everyone.

SchizoDuckie 11y ago

I'm more interested in what they're going to do to push updates to android 2.x+ devices. Will it even be technically possible without vendors?

deleted 11y ago

[deleted]

rplnt 11y ago

Considering how they can fuck up "feature" update.. no, thanks.

condescendence 11y ago

So basically, they're starting to do something they should've been doing?

yssrn 11y ago

Google claims that a security patch came out yesterday, yet my Nexus 6 still has no OTA update available. What, do they not have the bandwidth to send it out at once?

francoisblavoet 11y ago
I don't think it is a bandwidth issue. I think that they purposefully push the update to x% of the users first, wait for potential problems and then resume the rollout.

ikeboy 11y ago

Awesome! Can we get a fix for Logjam yet? It was first reported on May 20 [0], presumably Google knew about it earlier (I know Firefox was given advance notice [1]), yet the latest stable releases of chrome on both mobile and desktop are still vulnerable. Firefox fixed it on Jul 2 [2], Apple fixed it on June 30 [3]. Can someone explain to me why Google hasn't released a fix to something that affected 10% of popular websites on disclosure day [0]? [0] https://weakdh.org/ https://weakdh.org/ [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 [2] https://www.mozilla.org/en-US/security/advisories/mfsa2015-70/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-7... [3] https://support.apple.com/en-us/HT204941 https://support.apple.com/en-us/HT204941

RobAtticus 11y ago
[0] says I'm not vulnerable and I'm using Chrome 46 on Windows, so I guess it's on its way. (Chrome 44 on Android still vulnerable.)
- ikeboy 11y ago
  46 is not stable (the current stable release is 44, see http://googlechromereleases.blogspot.com/ http://googlechromereleases.blogspot.com/). Also, if you want Chrome Beta on android you can go here: https://play.google.com/store/apps/details?id=com.chrome.beta https://play.google.com/store/apps/details?id=com.chrome.bet...

tempVariable 11y ago

I have bought a Nexus 4, it has giant issues where you are unable to hear recipients, intermittently until you reboot. This has been reported to Google via so many ways. Being able to talk on a phone is kind of important. Is it also important to Google ? Since I don't want to shell-out another two bills for a different phone - please let it be!

skybrian 11y ago

Samsung will be doing this as well. Perhaps that will encourage others? http://www.engadget.com/2015/08/05/samsung-montly-android-security-fixes/ http://www.engadget.com/2015/08/05/samsung-montly-android-se...

aNoob7000 11y ago
I'll believe it when I see it. As a Samsung Galaxy Note 4 owner, I'm still waiting for Android 5.1.1 on my handset.

acd 11y ago

One could engineer phones differently so they would be more secure. Having some fallback option if a phone update fails, which I think is a reason why manufacturers does not update. For example having a boot loader and two different flash areas. One primary area and one secondary then you tick tock boot between the different images. This how routers and CoreOS and XenServer does it. The kernel can be live patched as of Linux 4.0 It's either that or more open phones where the customers can install and maintain their own operating system. Android stock, Cyanogenmod, Ubuntu phone etc.

SCdF 11y ago

While this is just lovely news, I'll withhold my breathless excitement for the headline: "Google implements monthly security updates for Nexus phones"

brimoh 11y ago

Nexus phones are suffering from app crashes and frequent phone restarts, Security is important, but at the same time stability too matters. Google should take care of these issues first. Samsung, HTC and LG's build are more stable than google's stock android.

jcastro 11y ago
Lollipop has effectively made my Nexus 5 worthless. Battery barely lasts a day now and the phone is still continuously plagued by disconnecting from the network at seemingly random times. I've owned every generation Nexus and the 5 went from being the best phone they've ever made to the worst phone I've ever owned in one fell swoop. :( Ordered a Moto this time around to see if I can have better luck there.

fulafel 11y ago

Before Stagefright the situation about Android security was very strange. Google and the Android OEMs basically had ancient unpatched WebKit running on ancient unpatched Linux, both with huge swaths of unpatched serious vulnerabilities, on zillions of devices with some half assed sandboxing thrown in, and they were getting away with it. No widespread malware outbreaks. Maybe they were just experimenting how long they could keep this laissez faire thing going on until they had to react, and had a plan in the back pocket.