5 ms·

I shouldn't be required to do to get security releases. Why should you not be required to do that?

ocdtrekkie 11y ago
Because withholding security updates over accepting horrifically invasive UI and branding changes is unacceptable. Similar to Microsoft still patching Vista nearly ten years later, Google should be obligated to deliver security patches to all versions of Android within a reasonable timeframe.
- oconnor663 11y ago
  I think it's more difficult to patch old versions of Android than you're suggesting. You can't just backport a few lines of code and hope for the best. You have to maintain all the testing infrastructure that you had in place back when that version was supported, to avoid introducing new bugs with your change. And if you're releasing a security fix, you now have to coordinate that release across all versions that were vulnerable, because patching the vulnerability in one version usually discloses it in all versions. So you've slowed down fixes for your most up-to-date version, on top of the added expense of all that testing. Companies like Microsoft make boatloads of money in exchange for supporting old versions of their software like that. But nobody is going to pay Google enough to support old Android phones.
  - x0x0 11y ago
    it's already disclosed, don't pretend like patching 4.4.4 discloses anything
  - ocdtrekkie 11y ago
    Google released a patch for Stagefright for 4.4.x anyways. So this is not the reason. The problem is that Android is currently flawed in implementation in that it treats security fixes and system upgrades the same way. There's only one "path" to get updates. So by blocking 5.1, I also don't get a Stagefright fix for my 4.4, even though a fix for 4.4 already exists. Also, companies like Microsoft do charge extra for supporting old versions. Specifically, versions OVER TEN YEARS OLD. (Vista security updates are still free!) However, Google does not properly support OS versions released within the last year, which is drastically worse.
- azernik 11y ago
  Microsoft is a very unusual case, in that they have a brand that is built on legacy support and enterprise stability. Very few other companies in this industry are willing to put up with the pain of maintaining multiple versions, especially without paying enterprise users who care.
  - ocdtrekkie 11y ago
    But Google has been heavily pushing their new "Android for Work" concept. Microsoft's support lifecycle is expected by enterprises today. Why on earth should people trust Google with their business data if they won't provide enterprise-level support?
x0x0 11y ago
Because I shouldn't be required to accept giant releases (including broken functionality I rely on) to get security updates. Because it noticeably worsens battery life. Because it's a horrid practice to screw with software on production gear just for shits and giggles, and what is your phone if not a production device?
tomp 11y ago
The problem with general updates is that they tend to screw up your workflow, settings, etc. in different ways (they call that "features"). Personally, I'm also more and more reluctant about installing updates for most apps and systems. Ideally, security updates would be distinct from general system or application updates. Don't Apple and Microsoft do that for their OSs?
Dylan16807 11y ago
On an ethical level: Because there's quite a lot of difference between major versions, and you shouldn't be forced to replace one product with another to get basic fitness-for-purpose fixes on something that's only a year or two old. On a practical level: Tons of devices are stuck on 4 and it's not hard to backport the fix. Once you do that, just compile it for the devices you sell already.
rodgerd 11y ago
If Microsoft came out and said they weren't fixing a critical Windows 7 security flaw to force people to upgrade to Windows 10, HN would have bottomless wells of criticism. Google refuse to issue a security fix for a critical vulnerability for a less-than-2-year-old OS, and what, that's ok?

Because withholding security updates over accepting horrifically invasive UI and branding changes is unacceptable. Similar to Microsoft still patching Vista nearly ten years later, Google should be obligated to deliver security patches to all versions of Android within a reasonable timeframe.

oconnor663 11y ago
I think it's more difficult to patch old versions of Android than you're suggesting. You can't just backport a few lines of code and hope for the best. You have to maintain all the testing infrastructure that you had in place back when that version was supported, to avoid introducing new bugs with your change. And if you're releasing a security fix, you now have to coordinate that release across all versions that were vulnerable, because patching the vulnerability in one version usually discloses it in all versions. So you've slowed down fixes for your most up-to-date version, on top of the added expense of all that testing. Companies like Microsoft make boatloads of money in exchange for supporting old versions of their software like that. But nobody is going to pay Google enough to support old Android phones.
- x0x0 11y ago
  it's already disclosed, don't pretend like patching 4.4.4 discloses anything
- ocdtrekkie 11y ago
  Google released a patch for Stagefright for 4.4.x anyways. So this is not the reason. The problem is that Android is currently flawed in implementation in that it treats security fixes and system upgrades the same way. There's only one "path" to get updates. So by blocking 5.1, I also don't get a Stagefright fix for my 4.4, even though a fix for 4.4 already exists. Also, companies like Microsoft do charge extra for supporting old versions. Specifically, versions OVER TEN YEARS OLD. (Vista security updates are still free!) However, Google does not properly support OS versions released within the last year, which is drastically worse.
azernik 11y ago
Microsoft is a very unusual case, in that they have a brand that is built on legacy support and enterprise stability. Very few other companies in this industry are willing to put up with the pain of maintaining multiple versions, especially without paying enterprise users who care.
- ocdtrekkie 11y ago
  But Google has been heavily pushing their new "Android for Work" concept. Microsoft's support lifecycle is expected by enterprises today. Why on earth should people trust Google with their business data if they won't provide enterprise-level support?

x0x0 11y ago

Because I shouldn't be required to accept giant releases (including broken functionality I rely on) to get security updates. Because it noticeably worsens battery life. Because it's a horrid practice to screw with software on production gear just for shits and giggles, and what is your phone if not a production device?

tomp 11y ago

The problem with general updates is that they tend to screw up your workflow, settings, etc. in different ways (they call that "features"). Personally, I'm also more and more reluctant about installing updates for most apps and systems. Ideally, security updates would be distinct from general system or application updates. Don't Apple and Microsoft do that for their OSs?

Dylan16807 11y ago

On an ethical level: Because there's quite a lot of difference between major versions, and you shouldn't be forced to replace one product with another to get basic fitness-for-purpose fixes on something that's only a year or two old. On a practical level: Tons of devices are stuck on 4 and it's not hard to backport the fix. Once you do that, just compile it for the devices you sell already.

rodgerd 11y ago

If Microsoft came out and said they weren't fixing a critical Windows 7 security flaw to force people to upgrade to Windows 10, HN would have bottomless wells of criticism. Google refuse to issue a security fix for a critical vulnerability for a less-than-2-year-old OS, and what, that's ok?