8 ms·
Is that our problem or Google's? You can point fingers at 50 different companies in the ecosystem, or you can collectively point the finger at the root cause. B
by _wmd 10y ago
Is that our problem or Google's? You can point fingers at 50 different companies in the ecosystem, or you can collectively point the finger at the root cause. By the topic of this article, they're no longer the underdog when it comes to dictating terms to device vendors, they're the biggest shop in town and there's no reason the vulns-frozen-for-life-of-device model should continue to be adhered to.
- pjmlp 10y agoIf they cared one second about it, they would have changed the terms of access to the Google services. The sad part is that the 2016 security report just came out and they brag how the whole security improved, without mentioning the elephant in the room. Google IO is around the corner and I bet they will keep talking as if everyone could upgrade right away to Android O, with N now having barely 2%.
- dublinben 10y agoEveryone (who buys Google phones) can upgrade right away. It's not Google's fault that the other manufacturers refuse to update their products in a timely manner. The responsibility for these devices lies solely with the manufacturer.
- enzanki_ars 10y agoIt kind of is Google's fault. Most people associate any version of Android with Google. Manufactures that don't update their phones causes harm to both the manufacture's image and Google image. Personally, I place all the blame on Google for not making the upgrades possible from their side. It should be easy to upgrade the core operating system as easy as updating Windows, OSX, and Linux.
- wutbrodo 10y ago> It kind of is Google's fault. Most people associate any version of Android with Google. Manufactures that don't update their phones causes harm to both the manufacture's image and Google image. This makes no sense. "People associate X with Y" is not the same as "Y is responsible for X". If I associate Android with Linux, is Linus now culpable for Android's security problems? > Personally, I place all the blame on Google for not making the upgrades possible from their side. It should be easy to upgrade the core operating system as easy as updating Windows, OSX, and Linux. If we were living in a fantasy land where you could wave a wand and things would happen instantly, this would be the case, but mobile devices are not desktops and the challenges they face are entirely different. Google has already been moving logic as much as possible into apps like Google Play Services (updateable without OS changes_, and the fact that they haven't moved everything should make all but the most technically illiterate think "There may be technical challenges involved", instead of your "They're not making this easy" approach.
- fixermark 10y agoIn an open marketplace, "People associate X with Y" is very much the same as "Y is responsible for X." This explains a lot of the legacy code in pre-Windows Vista Windows; if new versions of the OS broke someone's favorite app, they blame Windows, even if the reason the app broke is it didn't adhere to (or even actively tried to circumvent) published API (Adobe was notorious for trying to squeeze a few extra cycles of performance out of Photoshop, for example, by hand-rolling their own C++ data structure instances by building a binary-compatible pattern in memory instead of calling the documented constructor in the WinAPI).
- temac 10y ago> This makes no sense. "People associate X with Y" is not the same as "Y is responsible for X". If I associate Android with Linux, is Linus now culpable for Android's security problems? This is ridiculous. Linus in Android is a component, not a whole system, and phone vendor own SW are way too accessory in the ecosystem and add so little value in it that they don't render Android a mere component in the same way: the base Android is the system, whereas drivers and 3rd party GUI or other minor stuff are what should be sufficiently decoupled so that Android can be updated without vendor consent. Doing otherwise has proven to expose users at risk, and given its situation Google is responsible, not a swarn of phone vendors. I might not be saying that if Android was really open, but then Android might not have that market share. Well, in the end, even that reinforce the argument that Google is responsible...
- enzanki_ars 10y ago> "People associate X with Y" is not the same as "Y is responsible for X". I understand that, but many of the non-tech savvy people I know do not understand that Google is not responsible for most versions of Android that run on their phones. > ...but mobile devices are not desktops and the challenges they face are entirely different. I do not see how they are much different. To many people, their phone is just as important as their desktop/laptop. I do not see anything stopping updates to Android being invisible to the end use as most other updates. iOS is pretty good about updating in a way that is unobtrusive to the user and Windows 10 is getting closer.
- unethical_ban 10y ago
- digi_owl 10y agoI dunno. Enthusiasts may track the versions coming out of Google HQ. But for most updating is a hassle rather than something they look forward to. This because it means downtime for their device, and if the update fails it may leave them with a bricked device (chance is small, but it is still in the back of their mind). For most people a computer, a phone, or a tablet is an appliance.
- enzanki_ars 10y agoiOS updates are something that seems like many people look forward too. If Android updates were as unobtrusive as updates to iOS (even Windows 10 is getting closer to unobtrusive updating), then there wouldn't be much of an issue there. We are getting closer to the point where being secure and up to date is almost painless. That should be our goal in the tech industry.
- cale250 10y agoThey are more painless if you happen to have a Pixel. It downloads and installs the update on another partition, prompts for a reboot and comes up a minute later. The trade-off, of course, is space.
- pjmlp 10y agoSurely it is their fault, because Google is the very first to give the example of selling devices more expensive than desktop computers, above the minimum wage in many countries, with updates limited to 2 years (+1 for some fixes). As for the other OEMs, there is this thing called contracts and legal obligations. No updates, no access to Google services from invalid devices. It is as easy as that, if Google actually cared about the consumers.
- bitmapbrother 10y agoStop being disingenuous on purpose. A Google device receives security updates for 36 months. Your "+1 for some fixes" comment implies that you only get "some" of the security updates when, in fact, you get all of security updates.
- WorldMaker 10y agoIsn't 36 months 2 + 1 years? Also, the point is still valid that 36 months (or 3 years) is still rather short security lifetime for a device. At some point (presumably soon now that carriers are dropping most device subsidies) the 2 year replacement scheme of mobile devices stops being sustainable and you do start to have to deal with the long tail of people sticking to 5-15 year old hardware devices. Google seems to have little interest in anything beyond the short horizon and that security tech debt is going to come due.
- bitmapbrother 10y ago>Isn't 36 months 2 + 1 years? He stated "+1 for some fixes" which is incorrect as it implies that you may not get all of the security fixes for that additional year and only "some" of them. >Also, the point is still valid that 36 months (or 3 years) is still rather short security lifetime for a device. At some point (presumably soon now that carriers are dropping most device subsidies) the 2 year replacement scheme of mobile devices stops being sustainable and you do start to have to deal with the long tail of people sticking to 5-15 year old hardware devices. I agree it is rather short and the sooner Android OEM's can move from an SoC supplier, like Qualcomm, that only provides BSP support for 2 years the better.
- ocdtrekkie 10y agoThis excuse completely ignores the fact that through the MADA contract, Google controls all of the manufacturers and defines whether or not they are allowed to sell Android phones, effectively. And that the OS is designed, by Google, to require the manufacturer to distribute the update, rather than, as with... pretty much all other OSes, the software developer being responsible for updating their own software. Google would like you to blame the manufacturer, but you need to realize the fact that you even can blame the manufacturer is a design flaw in the OS which Google designed.
- bitmapbrother 10y agoGoogle does not control whether OEM's are allowed to sell Android phones. Does Google control the sale of all of those Chinese branded phones that don't ship with Google Play Services? Or how about the Blackphone or the Copperhead phone? The MADA simply states what is required if your phone wants to ship with Google Play Services and Apps. >Google would like you to blame the manufacturer, but you need to realize the fact that you even can blame the manufacturer is a design flaw in the OS which Google designed. This sentence makes so sense. Google cannot update an OS that they did not create. The OEM rolled the OS so only they can update it. How exactly does Google update an OS from an OEM they don't even have the source for? It's the OEM's responsibility and if that OEM doesn't do their job in updating their OS then maybe it's time to start looking for an OEM that does do their job.
- ocdtrekkie 10y ago1. Note my use of the word "effectively". Unless you're in China, where Google does not operate, there is no such thing as Android without Google Play Services. (Attempts to sell Android devices without Google Play outside of China have, for the most part[1], been dismal failures.) And Google has to give their written approval for the release of each and every device or software update of Android with Google Play Services. 2. Google created the OS. In fact, OEMs are forbidden from forking Android, and therefore, cannot "roll their own OS" from Android, without violating their agreement with Google. Yes, they sprinkle some of their own apps and drivers in, but this is a design flaw in Android: Google needs to be updating their own software independently of manufacturer-specific components. I know for a fact you and I have had this discussion before. [1]Someone will mention the Kindle. The Kindle does not compete with Google products, as it is perceived in the market as an e-reader more than a "tablet". And Google barely even does tablets anymore anyways.
- yawn 10y agoTry telling that to anyone owning a Nexus 5 (still a very viable phone) or older.
- digi_owl 10y agoYes and no. Google could rework Android such that it would be easier for companies to apply their own UX without doing deep code changes. Also, they could isolate the Java VM layer further such that it could be updated independently of the Linux kernel and related userland.
- technofiend 10y agoAnd that even google-sourced devices have a very short lifecycle for OS and security updates. Google seem to be running under the assumption any phone over 12 months old is reaching the end of its usable life.
- bitmapbrother 10y agoA Google device receives security updates for 36 months. Not sure where you pulled your 12 months from.
- technofiend 10y agoAh I'm a little salty because although you get security updates for 3 years you only get feature updates for 18 months. Combine that with the fact the Google so poorly plan their product releases that supply is constrained for the first 6 months of the product lifecycle. So in practice someone who manages to buy a device when they're generally available has at best a year to get updates for their shiny new $500-$900 device. It was egregious when a new Nexus device was $500+, now it's outrageous. The Pixel XL was released in October of 2017 which means updates stop one year away from today in April of 2019. Top of the line is $968 and you want top of the line for best memory performance. Why buy one of those phones and purchase sub par performance? It's a waste of money. So if I wanted one I'd pay $80/month for a device that's replaced in October of this year (Pixel 2 is supposedly an end-of-year release) and dropped from feature upgrades not too long after that. Google need to fix their feature window by extending it to two years and fix their supply pipeline by ordering apple-like quantities of product. Otherwise they're not really competing with Apple.
- tjoff 10y agoWell, if you use your phone a lot you kind of have to buy a new phone regardless. Non-replaceable batteries should be illegal.
- fpoling 10y agoAn ARM Chromebook that I bought more than 4 years ago still receives updates.
- cobookman 10y agoGoogle has broken out GMS from android core so that they can do OTA updates w/o updating the OS itself. I do agree this needs to be better, however its also a non-trivial problem to solve.
- pjmlp 10y agoHow is signing a contract, with the respective legal consequences for breach of contract, a non-trivial problem to solve?
- DannyBee 10y agoBecause suing customers is sure to improve things! That's definitely the path to greater cooperation and goodness. Do you really believe any of these companies would sign that instead of going with whatever plan b is? If so, I guess n-gate is right. But let's follow this silly thread anyway. On average, the lawsuit would take three to seven years to resolve. Assume they win: great, they get some small amount of damages and everyone stops using Android. They can't and won't ever get the remedy of forcing security updates. It's not even something available. Assume they lose: great, they get nothing and everyone stops using Android. ... What did this solve again?
- pjmlp 10y agoLet them stop selling phones with Android, create their own forks and lets see whose devices the public will bother to buy.
- DannyBee 10y agoThis represents such a fundamental misunderstanding of the power structures i almost don't know where to begin. Suffice to say, if it was as easy as waving the magic wand you think it is, it would have happened already. Instead, if you tried to wave it, handset makers would have walked and just done something else. Heck, some did! Besides, why stop at Google? Why not blame the carriers for devices like this be on their networks? By your logic, if Verizon told Samsung tomorrow said "you must update your phone monthly with security updates in order to stay connected to our network" it would have just happened! Maybe instead of assuming a vast lack of caring or outright maliciousnss, you should consider that maybe it's not the trivial thing you are making it out to be, and that's the real reason it hasn't happened yet.
- Certhas 10y agoOr it is within Googles power, but not within Googles interest to do so, so we in turn have power by getting outraged at Google, shouting from the rooftops and creating an incentive for them to apply more pressure to handset makers. Walking away from Android is not currently a realistic option for most of them (recent Sony Sailfish news non-withstanding).
- DannyBee 10y agoYou are right, they are just being completely self interested and it would all just work out happily if only they would just beat people over the head repeatedly. That has worked out so great in the past for them and others, and would not result in Android being abandoned wholesale for something worse inside of two years. If only they had thought of this. Oh, that's right, I forgot, it's not that this is much more nuanced and complex ecosystem interplay, it's that it's very black and white and they uniformly don't give a crap.
- fauigerzigerk 10y ago>Instead, if you tried to wave it, handset makers would have walked and just done something else. Heck, some did! Yes some have and some more would have. And then it would have been up to these holdouts to come up with a viable OS. Good luck with that. Almost everybody who tried has failed. There is no doubt in my mind that Google could force it successfully, but why would they? Everything is moving in their direction anyway and users don't seem fazed.