7 ms·

There is no technical reason that Android phones aren't up to date with patches. Apple is not doing something magical here. This is something that could be reme

There is no technical reason that Android phones aren't up to date with patches. Apple is not doing something magical here. This is something that could be remedied if Google forced phone makers and carriers to support the latest patches ASAP. iOS may be more security-focused in general than Android, but this article is centered on updates and un-patched phones. That part of the security equation is very solvable.

FussyZeus 9y ago
Except that they haven't solved it, and show no signs of nor have any financial motivation to solve it.
- euyyn 9y ago
  > show no signs of nor have any financial motivation to solve it _You_ haven't seen signs ;) Project Treble was announced at Google I/O.
  - pjmlp 9y ago
    It will fail like the previous initiatives if not followed by legal requirements on the Play Services contracts or gated access to Google servers.
  - pfranz 9y ago
    I remember hearing a bunch of initiatives and plans to keep Android phones up to date over the years[1]. They all quickly disappear and a year or two later there's some new plan. There has been signs, but financial motivation and followthrough is missing. [1] http://www.androidpolice.com/2011/05/10/io-2011-android-alliance-promises-timely-android-os-updates-for-18-months-after-device-launch/ http://www.androidpolice.com/2011/05/10/io-2011-android-alli...
    - euyyn 9y ago
      That alliance sounds like just the motivation/PR part. Treble is the "remove the actual technical hurdle that made it hard" part.
      - pfranz 9y ago
        There were many other "initiatives." I remember for the Alliance at the announcement they were very emphatic that it wasn't lip service, expect to hear more soon. 6 months later I saw and article pointing out how nothing seems to have happened since the announcement. I saw and article from 2010 recognizing that phone updates weren't reaching customers and the initiative was to untether more apps and release them via the app store. They pointed to Google Maps as an example they were copying. I don't really pay attention enough to know if that was successful. That seems like a "lower hanging fruit" version of Treble. This problem has been around since the very first handsets...almost 10 years ago. Both technical and working groups have been attempted. I'm skeptical things will change.
rothbardrand 9y ago
One difference with security implications is that Apple makes both the hardware and the software. So the hardware is controlled by Apple and can authenticate the software, across the full stack, including the fingerprint sensor (this is why third parties who replaced the fingerprint sensor were running into problems awhile back.) This ensures all software run on the phone is uncompromised. For android, the software is modified by the carrier, and while their intentions are likely good, their ability to integrate the security patches with their custom changes is open for debate (carriers are not the best software developers.) Further, there are more opportunities for compromising the software that is run- more surface area to attack, including installing malware in the supply chain.
- pjmlp 9y ago
  Google already makes a bunch of requirements to access the Play Store services on their contracts with OEMS and carriers, requiring a certain level of updates to access those services is just another legal clause and validation when devices talk to Google servers.
- zanny 9y ago
  Except the Windows world shows it isn't a technical hurdle either. Microsoft makes their OS, OEMs buy copies of it, and stuff bloatware and crap and change stuff all the same as Android vendors before selling it to consumers. But then, despite modifications, Microsoft updates their stuff, including the kernel. It doesn't actually even take hardware vendors being ethical and making open source mainline kernel drivers for their parts. They could just be shipping DKMS kernel modules instead of baking their trash into fixed kernel releases. But they simply do not, because they don't care.
  - bitmapbrother 9y ago
    You're missing the part where these Android OEM fork the OS, add all of their source code modifications, compile, link and the build it. Google cannot update an OS created by another OEM because unlike Microsoft, which provides these OEM's binaries of their OS, Google simply provides the source to Android.
Aoyagi 9y ago
I was under the impression that even Blacberry, who release security patches every month, are too slow though...
drampelt 9y ago
How are you supposed to force companies using open source software to update it immediately?
- pjmlp 9y ago
  Legal actions and blocking access to those devices to Google servers.
- pwthornton 9y ago
  Google already has requirements that if you don't install their Google apps and services, you can't get access to the latest versions of Android. They could simply withhold recent versions unless organizations meet these requirements. There would be nothing stopping companies from using older versions of Android, however.
jlg23 9y ago
> There is no technical reason that Android phones aren't up to date with patches. That's true for the 1st world only. Where I currently live the most recent phone I can get within 1.5h of driving runs Android 4. Also, Apple has a so much better security track record because they do not cater to the low-income population. Long term support is factored into the price of an iPhone but definitely not into the $20-thingy I can buy at every street corner everywhere in the world.
- petra 9y ago
  $20 ? What, Where ? i though $50-$60 was the low end of android phones.

FussyZeus 9y ago

Except that they haven't solved it, and show no signs of nor have any financial motivation to solve it.

euyyn 9y ago
> show no signs of nor have any financial motivation to solve it _You_ haven't seen signs ;) Project Treble was announced at Google I/O.
- pjmlp 9y ago
  It will fail like the previous initiatives if not followed by legal requirements on the Play Services contracts or gated access to Google servers.
- pfranz 9y ago
  I remember hearing a bunch of initiatives and plans to keep Android phones up to date over the years[1]. They all quickly disappear and a year or two later there's some new plan. There has been signs, but financial motivation and followthrough is missing. [1] http://www.androidpolice.com/2011/05/10/io-2011-android-alliance-promises-timely-android-os-updates-for-18-months-after-device-launch/ http://www.androidpolice.com/2011/05/10/io-2011-android-alli...
  - euyyn 9y ago
    That alliance sounds like just the motivation/PR part. Treble is the "remove the actual technical hurdle that made it hard" part.
    - pfranz 9y ago
      There were many other "initiatives." I remember for the Alliance at the announcement they were very emphatic that it wasn't lip service, expect to hear more soon. 6 months later I saw and article pointing out how nothing seems to have happened since the announcement. I saw and article from 2010 recognizing that phone updates weren't reaching customers and the initiative was to untether more apps and release them via the app store. They pointed to Google Maps as an example they were copying. I don't really pay attention enough to know if that was successful. That seems like a "lower hanging fruit" version of Treble. This problem has been around since the very first handsets...almost 10 years ago. Both technical and working groups have been attempted. I'm skeptical things will change.

rothbardrand 9y ago

One difference with security implications is that Apple makes both the hardware and the software. So the hardware is controlled by Apple and can authenticate the software, across the full stack, including the fingerprint sensor (this is why third parties who replaced the fingerprint sensor were running into problems awhile back.) This ensures all software run on the phone is uncompromised. For android, the software is modified by the carrier, and while their intentions are likely good, their ability to integrate the security patches with their custom changes is open for debate (carriers are not the best software developers.) Further, there are more opportunities for compromising the software that is run- more surface area to attack, including installing malware in the supply chain.

pjmlp 9y ago
Google already makes a bunch of requirements to access the Play Store services on their contracts with OEMS and carriers, requiring a certain level of updates to access those services is just another legal clause and validation when devices talk to Google servers.
zanny 9y ago
Except the Windows world shows it isn't a technical hurdle either. Microsoft makes their OS, OEMs buy copies of it, and stuff bloatware and crap and change stuff all the same as Android vendors before selling it to consumers. But then, despite modifications, Microsoft updates their stuff, including the kernel. It doesn't actually even take hardware vendors being ethical and making open source mainline kernel drivers for their parts. They could just be shipping DKMS kernel modules instead of baking their trash into fixed kernel releases. But they simply do not, because they don't care.
- bitmapbrother 9y ago
  You're missing the part where these Android OEM fork the OS, add all of their source code modifications, compile, link and the build it. Google cannot update an OS created by another OEM because unlike Microsoft, which provides these OEM's binaries of their OS, Google simply provides the source to Android.

Aoyagi 9y ago

I was under the impression that even Blacberry, who release security patches every month, are too slow though...

drampelt 9y ago

How are you supposed to force companies using open source software to update it immediately?

pjmlp 9y ago
Legal actions and blocking access to those devices to Google servers.
pwthornton 9y ago
Google already has requirements that if you don't install their Google apps and services, you can't get access to the latest versions of Android. They could simply withhold recent versions unless organizations meet these requirements. There would be nothing stopping companies from using older versions of Android, however.

jlg23 9y ago

> There is no technical reason that Android phones aren't up to date with patches. That's true for the 1st world only. Where I currently live the most recent phone I can get within 1.5h of driving runs Android 4. Also, Apple has a so much better security track record because they do not cater to the low-income population. Long term support is factored into the price of an iPhone but definitely not into the $20-thingy I can buy at every street corner everywhere in the world.

petra 9y ago
$20 ? What, Where ? i though $50-$60 was the low end of android phones.