38 ms·
Android devices, as deployed in the wild, consist of a bewildering array of offerings, from shovelware-equivalent throw-over-the-fence devices, to pricey flagsh
by niftich 9y ago
Android devices, as deployed in the wild, consist of a bewildering array of offerings, from shovelware-equivalent throw-over-the-fence devices, to pricey flagships whose makers command some brand awareness. Google has known for years that the Android security patch situation is awful, and has been slowly trying different approaches -- from shipping its own hardware, to moving portions of the OS out of the base image and into Google Play Services-updatable components (much to the chagrin of those who lament the increasing disparity between stock AOSP and Android-as-shipped-on-devices), to its newest: Project Treble, a HAL and vendor interface.
But a big part of Android's headaches is the long tail of devices that have been functionally abandoned by all involved parties: the device maker, the carrier, and Google. These devices are trapped in time and in a cesspit of an ever-increasing number of vulnerabilities. It's like unpatched WinXP, except these devices were once bought new a mere two or three years prior. Because all involved parties have dropped the ball, and at the lowest end of the market, the consumer can't really punish the these parties because they're reliant on the exact same names to get access, this sad state of affairs continues until Project Treble ships for real.
At that point, all pre-Treble devices are still doomed, but post-Treble devices at least have a fighting chance.
- pjmlp 9y agoAs I mentioned in another comment, I doubt Treble will succeed if not followed by legal requirements on the Play Services contracts or gated access to Google servers. They will keep not providing updates, because they don't come from Google anyway, even with Treble.
- bitmapbrother 9y agoI agree. It's now come to the point where OEM's must now be legally required to update their devices for a certain amount of time to be granted access to GMS. There are no financial incentives for these OEM's to do anything once their device is out the door.
- petra 9y agoAnd this results directly from the fact that most users not seeing value in updates, otherwise, maybe some small OEM's who offer updates , would be more successful.Or the major OEM's would offer paid updates.
- niftich 9y agoIt's also interesting that Windows Phone -- I'm intentionally using the term very loosely -- showed that it's possible to offer lower-end devices that do receive security updates straight from the OS-maker on carrier networks, although a myriad factors, including hard reboots of major versions dead-ending entire device lines, and a less-than-thriving third-party app ecosystem due to another set of problems doomed the entire ecosystem in the end. But Microsoft mandated UEFI to rationalize the clusterfuck that is the "ARM platform" from the very beginning, and made it so that the carrier would have to explicitly disable an MS-pushed update, rather than the Android equivalent of the carrier having to prep the update in the first place.
- bitmapbrother 9y agoThis is not correct. All firmware updates can only be made by the OEM and not Microsoft. So any firmware updates would need to be pushed by the OEM and then approved by the carrier.
- zanny 9y ago> all pre-Treble devices are still doomed The only devices that are doomed are those that: A. have no reasonable support for third party firmware B. have no user base or community to maintain security The Galaxy S series since the S3, for example, is unlikely to ever stop getting some degree of support from community ROMs. Of course, those community developments don't have the resources of the OEM - they can't fix the proprietary parts that break, and security hinges on the willingness of volunteers to merge patches, which they don't always do. I don't think its that black and white, though. Plenty of "supported" devices get updates and ignore security vulnerabilities. Companies can and will stop updating arbitrarily, and you have no way to know who is actually looking for vulnerabilities to fix. All you get is a set of known exploits elsewhere and the means you can test them yourself on your own devices, or someone else did and you already know unpatched vulnerabilities on your end.
- bitmapbrother 9y ago>A. have no reasonable support for third party firmware B. have no user base or community to maintain security You're automatically assuming that these third party maintainers apply all of the security patches released by Google. This would be an incorrect assumption.
- pjmlp 9y agoThose updates are useless to the common people on the street.