4 ms·

>Android security is Google's fault. Any kidding yourself that might occur through believing that OEMs deserve any blame for an update mechanism (or lack thereo

>Android security is Google's fault. Any kidding yourself that might occur through believing that OEMs deserve any blame for an update mechanism (or lack thereof) in a system designed by Google is pretty easily discredited It would seem you still don't understand how Android is built. Google cannot update the phones made by other OEM's. OEM's download the Android source code, add their modifications and create their own forked version of Android. This is like asking Debian to update Redhat's Linux distribution. Blaming Google for the OEM's inability to update their own phones is disingenuous, but it does support your prime directive of disparaging Google every opportunity you get. >especially when you consider it took Google five months to patch KRACK in the Pixel 2, when third party ROM authors did it in two days. Those patches were provided by Google incidentally. Additionally, Google patched KRACK in Dec, 2017 on the Pixel phones. So where exactly did you get this 5 months? >Also, Google's "reputation with security" needs some serious nuance: They are very good at preventing types of exploits they care about, but they are a literal joke when it comes to security that interfaces with submitted content and user choice. Consider that the Chrome Web Store is a literal cesspool of malware, and that a lot of websites blatantly try to force you to install extensions through the Chrome Web Store which steal your browsing data. Since extensions are permitted to request such a huge security hole, Google doesn't consider it their problem that extensions do it maliciously. Could you point me to the malware on the Chrome Web Store? Since you claim it's a "literal cesspool of malware" it shouldn't be that difficult for you to point to those extensions. I look forward to those links.

goatsi 9y ago
Here is the most recent example: https://arstechnica.com/information-technology/2018/01/malicious-chrome-extension-is-next-to-impossible-to-manually-remove/ https://arstechnica.com/information-technology/2018/01/malic... >Proving once again that Google Chrome extensions are the Achilles heel of what's arguably the Internet's most secure browser, a researcher has documented a malicious add-on that tricks users into installing it and then, he said, is nearly impossible for most to manually uninstall. It was available for download on Google servers until Wednesday, 19 days after it was privately reported to Google security officials, a researcher said. Another one: https://arstechnica.com/information-technology/2018/01/500000-chrome-users-fall-prey-to-malicious-extensions-in-google-web-store/ https://arstechnica.com/information-technology/2018/01/50000... >Researchers have uncovered four malicious extensions with more than 500,000 combined downloads from the Google Chrome Web Store, a finding that highlights a key weakness in what's widely considered to be the Internet's most secure browser. Google has since removed the extensions.
millstone 9y ago
Google designed the Android update model, so is responsible for its consequences. They designed a different model for ChromeOS and it has worked much better.
ocdtrekkie 9y ago
I've learned not to try to argue with you, but yes. Google patched the Pixel 2 in December. The problem is... They were notified about KRACK in July. And Lineage had it fixed in... October, shortly after it went public. July, vendors notified (incl. Google): https://www.nbcnews.com/tech/tech-news/krack-attack-security-flaw-puts-every-wi-fi-connection-risk-n811001 https://www.nbcnews.com/tech/tech-news/krack-attack-security... October, my Windows Mobile phone was patched: https://www.bleepingcomputer.com/news/security/microsoft-quietly-patched-the-krack-wpa2-vulnerability-last-week/ https://www.bleepingcomputer.com/news/security/microsoft-qui... October, vulnerability goes public: http://www.businessinsider.com/krack-attack-wi-fi-vulnerability-2017-10 http://www.businessinsider.com/krack-attack-wi-fi-vulnerabil... October, Lineage patched: https://twitter.com/LineageAndroid/status/920143977256382464 https://twitter.com/LineageAndroid/status/920143977256382464 December, Google patches their own phones: https://arstechnica.com/gadgets/2017/11/pixel-wont-get-krack-fix-until-december-but-is-that-really-a-big-deal/ https://arstechnica.com/gadgets/2017/11/pixel-wont-get-krack...
pjmlp 9y ago
Google requires device certification to access their services, including legally enforced contracts. They just don't care about updates, otherwise they would remove certification access to any OEM not providing updates. Even with Treble they are letting the OEMs do the updates, if they ever take place. And to add to injury, devices that are upgraded to 8.0 instead of being released with it, don't require Treble compliance. So, our lovely OEMs are mostly shipping Android 7.0 devices in 2018 to avoid Treble. It is 100% Google's fault.
- merb 9y ago
  > They just don't care about updates, otherwise they would remove certification access to any OEM not providing updates. I think they care, but they can't do something about it. Because OEM's dislike updates. Updates does not sell new phones. Google on the other hand actually has it easier if all their devices are up to date. They do not need to maintain old code/branches whatever. It's still Google's fault that they never had something in place to enforce it. They basically wanted to have anybody on board of the OHA, so they needed to make tradeoffs in their contracts.

goatsi 9y ago

Here is the most recent example: https://arstechnica.com/information-technology/2018/01/malicious-chrome-extension-is-next-to-impossible-to-manually-remove/ https://arstechnica.com/information-technology/2018/01/malic... >Proving once again that Google Chrome extensions are the Achilles heel of what's arguably the Internet's most secure browser, a researcher has documented a malicious add-on that tricks users into installing it and then, he said, is nearly impossible for most to manually uninstall. It was available for download on Google servers until Wednesday, 19 days after it was privately reported to Google security officials, a researcher said. Another one: https://arstechnica.com/information-technology/2018/01/500000-chrome-users-fall-prey-to-malicious-extensions-in-google-web-store/ https://arstechnica.com/information-technology/2018/01/50000... >Researchers have uncovered four malicious extensions with more than 500,000 combined downloads from the Google Chrome Web Store, a finding that highlights a key weakness in what's widely considered to be the Internet's most secure browser. Google has since removed the extensions.

millstone 9y ago

Google designed the Android update model, so is responsible for its consequences. They designed a different model for ChromeOS and it has worked much better.

ocdtrekkie 9y ago

I've learned not to try to argue with you, but yes. Google patched the Pixel 2 in December. The problem is... They were notified about KRACK in July. And Lineage had it fixed in... October, shortly after it went public. July, vendors notified (incl. Google): https://www.nbcnews.com/tech/tech-news/krack-attack-security-flaw-puts-every-wi-fi-connection-risk-n811001 https://www.nbcnews.com/tech/tech-news/krack-attack-security... October, my Windows Mobile phone was patched: https://www.bleepingcomputer.com/news/security/microsoft-quietly-patched-the-krack-wpa2-vulnerability-last-week/ https://www.bleepingcomputer.com/news/security/microsoft-qui... October, vulnerability goes public: http://www.businessinsider.com/krack-attack-wi-fi-vulnerability-2017-10 http://www.businessinsider.com/krack-attack-wi-fi-vulnerabil... October, Lineage patched: https://twitter.com/LineageAndroid/status/920143977256382464 https://twitter.com/LineageAndroid/status/920143977256382464 December, Google patches their own phones: https://arstechnica.com/gadgets/2017/11/pixel-wont-get-krack-fix-until-december-but-is-that-really-a-big-deal/ https://arstechnica.com/gadgets/2017/11/pixel-wont-get-krack...

pjmlp 9y ago

Google requires device certification to access their services, including legally enforced contracts. They just don't care about updates, otherwise they would remove certification access to any OEM not providing updates. Even with Treble they are letting the OEMs do the updates, if they ever take place. And to add to injury, devices that are upgraded to 8.0 instead of being released with it, don't require Treble compliance. So, our lovely OEMs are mostly shipping Android 7.0 devices in 2018 to avoid Treble. It is 100% Google's fault.

merb 9y ago
> They just don't care about updates, otherwise they would remove certification access to any OEM not providing updates. I think they care, but they can't do something about it. Because OEM's dislike updates. Updates does not sell new phones. Google on the other hand actually has it easier if all their devices are up to date. They do not need to maintain old code/branches whatever. It's still Google's fault that they never had something in place to enforce it. They basically wanted to have anybody on board of the OHA, so they needed to make tradeoffs in their contracts.