5 ms·

I wouldn't trust Google for security of MY data. I'd trust them for security of THEIR data. Examples: * Planned obsolescence for most Google devices (Chromeboo

I wouldn't trust Google for security of MY data. I'd trust them for security of THEIR data. Examples: * Planned obsolescence for most Google devices (Chromebooks, Android device, etc.) where security updates disappear after a few years. Contrast Linux, Windows, MacOS, etc. * The number of Android devices silently running without security updates * Google using basic security features as an upsell on GSuite. Pay us money, or your data will be compromised. * Android app versus iPhone app security. Android apps scarf up all sorts of information about you, and you can't make it stop. * Chrome versus Safari/Firefox privacy/security. Chrome makes tracking/ad/etc. blocking neigh impossible. Good B2B companies take the attitude that if my business fails because of something they've done or could have prevented, they've failed. They're trusted partners. Azure and AWS operate somewhat this way. For GCE, I'm a statistic. If they do something which costs me $1,000,000 and saves them $1000, that's good business. That comes out of their consumer-as-a-product business lines, but it makes them nearly useless for B2B. It's hitting their bottom line long-term; very little repeat business, and their reputation is in the gutter for B2B, but it's great for short-term metrics.

jeffbee 6y ago
> Planned obsolescence for most Google devices (Chromebooks Google has only EOLd two Chromebooks ever, the Cr-48 that was supported from 2010-2015 and the Pixel, from 2013-2018. The current model is guaranteed to get updates through 2026. What's wrong with this?
- wmf 6y ago
  I guess you're only counting Google-branded Chromebooks, because there are plenty of obsolete models listed. https://support.google.com/chrome/a/answer/6220366?hl=en https://support.google.com/chrome/a/answer/6220366?hl=en
- ocdtrekkie 6y ago
  The main issue is that it's a huge step backwards from PCs to treat laptops like phones that require model-specific updates. There are tons of Chromebook models that Google has abandoned, just not ones they themselves manufactured. The list is here: https://support.google.com/chrome/a/answer/6220366?hl=en https://support.google.com/chrome/a/answer/6220366?hl=en And yes, it's Google's choice to kill these, not OEMs: Chromebooks are built according to certain platform specifications Google hands down, upon which they then support for a given amount of time. So claiming Google has only dropped updates for two Chromebooks ever, ignoring all of the third party manufactured ones, is dishonest. Meanwhile, Windows, Linux, and macOS machines generally can run the latest version long past when the manufacturer supports it heavily. (Less true with Apple, but Apple's lifecycle is insanely long anyways.) You can actually take machines built to run Windows XP and install the latest release of Windows 10 on many of them. (It sometimes even runs decently too, if you use an SSD!) Ironically, you can run the latest version of Chrome, via Windows 10, on PCs built for XP, but plenty of Chromebooks sold since then can't. Additionally, Google has, like phones, positioned Chromebooks as disposable computing devices. $200-300 price point devices that you'll end up replacing in two or three years. Which is a massive e-waste problem, particularly given Google's push to get schools to force every student to buy/use them. For a supposedly green company, the entire Chromebook initiative should be seen as an embarrassing gap in good stewardship. Note that this entire subthread is pretty off-topic to the original article though.
  - jrockway 6y ago
    The underlying problem is Linux's driver model. To support new features, you have to support a new kernel. To support a new kernel, you have to port the device drivers to that kernel. Vendors don't like to maintain their code and changes in the kernel often break drivers, so vendors often just give up. That is basically the end of life for anyone that chooses hardware with bad drivers, which I guess some OEM Chromebook manufacturers did. I did a 20% project on Chrome OS when I worked at Google. At the time, I happened to use a Wacom tablet as a mouse and Chrome OS as my primary OS, and so I backported all the upstream Wacom drivers to the various kernels used by the variety of Chrome OS devices. It was a ton of work, and I really only did it because I needed it myself and there was one really nice person on the bug tracker who supported the tablets at his school. But it doesn't scale -- this was the easiest and most trivial porting job imaginable, and it took me several hours each patch; not because applying the patch was hard, but because validating that it worked as expected took a long time. It was a 15 minute build per device, then I had to reflash, then I had to try all the Wacom devices I had laying around. Now imagine doing that with WiFi -- where your laptop has to work with hundreds of craptastic access points. It's a multi-week effort for every (device, patch) combination. I don't work there anymore so I have no idea what the official policy is... but understand that it's, to some extent, the OEM's problem. They choose a WiFi chipset that breaks every kernel upgrade, and only they use it -- that's their validation to do. If they don't want to do it anymore they say "hey we saved three cents on the WiFi chipset, now throw away your laptop." As to why this doesn't affect Windows... Microsoft has spent years building in compatibility for binary blob drivers. On my fresh install of Windows 10 I have drivers from 2008 that are running (for my USB webcam, sadly). The code hasn't changed, so they don't have to revalidate it. It just works, forever. But with Linux there is no such option; you have to make your code compile against the latest kernel, or your device stops working. Hardware vendors (and OEMs) are very lazy, and you can see that in action -- Android and Chrome OS devices stop getting updates because nobody will maintain the code. This, I suppose, is the cost of building atop a GPL-based operating system. Hardware is "design once and forget". Linux is "evolve and grow forever". The impedance mismatch between hardware vendors and software engineers leads to a bad user experience.
    - 6y ago
- woofie11 6y ago
  Go to Google's store: https://eduproducts.withgoogle.com/products/category/chromebooks-for-education https://eduproducts.withgoogle.com/products/category/chromeb... Every Chromebook has a nicely listed expiration date. Past that date, security updates stop. At least in contrast to Android, they let you know. I have old expired Chromebooks. They're insecure. Most shops won't post the expiration date, and plenty of people buy Chromebooks with just a few months life left.
deelowe 6y ago
> Planned obsolescence for most Google devices I own 3 chromebooks. The first one was purchased well over 5 years ago it still gets updates. My 2 kids have school chromebooks that they were issued when they started elementary school that they are expected to keep until they move on to middleschool. My son is going to middle school next year.
mschuster91 6y ago
> The number of Android devices silently running without security updates That is not the fault of Google but of SoC manufacturers (look inside leaked Mediatek kernel code / BSPs, the quality is horrenduous!), device manufacturers (for adding tons of bloatware that has to be certified for each Google/AOSP update) and carriers (for adding even MORE bloatware). However, Google should finally add the requirement to fully open source everything needed to run stock Android (i.e. BSP, kernel and drivers) as criteria for Play Store certification.
- woofie11 6y ago
  Google is the dominant force in this market. I'm sorry, but you can't pass the buck here. Somehow, PCs get security updates.
  - mschuster91 6y ago
    Because PC manufacturers don't insist on modifying core Windows for their bloatware, and carriers don't insist on certification for each and every update. That is why the situation is better there.
    - woofie11 6y ago
      If Google wanted, it could prohibit that practice. If you want Play Store, Youtube, Gmail, and all the other Googlies, you play by Google's rules. It ain't rocket science. If Samsung decides not to play, Sony and Huawei will eat its market.
      - anoncareer0212 6y ago
        Well, Sony, at least. Finally a comeback from the Walkman!
      - mschuster91 6y ago
        Sony is a fucking joke when it comes to software (no matter if cameras or phones). For what it's worth they're so small IDC doesn't even list them on the market share diagram: https://www.idc.com/promo/smartphone-market-share/vendor https://www.idc.com/promo/smartphone-market-share/vendor Huawei is not going to eat anyone's market so soon, not with Google having cut them off from Android.
saagarjha 6y ago
Please don't use "Google" in the title as an opportunity to drag this thread into your personal issues with the company.
- woofie11 6y ago
  ????? Personal issues? I think you're projecting something. I was responding to this comment: "I'd personally trust Google's SRE team more than any other cloud provider in the world. They seem to have a great historical record and if they had any slip ups there, their business would be impacted for years." I'm not sure how commenting on Google's historical record is off-topic here, or what you mean by MY issues with the company. I use many tools from Google. I avoid many other tools from Google. They're great at some things, and horrible at others. I don't think it's unfair to discuss those. Privacy and MY security aren't their forte. But most things I do aren't super-high security, so that's often okay.
  - saagarjha 6y ago
    You’re responding to a comment about Google Cloud with complaints about how Chrome OS devices don’t get updates as fast as you want them to. This is hardly on topic even if you stretch, and you shouldn’t because that drags the conversation into an unrelated place that is easier to respond to which is a perpetual danger on Hacker News.

jeffbee 6y ago

> Planned obsolescence for most Google devices (Chromebooks Google has only EOLd two Chromebooks ever, the Cr-48 that was supported from 2010-2015 and the Pixel, from 2013-2018. The current model is guaranteed to get updates through 2026. What's wrong with this?

wmf 6y ago
I guess you're only counting Google-branded Chromebooks, because there are plenty of obsolete models listed. https://support.google.com/chrome/a/answer/6220366?hl=en https://support.google.com/chrome/a/answer/6220366?hl=en
ocdtrekkie 6y ago
The main issue is that it's a huge step backwards from PCs to treat laptops like phones that require model-specific updates. There are tons of Chromebook models that Google has abandoned, just not ones they themselves manufactured. The list is here: https://support.google.com/chrome/a/answer/6220366?hl=en https://support.google.com/chrome/a/answer/6220366?hl=en And yes, it's Google's choice to kill these, not OEMs: Chromebooks are built according to certain platform specifications Google hands down, upon which they then support for a given amount of time. So claiming Google has only dropped updates for two Chromebooks ever, ignoring all of the third party manufactured ones, is dishonest. Meanwhile, Windows, Linux, and macOS machines generally can run the latest version long past when the manufacturer supports it heavily. (Less true with Apple, but Apple's lifecycle is insanely long anyways.) You can actually take machines built to run Windows XP and install the latest release of Windows 10 on many of them. (It sometimes even runs decently too, if you use an SSD!) Ironically, you can run the latest version of Chrome, via Windows 10, on PCs built for XP, but plenty of Chromebooks sold since then can't. Additionally, Google has, like phones, positioned Chromebooks as disposable computing devices. $200-300 price point devices that you'll end up replacing in two or three years. Which is a massive e-waste problem, particularly given Google's push to get schools to force every student to buy/use them. For a supposedly green company, the entire Chromebook initiative should be seen as an embarrassing gap in good stewardship. Note that this entire subthread is pretty off-topic to the original article though.
- jrockway 6y ago
  The underlying problem is Linux's driver model. To support new features, you have to support a new kernel. To support a new kernel, you have to port the device drivers to that kernel. Vendors don't like to maintain their code and changes in the kernel often break drivers, so vendors often just give up. That is basically the end of life for anyone that chooses hardware with bad drivers, which I guess some OEM Chromebook manufacturers did. I did a 20% project on Chrome OS when I worked at Google. At the time, I happened to use a Wacom tablet as a mouse and Chrome OS as my primary OS, and so I backported all the upstream Wacom drivers to the various kernels used by the variety of Chrome OS devices. It was a ton of work, and I really only did it because I needed it myself and there was one really nice person on the bug tracker who supported the tablets at his school. But it doesn't scale -- this was the easiest and most trivial porting job imaginable, and it took me several hours each patch; not because applying the patch was hard, but because validating that it worked as expected took a long time. It was a 15 minute build per device, then I had to reflash, then I had to try all the Wacom devices I had laying around. Now imagine doing that with WiFi -- where your laptop has to work with hundreds of craptastic access points. It's a multi-week effort for every (device, patch) combination. I don't work there anymore so I have no idea what the official policy is... but understand that it's, to some extent, the OEM's problem. They choose a WiFi chipset that breaks every kernel upgrade, and only they use it -- that's their validation to do. If they don't want to do it anymore they say "hey we saved three cents on the WiFi chipset, now throw away your laptop." As to why this doesn't affect Windows... Microsoft has spent years building in compatibility for binary blob drivers. On my fresh install of Windows 10 I have drivers from 2008 that are running (for my USB webcam, sadly). The code hasn't changed, so they don't have to revalidate it. It just works, forever. But with Linux there is no such option; you have to make your code compile against the latest kernel, or your device stops working. Hardware vendors (and OEMs) are very lazy, and you can see that in action -- Android and Chrome OS devices stop getting updates because nobody will maintain the code. This, I suppose, is the cost of building atop a GPL-based operating system. Hardware is "design once and forget". Linux is "evolve and grow forever". The impedance mismatch between hardware vendors and software engineers leads to a bad user experience.
  - 6y ago
woofie11 6y ago
Go to Google's store: https://eduproducts.withgoogle.com/products/category/chromebooks-for-education https://eduproducts.withgoogle.com/products/category/chromeb... Every Chromebook has a nicely listed expiration date. Past that date, security updates stop. At least in contrast to Android, they let you know. I have old expired Chromebooks. They're insecure. Most shops won't post the expiration date, and plenty of people buy Chromebooks with just a few months life left.

deelowe 6y ago

> Planned obsolescence for most Google devices I own 3 chromebooks. The first one was purchased well over 5 years ago it still gets updates. My 2 kids have school chromebooks that they were issued when they started elementary school that they are expected to keep until they move on to middleschool. My son is going to middle school next year.

mschuster91 6y ago

> The number of Android devices silently running without security updates That is not the fault of Google but of SoC manufacturers (look inside leaked Mediatek kernel code / BSPs, the quality is horrenduous!), device manufacturers (for adding tons of bloatware that has to be certified for each Google/AOSP update) and carriers (for adding even MORE bloatware). However, Google should finally add the requirement to fully open source everything needed to run stock Android (i.e. BSP, kernel and drivers) as criteria for Play Store certification.

woofie11 6y ago
Google is the dominant force in this market. I'm sorry, but you can't pass the buck here. Somehow, PCs get security updates.
- mschuster91 6y ago
  Because PC manufacturers don't insist on modifying core Windows for their bloatware, and carriers don't insist on certification for each and every update. That is why the situation is better there.
  - woofie11 6y ago
    If Google wanted, it could prohibit that practice. If you want Play Store, Youtube, Gmail, and all the other Googlies, you play by Google's rules. It ain't rocket science. If Samsung decides not to play, Sony and Huawei will eat its market.
    - anoncareer0212 6y ago
      Well, Sony, at least. Finally a comeback from the Walkman!
    - mschuster91 6y ago
      Sony is a fucking joke when it comes to software (no matter if cameras or phones). For what it's worth they're so small IDC doesn't even list them on the market share diagram: https://www.idc.com/promo/smartphone-market-share/vendor https://www.idc.com/promo/smartphone-market-share/vendor Huawei is not going to eat anyone's market so soon, not with Google having cut them off from Android.

saagarjha 6y ago

Please don't use "Google" in the title as an opportunity to drag this thread into your personal issues with the company.

woofie11 6y ago
????? Personal issues? I think you're projecting something. I was responding to this comment: "I'd personally trust Google's SRE team more than any other cloud provider in the world. They seem to have a great historical record and if they had any slip ups there, their business would be impacted for years." I'm not sure how commenting on Google's historical record is off-topic here, or what you mean by MY issues with the company. I use many tools from Google. I avoid many other tools from Google. They're great at some things, and horrible at others. I don't think it's unfair to discuss those. Privacy and MY security aren't their forte. But most things I do aren't super-high security, so that's often okay.
- saagarjha 6y ago
  You’re responding to a comment about Google Cloud with complaints about how Chrome OS devices don’t get updates as fast as you want them to. This is hardly on topic even if you stretch, and you shouldn’t because that drags the conversation into an unrelated place that is easier to respond to which is a perpetual danger on Hacker News.