4 ms·

Maybe I'm getting it wrong, but what's the problem in Google flagging this bug as "won't fix"? It's the third party driver that has a bug, not their software. O

Maybe I'm getting it wrong, but what's the problem in Google flagging this bug as "won't fix"? It's the third party driver that has a bug, not their software. Once the bug is fixed by the third party then automatically it will be fixed for Google. Maybe the author has a stricter and more negative definition of "won't fix" so it sounded wrong to him?

dmitrygr 4y ago
> but what's the problem in Google flagging this bug as "won't fix"? You do not get to sell hardware as "100% google" AND shitcan a kernel bug. you only get to do one of those two, and you must pick and stick with it.
- randmeerkat 4y ago
  > You do not get to sell hardware as "100% google" AND shitcan a kernel bug. Turns out you totally can.
  - hnburnsy 4y ago
    And didn't have to pay a bug bounty. win win
- AstixAndBelix 4y ago
  We all know not 100% of the hardware is made by google. If there was a problem with the touchscreen, fingerprint sensor or camera drivers we all would be aware it came from a third party. The author knows full well the GPU is not actually made by Google, he is not an ignorant consumer being duped by marketing, so the label is actually 100% accurate for people in-the-know
  - dmitrygr 4y ago
    GPU is not made by google, but kernel IS compiled by google, who can fix a kernel bug in said kernel
    - GeekyBear 4y ago
      It's also Google's SOC. It's their job to support their SOC and the GPU they chose to integrate onto it.
- intelVISA 4y ago
  > you only get to do one of those two, and you must pick and stick with it. Wish that were true!
ccouzens 4y ago
Even if they're not developing the code, it would be good for them to push the third party to get it fixed, given that the 3rd party is used in their product.
- ikekkdcjkfke 4y ago
  They have to keep the source closed since there is ground-breaking, unicorn rockstar code that bankrupt them of it is open sourced
shkkmo 4y ago
> Once the bug is fixed by the third party then automatically it will be fixed for Google. The article explains why this isn't a safe assumption and documents numerous cases where patches were not deployed to Android devices until well after the vulnerability was publicly disclosed. https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/#disclosure-and-patch-gapping https://github.blog/2023-01-23-pwning-the-all-google-phone-w... Thus is seems obvious to me that closing the bug as "won't fix" is the wrong response. The issue shouldn't be closed until the security patch makes its way into the Android Security Bulletin.
- readams 4y ago
  You're assuming that Google isn't keeping track of security bugs they forward to their vendors. Almost certainly they opened a ticket in a different system and tracked it there.
  - shkkmo 4y ago
    Im not assuming anything, Google has a track record to failing to incorporate patches in a timely manner. I don't see how closing a high priority security bug on their public tracker as "won't fix" helps them do better.
pabs3 4y ago
They should stop using proprietary drivers, with open source drivers they could at least fix it themselves.
- AstixAndBelix 4y ago
  how can they stop using proprietary drivers if they are still relying on third party partners? until google becomes like apple they won't have access to the drivers
  - pabs3 4y ago
    Do the same as the Linux kernel community, don't allow proprietary drivers in Android. Linux doesn't allow proprietary drivers and now it has an open source driver for ARM Mali GPUs, Android should stop using the proprietary driver and use the open source driver. Whenever a vendor wants to have a proprietary driver, say no thanks, or reverse engineer the driver. A bunch of volunteers working part-time figured out how to make open source Apple M1 GPU drivers and Google has a ton of money so it could easily hire say 100-1000 people to reverse engineer proprietary drivers full-time and rewrite them from scratch.

dmitrygr 4y ago

> but what's the problem in Google flagging this bug as "won't fix"? You do not get to sell hardware as "100% google" AND shitcan a kernel bug. you only get to do one of those two, and you must pick and stick with it.

randmeerkat 4y ago
> You do not get to sell hardware as "100% google" AND shitcan a kernel bug. Turns out you totally can.
- hnburnsy 4y ago
  And didn't have to pay a bug bounty. win win
AstixAndBelix 4y ago
We all know not 100% of the hardware is made by google. If there was a problem with the touchscreen, fingerprint sensor or camera drivers we all would be aware it came from a third party. The author knows full well the GPU is not actually made by Google, he is not an ignorant consumer being duped by marketing, so the label is actually 100% accurate for people in-the-know
- dmitrygr 4y ago
  GPU is not made by google, but kernel IS compiled by google, who can fix a kernel bug in said kernel
  - GeekyBear 4y ago
    It's also Google's SOC. It's their job to support their SOC and the GPU they chose to integrate onto it.
intelVISA 4y ago
> you only get to do one of those two, and you must pick and stick with it. Wish that were true!

ccouzens 4y ago

Even if they're not developing the code, it would be good for them to push the third party to get it fixed, given that the 3rd party is used in their product.

ikekkdcjkfke 4y ago
They have to keep the source closed since there is ground-breaking, unicorn rockstar code that bankrupt them of it is open sourced

shkkmo 4y ago

> Once the bug is fixed by the third party then automatically it will be fixed for Google. The article explains why this isn't a safe assumption and documents numerous cases where patches were not deployed to Android devices until well after the vulnerability was publicly disclosed. https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/#disclosure-and-patch-gapping https://github.blog/2023-01-23-pwning-the-all-google-phone-w... Thus is seems obvious to me that closing the bug as "won't fix" is the wrong response. The issue shouldn't be closed until the security patch makes its way into the Android Security Bulletin.

readams 4y ago
You're assuming that Google isn't keeping track of security bugs they forward to their vendors. Almost certainly they opened a ticket in a different system and tracked it there.
- shkkmo 4y ago
  Im not assuming anything, Google has a track record to failing to incorporate patches in a timely manner. I don't see how closing a high priority security bug on their public tracker as "won't fix" helps them do better.

pabs3 4y ago

They should stop using proprietary drivers, with open source drivers they could at least fix it themselves.

AstixAndBelix 4y ago
how can they stop using proprietary drivers if they are still relying on third party partners? until google becomes like apple they won't have access to the drivers
- pabs3 4y ago
  Do the same as the Linux kernel community, don't allow proprietary drivers in Android. Linux doesn't allow proprietary drivers and now it has an open source driver for ARM Mali GPUs, Android should stop using the proprietary driver and use the open source driver. Whenever a vendor wants to have a proprietary driver, say no thanks, or reverse engineer the driver. A bunch of volunteers working part-time figured out how to make open source Apple M1 GPU drivers and Google has a ton of money so it could easily hire say 100-1000 people to reverse engineer proprietary drivers full-time and rewrite them from scratch.