3 ms·

> Once the bug is fixed by the third party then automatically it will be fixed for Google. The article explains why this isn't a safe assumption and documents

by shkkmo 4y ago

> Once the bug is fixed by the third party then automatically it will be fixed for Google. The article explains why this isn't a safe assumption and documents numerous cases where patches were not deployed to Android devices until well after the vulnerability was publicly disclosed. https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/#disclosure-and-patch-gapping https://github.blog/2023-01-23-pwning-the-all-google-phone-w... Thus is seems obvious to me that closing the bug as "won't fix" is the wrong response. The issue shouldn't be closed until the security patch makes its way into the Android Security Bulletin.

readams 4y ago
You're assuming that Google isn't keeping track of security bugs they forward to their vendors. Almost certainly they opened a ticket in a different system and tracked it there.
- shkkmo 4y ago
  Im not assuming anything, Google has a track record to failing to incorporate patches in a timely manner. I don't see how closing a high priority security bug on their public tracker as "won't fix" helps them do better.