25 ms·

On the contrary, Android is the only somewhat sane popular mobile OS today. I don't want to reboot my phone to update the web browser the way MacOS and iOS upda

On the contrary, Android is the only somewhat sane popular mobile OS today. I don't want to reboot my phone to update the web browser the way MacOS and iOS update Safari and the way Windows used to update IE. The browser is the application I use the most, and it has the largest attack surface. It should update transparently and not stop updating after the OS falls out of service, like Macs with Nvidia GPUs. The problem in this case isn't Google dragging its feet on releases. It releases Chrome updates frequently and OS updates monthly. The problem here is Google failing to include security patches for known vulnerabilities in those releases. What's ridiculous is that this is something that can be automated, and after multiple failures, it should have been automated, but here we are.

ocdtrekkie 4y ago
Don't get me wrong, having to reboot your device to update your browser is silly. But if the choice is between that and waiting until a vulnerability is actively exploited before it's patched, anyone who cares about security will choose the former. It's very obvious when something like Heartbleed comes around which affects a ton of operating systems, and Windows and iOS and major Linux distros are patched in like a week and then there's a chart to look at for which manufacturer and model and carrier on whether or not you'll see a fix in the next couple months or ever.
- lern_too_spel 4y ago
  Except if you get your OS from a particular vendor, like Apple, Google, or Ubuntu, you only have to check with the vendor to see when it will be released. All three have track records of timely updates. The real problem is patch-gapping across updates (instead of within an update), which Apple also suffers from: https://blog.theori.io/research/webkit-type-confusion/ https://blog.theori.io/research/webkit-type-confusion/ I'd expect both Apple and Google to spend the resources to automate this problem away, but the article shows this hasn't happened.

ocdtrekkie 4y ago

Don't get me wrong, having to reboot your device to update your browser is silly. But if the choice is between that and waiting until a vulnerability is actively exploited before it's patched, anyone who cares about security will choose the former. It's very obvious when something like Heartbleed comes around which affects a ton of operating systems, and Windows and iOS and major Linux distros are patched in like a week and then there's a chart to look at for which manufacturer and model and carrier on whether or not you'll see a fix in the next couple months or ever.

lern_too_spel 4y ago
Except if you get your OS from a particular vendor, like Apple, Google, or Ubuntu, you only have to check with the vendor to see when it will be released. All three have track records of timely updates. The real problem is patch-gapping across updates (instead of within an update), which Apple also suffers from: https://blog.theori.io/research/webkit-type-confusion/ https://blog.theori.io/research/webkit-type-confusion/ I'd expect both Apple and Google to spend the resources to automate this problem away, but the article shows this hasn't happened.