4 ms·

> These gaps between upstream vendors and downstream manufacturers allow n-days - vulnerabilities that are publicly known - to function as 0-days because no pat

by loeg 3y ago

> These gaps between upstream vendors and downstream manufacturers allow n-days - vulnerabilities that are publicly known - to function as 0-days because no patch is readily available to the user and their only defense is to stop using the device. While these gaps exist in most upstream/downstream relationships, they are more prevalent and longer in Android. Ouch. Maybe acknowledging it means that they can act on improving that ecosystem with their downstreams?

mminer237 3y ago
It's not even just downstream vendors. Google itself only supports its devices for three years. I bought a Pixel 4a on release in 2020 and next month will be my last security update. https://support.google.com/nexus/answer/4457705 https://support.google.com/nexus/answer/4457705 Can you imagine if Apple or Microsoft stopped making OS updates for CPUs more than three years old?
- IAmLiterallyAB 3y ago
  They've bumped it up to 5 years for Pixel 6 and later https://support.google.com/pixelphone/answer/4457705#zippy=%2Cpixel-later https://support.google.com/pixelphone/answer/4457705#zippy=%...
- doubled112 3y ago
  I was annoyed when the announced 1st gen Ryzen isn't supported in Windows 11.
  - needusername 3y ago
    You can’t expect part time open source contributors to work for free for you. Instead volunteer to take over maintenance by reviewing PRs and traiging user bug reports.
  - superlupo 3y ago
    But you still get security fixes for Windows 10 for years to come
- someguy7250 3y ago
  I've been using third party ROMs on Pixel 3. They receive monthly security updates to some extent, but obviously the hardware specific "vendor binaries" are still outdated. Frankly, I cared more about the open nature of the ROM than about security/privacy. These days, I assume all my data is available for sale everywhere anyways.
jbotdev 3y ago
The delay in updates is what originally pushed me to move from Android to iOS a while back, and years later it’s still an issue. You would think at least Nexus/Pixel would get updates quickly, but that still isn’t always the case. It seems like even within Google there are some issues that need to be addressed before they can lead other manufacturers by example.
- Arbortheus 3y ago
  Google have been quite irresponsible on some of their own devices too. For example the Chromecast With Google TV is actively being sold (and new product revisions released), yet it is still running Android TV 12 despite 13 coming out in December 2022. Apparently even they are struggling to update the device because of its lacklustre storage (8GB, only 4.4GB usable) which means there simply isn’t enough space for large OTA updates.
- maccard 3y ago
  The situation on Android is utterly insane. I bought a Pixel via my carrier a few years back only to find out that my _carrier_ was responsible for software updates, and they held them back so they could add their own bullshit to the OS. I was months waiting for a major Android OS version on a flagship Google device.
- Dah00n 3y ago
  While I agree that Google and manufactures needs to do better, the article shows that the amount of detected in the wild zero days are higher for iOS than Android in the newest stat (2022) while it used to be higher for Android.
  - realusername 3y ago
    That's basically because Android nowadays has the absolute bare minimum on the kernel, the rest is updated dynamically
    - Dah00n 3y ago
      For some reason I read it as if you think that is a bad thing? In my opinion that is how it should be and it is a strength.
callalex 3y ago
The downstream vendors just don’t give a hoot. It’s been more than 10 years now and their behavior hasn’t changed. Google has moved mountains to throw as much as they can into userspace which can be patched by Google directly, but that effort has hit its limits. The rest will just never get better, because phone manufacturers love forced obsolescence, and when any exploit causes a serious issue they can just disingenuously point their finger at Google and say “well they made the software”.
- fatfingerd 3y ago
  Now hold on.. Google made not just the software but the structure that makes it practical for Google and hardware makers like Qualcomm to get their cake and the vendors to somehow be responsible for the gap it causes when every vendor has to integrate drivers separately into orphans of the Linux kernel. Many vendors happily joined Android One which Google seems to have silently killed, so I don't think they are that happy losing reputation to sell Android phones they can't properly support.
  - evilduck 3y ago
    Not so unhappy that they will stop doing it. They earn their reputations by continuing to bring these poorly supported products to market despite the situation being very well established.

by loeg 3y ago

mminer237 3y ago

It's not even just downstream vendors. Google itself only supports its devices for three years. I bought a Pixel 4a on release in 2020 and next month will be my last security update. https://support.google.com/nexus/answer/4457705 https://support.google.com/nexus/answer/4457705 Can you imagine if Apple or Microsoft stopped making OS updates for CPUs more than three years old?

IAmLiterallyAB 3y ago
They've bumped it up to 5 years for Pixel 6 and later https://support.google.com/pixelphone/answer/4457705#zippy=%2Cpixel-later https://support.google.com/pixelphone/answer/4457705#zippy=%...
doubled112 3y ago
I was annoyed when the announced 1st gen Ryzen isn't supported in Windows 11.
- needusername 3y ago
  You can’t expect part time open source contributors to work for free for you. Instead volunteer to take over maintenance by reviewing PRs and traiging user bug reports.
- superlupo 3y ago
  But you still get security fixes for Windows 10 for years to come
someguy7250 3y ago
I've been using third party ROMs on Pixel 3. They receive monthly security updates to some extent, but obviously the hardware specific "vendor binaries" are still outdated. Frankly, I cared more about the open nature of the ROM than about security/privacy. These days, I assume all my data is available for sale everywhere anyways.

jbotdev 3y ago

The delay in updates is what originally pushed me to move from Android to iOS a while back, and years later it’s still an issue. You would think at least Nexus/Pixel would get updates quickly, but that still isn’t always the case. It seems like even within Google there are some issues that need to be addressed before they can lead other manufacturers by example.

Arbortheus 3y ago
Google have been quite irresponsible on some of their own devices too. For example the Chromecast With Google TV is actively being sold (and new product revisions released), yet it is still running Android TV 12 despite 13 coming out in December 2022. Apparently even they are struggling to update the device because of its lacklustre storage (8GB, only 4.4GB usable) which means there simply isn’t enough space for large OTA updates.
maccard 3y ago
The situation on Android is utterly insane. I bought a Pixel via my carrier a few years back only to find out that my _carrier_ was responsible for software updates, and they held them back so they could add their own bullshit to the OS. I was months waiting for a major Android OS version on a flagship Google device.
Dah00n 3y ago
While I agree that Google and manufactures needs to do better, the article shows that the amount of detected in the wild zero days are higher for iOS than Android in the newest stat (2022) while it used to be higher for Android.
- realusername 3y ago
  That's basically because Android nowadays has the absolute bare minimum on the kernel, the rest is updated dynamically
  - Dah00n 3y ago
    For some reason I read it as if you think that is a bad thing? In my opinion that is how it should be and it is a strength.

callalex 3y ago

The downstream vendors just don’t give a hoot. It’s been more than 10 years now and their behavior hasn’t changed. Google has moved mountains to throw as much as they can into userspace which can be patched by Google directly, but that effort has hit its limits. The rest will just never get better, because phone manufacturers love forced obsolescence, and when any exploit causes a serious issue they can just disingenuously point their finger at Google and say “well they made the software”.

fatfingerd 3y ago
Now hold on.. Google made not just the software but the structure that makes it practical for Google and hardware makers like Qualcomm to get their cake and the vendors to somehow be responsible for the gap it causes when every vendor has to integrate drivers separately into orphans of the Linux kernel. Many vendors happily joined Android One which Google seems to have silently killed, so I don't think they are that happy losing reputation to sell Android phones they can't properly support.
- evilduck 3y ago
  Not so unhappy that they will stop doing it. They earn their reputations by continuing to bring these poorly supported products to market despite the situation being very well established.