4 ms·

Look, I’m an iOS user but this seems like flame-bait to me without any technical details. I’ve seen a lot of Google blog posts about security improvements over

by acdha 1y ago

Look, I’m an iOS user but this seems like flame-bait to me without any technical details. I’ve seen a lot of Google blog posts about security improvements over the years so that seems like a very sweeping assertion if you’re not going to support it.

transpute 1y ago
Recent discussion on 90-day embargo for security updates, https://news.ycombinator.com/item?id=45158523 https://news.ycombinator.com/item?id=45158523
- acdha 1y ago
  That’s potentially substantial but I note that Graphene specifically rejected the framing: https://xcancel.com/GrapheneOS/status/1964757878910136346 https://xcancel.com/GrapheneOS/status/1964757878910136346
  - transpute 1y ago
    Yes, they said it was worse, i.e. affected all Android, not only AOSP, https://news.ycombinator.com/item?id=45161011 https://news.ycombinator.com/item?id=45161011
ysnp 1y ago
I haven't read the articles posted (and I don't know how credible piunikaweb and cyberinsider are) but here is the first-ish hand information from GrapheneOS: https://grapheneos.social/@GrapheneOS/115164133992525834 https://grapheneos.social/@GrapheneOS/115164133992525834 > ... Google recently made incredibly misguided changes to Android security updates. Android security patches are (now) almost entirely quarterly instead of monthly to make it easier for OEMs. They're giving OEMs 3-4 months of early access.. Google's existing system for distributing security patches to OEMs was already incredibly problematic. Extending 1 month of early access to 4 months is atrocious. This applies to all of the patches in the bulletins. > ... The existing system should have been moving towards shorter broad disclosure of patches instead of 30 days. Moving in the opposite direction with 4 months of early access is extraordinarily irresponsible. ...Their 3-4 month embargo has an explicit exception for binary-only releases of patches. We're fully permitted to release the December 2025 patches this month in a release but not the source code. > Nearly all OEMs were failing to ship the monthly security patch backports despite how straightforward it is. The backports alone are not even particularly complete patches. They're only the High and Critical severity Android patches and a small subset of external patches for the Linux kernel, etc. Getting the full Android patches requires the latest stable releases.

by acdha 1y ago

transpute 1y ago

Recent discussion on 90-day embargo for security updates, https://news.ycombinator.com/item?id=45158523 https://news.ycombinator.com/item?id=45158523

acdha 1y ago
That’s potentially substantial but I note that Graphene specifically rejected the framing: https://xcancel.com/GrapheneOS/status/1964757878910136346 https://xcancel.com/GrapheneOS/status/1964757878910136346
- transpute 1y ago
  Yes, they said it was worse, i.e. affected all Android, not only AOSP, https://news.ycombinator.com/item?id=45161011 https://news.ycombinator.com/item?id=45161011

ysnp 1y ago

I haven't read the articles posted (and I don't know how credible piunikaweb and cyberinsider are) but here is the first-ish hand information from GrapheneOS: https://grapheneos.social/@GrapheneOS/115164133992525834 https://grapheneos.social/@GrapheneOS/115164133992525834 > ... Google recently made incredibly misguided changes to Android security updates. Android security patches are (now) almost entirely quarterly instead of monthly to make it easier for OEMs. They're giving OEMs 3-4 months of early access.. Google's existing system for distributing security patches to OEMs was already incredibly problematic. Extending 1 month of early access to 4 months is atrocious. This applies to all of the patches in the bulletins. > ... The existing system should have been moving towards shorter broad disclosure of patches instead of 30 days. Moving in the opposite direction with 4 months of early access is extraordinarily irresponsible. ...Their 3-4 month embargo has an explicit exception for binary-only releases of patches. We're fully permitted to release the December 2025 patches this month in a release but not the source code. > Nearly all OEMs were failing to ship the monthly security patch backports despite how straightforward it is. The backports alone are not even particularly complete patches. They're only the High and Critical severity Android patches and a small subset of external patches for the Linux kernel, etc. Getting the full Android patches requires the latest stable releases.