4 ms·

As I remember it, most of these critical bugs are in the Android browser, which is considered a core part of the OS in those versions. The trouble with that is

by ufmace 12y ago

As I remember it, most of these critical bugs are in the Android browser, which is considered a core part of the OS in those versions. The trouble with that is there's no way to update it without doing all the work of a whole OS update, including the usual mess of getting approval and merging changes from device manufacturers and local carriers. It seems more understandable that way that Google told them to just upgrade to a newer Android version instead.

outside1234 12y ago
Maybe we should give them a 90 day deadline to fix them.
- cheald 12y ago
  Or what, you'll disclose them?
  - outside1234 12y ago
    It sounds like that is what Google thinks is the right thing to do. Note: I don't.
    - cheald 12y ago
      (Hint: They're already disclosed.)
      - wyldfire 12y ago
        Agreed. But it's disappointing that Google doesn't feel the same responsibility that they think Microsoft has.
- magicalist 12y ago
  I doubt the carriers would care. There have been a bunch of published exploits that haven't motivated them to push updates.
- Shog9 12y ago
  If you can figure out a way to make phone manufacturers and mobile service providers care about any kind of deadline for updates, you'll be doing the world a great service.
  - outside1234 12y ago
    You mean like the roughly 6M different variants that Windows runs on where Google has made the same demand? :)
    - Dylan16807 12y ago
      OEMs don't customize windows. Google isn't actually capable of shoving proper OS updates to all android phones. It's the manufacturers and service providers that want you to throw out your phone every year and drag their feet on updating anything.
- andyrj 12y ago
  Do we really need to make all threads with any relation to Google about the whole "90 days vs. Patch Tuesday"?
- ufmace 12y ago
  Enforced how, on who, by whom? Google can say "They're fixed already, just upgrade to Android 5.0.1". Manufacturers and Carriers can say "Meh, we're still testing it". Enforcing such a rule requires holding a particular party responsible, and that party must have some authority to hold other involved parties responsible for doing their parts. Probably the best thing that could be done overall is Google's already-complete plan to move the web browser, and as much other code as they can, to Play store apps that they can centrally auto-update. But getting that solution onto the vulnerable phones required them to, once again, just upgrade to the newest Android.
  - slacka 12y ago
    Agreed, placing all the blame on Google is not fair. Besides Google, carriers, and manufactures, there's one more party involved that no one seems to talk about, users. Google only promises to update their software for 18 months. If you're going to milk years and years out of your smartphone, don't you have some responsibly to update outdated apps with updated ones from the Google Play store? I have an old Galaxy S3 that Samsung no longer updates, yet these bugs don't effect me because I've replaced the built in browser with Chrome, which still receives regular security updates. What's stopping users of old phones from installing Chrome or Firefox?
    - ufmace 12y ago
      Some truth to that, but replacing your web browser doesn't actually fix the bug entirely. The problem is that the WebView elements inside applications still use the vulnerable Android Browser to display content. You can't change that behavior or update the Android Browser without an OTA update of the whole OS.
      - slacka 12y ago
        True, but you have to download the malicious app from the app store. Here Google has a good track record of removing them from their store. Also, the user can exercise some common sense by not installing apps from untrusted sources. If the users does not pay attention to the app's permissions, any app could be harmful without needing a browser exploit.
deleted 12y ago
[deleted]
xorcist 12y ago
No, this is and should be Google's problem. Carriers have no say expect in certain markets, and hardware manufacturers do what Google dictates. The requirements to carry Google Play is pretty steep, and there should be consequences for not following the agreements. I bought a Nexus One, and one a half year later it was insecure with no updates. That can never be acceptable. If Debian can ship updates for a five year old distribution, I'm sure Google can. Android is slim by comparison.
- amaks 12y ago
  How come it's a Google's problem if the browser in question is part of AOSP, and therefore could (and should) be updated as any other open source project. Google may be able to fix those bugs, but doesn't have to.
  - exDM69 12y ago
    AOSP is not at all like most other open source projects. And even if the bugs would be fixed or backported to upstream AOSP, it's not going to magically be sent as an OTA update to customers. This is a real issue and it's Google's platform, they should take action to not leave customers at peril or force them to buy a new device. Google is the only one who has the power to make sure that the updates get all the way to the customers' devices. This might mean exerting pressure on the device manufacturers and operators who make downstream changes to Android. Otherwise we'll end up with millions of vulnerable devices that could be used (and are currently used) as zombies in botnets.
  - ufmace 12y ago
    Fixing the bug is trivial, but getting the fix out to users is anything but. Google's original model for Android was to have as few restrictions on the manufacturers and carriers as possible. This arguably allowed them to gain a foothold in a market that was starting to be dominated by iPhone, but they're feeling the pain now as the try to lock Android down harder. Google is moving as much stuff out of AOSP and into closed-source Google Apps package as possible for a variety of reasons, not least of which is that it gives them increased leverage over manufacturers by increasing the amount of work they'd have to do to make a forked AOSP device competitive with official Android. This helps them prevent hostile forks as well as enforcing things like updates and not too much mucking around with the UI. This only goes so far, especially when it comes to compelling updates of devices already running obsolete versions. Both Google and the manufacturers have very little leverage in practice over the carriers, who seem to be the usual stopping block in delaying updates for various unspecified "testing" requirements.

by ufmace 12y ago

outside1234 12y ago

Maybe we should give them a 90 day deadline to fix them.

cheald 12y ago
Or what, you'll disclose them?
- outside1234 12y ago
  It sounds like that is what Google thinks is the right thing to do. Note: I don't.
  - cheald 12y ago
    (Hint: They're already disclosed.)
    - wyldfire 12y ago
      Agreed. But it's disappointing that Google doesn't feel the same responsibility that they think Microsoft has.
magicalist 12y ago
I doubt the carriers would care. There have been a bunch of published exploits that haven't motivated them to push updates.
Shog9 12y ago
If you can figure out a way to make phone manufacturers and mobile service providers care about any kind of deadline for updates, you'll be doing the world a great service.
- outside1234 12y ago
  You mean like the roughly 6M different variants that Windows runs on where Google has made the same demand? :)
  - Dylan16807 12y ago
    OEMs don't customize windows. Google isn't actually capable of shoving proper OS updates to all android phones. It's the manufacturers and service providers that want you to throw out your phone every year and drag their feet on updating anything.
andyrj 12y ago
Do we really need to make all threads with any relation to Google about the whole "90 days vs. Patch Tuesday"?
ufmace 12y ago
Enforced how, on who, by whom? Google can say "They're fixed already, just upgrade to Android 5.0.1". Manufacturers and Carriers can say "Meh, we're still testing it". Enforcing such a rule requires holding a particular party responsible, and that party must have some authority to hold other involved parties responsible for doing their parts. Probably the best thing that could be done overall is Google's already-complete plan to move the web browser, and as much other code as they can, to Play store apps that they can centrally auto-update. But getting that solution onto the vulnerable phones required them to, once again, just upgrade to the newest Android.
- slacka 12y ago
  Agreed, placing all the blame on Google is not fair. Besides Google, carriers, and manufactures, there's one more party involved that no one seems to talk about, users. Google only promises to update their software for 18 months. If you're going to milk years and years out of your smartphone, don't you have some responsibly to update outdated apps with updated ones from the Google Play store? I have an old Galaxy S3 that Samsung no longer updates, yet these bugs don't effect me because I've replaced the built in browser with Chrome, which still receives regular security updates. What's stopping users of old phones from installing Chrome or Firefox?
  - ufmace 12y ago
    Some truth to that, but replacing your web browser doesn't actually fix the bug entirely. The problem is that the WebView elements inside applications still use the vulnerable Android Browser to display content. You can't change that behavior or update the Android Browser without an OTA update of the whole OS.
    - slacka 12y ago
      True, but you have to download the malicious app from the app store. Here Google has a good track record of removing them from their store. Also, the user can exercise some common sense by not installing apps from untrusted sources. If the users does not pay attention to the app's permissions, any app could be harmful without needing a browser exploit.

deleted 12y ago

[deleted]

xorcist 12y ago

No, this is and should be Google's problem. Carriers have no say expect in certain markets, and hardware manufacturers do what Google dictates. The requirements to carry Google Play is pretty steep, and there should be consequences for not following the agreements. I bought a Nexus One, and one a half year later it was insecure with no updates. That can never be acceptable. If Debian can ship updates for a five year old distribution, I'm sure Google can. Android is slim by comparison.

amaks 12y ago
How come it's a Google's problem if the browser in question is part of AOSP, and therefore could (and should) be updated as any other open source project. Google may be able to fix those bugs, but doesn't have to.
- exDM69 12y ago
  AOSP is not at all like most other open source projects. And even if the bugs would be fixed or backported to upstream AOSP, it's not going to magically be sent as an OTA update to customers. This is a real issue and it's Google's platform, they should take action to not leave customers at peril or force them to buy a new device. Google is the only one who has the power to make sure that the updates get all the way to the customers' devices. This might mean exerting pressure on the device manufacturers and operators who make downstream changes to Android. Otherwise we'll end up with millions of vulnerable devices that could be used (and are currently used) as zombies in botnets.
- ufmace 12y ago
  Fixing the bug is trivial, but getting the fix out to users is anything but. Google's original model for Android was to have as few restrictions on the manufacturers and carriers as possible. This arguably allowed them to gain a foothold in a market that was starting to be dominated by iPhone, but they're feeling the pain now as the try to lock Android down harder. Google is moving as much stuff out of AOSP and into closed-source Google Apps package as possible for a variety of reasons, not least of which is that it gives them increased leverage over manufacturers by increasing the amount of work they'd have to do to make a forked AOSP device competitive with official Android. This helps them prevent hostile forks as well as enforcing things like updates and not too much mucking around with the UI. This only goes so far, especially when it comes to compelling updates of devices already running obsolete versions. Both Google and the manufacturers have very little leverage in practice over the carriers, who seem to be the usual stopping block in delaying updates for various unspecified "testing" requirements.