4 ms·

Maybe we should give them a 90 day deadline to fix them.

by outside1234 12y ago

cheald 12y ago
Or what, you'll disclose them?
- outside1234 12y ago
  It sounds like that is what Google thinks is the right thing to do. Note: I don't.
  - cheald 12y ago
    (Hint: They're already disclosed.)
    - wyldfire 12y ago
      Agreed. But it's disappointing that Google doesn't feel the same responsibility that they think Microsoft has.
magicalist 12y ago
I doubt the carriers would care. There have been a bunch of published exploits that haven't motivated them to push updates.
Shog9 12y ago
If you can figure out a way to make phone manufacturers and mobile service providers care about any kind of deadline for updates, you'll be doing the world a great service.
- outside1234 12y ago
  You mean like the roughly 6M different variants that Windows runs on where Google has made the same demand? :)
  - Dylan16807 12y ago
    OEMs don't customize windows. Google isn't actually capable of shoving proper OS updates to all android phones. It's the manufacturers and service providers that want you to throw out your phone every year and drag their feet on updating anything.
andyrj 12y ago
Do we really need to make all threads with any relation to Google about the whole "90 days vs. Patch Tuesday"?
ufmace 12y ago
Enforced how, on who, by whom? Google can say "They're fixed already, just upgrade to Android 5.0.1". Manufacturers and Carriers can say "Meh, we're still testing it". Enforcing such a rule requires holding a particular party responsible, and that party must have some authority to hold other involved parties responsible for doing their parts. Probably the best thing that could be done overall is Google's already-complete plan to move the web browser, and as much other code as they can, to Play store apps that they can centrally auto-update. But getting that solution onto the vulnerable phones required them to, once again, just upgrade to the newest Android.
- slacka 12y ago
  Agreed, placing all the blame on Google is not fair. Besides Google, carriers, and manufactures, there's one more party involved that no one seems to talk about, users. Google only promises to update their software for 18 months. If you're going to milk years and years out of your smartphone, don't you have some responsibly to update outdated apps with updated ones from the Google Play store? I have an old Galaxy S3 that Samsung no longer updates, yet these bugs don't effect me because I've replaced the built in browser with Chrome, which still receives regular security updates. What's stopping users of old phones from installing Chrome or Firefox?
  - ufmace 12y ago
    Some truth to that, but replacing your web browser doesn't actually fix the bug entirely. The problem is that the WebView elements inside applications still use the vulnerable Android Browser to display content. You can't change that behavior or update the Android Browser without an OTA update of the whole OS.
    - slacka 12y ago
      True, but you have to download the malicious app from the app store. Here Google has a good track record of removing them from their store. Also, the user can exercise some common sense by not installing apps from untrusted sources. If the users does not pay attention to the app's permissions, any app could be harmful without needing a browser exploit.

Maybe we should give them a 90 day deadline to fix them.

cheald 12y ago

Or what, you'll disclose them?

outside1234 12y ago
It sounds like that is what Google thinks is the right thing to do. Note: I don't.
- cheald 12y ago
  (Hint: They're already disclosed.)
  - wyldfire 12y ago
    Agreed. But it's disappointing that Google doesn't feel the same responsibility that they think Microsoft has.

magicalist 12y ago

I doubt the carriers would care. There have been a bunch of published exploits that haven't motivated them to push updates.

Shog9 12y ago

If you can figure out a way to make phone manufacturers and mobile service providers care about any kind of deadline for updates, you'll be doing the world a great service.

outside1234 12y ago
You mean like the roughly 6M different variants that Windows runs on where Google has made the same demand? :)
- Dylan16807 12y ago
  OEMs don't customize windows. Google isn't actually capable of shoving proper OS updates to all android phones. It's the manufacturers and service providers that want you to throw out your phone every year and drag their feet on updating anything.

andyrj 12y ago

Do we really need to make all threads with any relation to Google about the whole "90 days vs. Patch Tuesday"?

ufmace 12y ago

Enforced how, on who, by whom? Google can say "They're fixed already, just upgrade to Android 5.0.1". Manufacturers and Carriers can say "Meh, we're still testing it". Enforcing such a rule requires holding a particular party responsible, and that party must have some authority to hold other involved parties responsible for doing their parts. Probably the best thing that could be done overall is Google's already-complete plan to move the web browser, and as much other code as they can, to Play store apps that they can centrally auto-update. But getting that solution onto the vulnerable phones required them to, once again, just upgrade to the newest Android.

slacka 12y ago
Agreed, placing all the blame on Google is not fair. Besides Google, carriers, and manufactures, there's one more party involved that no one seems to talk about, users. Google only promises to update their software for 18 months. If you're going to milk years and years out of your smartphone, don't you have some responsibly to update outdated apps with updated ones from the Google Play store? I have an old Galaxy S3 that Samsung no longer updates, yet these bugs don't effect me because I've replaced the built in browser with Chrome, which still receives regular security updates. What's stopping users of old phones from installing Chrome or Firefox?
- ufmace 12y ago
  Some truth to that, but replacing your web browser doesn't actually fix the bug entirely. The problem is that the WebView elements inside applications still use the vulnerable Android Browser to display content. You can't change that behavior or update the Android Browser without an OTA update of the whole OS.
  - slacka 12y ago
    True, but you have to download the malicious app from the app store. Here Google has a good track record of removing them from their store. Also, the user can exercise some common sense by not installing apps from untrusted sources. If the users does not pay attention to the app's permissions, any app could be harmful without needing a browser exploit.