3 ms·

Enforced how, on who, by whom? Google can say "They're fixed already, just upgrade to Android 5.0.1". Manufacturers and Carriers can say "Meh, we're still testi

by ufmace 12y ago

Enforced how, on who, by whom? Google can say "They're fixed already, just upgrade to Android 5.0.1". Manufacturers and Carriers can say "Meh, we're still testing it". Enforcing such a rule requires holding a particular party responsible, and that party must have some authority to hold other involved parties responsible for doing their parts. Probably the best thing that could be done overall is Google's already-complete plan to move the web browser, and as much other code as they can, to Play store apps that they can centrally auto-update. But getting that solution onto the vulnerable phones required them to, once again, just upgrade to the newest Android.

slacka 12y ago
Agreed, placing all the blame on Google is not fair. Besides Google, carriers, and manufactures, there's one more party involved that no one seems to talk about, users. Google only promises to update their software for 18 months. If you're going to milk years and years out of your smartphone, don't you have some responsibly to update outdated apps with updated ones from the Google Play store? I have an old Galaxy S3 that Samsung no longer updates, yet these bugs don't effect me because I've replaced the built in browser with Chrome, which still receives regular security updates. What's stopping users of old phones from installing Chrome or Firefox?
- ufmace 12y ago
  Some truth to that, but replacing your web browser doesn't actually fix the bug entirely. The problem is that the WebView elements inside applications still use the vulnerable Android Browser to display content. You can't change that behavior or update the Android Browser without an OTA update of the whole OS.
  - slacka 12y ago
    True, but you have to download the malicious app from the app store. Here Google has a good track record of removing them from their store. Also, the user can exercise some common sense by not installing apps from untrusted sources. If the users does not pay attention to the app's permissions, any app could be harmful without needing a browser exploit.
- joev_ 12y ago
  Out of curiosity, did you actually replace the Browser app, or did you just install a new one? If the stock Browser is still installed, you may consider the fact that it can probably be launched from Chrome with a specific URL intent.
lkbm 12y ago
Google hasn't pushed Lollipop out to all their own devices yet. I just talked to tech support yesterday, and was told if I wanted 5.01 on my brand new Nexus 5 (came from the Play Store two days ago and is on 4.4.4), I would have to figure out how to flash it myself. They would not help me with that at all. I can probably manage to flash it, but the typically phone user probably shouldn't be attempting that. "Just upgrade" is not a valid response when they refuse to push the upgrade to all users.

by ufmace 12y ago

slacka 12y ago

Agreed, placing all the blame on Google is not fair. Besides Google, carriers, and manufactures, there's one more party involved that no one seems to talk about, users. Google only promises to update their software for 18 months. If you're going to milk years and years out of your smartphone, don't you have some responsibly to update outdated apps with updated ones from the Google Play store? I have an old Galaxy S3 that Samsung no longer updates, yet these bugs don't effect me because I've replaced the built in browser with Chrome, which still receives regular security updates. What's stopping users of old phones from installing Chrome or Firefox?

ufmace 12y ago
Some truth to that, but replacing your web browser doesn't actually fix the bug entirely. The problem is that the WebView elements inside applications still use the vulnerable Android Browser to display content. You can't change that behavior or update the Android Browser without an OTA update of the whole OS.
- slacka 12y ago
  True, but you have to download the malicious app from the app store. Here Google has a good track record of removing them from their store. Also, the user can exercise some common sense by not installing apps from untrusted sources. If the users does not pay attention to the app's permissions, any app could be harmful without needing a browser exploit.
joev_ 12y ago
Out of curiosity, did you actually replace the Browser app, or did you just install a new one? If the stock Browser is still installed, you may consider the fact that it can probably be launched from Chrome with a specific URL intent.

lkbm 12y ago

Google hasn't pushed Lollipop out to all their own devices yet. I just talked to tech support yesterday, and was told if I wanted 5.01 on my brand new Nexus 5 (came from the Play Store two days ago and is on 4.4.4), I would have to figure out how to flash it myself. They would not help me with that at all. I can probably manage to flash it, but the typically phone user probably shouldn't be attempting that. "Just upgrade" is not a valid response when they refuse to push the upgrade to all users.