Hacker News Reader

Comment by pwthornton | Hacker News Reader

There is no technical reason that Android phones aren't up to date with patches. Apple is not doing something magical here. This is something that could be remedied if Google forced phone makers and carriers to support the latest patches ASAP.

iOS may be more security-focused in general than Android, but this article is centered on updates and un-patched phones. That part of the security equation is very solvable.

View on HN

One difference with security implications is that Apple makes both the hardware and the software. So the hardware is controlled by Apple and can authenticate the software, across the full stack, including the fingerprint sensor (this is why third parties who replaced the fingerprint sensor were running into problems awhile back.)

This ensures all software run on the phone is uncompromised. For android, the software is modified by the carrier, and while their intentions are likely good, their ability to integrate the security patches with their custom changes is open for debate (carriers are not the best software developers.) Further, there are more opportunities for compromising the software that is run- more surface area to attack, including installing malware in the supply chain.

Except the Windows world shows it isn't a technical hurdle either. Microsoft makes their OS, OEMs buy copies of it, and stuff bloatware and crap and change stuff all the same as Android vendors before selling it to consumers.

But then, despite modifications, Microsoft updates their stuff, including the kernel.

It doesn't actually even take hardware vendors being ethical and making open source mainline kernel drivers for their parts. They could just be shipping DKMS kernel modules instead of baking their trash into fixed kernel releases. But they simply do not, because they don't care.

You're missing the part where these Android OEM fork the OS, add all of their source code modifications, compile, link and the build it. Google cannot update an OS created by another OEM because unlike Microsoft, which provides these OEM's binaries of their OS, Google simply provides the source to Android.

Google already makes a bunch of requirements to access the Play Store services on their contracts with OEMS and carriers, requiring a certain level of updates to access those services is just another legal clause and validation when devices talk to Google servers.

> There is no technical reason that Android phones aren't up to date with patches.

That's true for the 1st world only. Where I currently live the most recent phone I can get within 1.5h of driving runs Android 4.

Also, Apple has a so much better security track record because they do not cater to the low-income population. Long term support is factored into the price of an iPhone but definitely not into the $20-thingy I can buy at every street corner everywhere in the world.

$20 ? What, Where ? i though $50-$60 was the low end of android phones.

How are you supposed to force companies using open source software to update it immediately?

Google already has requirements that if you don't install their Google apps and services, you can't get access to the latest versions of Android. They could simply withhold recent versions unless organizations meet these requirements.

There would be nothing stopping companies from using older versions of Android, however.

Legal actions and blocking access to those devices to Google servers.

I was under the impression that even Blacberry, who release security patches every month, are too slow though...

Except that they haven't solved it, and show no signs of nor have any financial motivation to solve it.

> show no signs of nor have any financial motivation to solve it

_You_ haven't seen signs ;) Project Treble was announced at Google I/O.

I remember hearing a bunch of initiatives and plans to keep Android phones up to date over the years[1]. They all quickly disappear and a year or two later there's some new plan. There has been signs, but financial motivation and followthrough is missing.

[1] http://www.androidpolice.com/2011/05/10/io-2011-android-alli...

That alliance sounds like just the motivation/PR part. Treble is the "remove the actual technical hurdle that made it hard" part.

There were many other "initiatives." I remember for the Alliance at the announcement they were very emphatic that it wasn't lip service, expect to hear more soon. 6 months later I saw and article pointing out how nothing seems to have happened since the announcement.

I saw and article from 2010 recognizing that phone updates weren't reaching customers and the initiative was to untether more apps and release them via the app store. They pointed to Google Maps as an example they were copying. I don't really pay attention enough to know if that was successful. That seems like a "lower hanging fruit" version of Treble.

This problem has been around since the very first handsets...almost 10 years ago. Both technical and working groups have been attempted. I'm skeptical things will change.

It will fail like the previous initiatives if not followed by legal requirements on the Play Services contracts or gated access to Google servers.

Reply on news.ycombinator.com