Hacker News Reader

Comment by AstixAndBelix | Hacker News Reader

Maybe I'm getting it wrong, but what's the problem in Google flagging this bug as "won't fix"? It's the third party driver that has a bug, not their software. Once the bug is fixed by the third party then automatically it will be fixed for Google.

Maybe the author has a stricter and more negative definition of "won't fix" so it sounded wrong to him?

View on HN

Even if they're not developing the code, it would be good for them to push the third party to get it fixed, given that the 3rd party is used in their product.

They have to keep the source closed since there is ground-breaking, unicorn rockstar code that bankrupt them of it is open sourced

> Once the bug is fixed by the third party then automatically it will be fixed for Google.

The article explains why this isn't a safe assumption and documents numerous cases where patches were not deployed to Android devices until well after the vulnerability was publicly disclosed. https://github.blog/2023-01-23-pwning-the-all-google-phone-w...

Thus is seems obvious to me that closing the bug as "won't fix" is the wrong response. The issue shouldn't be closed until the security patch makes its way into the Android Security Bulletin.

You're assuming that Google isn't keeping track of security bugs they forward to their vendors. Almost certainly they opened a ticket in a different system and tracked it there.

Im not assuming anything, Google has a track record to failing to incorporate patches in a timely manner. I don't see how closing a high priority security bug on their public tracker as "won't fix" helps them do better.

> but what's the problem in Google flagging this bug as "won't fix"?

You do not get to sell hardware as "100% google" AND shitcan a kernel bug. you only get to do one of those two, and you must pick and stick with it.

> You do not get to sell hardware as "100% google" AND shitcan a kernel bug.

Turns out you totally can.

And didn't have to pay a bug bounty. win win

> you only get to do one of those two, and you must pick and stick with it.

Wish that were true!

We all know not 100% of the hardware is made by google. If there was a problem with the touchscreen, fingerprint sensor or camera drivers we all would be aware it came from a third party.

The author knows full well the GPU is not actually made by Google, he is not an ignorant consumer being duped by marketing, so the label is actually 100% accurate for people in-the-know

GPU is not made by google, but kernel IS compiled by google, who can fix a kernel bug in said kernel

It's also Google's SOC.

It's their job to support their SOC and the GPU they chose to integrate onto it.

They should stop using proprietary drivers, with open source drivers they could at least fix it themselves.

how can they stop using proprietary drivers if they are still relying on third party partners? until google becomes like apple they won't have access to the drivers

Do the same as the Linux kernel community, don't allow proprietary drivers in Android. Linux doesn't allow proprietary drivers and now it has an open source driver for ARM Mali GPUs, Android should stop using the proprietary driver and use the open source driver. Whenever a vendor wants to have a proprietary driver, say no thanks, or reverse engineer the driver. A bunch of volunteers working part-time figured out how to make open source Apple M1 GPU drivers and Google has a ton of money so it could easily hire say 100-1000 people to reverse engineer proprietary drivers full-time and rewrite them from scratch.

Reply on news.ycombinator.com