Hacker News Reader

Comment by mdaniel | Hacker News Reader

Is it my imagination or is 5 months a very short disclosure window for a vulnerability that affects Androids since Donut?

I think about how manufacturers drag their feet on normal updates and can't imagine what heaven and earth movement would be required to patch this industry wide.

Then again, maybe the attack surface for this is small enough that it's manageable.

View on HN

Google set the time frame and gave the go ahead for public disclosure based on their work with the manufactures.

>I think about how manufacturers drag their feet on normal updates

They do release security updates. (Or at least used to -- I haven't paid attention lately.)

The major upgrades change and break lots of shit for them. A backported security update generally does not.

Not really. Three months is common.

Well he's got to create some publicity for the Blackhat presentation. Though I only bought it in March, I know my android phone has downloaded several system updates since then. It isn't clear to me from TFA precisely how the signature validation process was broken, and I'm not familiar enough with Android architecture to be sure this is possible, but it seems like the validation for un-hacked devices should have been fixed by now.

I think Google itself sets a higher bar than even 5 or 3 months for other companies and itself.

http://www.darkreading.com/vulnerability/google-sets-new-agg...

Those are for bugs that are "under attack", where it's important that those being attacked have the information necessary. There's no evidence that this is being exploited in the wild (at this point).

"Under attack" allows people to distort reality as much as they want for their own benefit. Google sure looked like a tough cookie by disclosing bugs in 7 days and now it gets a pass.

Reply on news.ycombinator.com