Hacker News Reader

Comment by Karunamon | Hacker News Reader

That covers roughly two-thirds of the billion-plus Android devices in use, according to Google

Wow. How is this even remotely acceptable? I get that they want to focus on the latest and greatest, but leaving 2/3 of your users out in the cold, in 2015's security climate is absolutely insane!

Nevermind the fact that upgrading is a non starter for most users.

View on HN

The problem is that Google can't force phone vendors to support old devices or carriers not to slack on allowing them. Suppose they did release a patch for 4.3 – how long would it take for the phone vendor to update their custom UI value-subtraction patches, package a release, test it, ship it to the carriers, who will do their own branding and testing, etc?

This only applies to old devices so the manufacturer sees it as pure cost unless many people get exploited so badly that they will never buy a new model again; similarly the phone carriers only consider this a problem if you leave your contract – and given that the most likely reaction is “Android sucks – I'm buying an iPhone” or “Verizon/AT&T/etc. sucks – I'm switching to the other one” they obviously haven't been feeling much pressure to change.

What we need is a legal fix to avoid them punting the costs onto customers: e.g. not shipping security updates within, say, two months requires the carrier has to unlock your phone and release any remaining contract without penalty. Unless it affects revenue, they're going to continue to treat support as a cost-minimization exercise.

Couldn't they have the Play Store and/or Google Play Services not work on unpatched devices? That would probably force carriers to update.

They actually do this on a lot of the oldest devices, but probably not for the same reasoning. I occasionally come across phones that are too old to support Google Play Services (<2.2 IIRC), so they're stuck on the Android Market, which no longer works.

It would seem that's not made OEMs/Carries feel the need to update them.

Are you sure? I think that the Android Market on 1.6 (ADP1) still works.

Perhaps the dev phone has a slightly different situation? I know someone with a 1st generation HTC Wildfire (formerly) for testing and when you the market throws a connection error and refuses to go any further. I've seen the same thing on other Android phones from that era.

I'd like to think so but it seems equally likely that carriers would either push you towards their own stores or tell you that you need to buy a new phone if the message was anything less aggressive than “There is a critical security available which must be installed before using the web. Please contact your carrier to ask for it”

You could argue Google have already fixed the bugs - in Android 4.4 and newer - and that it's the carrier and manufacturer's responsibility to issue those updates. In many cases even if Google issues a patch, carriers and manufacturers don't bother to issue an update for their own devices. So is Google really entirely to blame here?

It's a bit of a strange relationship:

The manufacturers can't insist that google support older versions with proper patch releases for bugs like this, because they aren't paying for it.

On the other hand, google really can't expect to drive the manufacturers test & release cycles. I expect that even a minor release is an expensive testing effort on their part, so they are understandably reluctant to do this off cycle.

I think this is the point of some of google's recent changes, but it's unclear how well that will work in practice.

As they say: you can't have your cake and eat it too.

If Google takes credit for those phones and stamps its logo of approval on the phone, they need to take the blame for the consequences.

Unfortunately, Android device manufacturers have no obligation to update their old devices. Many that only support 4.2 or 4.3 haven't even pushed out the latest updates with the security fixes to those versions.

This is one reason the latest Android releases don't have a 'Browser' app and have Chrome as the default (as they should). Granted, some manufacturers probably still have 'browser' because they want more control over their users.

From 5.0 forward, there is no "browser" that isn't chrome. The system webview is the chrome rendering engine and receives updates through the play store. If an OEM wants to ship their own browser to retain control, it's still chrome underneath, just with some custom UI.

(this was also true in 4.4, except that the 4.4 webview doesn't receive updates other than via a full system update)

Just to be clear, an OEM or google play app is still free to ship their own rendering engine, see firefox. But the builtin stuff on android is all chromium now.

in practice though, i don't think there's any OEM that uses a non-standard rendering engine, except for the forks like amazon's silk browser.

Correct me if I am wrong, but this seems to be a bug in the default browser, which was not updatable. Android now uses Chrome as its default browser, and it is automatically updated when you activate your terminal. Same thing for the new Chromium-based webview. The solution is to update the terminal to a new version of Android and yes this is not without issues.

Google really needs to figure out how to keep Android phones updated, preferably for 3 years, because I think that's how much most people keep their phones.

The biggest problem Google is facing regarding that is the fact that essentially every OEM creates its own "distro" of Android, which makes it very hard for Google to fix everything. Some of the bugs could be in software of those OEMs.

I think Google should build-in deeper customization frameworks that allows OEMs to customize the OS quite a lot, while still doing it in a "standardized way" that would allow Google to fix the problems.

In a way Google chose this. They could've done what they did with ChromeOS - make Chromium OS open source, but only promote Chrome OS, which is why all OEMs choose the proprietary Google version instead of the open source one. That's how Android should've worked as well. But they probably thought of this too late.

Google has figured out a way and are slowly deploying it...

When people talk about Android updates that can include several things:

- Launchers

- Apps (e.g. Camera, Browser, Calculator, and so on)

- Operating system components (services, drivers, etc)

- Linux kernel

A normal Android update has the ability to update all of the above. However most of the user-impacting and security impacting issues are at the "apps" level (since Android apps are largely isolated from the underlying OS via a Java-like VM).

So what Google have been doing is leaving the Kernel and OS components to the OEMs and providing app updates via the Play Store even onto older devices. So now on the Play Store we have:

- Chrome (replaces Browser)

- Google Services (updates a large chunk of APIs)

- Google Search (more APIs, Google Now, and so on)

- Google Voice (more APis, etc)

- Google Keyboard (built in keyboard)

- Gmail (will replace email eventually)

- Google Launcher

- Google Calendar

- Google Camera

- Google Talkback, Text-To-Speech (accessibility)

- Google+ (replaces SMS Messenger)

And so on...

Which is a really bad solution.

The proper solution would be to put the AOSP version on the store, but keep it open.

Also Google Play Frameworks should be split in the AOSP parts of their libs and the few actually closed parts.

Vendors often don't ship AOSP apps at all, they ship their own dialer, messenger, email client, camera, gallery and all the other apps. So AOSP apps in the app store would not update them anyway.

But would allow the user to install them.

It would have the same effect as the Google Apps in the store, without losing AOSP.

The thing about all these counterfactuals that people come up with for how Android should've been done is, if Google HAD done them, what would the market for smartphones looke like now? We don't know. It's possible (I think it's probably likely) that all the compromises and concessions Google made with the carriers and manufacturers are part of why Android has the market share it does. Google was playing catch-up with Apple, it's not like they had the luxury of time.

Maybe they are hoping they'll be able to force ISPs to release upgrades for phones, since that's what's stopping the upgrades, not unwillingness by the users.

I don't think that's a play that will work. Considering that with the basic apps, the buck stops with Google (they could push something out via the Play store), it's all on them for refusing to support.

Neither the old android browser nor the old webviews could be updated through the play store.

Could they in a modern phone? I thought that was part of the point of Google's slightly sneaky updates to "Google Play Services" -- that it allows them to do their own OTA updates sidestepping carriers.

(See e.g. http://arstechnica.com/gadgets/2013/09/balky-carriers-and-sl...)

The newest version of Android (Lollipop) can update the WebView now.

http://developer.android.com/about/versions/lollipop.html#We...

Not even Google Play Services can update binaries on /system partition. That's the manufacturer's playground, (often signed and checked at boot).

How do you push updates to webview through the play store?

I thought this was just about the browser, not the inbuilt web view functionality. My bad!

No worries, friend :)

From what I can tell, it doesn't affect Chrome, which is compatible with 4.3 devices. It's just a bug in the default browser, which they stopped working on a long time ago.

Isn't it a bug in the default browser and WebView, which affects every single application using WebView?

I guess web and app developers can start slowly by just blocking older versions of Android:

http://ruby-journal.com/how-to-block-old-ie-version-with-rai...

You're getting voted down, but this is quite true. Having ancient unpatched devices out there doing things is a menace to anything those devices share a network with.

It's in pretty much everyone's best interests to make those devices as non-functional as possible as fast as possible.

Reply on news.ycombinator.com