Hacker News Reader

Comment by ufmace | Hacker News Reader

As I remember it, most of these critical bugs are in the Android browser, which is considered a core part of the OS in those versions. The trouble with that is there's no way to update it without doing all the work of a whole OS update, including the usual mess of getting approval and merging changes from device manufacturers and local carriers.

It seems more understandable that way that Google told them to just upgrade to a newer Android version instead.

View on HN

No, this is and should be Google's problem. Carriers have no say expect in certain markets, and hardware manufacturers do what Google dictates. The requirements to carry Google Play is pretty steep, and there should be consequences for not following the agreements.

I bought a Nexus One, and one a half year later it was insecure with no updates. That can never be acceptable. If Debian can ship updates for a five year old distribution, I'm sure Google can. Android is slim by comparison.

How come it's a Google's problem if the browser in question is part of AOSP, and therefore could (and should) be updated as any other open source project. Google may be able to fix those bugs, but doesn't have to.

AOSP is not at all like most other open source projects. And even if the bugs would be fixed or backported to upstream AOSP, it's not going to magically be sent as an OTA update to customers.

This is a real issue and it's Google's platform, they should take action to not leave customers at peril or force them to buy a new device. Google is the only one who has the power to make sure that the updates get all the way to the customers' devices. This might mean exerting pressure on the device manufacturers and operators who make downstream changes to Android.

Otherwise we'll end up with millions of vulnerable devices that could be used (and are currently used) as zombies in botnets.

Fixing the bug is trivial, but getting the fix out to users is anything but. Google's original model for Android was to have as few restrictions on the manufacturers and carriers as possible. This arguably allowed them to gain a foothold in a market that was starting to be dominated by iPhone, but they're feeling the pain now as the try to lock Android down harder.

Google is moving as much stuff out of AOSP and into closed-source Google Apps package as possible for a variety of reasons, not least of which is that it gives them increased leverage over manufacturers by increasing the amount of work they'd have to do to make a forked AOSP device competitive with official Android. This helps them prevent hostile forks as well as enforcing things like updates and not too much mucking around with the UI. This only goes so far, especially when it comes to compelling updates of devices already running obsolete versions.

Both Google and the manufacturers have very little leverage in practice over the carriers, who seem to be the usual stopping block in delaying updates for various unspecified "testing" requirements.

But Google doesn't control push to the end users, it's phone manufacturers/cell service providers that do that. If it was a Chrome for Android, then yet, it's part of Google Play Services that is pushed independently. So, bottom line, there is no real need to use Android browser anymore, and IIRC it's not even included to the Lollipop release.

Regarding the Nexus one that's surprising and disappointing. I was under the impression that the Nexus line used vanilla android (no device manufacturer or service provider customizations) and would be update-able as long as the hardware could handle the new OS.

Samsung Galaxy Nexus (GT-I9250) has Google's logo on it was the first such example. It shipped with Android 4.0 and the last version supported is 4.3, 20 months of software updates.

Maybe we should give them a 90 day deadline to fix them.

Or what, you'll disclose them?

It sounds like that is what Google thinks is the right thing to do.

Note: I don't.

(Hint: They're already disclosed.)

Agreed. But it's disappointing that Google doesn't feel the same responsibility that they think Microsoft has.

I doubt the carriers would care. There have been a bunch of published exploits that haven't motivated them to push updates.

If you can figure out a way to make phone manufacturers and mobile service providers care about any kind of deadline for updates, you'll be doing the world a great service.

You mean like the roughly 6M different variants that Windows runs on where Google has made the same demand? :)

OEMs don't customize windows. Google isn't actually capable of shoving proper OS updates to all android phones. It's the manufacturers and service providers that want you to throw out your phone every year and drag their feet on updating anything.

Do we really need to make all threads with any relation to Google about the whole "90 days vs. Patch Tuesday"?

Enforced how, on who, by whom? Google can say "They're fixed already, just upgrade to Android 5.0.1". Manufacturers and Carriers can say "Meh, we're still testing it". Enforcing such a rule requires holding a particular party responsible, and that party must have some authority to hold other involved parties responsible for doing their parts.

Probably the best thing that could be done overall is Google's already-complete plan to move the web browser, and as much other code as they can, to Play store apps that they can centrally auto-update. But getting that solution onto the vulnerable phones required them to, once again, just upgrade to the newest Android.

Agreed, placing all the blame on Google is not fair. Besides Google, carriers, and manufactures, there's one more party involved that no one seems to talk about, users. Google only promises to update their software for 18 months. If you're going to milk years and years out of your smartphone, don't you have some responsibly to update outdated apps with updated ones from the Google Play store?

I have an old Galaxy S3 that Samsung no longer updates, yet these bugs don't effect me because I've replaced the built in browser with Chrome, which still receives regular security updates. What's stopping users of old phones from installing Chrome or Firefox?

Some truth to that, but replacing your web browser doesn't actually fix the bug entirely. The problem is that the WebView elements inside applications still use the vulnerable Android Browser to display content. You can't change that behavior or update the Android Browser without an OTA update of the whole OS.

True, but you have to download the malicious app from the app store. Here Google has a good track record of removing them from their store. Also, the user can exercise some common sense by not installing apps from untrusted sources. If the users does not pay attention to the app's permissions, any app could be harmful without needing a browser exploit.

Out of curiosity, did you actually replace the Browser app, or did you just install a new one? If the stock Browser is still installed, you may consider the fact that it can probably be launched from Chrome with a specific URL intent.

Google hasn't pushed Lollipop out to all their own devices yet. I just talked to tech support yesterday, and was told if I wanted 5.01 on my brand new Nexus 5 (came from the Play Store two days ago and is on 4.4.4), I would have to figure out how to flash it myself. They would not help me with that at all.

I can probably manage to flash it, but the typically phone user probably shouldn't be attempting that. "Just upgrade" is not a valid response when they refuse to push the upgrade to all users.

Reply on news.ycombinator.com