Hacker News Reader

Comment by outside1234 | Hacker News Reader

Maybe we should give them a 90 day deadline to fix them.

Enforced how, on who, by whom? Google can say "They're fixed already, just upgrade to Android 5.0.1". Manufacturers and Carriers can say "Meh, we're still testing it". Enforcing such a rule requires holding a particular party responsible, and that party must have some authority to hold other involved parties responsible for doing their parts.

Probably the best thing that could be done overall is Google's already-complete plan to move the web browser, and as much other code as they can, to Play store apps that they can centrally auto-update. But getting that solution onto the vulnerable phones required them to, once again, just upgrade to the newest Android.

Google hasn't pushed Lollipop out to all their own devices yet. I just talked to tech support yesterday, and was told if I wanted 5.01 on my brand new Nexus 5 (came from the Play Store two days ago and is on 4.4.4), I would have to figure out how to flash it myself. They would not help me with that at all.

I can probably manage to flash it, but the typically phone user probably shouldn't be attempting that. "Just upgrade" is not a valid response when they refuse to push the upgrade to all users.

Agreed, placing all the blame on Google is not fair. Besides Google, carriers, and manufactures, there's one more party involved that no one seems to talk about, users. Google only promises to update their software for 18 months. If you're going to milk years and years out of your smartphone, don't you have some responsibly to update outdated apps with updated ones from the Google Play store?

I have an old Galaxy S3 that Samsung no longer updates, yet these bugs don't effect me because I've replaced the built in browser with Chrome, which still receives regular security updates. What's stopping users of old phones from installing Chrome or Firefox?

Some truth to that, but replacing your web browser doesn't actually fix the bug entirely. The problem is that the WebView elements inside applications still use the vulnerable Android Browser to display content. You can't change that behavior or update the Android Browser without an OTA update of the whole OS.

True, but you have to download the malicious app from the app store. Here Google has a good track record of removing them from their store. Also, the user can exercise some common sense by not installing apps from untrusted sources. If the users does not pay attention to the app's permissions, any app could be harmful without needing a browser exploit.

Out of curiosity, did you actually replace the Browser app, or did you just install a new one? If the stock Browser is still installed, you may consider the fact that it can probably be launched from Chrome with a specific URL intent.

If you can figure out a way to make phone manufacturers and mobile service providers care about any kind of deadline for updates, you'll be doing the world a great service.

You mean like the roughly 6M different variants that Windows runs on where Google has made the same demand? :)

OEMs don't customize windows. Google isn't actually capable of shoving proper OS updates to all android phones. It's the manufacturers and service providers that want you to throw out your phone every year and drag their feet on updating anything.

Do we really need to make all threads with any relation to Google about the whole "90 days vs. Patch Tuesday"?

Or what, you'll disclose them?

It sounds like that is what Google thinks is the right thing to do.

Note: I don't.

(Hint: They're already disclosed.)

Agreed. But it's disappointing that Google doesn't feel the same responsibility that they think Microsoft has.

I doubt the carriers would care. There have been a bunch of published exploits that haven't motivated them to push updates.

Reply on news.ycombinator.com