Hacker News Reader

Comment by giovannibajo1 | Hacker News Reader

They would fix any doubt if they began releasing bugs and exploits for Android as well.

Better that they fix their own vulnerabilities than release them.

They do offer a bug bounty for their own products, to encourage third parties to do to them exactly what they're doing to Apple and Microsoft.

It's not like they sit around and say: "Oh, f*ck Android, let's find vulnerabilities in other operating systems." I suppose it's long since they have a team working on Android vulnerabilities, but it's not trivial fixing, deploying - not to mention finding the flaws.

When it comes to others they have total disregard as to how difficult to deploy any fix is. The same standard should apply to themselves, but clearly doesn't.

For a start, they could try to fix vulnerabilities in Jelly Bean's webview[1] and urge manufacturers and carriers to push updates to their phones, since 46% of the market is apparently still Jelly Bean[2]

Of course, it's an uphill battle with the manufacturers/carriers. But as long as Google is not applying fixes to Jelly Bean, the manufacturers can always blame Google.

[1] http://www.androidpolice.com/2015/01/23/google-issues-offici...

[2] https://developer.android.com/about/dashboards/index.html

The Android security lead has posted a statement on this issue, explaining what is and is not being done, and why: https://plus.google.com/u/0/+AdrianLudwig/posts/1md7ruEwBLF

Reply on news.ycombinator.com