Google Explains Why WebView Vulnerability Will Go Unpatched On Android 4.3

MojoKid writes If you're running Android 4.3 or earlier, you're pretty much out of luck when it comes to a baked-in defense against a WebView vulnerability that was discovered earlier this month by security analyst Tod Beardsley. The vulnerability leaves millions of users open to attack from hackers that choose to exploit the security hole. WebView is a core component of the Android operating system that renders web pages. The good news is that the version of WebView included in Android 4.4 KitKat and Android 5.0 Lollipop is based on Chromium and is not affected by the vulnerability. The bad news is that those running Android 4.3 and earlier are wide open, which means that 60 percent of Android users (or nearly one billion customers) are affected. What's most interesting is that Google has no trouble tossing grenades at the feet of Microsoft and Apple courtesy of its Project Zero program, but doesn't seem to have the resources to fix a vulnerability that affects a substantial portion of the Android user base.

Comments

The solution is obvious

[BVis]

Clearly Google has decided that the solution for this problem is to update Android. This is not an unreasonable solution. The problem is fixed, and how you get the fix is well documented.

The problem is when your carrier prevents you from upgrading. Blame for this issue lies soley at the feet of Verizon, At&T, Sprint, T-Mobile, etc.

Re:The solution is obvious

[Mr D from 63]

They also state that the vulnerability can be easily avoided just by using an updated browser.

Re:The solution is obvious

[alen]

how is apple able to upgrade their phones for like 5 years and Scamsung, LG and HTC cannot?

Re:The solution is obvious

[Anonymous Coward]

By being control-freak monopolists.

Re:The solution is obvious

[Anonymous Coward]

No, blame for this is on Google, because Android is designed as a firmware but marketed as an operating system. An operating system would get updates without requiring a complete wipe and reinstallation. Android has a huge attack surface and still completely lacks ways to fix bugs except by abandoning entire "OS" versions.

Re:The solution is obvious

[rot26]

My widely distributed product has been discovered to have a serious security flaw affecting millions of users. I have fixed this but it requires you to get your congressman to fetch it for you and have his staff install it. It's not MY fault if you can't convince your congressman to do this, it's HIS fault, and if you suffer, that's just too bad. Take it up at the voting booth.

Re:The solution is obvious

[Anonymous Coward]

That's fucking comical. Google knows very well what the situation with the carriers and OEMs is, they are just as culpable in this mess. If Microsoft or Apple pulled some shit like this the tech blog sphere would implode from the density of the rage. All is forgiven for Glorious Google-sama however!

Re:The solution is obvious

[GoJays]

Exactly. I wouldn't blame Google for this, the problem lies with the carriers not upgrading their fleet of phones. Android is now 3 major version releases past 4.3. Would you really expect Microsoft to continue to support Windows XP anymore? They don't, unless business is willing to shell out big bucks for added support.

Carriers should really be to blame.

Re:The solution is obvious

[soft_guy]

Apple tries to control as much as they can on their platforms. Other platforms like Android and Windows take an approach of sharing responsibility for the overall quality between several different companies who can each point at each other and say "not it!" when a problem arrises.

Re:The solution is obvious

[Noah Haders]

the problem is when a phone OS manufacturer constantly cuts corners to deploy fast and ends up in a pickle like this. google is the one who made up the "carriers won't upgrade" system.

Re:The solution is obvious

[Anonymous Coward]

The webview control is also used internally by many apps, so you can't really avoid it. Google is pulling an "XP" here, except they're abandoning software that hasn't even been in the market for two full years.

Re:The solution is obvious

[Black.Shuck]

how is apple able to upgrade their phones for like 5 years and Scamsung, LG and HTC cannot?

Apple is comparatively disciplined, releasing about one new phone a year, and hardware and software are under their full control.

Together, the others release dozens, and different companies share different responsibilities. Nice for consumer choice, but not so nice for support, since nobody wants to maintain a software stack nor wrestle with the politics involved in updating so many different devices.

Re:The solution is obvious

[jgtg32a]

Android 4.3 was released July 24, 2013

Re:The solution is obvious

[fateblossom]

It's not just carriers. It's also manufacturers. I Europe it's common to buy phones off contract but they are not upgraded either.

So the manufactures are also to blame. And I offend think that it's the manufactures fault. And not the carrier. For why else would they not make the updates for the rest of the world?

Re:The solution is obvious

[BVis]

google is the one who made up the "carriers won't upgrade" system.

How do you figure?

Re:The solution is obvious

[Anonymous Coward]

You should do a little reading about monopolies before posting, maybe then you wouldn't make such a fool of yourself. Many negative things could be said about Apple, but monopolist is not one of them.

Re:The solution is obvious

[Lazere]

I disagree. Microsoft not supporting XP and Google not supporting 4.3 are two completely different things. 4.3, despite being two major versions ago was released less than two years ago. If Microsoft or Apple stopped supporting an OS version after less than two years, there would hell to pay. Why does Google get a pass just because they have a fast versioning scheme?

Re:The solution is obvious

[mdielmann]

Exactly. I wouldn't blame Google for this, the problem lies with the carriers not upgrading their fleet of phones. Android is now 3 major version releases past 4.3. Would you really expect Microsoft to continue to support Windows XP anymore? They don't, unless business is willing to shell out big bucks for added support.

Carriers should really be to blame.

Two key differences. First, XP came out in 2001. Second, XP support ended last year. But to be fair, I'd be happy if Google would support their OS for even half that long. So, where is that support for Android 1.1?

Realistically, support should last at least as long as the longest contract in the countries their product is used in. If you went with the standard of a 3-year contract (I think there are 4-year contracts, but I'm certain my carrier has 3-year contracts), that would still leave the later releases of Ice Cream Sandwich (4.0) under support. Face it, their Android OS support is abysmal.

Re:The solution is obvious

[Munchr]

No, the carriers made up this system, and it existed long before Android entered the market. Symbian OS, Windows Phone, and Android are all affected. Apple managed to get AT&T to agree to allow Apple to control when and how updates to the iPhone are provided as part of the initial AT&T exclusive partnership agreement for the original iPhone. Every carrier since AT&T has had to agree to the same provision regarding Apple's control, or they don't get the iPhone. I'm not aware of ANY other phone manufacturer that has managed that feat before or since, without being forced to sell their phones directly to the public as carrier free/unlocked phones as Nokia did with the n900.

Re:The solution is obvious

[Noah Haders]

Google created the rules of the AOSP and the OHA. they could have set a rule about phone upgrades, but decided they would get faster market share growth if they let that one slide. now they are paying the price. actually, the users are paying the price, google still has its market share so they feel good about it.

Re:The solution is obvious

[Asmodae]

It sounds like you've entered full snark mode here. To make the analogy complete you must include the fact that congress passed a law making them the only ones able to push out an update. It's been said before, even if Google did write a patch how do you propose they actually get it onto the vulnerable devices?

Re:The solution is obvious

[prelelat]

It's a bit different though isn't? Updating versions on your phone is more like upgrading to the newest service pack instead of buying a new OS. The OS is available for anyone to grab free of charge, updated patched and new features even. Free of charge.

That's not the same as letting support of XP die and quite frankly I had no problem with it in the first place. That OS is decades old now and the people bitching about security holes were most likely using it for custom software that was probably just as buggy as the OS at that point. I know first hand it can be hard to get custom software companies to update their software but it's not Microsofts fault either.

If the people who take Android and put it on phones are unwilling to release updates for it, that's the vendors fault. They take Android and fork it to suite them, then don't bother updating it when a new version comes out. That's how open source software works when you think about it. The main distro is out there free for the taking. Vendors take it and fork it how they see fit, it no longer is the main channels responsibility.

If we have a problem with this, we are really talking about having a problem with opensource software. Then we can discuss the other issue which is when do we can support on outdated versions?

Re:The solution is obvious

[Anonymous Coward]

Why the fuck should a god damn carrier who doesn't even make the fucking software be responsible for updating the OS an a phone they didn't manufacture? What were the faggots at Google thinking?

Re:The solution is obvious

[Anonymous Coward]

By not allowing the carriers to customize the build that they put on the phones, and therefore being able to run the update server themselves, instead of requiring the carriers to do it.

Re:The solution is obvious

[LWATCDR]

Exactly.
And this part is just flamebait.
"What's most interesting is that Google has no trouble tossing grenades at the feet of Microsoft and Apple courtesy of its Project Zero program, but doesn't seem to have the resources to fix a vulnerability that affects a substantial portion of the Android user base."
Does Google release bugs for Windows XP and Me under Project Zero?
Really the issue are the manufactures and the carriers.

Re:The solution is obvious

[Anonymous Coward]

No, it's your hardware provider that is your problem, not Google.

The "updates" are FREE, there's zero reason not to be on the current release.

They aren't pulling an XP here, they evolve, release constantly, each new release the same price - FREE.

Contact your hardware provider and bitch to them, not Google.

Re:The solution is obvious

[BVis]

They're not "responsible" for updating the OS on their customers' phones. The customer can update the OS... IF the carrier will let them. OS changes are locked out on most under-contract Android phones.

Re:The solution is obvious

[Tablizer]

how is apple able to upgrade their phones for like 5 years and Scamsung, LG and HTC cannot?

Perhaps you really do get what you pay for.

Re:The solution is obvious

[gstoddart]

Apple abandoned the original iPad in under 2.5 years.

It's not like they don't do it either.

Companies expect you to buy the new hotness all the time, and stop expending resources on older platforms.

Because, after all, they only give a shit about you for as long as it takes to get your money. And then you're just someone who doesn't matter to them.

Re:The solution is obvious

[BVis]

So because Google didn't specifically forbid something, and the carriers went ahead and did it not because it was a good idea, but because fuck the customer, that's Google's fault? If I don't specifically tell someone to look both ways before crossing the street, is it my fault when they don't and get hit by a bus?

The carriers are the bad actors here. Google had a bug in their product, and they have fixed it. The carriers are the ones not allowing their customers to install the fixed version.

Re:The solution is obvious

[rickb928]

The timeframes for Android are not of the same scale as those for Windows. Don't confuse them and then complain.

Re:The solution is obvious

[maorb]

No, blame for this is on Google, because Android is designed as a firmware but marketed as an operating system.

Darn it, I feel a bit pedantic saying this but...
...No matter how I look at it, Android is definitely an operating system, not a firmware (especially as it doesn't reside in any sort of ROM, you just don't have write permissions as the end-user). It happens to be most commonly updated all at once, rather than in bits and pieces like Windows or OS X, but it is not in anyway necessary for an OS to provide a streamlined update mechanism to perform the function of an OS.

Then again, everyone refers to anything that gets updated in this manner as firmware even when it's not so maybe us techies will just have to start accepting that the meaning of the word is changing.

Re:The solution is obvious

[BVis]

The difference is, unlocked/no-contract phones can have their OS upgraded. Under-contract phones in the USA can only be upgraded if the carrier allows it.

So in Europe it's possible, and in the USA it is not.

Re:The solution is obvious

[Noah Haders]

ok, so why didn't google do things the way apple did them? the precedent was already set. I'll tell you why - they wanted market share, not a good (and safe) user experience. For google, users are the product.

Re:The solution is obvious

[dumfrac]

The *Google* Galaxy Nexus was created by... wait for it... GOOGLE. It runs stock Android. _Google_ has certainly NOT fixed their product.

Re:The solution is obvious

[Noah Haders]

then why would google let someone into the OHA if they're not willing to patch critical vulnerabilities in their phones? If I were in charge and I cared about the customers I would throw somebody out of the OHA for that nonsense.

Re:The solution is obvious

[oodaloop]

Why would they bother to fix it if the carriers aren't going to deploy the fix? Again, this isn't on Google, but on the carriers.

Re:The solution is obvious

[the_B0fh]

Why wouldn't you blame Google for this? Google explicitly said they are not updating the code. Since the carriers depend on Google to provide the code, how are they not culpable?

And the "oh, 5 million lines of code, I don't know where to look" is damned weak sauce. Debian back ports security patches all the time.

Re:The solution is obvious

[rickb928]

Apple has total control of the hardware platforms they support. Google does not have control over the hardware platforms they support.

This is neither new nor particularly complicated, but Apple fans seem to think it's not that hard to support 6-15 different manufacturers, each releasing new phones quarterly if not more often, and building the software from the supplied image, handing that image to the carriers, who them build their image with the changes they want. And then doing so for updates as the manufacturers AND the carriers wish. For instance, T-Mobile may add Wi-Fi calling and HotSpot, where AT&T may not.

Apple users of course also complain that their 2-3 year old phones perform badly with new software, which is likely due to the increased functionality and demands made... But that's their problem.

Re:The solution is obvious

[TechyImmigrant]

Software : In Ram
Firmware : In Rom, EPROM, EEPROM, FLASH ROM, Bubble memory, Phase change memory or something you built with Lego.

Re:The solution is obvious

[BVis]

If there's a problem with an old (10+ years) version of something, and the solution the vendor makes available is to upgrade to the newer version (as you've had 10 years to do so), I fail to see how that's unfair. Blaming Microsoft for that situation IS unfair. They made a perfectly viable solution available; if you don't like it, go to the competition. Oh, wait... you bought Microsoft, so you're completely locked-in. Ha ha.

Organizations that refuse to upgrade from XP can pay a great deal of money for support. Money that would be better spent upgrading their systems and patching their business apps to work with a version from this decade.

Re:The solution is obvious

[the_B0fh]

No. They have not fixed it. They are refusing to provide a patch.

No, going to a new version of Android is not a patch.

Re:The solution is obvious

[Karlt1]

The problem is when your carrier prevents you from upgrading. Blame for this issue lies soley at the feet of Verizon, At&T, Sprint, T-Mobile, etc.

Strange, my carrier has never stopped me from updating my iPhone.....

Re:The solution is obvious

[TechyImmigrant]

Google aren't manufacturing and selling the phones to the carriers. The manufacturer is.

The phone that Google manufacture are generally updated in a timely fashion.

Re:The solution is obvious

[LordLimecat]

And the "oh, 5 million lines of code, I don't know where to look" is damned weak sauce. Debian back ports security patches all the time.

Debian isnt changing huge parts of the codebase all at once and calling it a security fix.

Re:The solution is obvious

[gmhowell]

So a customer 'bought' a busted phone. Not getting updates is one of the downsides. Buy unlocked or from a different carrier.

Re:The solution is obvious

[Karlt1]

Apple abandoned the original iPad in under 2.5 years.

But on the other hand, Apple released a security patch for the iPhone 3GS - released in 2009 -- last February.

The iPad 2 released mid-2011 can still run the latest OS.

Re:The solution is obvious

[Anonymous Coward]

Except that the hardware requirements for Android have advanced for each new release. Specifically, phones with 512MB of RAM or less cannot be upgraded to Jelly Bean.

Re:The solution is obvious

[WaffleMonster]

Clearly Google has decided that the solution for this problem is to update Android. This is not an unreasonable solution. The problem is fixed, and how you get the fix is well documented.

The problem is when your carrier prevents you from upgrading. Blame for this issue lies soley at the feet of Verizon, At&T, Sprint, T-Mobile, etc.

While mobile carriers and more importantly mobile vendors who unsurprisingly refuse to support their one-off creations are assholes iPhone and WP8 users don't have this problem. When Apple releases an iPhone patch it gets distributed.

Re:The solution is obvious

[Geordish]

No, blame for this is on Google, because Android is designed as a firmware but marketed as an operating system. An operating system would get updates without requiring a complete wipe and reinstallation.

My current phone has got updates from Kit Kat to Lollipop without a wipe and reinstallation. As have all my previous android phones from one version to another. I'm unsure what you are getting at here...

Android has a huge attack surface and still completely lacks ways to fix bugs except by abandoning entire "OS" versions.

Not true. Google has a way to patch parts of the operating system on older versions using play services:

http://arstechnica.com/gadgets...

Re:The solution is obvious

[fateblossom]

And yet there is no update.
If it was only the carriers fault then there would be upgrades for the phone that was not carrier locked.
that is why I say that the manufactures are also to blame. And most of the time only them.

If the manufactures made upgrades and released then to all the phones that were unlocked at carriers that would allow a upgrade. Then the carriers that would not allow upgrades would get angry customers. And a chance to loss them if they had a choice to pick someone that would allow upgrades/updates.

Re:The solution is obvious

[Karlt1]

I'm not aware of ANY other phone manufacturer that has managed that feat before or since

Windows Phones can be updated without the carriers permissions.

Re:The solution is obvious

[BVis]

You could shorten that to "Buy unlocked". I am not aware of any major carrier in the USA that does not lock down their Android phones. There is no incentive to fix bad behavior when everyone else is doing it as well. See: car sales.

Re:The solution is obvious

[Munchr]

Google didn't have the market clout that Apple did to force the carriers into the agreement. Remember, Apple had to "shop around" for a carrier that would agree to the financial and control terms for the iPhone. Verizon famously turned down the offer for exclusivity, AT&T did not. At the time, with the popularity of the iPod, one would think that an iPod phone would print it's own money and that all the carrier's would be scrambling to jump to Apple's whim. As we saw though, only AT&T saw the potential, and everyone else was left playing catch-up.

Re:The solution is obvious

[Anonymous Coward]

don't forget the OEM/ODMs either as they are the ones who ORIGINATE the OS updates. Verizon et. al. theoretically just test them before approving them.

This is not an unreasonable solution, and perhaps it will light a fire under said OEM/ODMs and the various carriers to get with the program, although Google has already taken large chunks out to be upgradeable by them on a per program/service basis.

Re:The solution is obvious

[Anonymous Coward]

Totally agree, same could be said for Apple. Just imagine if they stopped supporting a OS version 2 years into its life? For me Google head has swollen so big it has this inability to accept that by its own allowance of this kind of splintered OS releases. It has created this problem. Cellular carries may be a road block to upgrades as well as phone makers. But apparently Google is OK with it.

Re:The solution is obvious

[Karlt1]

To make the analogy complete you must include the fact that congress passed a law making them the only ones able to push out an update

Really Congress passed a law not allowing phone manufacturers the right to update their phone? Has Apple been breaking the law for over 7 years?

Re:The solution is obvious

[BVis]

Does the carrier allow you to upgrade to the fixed version? If the answer isn't "yes", then it's not Google's responsibility, as they have done their part by fixing the problem.

Re:The solution is obvious

[CastrTroy]

Isn't this basically what Microsoft does with Windows, or what Linux does. One code base that runs on all kinds of machines. And we still expect them to get vulnerabilities fixed. I could understand if it was a bug with some kind of driver that communicated with the cellular radio or other piece of hardware. Then it would be up to the manufacturer or carrier to fix the bug. But this is a bug in something that has nothing to do with the hardware that it is running on. There should be a more reliable way for bugs to get fixed on Android without going through multiple entities, some of which would just rather you buy new hardware. Imagine if you had to go through Dell, HP, or Acer every time you needed something fixed in Windows. It would be a disaster. But that's exactly what the state of affairs is with Android. I'm due for a new phone soon. I can't afford an iPhone, and my previous phone was Android, but I seriously got burned on updates. I've been considering Windows Phone, but their app selection is quite poor. I find that the current state of affairs with phone operating systems to be quite terrible.

Re:The solution is obvious

[bondsbw]

2.5 years is pretty good compared with many Android devices. My wife and I have owned 4 Android devices between us, and none of them received updates even 2 years after their initial release date.

Also I suspect you picked on the first iPad because it was the worst. I can't recall any mainstream Apple product that was supported for less time. Many of them are supported for 4 years or more.

Re:The solution is obvious

[BVis]

Perhaps, but it DOES fix the problem. Don't like it? Go buy a different phone. Yes, it sucks if you can't upgrade. But the chances are that even if there WERE a patch that didn't require a whole new version, your carrier wouldn't let you install it anyway.

Re:The solution is obvious

[CODiNE]

Until Google figures out a way to get around carriers on this...

It seems that Android is destined to always have a majority of it's devices vulnerable to known exploits. Even Google Play Services hasn't been a solution for this.

Re:The solution is obvious

[Munchr]

Microsoft does NOT control their own update process for Windows phone. Updates are delayed by each carrier for "testing" before being released. You can visit Windows Phone Availability to see which carriers phones have been updated to the latest version, Denim. As it stands, only 1 carrier has issued the Denim update, and only to 2 phones. If you don't have one of those 2 phones from that specific carrier in the US, you can only obtain the Denim update by signing up as a developer. Of course, by doing so, you acknowledge that your carrier no longer has to support your phone since you are no longer running carrier approved firmware.

Re:The solution is obvious

[BVis]

Because the carriers signed a deal saying they wouldn't prevent Apple from controlling OS upgrades. The Android folks didn't require that. So, since a big for-profit corporation will do anything that it CAN do unless you tell them specifically not to, especially when it fucks its paying customers over, we get what we have here.

Re:The solution is obvious

[Anonymous Coward]

Yeah sure. Just like the solution for Windows XP is to upgrade to Windows 8.1.

This is bullshit. Android is a few years old and Windows XP is 15 years old. Double standards Google, you are a disappointment and Microsoft is making you look bad.

Re:The solution is obvious

[dinfinity]

Yeah, that can't be right.
A WebView can be used in pretty much any app. It may or may not be vulnerable, depending on whether certain features of the WebView are used, but a WebView has the potential to be the core of a complete (vulnerable) browser in any app.

More info on this matter here: https://community.rapid7.com/c...

My guess (or hope, maybe) is that Google is responding the way they are to strongarm the handset manufacturers into (allowing) properly updating Android on their older products. A sort of 'this shit has been going on long enough: take some fucking responsibility for your products'. Either that or they really see no realistic way to fix this.

Re:The solution is obvious

[rickb928]

" An operating system would get updates without requiring a complete wipe and reinstallation."

Maybe in your dreams, but that is not a required feature of an OS. Merely a very desirable and perhaps expected one.

Of course, the distinction between 'firmware;' and 'OS' is interesting.

Re:The solution is obvious

[bondsbw]

It would be a major improvement if Android products were supported for even 2 year contract periods.

Google should require manufacturers to provide all Android updates for 2 years minimum and 2 minor versions minimum, and security updates for those minor versions for 4 years minimum.

Re:The solution is obvious

[dumfrac]

How is the fucking carrier involved? Google is the manufacturer of this phone (the phone was bough directly from Google though the Google Play Store). The phone has stock Android installed. OS updates come *directly* from Google. The carrier isn't involved in this process at all.

Re:The solution is obvious

[gstoddart]

Also I suspect you picked on the first iPad because it was the worst.

No, I picked on it because I owned one.

My trust level for Apple has dropped significantly since then ... I'm not spending that kind of money on something which they'll abandon soon thereafter.

In fact, it has reaffirmed my belief you should never be the one to buy a first gen of any product, unless you're willing to lose the money on that.

Re:The solution is obvious

[gnupun]

No, it's your hardware provider that is your problem, not Google.

Do you update your Windows/Linux/OSX PC/laptop from the OS vendor or the company that sold you the hardware? It's almost always the OS vendor. A PC/laptop is very similar to a smartphone except the latter is smaller. Google's model of pushing updates through the hardware vendor utterly stupid and adds an extra unnecessary middleman to the process.

Contact your hardware provider and bitch to them, not Google.

Why can't google's patch fix the issue? Is there a different kernel for each android phone so that different patches are needed for each phone?

Re:The solution is obvious

[Cardcaptor_RLH85]

Dumfrac's noting the fact that the Galaxy Nexus is a directly supported Google device that is stuck on 4.3 because Texas Instruments stopped supporting its CPU hardware when they got out of the CPU manufacturing business. Since Google directly pushes the updates for Nexus devices, there's no manufacturer or carrier interference to speak of. However, my Galaxy Nexus is running 4.4 since I installed a ROM of it months ago.

Re:The solution is obvious

[Anonymous Coward]

Microsoft still does support XP - its just not free anymore. They want you to pay a yearly maintenance fee - not at all unlike how RedHat and Oracle make money on their OS's.

Re:The solution is obvious

[Dixie_Flatline]

Apple released a security patch for iOS 6 when that SSL vulnerability was found. It was a deprecated OS running on a MINORITY of Apple phones and they issued an update anyway. (http://support.apple.com/en-ca/HT202920)

Why are so many people excited to give Google a pass over this? Support your customers or don't, but be up front about how long they're going to get to see updates. If you're going to drop security support after 18 months, at least let everyone know so they can make an informed decision.

Re:The solution is obvious

[turning in circles]

My phone (Z998) is running Android 4.1.2 through AT&T and there is no option to upgrade to the fixed version. I am switching to Chrome and Firefox for use as web browsers but otherwise looks like I'm stuck.

Re:The solution is obvious

[KlomDark]

But 512 megs should be enough for ANYBODY...

Re:The solution is obvious

[Anonymous Coward]

Google has stopped patching Android 4.3 and lower. Instead they want you to upgrade the OS, and they don't give a rat's ass whether that is actually possible. How is that not worse than pulling an XP, considering that Android 4.3 was the latest version just seven months ago?

Re:The solution is obvious

[Cardcaptor_RLH85]

You do know why the Galaxy Nexus isn't being supported anymore right? It has a TI OMAP processor and TI decided to stop supporting their CPU's when they stopped manufacturing them. Me (and the toroplus I'm using to listen to music right now) don't really like it much but, without support from the processor manufacturer to optimize drivers you can end up with a suboptimal experience. I'm using a 4.4 ROM right now and it's just not as fast as the last 4.3 update.

Re:The solution is obvious

[mrbester]

Six of one, half a dozen of the other. As slow as carriers are to roll out updates (and sometimes never, but at least the end user gets told that), if Google doesn't provide it in the first place they aren't going to do it themselves.

Re:The solution is obvious

[TsuruchiBrian]

Except that google isn't charging for their new software. They aren't abandoning android. They are actively improving it and not charging people to upgrade to the new version. This is totally different from microsoft refusing to fix XP bugs, given that upgrading is purchasing a new product.

The new version of android *is* the patch.

Re:The solution is obvious

[KlomDark]

So it's an OS in firmware, that doesn't handwave away the problem.

Re:The solution is obvious

[c]

Why does Google get a pass just because they have a fast versioning scheme?

Largely because everyone with a clue knows that 99.999% of devices still running Android 4.3.x which haven't been upgraded to 4.4.x have approximately 0.00000 probability of being updated to 4.3.(x+1) even if Google were to make a patch available.

Whether they "support" 4.3 for two days, two years or two decades at this point is largely irrelevant. If you have no means to get a patch to the people affected by the problem and you're going to get criticized irrespective of whether or not you try, then why waste the resources?

And it's pretty darn obvious from what Google's been doing in the last few years that this is not a situation that Google is happy with, nor is it a situation they could reasonably do much more about.

Re:The solution is obvious

[bondsbw]

Ok, well after that I can understand your hesitancy to get Apple products in the future.

But do realize, that was an outlier and is atypical of what Apple does. I doubt you would see that from them again. Whereas their primary competitor has such an abysmal record that 2.5 years would also be considered an outlier (just in the opposite way).

Re:The solution is obvious

[Tran]

Well, unlike the wireless phone companies, there where no vendors for the PCs that insist on putting their hands on the OS to customize the Android experience (mostly to detrimental effect, in my experience). So yes, Verizon, T-Mobile are on the hook for this one.

My plain vanilla Nexus 4 is still running fine with the latest and greatest, well latest, OS from Google. It is just staring to take some performance hits as compared to when it first came out.

Re:The solution is obvious

[TsuruchiBrian]

This is a bad example. You don't get all your drivers from the OS vendor. Google publishes the OS images to the public. The problem is that you can't use them if your hardware vendor has not yet made their drivers compatible with the new version of the OS.

Microsoft doesn't package every driver from every hardware vendor with it's OS. IF your hardware vendor doesn't provide a driver for Windows then that's not Microsoft's fault.

Furthermore, if you really want updates ASAP, you can get a Nexus phone and be the first to receive them directly from Google.

Re:The solution is obvious

[Noah Haders]

lolwut? apple had clout when it had not released a single phone and nobody understood its potential or how popular it would be? ummno. I think google had clout when ATT had the iphone exclusive and the other carriers were aching to get a good smartphone they could compete with. and google had a precedent of how apple set up their agreement with ATT.

Re:The solution is obvious

[TsuruchiBrian]

No. Google allows you more options. You can buy a phone directly from Google (and have them be the only company bearing responsibility), or you can buy a phone from anyone else making android products. The availability of more options should not be confused with being forced to exercise those options.

Re:The solution is obvious

[TsuruchiBrian]

Yeah, you should get a windows phone..... (snickering)

Re:The solution is obvious

[tlhIngan]

Together, the others release dozens, and different companies share different responsibilities. Nice for consumer choice, but not so nice for support, since nobody wants to maintain a software stack nor wrestle with the politics involved in updating so many different devices.

You're off by an order of magnitude.

Samsung, in 2014, released about 3 smartphones per week. Yes, they have over 150 smartphones released in 2014. Tablet wise, I think it was over 1 tablet a week (it was over 50 around October).

It seems a lot of Android manufacturers see Android more as a "fire and forget" style of releases - just get a version of Android, stick it on, sell it, move on.

I mean, supporting 200 brand new Android devices (ignoring 2013 releases and prior) ...

Re:The solution is obvious

[Christian Smith]

No, it's your hardware provider that is your problem, not Google.

Do you update your Windows/Linux/OSX PC/laptop from the OS vendor or the company that sold you the hardware? It's almost always the OS vendor. A PC/laptop is very similar to a smartphone except the latter is smaller. Google's model of pushing updates through the hardware vendor utterly stupid and adds an extra unnecessary middleman to the process.

Not the same issue. PCs are standard, using largely off the shelf parts, a discoverable PCI based bus architecture to attach peripherals to the CPU, and the OS component is bought in.

In the case of a phone, the hardware is proprietry, using device trees to describe where peripherals are mapped (may vary between vendors) and the OS image itself usually customized by the network operator to push their crapware and "value add" tools.

Contact your hardware provider and bitch to them, not Google.

Why can't google's patch fix the issue? Is there a different kernel for each android phone so that different patches are needed for each phone?

Exactly. Each hardware vendor provides it's own kernel, and probably own version of drivers such as GPU and radio devices. The way Android is put onto phones is via a single monolithic read-only image, so it's all or nothing when updating the base Android image.

Now, if the hardware vendors make after market ROMs easier to install (or just possible to install without hacking the phone) then it might not even be an issue. My HTC One S (stock Android == 4.1) is happily running CM12 (Lollipop based), and it rocks. But again, this is outside Google's control, and I had to get unlock codes from HTC to do so (but at least they do so without requiring jail-breaking hacks.)

Re:The solution is obvious

[TsuruchiBrian]

Why did you buy your phone from your congressman?

Re:The solution is obvious

[pr0fessor]

The thing is that they are providing an update path at no charge it's just one that can be difficult to follow if your carrier or manufacture isn't going to push the update to your phone. Even if they did create just a patch then you still may not get it.

Re:The solution is obvious

[Anonymous Coward]

You mean they are letting the OS be distributed for 10 years too long?

Re:The solution is obvious

[gnupun]

This is a bad example.

It's a valid example: a smartphone is just a shrunk down PC/laptop.

You don't get all your drivers from the OS vendor.

True, but we do get OS updates from only one vendor: the OS vendor. If there's a driver bug or hardware bug, we get the driver update from the hardware vendor. This is not a hardware/hardware driver bug, so the update must come from the OS vendor, google.

The problem is that you can't use them if your hardware vendor has not yet made their drivers compatible with the new version of the OS.

What does a pure software component, WebView, have anything to do with hardware drivers? Nothing. Your argument is baseless.

Re:The solution is obvious

[Anonymous Coward]

Too easy. My phone is a Galaxy Nexus and Google won't update it, who's to blame now?

Re:The solution is obvious

[TsuruchiBrian]

They get a pass because they aren't selling the Android OS. They are not asking you to buy a new product. They are providing upgrades to the OS (including patches) for free. If you don't want to be at the mercy of a hardware vendor that doesn't support the new android versions, then don't buy a phone from one of those vendors.

Google can't force them to support the new android versions. Only savvy customers can.

Re:The solution is obvious

[Anonymous Coward]

Clearly Google has decided that the solution for this problem is to update Android. This is not an unreasonable solution. The problem is fixed, and how you get the fix is well documented.

The problem is when your carrier prevents you from upgrading. Blame for this issue lies soley at the feet of Verizon, At&T, Sprint, T-Mobile, etc.

I'd prove your argument was idiotic with some links to the Google Nexus that won't be updated, but you wouldn't read them anyways. Its your fault you will never know how idiotic you sound.

Re:The solution is obvious

[TsuruchiBrian]

So if a company sell's computers with windows XP in January 2014, is it Microsoft's fault that those customers only had windows XP support for less than a year?

Re:The solution is obvious

[TsuruchiBrian]

T-mobile has contract free plans where you bring your own (unlocked phone), and are not forced to pay for a phone subsidy. I don't know if the phones they sell are locked, because I never had to buy one.

Re:The solution is obvious

[Anonymous Coward]

No, they just don't give a shit like any other massive software company. My 1 year old Post-Google Moto phone will never see an official 4.4/5.0 release. Clearly they just can't be fucked to try.

Re:The solution is obvious

[Anonymous Coward]

The problem is when your carrier prevents you from upgrading. Blame for this issue lies soley at the feet of Verizon, At&T, Sprint, T-Mobile, etc.

And the problem easily solved by avoiding Android. Is there any other solution?

Re:The solution is obvious

[sexconker]

The updates are NOT free. Android is NOT free.
You have to PAY to get access to Android source code. You pay more if you want the newer versions. You have to agree to shit like bundling Google's apps and store (which now also cost money separate from Android itself) or guaranteeing a "flagship" phone launch with expected sales of X within a certain time frame if you want access to the latest builds.

Even if Android was actually free, there are plenty of costs associated with pushing out an update. You've got to make sure the new version runs on the old devices (it won't). Then you've got to do QA. Then you've got to push the update out to the carriers. Then the carriers have to do their own validating. Then the carriers have to push it out.

Then people have to accept the update.

Google is the pot calling the granite counter top of Microsoft black.

Re:The solution is obvious

[TsuruchiBrian]

Google already updated their code. If the carriers don't care about spending any effort updating their phones to the latest android, why would they bother updating their phones with patches?

Debian squeeze 6.0 is no longer supported. That came out in 2011 (i.e. it was only supported for 3 years). If you bought your debian machine from some hardware vendor that refuses to come out with driver updates for debian versions past squeeze, you'd be in the same position.

The android hardware vendors are even worse. They lock the bootloader of their phones too. So don;t buy your phones from those vendors.

Re:The solution is obvious

[sexconker]

Except that google isn't charging for their new software.

Yes they fucking are. Android is not free. Android is not open source. AOSP is not Android.
If you are an OEM and you want the latest version of Android you pay money and agree to bundle Google's apps and store (which cost more money) into a "flagship" phone that will launch within a certain time frame and is expected to sell some minimum number of units and will be heavily advertised as running Android X.Y Whatever Candy.

Re:The solution is obvious

[TsuruchiBrian]

How did apple force the hardware vendors to send the patch to their customers? Because they *are* the hardware vendor.

Once you open up your code to 3rd parties, you can't control how it is used.

Re:The solution is obvious

[Anonymous Coward]

Well duh.

If you're the first person to buy into new tech, you always pay the bleeding edge tax of:
a) The hardware going obsolete 2-3X faster than subsequent refined models
b) Costs likely 2X as much as later revisions
c) Compatibility cost (eg less peripheral availability)

I intentionally waited for the Retina model before buying in. I knew it had to come.
Where I've been burned:
- Toshiba & Windows Mobile
- Sony & Palm
- Nokia (I'll say this was probably a good investment at the time, but I could never have seen Microsoft buying Nokia in advance)
- HP & Windows CE
- Anything that ran JavaME

That's 3 "Palm-size" devices I got burned with. I've also kept the same Mobile phone (Nokia N95) since the introduction of the first iPhone. It's well beyond the need for replacement now, but Apple keeps moving the goal posts of when I want to buy.

For me the goal posts:
- Carrier Neutral (Achieved at iPhone 5s)
- LTE (Achieved at iPhone 5s)
- VoLTE (Achieved at iPhone 6)
- NFC Payments (Achieved at iPhone 6, but not yet available outside the US)

There's other "nice to haves" but I'm ready to buy whatever comes next, provided some banks/credit unions start offering Apple Pay. In the mean time, hopefully my Nokia holds out another year. If it dies this year, I'll just hold out and use the WebPhone from the iPad.

Re:The solution is obvious

[Anonymous Coward]

iOS devices still need to go through carrier testing just like any other device. Apple just has a manageable number of devices per carrier that need to be tested.

Re:The solution is obvious

[TsuruchiBrian]

Google made up the system, where customers are allowed to choose their hardware vendor (good or bad).

Re:The solution is obvious

[Anonymous Coward]

60% are vulnerable and most probably don't even know the problem exists or how to fix it! Its up to Google to provide the fix and protect its customers and push the update!

This is the problem with open source and too many having their hands in the cookie jar! Its open as in wide open with no fix for 60% of its customers! Goes to show that Google doesn't care about its customers and your just their product being sold to its true customers the advertisers!

Re:The solution is obvious

[Ramze]

The real question is: WHEN will Google have enough leverage to force carriers and device manufacturers to allow them direct access to upgrade the devices and without crapware or disabling features?

I bet one could jailbreak a device and flash a firmware hack to patch the hole if Google or another team released a fix.

Google lets manufacturers use their base OS for free given some restrictions, and yes, many of the devices use radically different hardware with different kernel modifications, GUIs, and drivers. It's a fragmented ecosystem, and it would be pointless to push updates without consulting the manufacturers on how such changes would affect such customized systems. Think of the many different Linux distros running various window managers, kernel versions, hardware, etc. You push the wrong update to the wrong distro and you break all sorts of things. Google doesn't want that liability. Not to mention, they don't have the authority to alter a device - it would void your warranty without the manufacturer's permission.

The smartphone market is less like the laptop market and more like the embedded OS market - highly customized software specifically for one configuration of a device and also tailored for the manufacturer's preferred interface and the carrier's preferred lock-in schemes with crapware and disabled features (so they can offer premium paid features).

Blame the carriers first, the manufacturers (who stopped thinking about supporting your phone about 5 months after they released it) second, and Google very last.

Look at Google's Nexus product line - those get updates first b/c Google negotiated to have a clean OS on good hardware that would be largely portable between carriers. It's not Google's fault people choose other less supported makes and models. If consumers only purchased Nexus devices, Google would have the clout of Apple and could command more authority on the design, implementation, and upgrades of Android devices.

It would be very nice if and when the Android market were more like the laptop market, but even then -- remember all those Windows XP machines that could upgrade to Windows 7, but the manufacturers never made drivers for the hardware? XP laptops upgraded to 7 sometimes didn't have trackpad drivers or webcam drivers... same thing could happen with android devices. Fix a kernel bug and suddenly your phone loses a feature because the manufacturer didn't bother to upgrade the driver for the new kernel.

The current arrangement is Google makes the software, Manufacturers customize it for the device and carrier. Google updates the software, Manufacturers support the device with software upgrades pushed over carrier networks. If google's made a patch or update (and Android 5 can work on older devices that couldn't take the 4.4 upgrade), then it is definitely the manufacturer's fault for not supporting their hardware and testing and rolling out the patch. If the arrangement is going to change to more like the Apple model - people need to start buying Nexus products and shunning all hardware that doesn't come with updates straight from Google.

I understand that the life cycle of phones is about 2 years, so It's hard for me to be upset about 2 year old unsupported hardware (Verizon has a "new every 2 plan"), but I certainly wouldn't blame Google for he issue when manufacturers and carriers are the ones blocking their ability to provide the updates. IF Google could update any old Android device on their own, they'd wipe out crapware and bloatware, enable the features Verizon and others have disabled by default, and get rid of crappy UIs some manufacturers put on their devices in favor of the Nexus interface.

Re:The solution is obvious

[TechyImmigrant]

What problem? I was explaining why it's called firmware to the guy 2 levels up who things Android doesn't reside in any sort of ROM, whereas is obviously does. We don't have the universal, persistent RAM quite yet.

Re:The solution is obvious

[dumfrac]

I don't get why the sme device drives used with 4.3 can't be used with 4.4. It seems that the device drivers simply need to be compiled for the 4.4 kernel. Is the reason that the souce code for the device drivers is not available to Google?

Re:The solution is obvious

[Anonymous Coward]

For browsing. For apps that invoke the original one, or malicious programs that could specifically ask to do so, unfortunately no. Maybe there's a way to set permissions to prevent it from running, but I suspect it's too deeply embedded in the OS for this not to cause problems.

Re:The solution is obvious

[TsuruchiBrian]

I don't think it's reasonable to be forced to support phones indefinitely. A Galaxy nexus phone (if any still exist), is probably a land line by now, requiring it to be plugged in to be used because it's battery won't hold a charge anymore.

There has been 3 nexus phones released since the galaxy nexus. If you have a galaxy nexus, it's time for you to get a new phone anyway.

Re:The solution is obvious

[Anonymous Coward]

Which is exactly why open systems matter. If you don't 'own' your system to the level necessary to keep it secure yourself, then you're playing with a toy.

Re:The solution is obvious

[synaptik]

You seem to be unclear on the meaning of 'analogy'. Either that, or you read the GP's post without also reading the GGP's.

Re:The solution is obvious

[TsuruchiBrian]

This phone is old. If Google had to support the latest android on all their phones, it would hinder development for the benefit of relatively few people.

Re:The solution is obvious

[dumfrac]

One can buy replacement batteries that are very reasonably priced (less than $30). From an electronic waste perspective, supporting hardware that is perfectly capable of running newer versions of Android is a socially reasonible thing to do.

Re:The solution is obvious

[Anonymous Coward]

I should've known that you can't expect nerds to understand a distinction between firmware and operating system. Obviously there are firmwares which are operating systems. Nevertheless, when I call something "a firmware, not an OS", I mean to draw your attention to a property which is typical of firmwares but not of operating systems. When I refer to "an OS, not a firmware", a property that is typically shared by operating systems but absent from firmwares is in focus.

A firmware is typically a device-dependent monolithic piece of software stored in a memory device that is used read-only in normal operation. An operating system is usually user-installable on a variety of hardware and consists of many parts which are individually replaceable, so that they can be fixed without switching out the entire OS. Android is all of the former and none of the latter. I've previously called Android a "firmware construction kit", because there isn't a way for a user to download a generic Android and install it on a phone of their choosing.

Re:The solution is obvious

[dumfrac]

Not to mention that such a move would reduce electronic waste, which only affects relative few people (oh, wait).

Re:The solution is obvious

[TsuruchiBrian]

It's a valid example: a smartphone is just a shrunk down PC/laptop.

That's not the reason your example is bad. The reason your example is bad is because PC's have the exact same problem. The example doesn't show a problem specific to Google, but all platforms open to 3rd party manufacturers.

True, but we do get OS updates from only one vendor: the OS vendor. If there's a driver bug or hardware bug, we get the driver update from the hardware vendor. This is not a hardware/hardware driver bug, so the update must come from the OS vendor, google.

So this is where maybe a phone is not just a shrunk down PC/laptop. What is preventing you from updating the software on the phone yourself (circumventing the hardware vendor)? Well, it's that the hardware vendor has locked the bootloader of your phone. Not typically done with a PC.

What does a pure software component, WebView, have anything to do with hardware drivers? Nothing. Your argument is baseless.

Well let's assume you are correct. Just go download the publicly available android update and put it on your phone. If it's just a software component like you say, then it should just work.

Re:The solution is obvious

[Anonymous Coward]

You're a raving idiot. Show me proof that you have to pay for Android source code. I didn't think so. Now, shut up.

Re:The solution is obvious

[TsuruchiBrian]

As electronics get more efficient, using hardware which requires more energy to make the same computations is not socially responsible. Fixing old cars up is not more socially responsible than buying a new one that is more energy efficient.

Re:The solution is obvious

[Aqualung812]

Until Google figures out a way to get around carriers on this...

Apple did this a long time ago. There is nothing to figure out.

All Google needs to do is require those that are going to sell hardware running their OS to allow Google to push the updates. Done.

Re:The solution is obvious

[Anonymous Coward]

We'll never know, because Google won't fucking fix it!!!
No carrier has the option to patch it because GOOGLE WON'T FIX IT!!!

Re:The solution is obvious

[paulatz]

I've got an HTC ONE-S, that was not dirty cheap at all, and I love it: small, lightweight, nice screen, fast. But, shortly after having bought it HTC went back on their promise to udate it at least one mayor version. So now I'm fucked.

I have three choices: 1) stop using a perfectly good phone that I like, but is basically a portable danger until I to get my data stlen by some russian mofo 2) throw away a perfectly good phone 3) sue HTC for selling an unsafe device, and spend all my money for a very dubious outcome

Re:The solution is obvious

[TsuruchiBrian]

What would reduce electronic waste even more is if google never made the galaxy nexus in the first place. We could just keep using our nexus Ss and nexus ones.

Re:The solution is obvious

[AmiMoJo]

That seems like a strange limitation. I have an old Galaxy S with 394MB of RAM and it runs KitKat via Cyanogen really well. It's quite smooth and usable, more so than it ever was in fact.

Re:The solution is obvious

[dumfrac]

I won't disagree that there is a point at which using old hardware becomes less energy efficient. Cars are an excellent example. However, I think that it would be reasonable to say that a 3 year old phone hasn't hit that point yet. Actually, most newer phones use more energy than older phones, so I don't think that your point is well made with phones. In this case, I suspect that total waste would be reduced by not buying a newer phone.

Re:The solution is obvious

[Anonymous Coward]

IIRC they still sell them locked, but will unlock them if the device meets their requirements (e.g., paid for, not listed as stolen, etc.)

Re:The solution is obvious

[dumfrac]

One could argue quite well for creating laws that require hardware to last a minimum of five years. My primary desktop is an eight year old PC that has had some minor upgrades (memory and hard drive). My laptop is five years old (again, memory and hard drive upgraded). Both run fine. My phone is three years old. Again, it runs fine. If manufacturers supported hardware for longer, people would probably continue using it.

Re:The solution is obvious

[Anonymous Coward]

No, KitKat (4.4) allows for 512MB ram, and is a supported platform with the secure WebView based on Chromium.

As already stated, the hardware vendors and carriers have no incentive to update old hardware though, and have every reason to want you to buy new hardware, so don't invest in updating.

I'ts a screwed up system that google slapped together in order to compete with iOS, and though they ultimately won the battle in terms of total numbers of devices, we are living with the consequences of the deals they had to strike with carriers and manufacturers.

Things are better now, but lots of early adopters got screwed by the manufacturers and carriers not updating the software after selling the device / contract.

Re:The solution is obvious

[Anne Thwacks]

However, if this security failing leads to a major loss of money or privacy for Android users, I suspect Google could be on the recieving end of a multi-gazillion dollar class action.

And so could the handset manufacturers.

This is going to be so big, the lawyers wont bother laughing all the way to the bank - the banks will come to them.

Re:The solution is obvious

[AmiMoJo]

Download the Android source from the official site for free: https://source.android.com/sou...

You might be thinking of the Play store and other Google apps, which as you say are not free. You can download and install them for free as a user, but if you want to ship them pre-installed on a device then there are licence agreements. Nothing in those agreements about having to launch a flagship phone or nonsense like that... Android is winning because it is available on everything from low cost low end devices to the very top tier hardware.

As for the costs, Cyanogen seems to prove that they can be pretty low. They support a lot of devices with very little funding to do so, partly because they are open source and rely on volunteers. Some companies pay them for support, which seems like a reasonable way to do long term updates.

You should never buy a phone from a carrier. Always get it unbranded and unlocked.

Re:The solution is obvious

[jfdavis668]

These are 2 different situations. If Dell pushed all your Windows 7 pushes, and decides not to any longer, how could Microsoft fix it? That is the situation Google is in. Of course, that is not how Windows updates, but it is how Android updates. What is the point in creating a patch no one will see?

Re:The solution is obvious

[Anonymous Coward]

Even if Android was actually free

There is no if, it IS free. Or have you never heard of AOSP?

Re:The solution is obvious

[AmiMoJo]

AOSP is Android. You can something like Cyanogen or any number of AOSP based distros with no Google software at all and have a fully functional phone. The Android OS is free.

You are confusing the OS with the Google apps like Gmail and the Play store. If you don't want them, there are open source alternatives available. Cyanogen doesn't ship with any Google apps by default, you have to download and install them yourself manually.

Re:The solution is obvious

[TsuruchiBrian]

The bulk of the e-waste is going to be the battery. So manufacturing new batteries for old phones to keep them alive isn't really buying us much.

Furthermore, as far as e-waste goes, phones being relatively small, gives us a very high "bang-for the-buck" in terms of utility:e-waste ratio, compared to desktops, laptops televisions, etc.

The consumer demand for smaller and smaller mobile devices is driving technology of miniaturization, and this technology is benefiting many industries outside of the phone industry.

The faster (and smaller) these devices get, the less e-waste we will produce especially if we are recycling.

Re:The solution is obvious

[cheater512]

Most Android 4.x phones I'd expect to have more than 512mb RAM.
Mine runs 4.3 for example and it only has a paltry 3gigs of RAM.

Re:The solution is obvious

[Anonymous Coward]

Completely false. JB/KK runs on 512MB.

Re:The solution is obvious

[Anne Thwacks]

Adult phone users have slightly more grownup expectations: If the hardware is not busted, then the phone should be fixable by the end user following a viable procedure - eg taking it to the local phone shop.

We do not need any more landfill.

I have two Android phones, one running the latest software available for it - the other, CM. I also use two Nokias that are 5 and 8 years old. My computer has been regulary upgraded, but is, in the vewi of most of my family, over 10 years old (runs Linux Mint). If Android phones have a very short life, I wont be buying more of them, considering the extremely high price.

If Google do not address security risks, then their market share means this is a National Security Risk and I expect my government to act - using RPGs and nuking from high orbit if required.

Re:The solution is obvious

[cheater512]

Two words: Cyanogen Mod.

Re:The solution is obvious

[AmiMoJo]

It's not 150 smartphones a year, it's 150 distinct models. Often the only difference between models is the default language, or some minor variation in the case (far eastern models usually have a place to attach a strap, western models don't but otherwise the hardware is identical). Often it's just a different modem driver to support different regions LTE, that kind of thing. The core software is the same, and sure enough when they do release updates they tend to be for all models in a family at once.

Re:The solution is obvious

[gstoddart]

I doubt you would see that from them again.

Oh, I can guarantee I'll never see it from them again.

Had I known they were killing off the iPod classic I'd have replaced mine ... because it has no OS to be upgraded until it's broken.

My original iPad? I traded it in for $40 store credit while it still had some value.

But they won't be getting another iPad sale from me ever. And they won't ever sell me a phone. Or an Apple TV. Or a desktop.

I like the iPod, but for the rest? Apple is not getting my money.

If it wasn't for the fact that I still need some Windows software, my next desktop would be Linux. As it is, it might be worth it to buy a copy of Win 7 and run it in Virtual Box.

Re:The solution is obvious

[ganjadude]

But, shortly after having bought it HTC went back on their promise to udate it at least one mayor version. So now I'm fucked.

And how exactly does one blame google for this?? Blame the handset makers and the cell companies. Its not as if you cant flash the phone and put cyanogenmod on it and be secure, google has fixed the problem as far as their end is concerned.

Re:The solution is obvious

[Anonymous Coward]

nor is it a situation they could reasonably do much more about.

They created this situation, that is not something they get a free pass from. What is happening was known and expected from the moment they launched their Android model, but Google was too eager to get into bed with handset makers and operators and willing to fuck over their users royally for it. Now when they have a position they are trying to backtrack to a better model, but that doesn't help the millions of users they let to rot.

Re:The solution is obvious

[Anonymous Coward]

I can't recall any mainstream Apple product that was supported for less time. Many of them are supported for 4 years or more.

Ask pretty much anyone owning an Apple device that is one, two, or three generations of hardware behind the current one how well their latest iOS or OS X upgrades are treating them and ask that question again.

Re:The solution is obvious

[Anne Thwacks]

Nope. The solution for XP expiring is Linux.

The equivalent for Andoid is to require the boot loader to be unlocked for free if there is no free availability of security updates. Then you can use the ROM of your choice. It is open source, so people can, and probably will, fix bugs if there is still a significant user base*. If not unlocked, then Google or the manufacturer is wilfully converting the phone landfill, and should be billed accordingly.

Clearly, this needs to be a legal right. There is a remote chance of this in Europe, but probably none in the USA - there are no consumer rights in the land of the free.

* I would argue that the source (and data sheet) for device drivers should be compulsorily released to public domain where the hardware manufacturer is not maintaining them.

Re:The solution is obvious

[ganjadude]

the big issue with all of that is that while yes, they do push the new IOS update to all iphones once they have a new IOS, they also plan to break things on the phone in the process. since rev 1, they have a pretty much 2 year cycle when you get updates, and after 2 years the phone is so slow its pretty much useless. Im not so sure thats a better method than simply leaving well enough alone work

Re:The solution is obvious

[TsuruchiBrian]

You have to compare the costs of recycling the devices and making more energy efficient devices with the cost of using the older devices.

You don't need "laws". All you need to do is charge people the true cost of energy and the true cost of e-waste disposal (e.g. an e-waste tax when the item is purchased), and let the market decide).

Re:The solution is obvious

[ganjadude]

right, and apple simply blames the user, "you're holding it wrong"

Re:The solution is obvious

[Chas]

No, it's your hardware provider that is your problem, not Google.

Wrong. It's not up to Samsung what's installed on my Galaxy S4.

The "updates" are FREE, there's zero reason not to be on the current release.

Wrong. If my wireless provider doesn't release an update, I'm shit out of luck unless I want to root my phone, which voids my warranty and can negate my service contract. It'd also piss off my employer, as they're the ones supplying the phone and service and we have a contractual obligation with them NOT to root the phone.

Contact your hardware provider and bitch to them, not Google.

Again, the hardware provider isn't the one who controls this situation.

Re:The solution is obvious

[TsuruchiBrian]

So go run CM on your galaxy nexus if you don't want to throw it in a landfill. And if CM isn't good enough, you can write your own software for it. Unlike phones with locked bootloaders, the galaxy nexus is full of endless possibilities.

Re:The solution is obvious

[Ramze]

" a smartphone is just a shrunk down PC/laptop."

No. It isn't. Seriously. PC/Laptop CPUs are all either x86 or i64 (mostly i64) compatible and standardized. The various modified ARM versions in mobiles are not. ARM tech is licensed and various core manufacturers make their own changes - but also, there are ARM4, ARM5, ARM6, ARM7, and ARM8 based CPUs out there with incompatible binaries. MS and Apple just compile once and go (Though Apple compiles for A5, etc for tablets and MS compiles for 32 bit and 64 bit)- but you have to compile for each architecture for various devices running Android. In fact, it's smarter for the manufacturer to compile it specifically for the configuration they created - as well as enabling/disabling features to optimize memory, speed, etc. Manufacturers also may have to recompile any other binaries/drivers to inter-operate with the updated code.

Also, MS and Apple have standardized OSes. Android is not - it's a base for the manufacturers and carriers to modify. Because it's modified, it's up to the manufacturer who made the modifications to update the systems to be compatible. It simply is not possible for Google to maintain a list of all manufacturer's various hardware and software modifications for each device produced (assuming manufacturers would even give them that info).

"What does a pure software component, WebView, have anything to do with hardware drivers? Nothing."

Now, here is where you have a solid argument. Google could release a patch for each Android version affected rather than require an upgrade to a new Android version to resolve the issue. That's not an unreasonable request for maintenance on 2 year old software. Even then, it would be up to the manufacturers to compile and test the code for their devices, then to release it.

I'm not sure there's much of an argument if the devices could be upgraded instead of patched. MOST of them can be upgraded to Android 5 - it was designed to have a smaller footprint so that even older devices that couldn't take previous updates could upgrade to 5. Either way, it'd be the device manufacturers' responsibility to test and push out the update.

Your device manufacturer chose the hardware configuration, modified the OS, and accepted responsibility for supporting the hardware AND software updates for the device. That's why it's their fault and not Google's. Android 5 can be run with few modifications on practically any device that could run Android 4 (ice cream sandwich) which came out 3 or 4 years ago. There's no reason each and every device manufacturer couldn't recompile from source, test, and push out the very latest Android to just about every device out there. Why haven't they? Because they don't care about long term support. They are in the business of selling you a NEW device, not maintaining your old one beyond a reasonable time for them not to be sued.

Want to blame someone? Manufacturer FIRST, then Carrier, then Google. Google's done their part IMHO by releasing free fully patched OSes for the manufacturer. It's not their fault if the manufacturer refuses to compile, test, and push out the updates (with their carriers' blessings) which they accepted full responsibility for doing.

 

Re:The solution is obvious

[dgatwood]

But do realize, that was an outlier and is atypical of what Apple does.

No, it isn't atypical, at least for early-generation Apple products. The average support period for Apple is about three years, and there are a fair number of products that got less than that (mostly early models). For example, here's the time between the release date and last supported update of some other first-generation and second-generation Apple iOS devices:

• Original Apple TV: 3 years, 1 month, and 1 day
• Original iPhone: 2 years, 7 months, and 4 days
• iPhone 3G: two years, four months, 11 days

The support period tends to vary based in part on how many of the devices are out there in active use, and in part on how badly underpowered the hardware was to begin with. So later products in a given line are likely to have longer support periods than earlier products.

Re:The solution is obvious

[liquidsin]

So here's what we're actually dealing with. Google maintains the Android Open Source Project, or AOSP. Every handset manufacturer uses this as a base for their own "distribution". The only distributions that Google actually builds are for their own branded handsets and tablets (the Nexus line). All of the other handset manufacturers build their own distribution(s) for their hardware, which effectively makes them the OS vendor for that hardware. It's analogous to other situations in open source software, where, for example, the kernel is developed and maintained by one group, but the individual distributions' maintainers (Debian, Ubuntu, etc) will package/build the kernel for their own distros and release it through their own repositories (ie when I run apt-get on an Ubuntu machine I'm pulling updates from Ubuntu and not, for example, from kernel.org).

This leads to situations like the current one, where the updates have been rolled into new versions (in this case you upgrade 4.3 to 4.4.x) but not every vendor has chosen to build and distribute these newer versions to their customers; Google is no more able to push these updates than the kernel.org maintainers are of pushing new kernels onto your Slackware machine.

Re:The solution is obvious

[Dixie_Flatline]

You're talking like Google's a minority player in this deal. Google's the big dog here. Google dictates terms, and this one isn't so onerous. They patch the OS and they send the patch to a bunch of handset makers. They integrate the patch and push the update. This isn't a fundamental system overhaul, it's a bug fix. Unless the phones are incapable of receiving an update at all, they should be able to get this no problem. If there are costs, Google can offer to defray them. This is about building a brand and taking care of your customers. All this is doing is further pushing the perception that Apple takes care of its customers and Google and it's partners don't. Samsung is the only one that could theoretically afford to turn Google down because they could switch to Tizen, but they're getting drubbed by Apple at the top end and Xiaomi at the bottom; I don't think they're in a position to make a afuss.

But if that's what they want, that's fine--I'm an Apple shareholder (20 whole shares!) and that just makes my stock more valuable. And I own an iPhone and will continue to buy them. Whenever I look at Android, one of my big concerns is how long I'll get updates. If this is the sort of thing I can expect--buy a new phone for the latest security patch--I'll continue paying $700 for an iPhone and getting updates for 4+ years, thanks. I'm sure I'm not the only one.

Re:The solution is obvious

[dgatwood]

The iPhone 5 had LTE. And it was not carrier-neutral. Each came in multiple models, none of which supported all the LTE bands. AFAIK, even the current iPhone 6 and 6 Plus are not fully carrier-neutral unless you buy the model designed for China Mobile.

Re:The solution is obvious

[ganjadude]

even if google could fix the issue, how long do you think it will take before verizon and others QA and push it through?

Re:The solution is obvious

[ganjadude]

yeah, just ignore antennagate because its the users fault for holding the device wrong correct?

apple screws up every new release (just as everyone else does) Apple is not special by any means on that front

Re:The solution is obvious

[dgatwood]

Correction: Even the China Mobile iPhone 6 and 6 Plus aren't truly carrier-neutral, because they don't support CDMA. So you can either have LTE support in China or you can have CDMA support in the U.S., but not both.

Re:The solution is obvious

[ic3m4n1]

Why cant Google have another channel that by-passes carries for security updates.
We are not talking about major update with new features that would break everything carriers have done on top.

How difficult it would be to have a Google Security app with system level permissions to fix OS bugs?
It can as simple as Windows update if security is too scary for average Joe.

Re:The solution is obvious

[Anonymous Coward]

Problem is that many carriers have specific phones ordered, for which android drivers and various customizations are made. And when finished the development team gets disbaned or reassigned. So the software might already be unsupported at the moment phone is on the market. To expect from google to update firmware blob someone else build ...well good luck.
What google did wrongly is they didn't design a proper update model. Something like rpm would do a favor to everyone (google,vendors,carriers and users) here. Now they're partially trying to fix it with updating as much as possible through play, but that doesn't cover everything.

What if somebody finds a vulnerability in a more recent version, like lollipop? I hope for one because that will force them to adopt a proper practice.

Re:The solution is obvious

[ganjadude]

by that logic why are iphone 1s not running the most up to date IOS??

Re:The solution is obvious

[c]

However, if this security failing leads to a major loss of money or privacy for Android users, I suspect Google could be on the recieving end of a multi-gazillion dollar class action.
And so could the handset manufacturers.

Lawsuits are always a possibility.

Mind you, Google has an out ("it's fixed in 4.4.x, which we make available free-of-charge. Why didn't you install it?") while the handset manufacturers don't, really.

Re:The solution is obvious

[ganjadude]

no one is updating 1st gen iphones either. if you are still on a Gnexus, thats entirely on you at this point

Re:The solution is obvious

[ganjadude]

are 1st gen iphones getting updates?

Re:The solution is obvious

[BVis]

Obvious troll is obvious. Grind your axe somewhere else.

Re:The solution is obvious

[Anonymous Coward]

The original ipad was a bit of a fluke. Even apple didn't expect it to blow up an create a whole market. It was a first-of-its-kind design and was not very forward thinking compared to the ipad2, which is still supported.

The original ipad's main issue is that it has very little memory (ram). If it had more, it would likely be still usable.

Re:The solution is obvious

[Anonymous Coward]

I'm close to downgrading my Samsung phone, just to get some battery life back.

Re:The solution is obvious

[dumfrac]

In terms of batteries causing electronic waste, buying a new battery for an old phone is pretty much the same as receiving a battery with a new phone. My point is that good hardware is being thrown away unnecessarily because manufacturers aren't supporting it for its full useful lifetime. I still contend that net electronic waste would decreae if people bought a new phone once every five years, rather than once every two years. Battery technology might also improve more rapidly in this scenario.

Re:The solution is obvious

[BVis]

If the manufactures made upgrades and released then to all the phones that were unlocked at carriers that would allow a upgrade.

There is an upgrade. Go to Kit Kat.

Then the carriers that would not allow upgrades would get angry customers. And a chance to loss them if they had a choice to pick someone that would allow upgrades/updates.

I don't think you really understand the mobile market in the USA. One of the carriers fucks the customer in a new and interesting way, the others follow. Switching mobile carriers is 1) a huge inconvenience and 2) not going to improve your situation, because they're pretty much all equally awful. The carriers don't want to support more than one version of Android on a given handset, because then they might have to spend money to support them. Obviously they can't do that, since it eats into the profits. And as long as nobody goes off the reservation, the situation will not improve. Yes, collusion is illegal. Their lawyers can beat up your lawyers.

Re:The solution is obvious

[dumfrac]

You do need laws to charge for the true cost of electronic waste through taxes. If you don't pass such a law, some idiot won't charge the tax, giving them a competive edge, eventually resulting in all manufacturers not charging the tax.

Re:The solution is obvious

[TheGratefulNet]

google has to start being a responsible binary distributor, too!

I have an original N1 that I bought FROM GOOGLE. no carrier involved, flagship phone for google employees and then, later, the rest of us. it got up to 2.x of the os, google LOST INTEREST and gave up. to this day, the screen still freaks out halfway thru the day (loses its xy calibration and buzzes at you; known bug since almost day-1 of the device) and yet, google does not see fit to fix showstopper bugs on even flagship devices.

I won't buy another android phone, given how poorly google treats people. they have a short attention span, just like the carriers. they are NOT faultless here! they are just as much to blame. more so, if you realize that they let carriers run wild and loose with OUR PHONES, all the while denying updates and forcing crapware on us.

google really fucked the chicken, here. they could have controlled the vendors and carriers but they dropped the ball and we all pay for this lack of vision. we have unsecure phones and no way to update them. great. just great. super genius company (google) that refuses to support perfectly good, working hardware since its 'too hard' to do updates for so many devices. with all the smart heads (??) at google, and they can't do linux updates properly? wow. just wow.

Re:The solution is obvious

[Archangel Michael]

It's not their fault if the manufacturer refuses to compile, test, and push out the updates (with their carriers' blessings) which they accepted full responsibility for doing.

It isn't even this. Manufacturers could release the binary blobs for the hardware for people like CM to use to build Android for obsolete hardware platforms. But the fact that Carriers are requiring LOCKED devices from Manufacturers is where the real problem lies.

Which is why Google produces (or has produced for them) the Nexus line of phones and tablets. And why I bought two OnePlusOnes. Support the manufacturers that do it right.

Re:The solution is obvious

[meta-monkey]

And testing for Android app development is a nightmare. "My new app works great in the emulator built into Android Studio! So I'm sure that means it'll work perfectly on 200 different devices all running different versions of customized OSes!"

Re:The solution is obvious

[Altrag]

Yep. Exactly how Windows and Linux work, just with a much shorter cycle time. Try to get an official patch for Windows 98 or Redhat 6 and see how far you get.

It would be nice if the Android support phase were lengthened.. 12 or 18 isn't really long enough when the average phone replacement cycle is two years, and a quick Googling suggests that its even longer in other parts of the world. That means there's a hell of a lot of vulnerable devices in the world.

And I realize that Google doesn't have much say over what HTC/Samsung/whoever do. But there's things they could do to promote a better global atmosphere:
- Add a licensing requirement that derivatives must always be capable of being imaged back to the base OS install (well on a rooted phone at least.. this wouldn't be the place to restrict software lock-ins even if Google wanted to.) Losing the functionality of non-core features would be allowed as long as the base system runs (ie: if HTC adds a blood sugar monitor for example that isn't supported in the core OS, then it would be fine for that to just not work when the core OS image is installed -- as long as it doesn't prevent the core features from working.)
- Develop an extremely strict driver structure that can, with a high degree, guarantee that old devices will continue to work with new OS versions. Similar to how modern versions of Windows and Linux can still be made to run on absolutely ancient hardware (albeit slowly.)

The first point means a user could always (with rooting) revert to the core OS, and the second point means that they could always update that core OS to the latest version. They may lose functionality and it may run like a snail but they COULD do it whereas right now its a shot in the dark at best and an insta-brick at worst.

But it will likely take the kind of customer pushback that MS faced after XP to push Google into a more structured distribution model. And that in turn will likely require a high-profile, user-visible virus to come as a wake up call to the masses. Viruses that just take up a couple of cpu cycles but otherwise remain invisible tend to not be noticed by anyone outside of the tech community.

In the meantime, Cyanogenmod is the only real savior for older devices.

Re:The solution is obvious

[meta-monkey]

Which is why I use a Nexus phone. It's the reference hardware. Even if you have the AT&T branded Nexus 6, it's unlockable and rootable, while on contract. I don't understand the point of buying a non-Google Android device.

I've looked at them, and I just never saw anything that made me think "that's clearly so much better and cheaper than the Google device that I should be reliant on the manufacturer and carrier to support it."

Re:The solution is obvious

[Anonymous Coward]

4.3 = 30 month old software
XP = 160 months
ME = 172 months
Windows 8.1 = 15 months ago

There is SUCH a difference between 30 months and 160/172 months.

So, their cut off must be somewhere between 15 months and 30 months old for software. After all, no one ever uses software older than 16 months...

Re:The solution is obvious

[bondsbw]

Had I known they were killing off the iPod classic I'd have replaced mine ... because it has no OS to be upgraded until it's broken.

Need I remind you about your original complaint on this thread: "Companies expect you to buy the new hotness all the time, and stop expending resources on older platforms."

Yet now you've changed your tune, you only want products that were the new hotness at the time but where the company stopped expending resources once it became older?

Ok.

If it wasn't for the fact that I still need some Windows software, my next desktop would be Linux. As it is, it might be worth it to buy a copy of Win 7 and run it in Virtual Box.

Ah, so that's the meat of the matter. You just don't like Apple. It has nothing to do with the topic of the conversation, which is how long support is offered on a product.

Re:The solution is obvious

[the_B0fh]

I think you're missing something. No one is saying back port the entire _CURRENT_ version of chrome back. What people are saying is weak sauce is not going back to the 4.3 (or whatever) shipping version and fixing the problem over there and releasing that.

If that were the only change, it makes it easier for the manufacturers and carriers to push the updates out, as they don't have to revalidate everything.

Re:The solution is obvious

[ganjadude]

pointing out a failure by X, when people are claiming that X never has issues is not trolling.

Re:The solution is obvious

[the_B0fh]

A patch is different from a OS level upgrade. One is just updating *ONE* component. The other is an entire OS update.

If you can't understand why one would be easier than the other, then maybe slashdot isn't the right site for you.

As for Debian 6.0 - https://www.debian.org/News/20...

Re:The solution is obvious

[Coren22]

The best analogy would be MS refusing to backport a patch to Win7 RTM after SP2 has already been released, which does happen.

Re:The solution is obvious

[bondsbw]

Making a conclusion based on what you say a person said (but they didn't actually say it) is called a strawman argument.

Re:The solution is obvious

[SeaFox]

Apple had it written into their carrier agreements they retained full control of the OS and updating it. Carriers simply are not allowed to block stuff like that. Plus, you can always update your phone through USB with iTunes.

Google gave the carriers more power to change Android and control things like software updates. Some of this was necessary (more hardware to support from different manufactures, requiring drivers and testing my those OEMs), but a lot of it was because it's what OEMs/carriers wanted (so they could differentiate their handsets from competitors and for business reasons).

Carriers wielded this power as a club to force people into upgrading their phones more. Lots of earlier versions of Android were, you have to admit, kinda half-baked. Google released new versions that filled in many of these gaps in the phone features, but carriers didn't make those updates available to current Android users as often as they should, preferring to make the new Android version a bullet point on the features list for new handsets (which defeats the whole purpose of a smartphone OS).

Why did Google make their agreements like this? It was easier to get agreements with carriers to support the platform at all. Remember that Apple had to work very hard to get in the door at all with the iPhone, eventually signing an exclusivity agreement with AT&T to get them to come on board. Verizon would plain not agree to Apple in a setup where they did not have the ability to customize the OS and disable features they didn't like (as they were famous for at the time), add carrier branding to the hardware, etc. Once the iPhone became the must-have device of the time and AT&T's exclusivity agreement ended it was only then the other carriers agreed to Apple's terms.

Re:The solution is obvious

[Coren22]

How long does MS support RTM versions once SP1, SP2, and SP3 has been released?

Re:The solution is obvious

[kenshin33]

3) sue HTC for selling an unsafe device, and spend all my money for a very dubious outcome

strength in numbers

Re:The solution is obvious

[gstoddart]

you only want products that were the new hotness at the time but where the company stopped expending resources once it became older?

No, what I want is some guaranteed level of support for consumer electronics.

If I buy something I don't expect it to be unsupported in under 3 years.

Apple was just the last straw.

Re:The solution is obvious

[Coren22]

Google did fix it, and every carrier/manufacturer does have the option. The fix is in 4.4 and 5.0. Do you expect MS to support Windows 8 RTM after SP1 and 8.1 have been released? You have the option of updating, it is the manufacturer holding you back, not Google.

Re:The solution is obvious

[kenshin33]

in theory it could, but in practice not so much, why? see your second point !

Re:The solution is obvious

[Damarkus13]

I don't believe any of T-Mobile's current lineup is boot loader or Sim locked.

Re:The solution is obvious

[Damarkus13]

I think you're missing the point that Webview is an OS component. Google has provided an update, 4.4 or even 5.0. And part of the problem is that the major carriers (Verizon and AT&T) do require a full recertification for any OTA update.

Re:The solution is obvious

[Damarkus13]

They patch the OS and they send the patch to a bunch of handset makers. They integrate the patch and push the update.

Only the first sentence is true. Google does not integrate the patched version of Android with the manufacturers finished OS. And Google certainly doesn't push out OTAs.

Re:The solution is obvious

[ShieldW0lf]

Bullshit.

Google are a highly effective propaganda company.

But, as providers of a platform for developers, they are absolutely horrible. Writing software for their "platform" is like building a house on quicksand.

They make me look back on the time spent developing for Microsofts products with fondness.

Re:The solution is obvious

[bondsbw]

No, what I want is some guaranteed level of support for consumer electronics.

If I buy something I don't expect it to be unsupported in under 3 years.

I agree. But you act as if Apple were the worst about this, when in reality they tend to be one of the best among mainstream tech brands (although, as I stated and others have corrected me further, they are not perfect).

Re:The solution is obvious

[TsuruchiBrian]

In terms of batteries causing electronic waste, buying a new battery for an old phone is pretty much the same as receiving a battery with a new phone.

That was my point

My point is that good hardware is being thrown away unnecessarily because manufacturers aren't supporting it for its full useful lifetime.

No one is stopping you from putting whatever software you want on a galaxy nexus, unlike phones from other manufacturers.

I still contend that net electronic waste would decreae if people bought a new phone once every five years, rather than once every two years.

This would artificially limit the demand for new phones and slow technology. If we had implemented this policy at the dawn of mobile phone technology, we'd have probably produced less e-waste and our phones would be terrible compared with what we have now.

Battery technology might also improve more rapidly in this scenario.

I don't think having stagnant markets is a great way to boost improve technology.

Re:The solution is obvious

[TsuruchiBrian]

That's why I put "laws" in quotes.

Re:The solution is obvious

[drinkypoo]

I don't understand the point of buying a non-Google Android device.

I've looked at them, and I just never saw anything that made me think "that's clearly so much better and cheaper than the Google device that I should be reliant on the manufacturer and carrier to support it."

When my Nexus 4 went tits up I bought a Moto G 2014. It's got an SD slot, it's got KitKat (now) and it's unlockable/rootable. Indeed, unlocked and rooted. It was under $200 with a ringke slim backing added, from Amazon. That was pretty compelling. I miss the GB of RAM but nothing else.

Re:The solution is obvious

[TsuruchiBrian]

As a software engineer whose sick of customers that want me to fix their software problems but not not through software upgrades, I can certainly relate to Google's frustration.

The hardware vendors don't give a shit. They already sold their phone. Is applying a small patch easier than applying a big patch? Yeah probably, but it doesn't matter because both are harder and more expensive than doing nothing.

Re:The solution is obvious

[hawguy]

Google has stopped patching Android 4.3 and lower. Instead they want you to upgrade the OS, and they don't give a rat's ass whether that is actually possible. How is that not worse than pulling an XP,

Even if they released a patch, they can't force phone manufacturers to release it, and they probably won't.

considering that Android 4.3 was the latest version just seven months ago?

4.4 was announced in Sept 2013 and shipping in Oct 2013, so 4.3 hasn't been the latest version for about 14 months.

Re:The solution is obvious

[kenshin33]

these are to diffrent types of locks. One is a SIMLOCK : cannot use any other SIM card, the other is bootloader LOCK (no way of installing anything other than the SIGNED/blessed OS/FIRMWARE from the MANUFACTURER). in regard to the second type some phone are better than others : can unlock the bootloader easily, with provided tools (no need for exploits).
If the bootloader can be unclocked you can always go the aosp/custom way, but there will be a point where that won't work, mainly because of the non opensource components.

Re:The solution is obvious

[TsuruchiBrian]

in theory it could, but in practice not so much, why? see your second point !

It's not my analogy, so I don't intend on defending it. Rather than saying "that's not the reason your analogy is bad" I should have said "That's not the particular problem with your analogy I was referring to (although that is a different reason your analogy is bad)"

Re:The solution is obvious

[ganjadude]

op said

"But do realize, that was an outlier and is atypical of what Apple does. I doubt you would see that from them again. "

I simply pointed out that no, it is well within the norm for apple to not be perfect as every release there are issues (real and imagined) by supporters of the product, as well as pretty much any product that receives an update

Re:The solution is obvious

[kenshin33]

sorry I forgot to quote. I was referring specifically to this

Well let's assume you are correct. Just go download the publicly available android update and put it on your phone. If it's just a software component like you say, then it should just work.

What's more so : there is no publicly "available android update" that includes a patch for 4.3-.
If it were in existence, rebuilding the components is easy, getting them on a "unlocked -as in bootloader- phone" is the challenge. But if the bootloader is unlocked, chances are the user is tech savvy and the device is in "the supported devices list" of some custom android project out there (CM/AOKP/OMNIUM/PA to name few).

Re:The solution is obvious

[Anonymous Coward]

Christ. What astroturfing shills modded *this* up? AOSP *is* Android. If you want to ship Google's apps (including the Play Store), you have to agree to Google's licensing terms.

Re:The solution is obvious

[Noah Haders]

the iphone 1 was discontinued in 2008, while even today there are phones on store shelves running android 4.3.

Re: The solution is obvious

[Anonymous Coward]

Oh yes, file a class action lawsuit. Win 0.99 on the Google Play store!

Re: The solution is obvious

[Anonymous Coward]

I have to contest the 'fully featured phone' statement. You are not always guaranteed to retain all features after converting to cyanogenmod or any other unofficial AOSP- based distribution. Only those features for which an unencumbered (legally through copyright, licencing or technically through AOSP-provided, FOSS or component-integrator supplied) driver is available will work. Even something as basic as touch control might be unavailable of it was initially implemented with a customisation that was never tested or intended to be used on an AOSP platform.

What we are seeing is the combination of planned obcelesence and lack of financial incentive from future sales to maintain sold product. How many USB peripherals became bricks when xp arrived? How many when win7 arrived?

Re:The solution is obvious

[Anonymous Coward]

My "carrier" is Google (it is a Google phone; no ISP involved). The Google Nexus is not exactly a phone produced in small numbers either.

Re:The solution is obvious

[kenshin33]

No it is no old. I have one and it is still working perfectly. Running the latest version of android (thank you CM)

Re:The solution is obvious

[kenshin33]

what kind of support does a carrier offer exactly?

Re:The solution is obvious

[Ramze]

Exactly. I have a Nexus 7 2013 tablet. Samsung has some very tempting products, but I prefer to have Google's flagship products that get the longest support and the fastest updates.

Apple has the clout to fight the carriers on crapware, bloatware, and lock-in. I hope Google in conjunction with hardware manufacturers get the same leverage soon.

'Til then, buy what you like, but know that if it's not supported directly by Google, your support may be lacking.

Re:The solution is obvious

[Anonymous Coward]

This is what Microsoft does in the PC/Laptop space. In the rugged handheld and phone space they are the same as Android. Support is through the Hardware OEM only. If you want a patch Microsoft released as part of it's monthly AKU cycle then you need to request the hardware OEM for each device you have to include that update for that specific device. IN many cases this may require reloading the whole OS image, not just patching the effected files. Windows Phone 10 or whatever they end up branding it seems to be moving away from that model, but we will have to see when they really become available.

Re:The solution is obvious

[TsuruchiBrian]

There are publicly available android images. They are probably not for your phone unless you have a nexus 4 5 or 6, etc.

These images contain some hardware specific code, (that's why there isn't one monolithic android update). It is the job of hardware manufacturers to incorporate what google releases with their own hardware specific code to create an android image for a specific phone.

Google can't make hardware vendors do this. Nor can they make hardware vendors apply patches to 4.3.

My point was that there is a hardware component to every update, even if that update seems like "just software". It is the hardware vendors that must fill that gap. It's easy for apple to do this because they *are* the hardware vendor. It is also easy for Google to do this for the phones they make (the nexus phones), and they do.

My guess is that Google is trying to force vendors to do the work of having to upgrade their phones to a new android version rather than just getting the easy way out and simply applying a patch (which is bad for consumers).

As a software developer I run into this all the time. Our customer wants us to fix a bug in our software, and we tell them it is already fixed in a newer version of our software. But they don't want to upgrade. They just want a patch to their existing software because (they think) it's easier for them. But what they don't realize is that we fixed a bunch of stuff. Rather than issuing 100 patches, it really is just easier to get the latest software.

And in actuality our customer doesn't even want patches. They want us to magically fix the software without making any changes to it. Because changing the software requires them to do more paperwork. So we must continually explain to them that it isn't possible to fix software without changing it.

Re:The solution is obvious

[macs4all]

The problem is when your carrier prevents you from upgrading. Blame for this issue lies soley at the feet of Verizon, At&T, Sprint, T-Mobile, etc.

Partially, yes.

But, the actual "problem" is that Google never has (and probably never will) put their foot down, like Apple did at the very start, and say "We control the OS updates and distribution of same".

And before you say "But that is precisely why Android is better.", you need to examine whether that knee-jerk reaction is standing the test of time...

Re:The solution is obvious

[mdielmann]

Do you think this looks better for Google when I point out that first, just about any computer would support SP 1 to 3 for free (and usually requires the same or lower specs), or, more importantly, that SP3 still came out 6 years before support was ended?

Re:The solution is obvious

[Anonymous Coward]

AOSP *is* Android.

What phones run AOSP? None. From a practical standpoint AOSP is not Android because you cant run it on anything.

Re:The solution is obvious

[TsuruchiBrian]

It will probably continue to work perfectly indefinitely as long as you keep buying new batteries for it. So when is it time to upgrade?

Re: The solution is obvious

[TheGavster]

My experience with cyanogenmod had been that they can't do a release until the manufacturer updates, because the drivers are closed source and cm needs updated binaries. You might catch something when your device has compatible hardware with a nexus device or something, but otherwise cm is more "ditch sense/touchwiz/blur" than "get security patches".

Re:The solution is obvious

[exomondo]

The best analogy would be MS refusing to backport a patch to Win7 RTM after SP2 has already been released, which does happen.

No that isn't analogous at all because any Windows 7 system can be upgraded to SP2, almost none of the Android 4.3 devices can be upgraded to 4.4. If all (or even most) of the 4.3 users could upgrade to 4.4 then yes, this would be analogous and most likely it would be a non-issue.

Re:The solution is obvious

[mdielmann]

No, and that's a wonderful edge case. But, and this is a very big but, Windows 7 came out in 2009, 5 years before support for XP was ended. I don't think very many people were buying WinXP computers in 2012. And we're not even talking about windows Vista (which is as it should be).

Re:The solution is obvious

[exomondo]

These are 2 different situations. If Dell pushed all your Windows 7 pushes, and decides not to any longer, how could Microsoft fix it?

Leverage their agreements with their OEM partners for the benefit of the end user, Google could do this with their Open Handset Alliance if they wanted to.

Re:The solution is obvious

[mdielmann]

With respect to the carriers, Google is in a very similar position as Apple. If Apple can do it, there's no reason that Google can't do it. And if Apple can get the carriers to do it, Google could if they tried, too.

Now, I understand there are a few key differences between Apple and Google, two of the most important being that Google isn't the manufacturer and, related to that, that different manufacturers add their own look and feel to Android. But that's a strong indicator that Google needs to change their methodology, to help decouple the OS from the UI. Apparently they've already started this, by bumping OS features into Google Play (which may also be a poor choice), but this only means they're leaving older versions out in the cold.

I use GMail, have an android phone, and use a number of other services that google provides, but they desperately need to get out of the web mindset. Deployment plans that work for a web page don't really work well for an OS, having products in multi-year beta modes, and abruptly dropping support for services are all very upsetting practices that don't work if you want to be integral to people's daily lives.

Re:The solution is obvious

[BarbaraHudson]

It's not a problem with the kernel or any part of the software-hardware interface - it's a bug in the browser component, which is purely software. They could patch it for everyone if they wanted.

Re:The solution is obvious

[Anonymous Coward]

And how exactly does one blame google for this??

Because they have the OHA, they control Android (more now than ever thanks to the proprietary Google Play Services) and they own the most popular must-have core Android apps. They have the power to force these OEMs to do right by the users.

Microsoft has been totalitarian, if you want to sell Windows systems you cannot modify the operating system to lock users out of updates and upgrades in order to force them to buy new systems. They can preload crapware that you can uninstall but they can't do things like replace the shell (though the users are free to do this) and add stupid dependencies to create a fragmented user experience across the supposedly same version of the OS.

...and yes we all know all the bad shit microsoft has done and it has been discussed at length more times than i can remember and no this isnt some thing to say microsoft is great or excuse their past behavior.

Re:The solution is obvious

[BarbaraHudson]

Phones used to last 5-6 years. The worst you had to do was change the battery after 3 years. Now it's OMG you need to buy a new phone every year. PCs still (mostly) last more than half a decade, and are supported for longer - and they frequently cost less, not more, than the latest hotness from a smartphone vendor.

Re:The solution is obvious

[TsuruchiBrian]

My point was that it would not be microsoft's fault in this scenario, not that this scenario happened often. So maybe in the same way that people are not dumb enough to buy computers from comanies selling computers with windows XP in 2014, they should become smart enough not to buy phones with locked bootloaders (making them dependent on hardware vendors to get android updates).

Re:The solution is obvious

[bondsbw]

I was that op. I know what I said, thanks.

The topic was support timelines, not whether Apple was perfect. What you said, "just ignore antennagate", clearly went off topic.

Do you have anything to contribute regarding the actual topic at hand?

Re:The solution is obvious

[exomondo]

The real question is: WHEN will Google have enough leverage to force carriers and device manufacturers to allow them direct access to upgrade the devices and without crapware or disabling features?

They already do! Android owns the smartphone market and where Apple makes their own hardware Google have their Open Handset Alliance agreements with OEMs to enforce their requirements. Even Apple makes sure that iOS updates get pushed through so Google should be doing the same.

Re:The solution is obvious

[zieroh]

Except that google isn't charging for their new software. They aren't abandoning android. They are actively improving it and not charging people to upgrade to the new version. This is totally different from microsoft refusing to fix XP bugs, given that upgrading is purchasing a new product.

XP is a version of Windows. Android 4.3 is a version of Android. They aren't just roughly analogous, they are exactly analogous.

The new version of android *is* the patch.

That is easily the dumbest statement I've seen on this thread.

Re:The solution is obvious

[zieroh]

No, they just don't give a shit like any other massive software company. My 1 year old Post-Google Moto phone will never see an official 4.4/5.0 release. Clearly they just can't be fucked to try.

This.

Re:The solution is obvious

[Anonymous Coward]

Right, I mixed that up with 4.4.3. Anyway, 14 months still isn't even out of the 2 year mandatory warranty in some countries. If the phone manufacturers don't pass on the updates, then that's their fault, but if Google doesn't even provide them, then that's Google's fault.

Re:The solution is obvious

[zieroh]

BZZZT! Apple has never, ever had a monopoly position in the phone market. Try again.

Re:The solution is obvious

[Anonymous Coward]

you have to compile for each architecture for various devices running Android

Either you're wrong because you don't understand how a JVM works (a.k.a. Dalvik) or you're right and Google doesn't know how a JVM works.

I'm betting on the former.

Re:The solution is obvious

[Anonymous Coward]

Your options 1) and 2) are identical. I think you meant 1) stop using (or throw away, same damn thing) or 2) install a third party ROM based off 4.4 or better or 3) sue HTC.

Actually, neither 1) nor 2) are mutually exclusive with 3). You can run a third party ROM and sue and you can also stop using/throw out the device and sue. You're affected and it's HTC's fault.

Re:The solution is obvious

[zieroh]

Google does not have control over the hardware platforms they support.

I think it's a bit more nuanced than that. Google took a page from Microsoft's playbook and positioned Android as a product that would run on multiple hardware platforms. Unfortunately, the page they took from Microsoft did not include the rest of Microsoft's strategy regarding standardization and qualification of drivers that allows individuals to update their own PCs without intervention from the HW vendor. Google could have baked in a comprehensive update strategy, but they simply couldn't be bothered to think through the ramifications of what they were doing.

Re:The solution is obvious

[macs4all]

My plain vanilla Nexus 4 is still running fine with the latest and greatest, well latest, OS from Google. It is just staring to take some performance hits as compared to when it first came out.

That's Google trying to force you to upgrade through planned obsolescence, don'tcha know?

At least that's what all the Fandroids claim Apple is doing when older hardware has trouble keeping up with new iOS versions... ;-)

Sorry, couldn't resist!

Re:The solution is obvious

[Anonymous Coward]

Until someone makes a new Android handset with a keyboard, I will continue to use a device that hit the market in early 2013.

Do not expect everyone to buy into the "new device as often as possible" lie.

Re:The solution is obvious

[Anonymous Coward]

This is false. The only phones that can't be upgraded are those crappy Chinese cheapos that simply don't have the capacity to run KK. I have yet to find an older, high quality phone, that won't run KK. Sadly, you often have to root them to do so, but that's what people pay me big bucks to do :)

Re:The solution is obvious

[macs4all]

Google can't make hardware vendors do this. Nor can they make hardware vendors apply patches to 4.3.

You REALLY think that Google doesn't have enough leverage to change their Licensing Terms to make this so, even retroactively?

Seriously: What are the hardware manufacturers and carriers going to do? Write their own OS? Sure, and watch their sales PLUMMET, as they could no longer user the "Android" trademark.

Google has PLENTY of leverage here. They just don't care, anymore than the greedy manufacturers and even greedier carriers do.

Re:The solution is obvious

[zieroh]

Why did you buy your phone from your congressman?

Because he offered them cheap and with a screen the size of my head.

Re:The solution is obvious

[kenshin33]

when it's dead!

Re:The solution is obvious

[Anonymous Coward]

FWIW, you can get a new iPhone 5S from Apple for $99. You can probably find used ones (possibly even unlocked) on eBay from upgraders for even less.

Re:The solution is obvious

[Anonymous Coward]

My mistake. The droid 4 came out in early 2012, not 2013. But that further reinforces my demand for longevity.

Re:The solution is obvious

[zieroh]

I wouldn't blame Google for this, the problem lies with the carriers not upgrading their fleet of phones.

I would blame Google for creating this situation in the first place. A system that requires customization of the OS for each phone is naturally going to create a bottleneck for software updates. Any software engineer who has ever shipped a single piece of software could have seen this coming years ahead of time, and yet Google (which is ostensibly filled with software engineers) utterly failed to notice that fixing security vulnerabilities would be hampered by unwilling hardware vendors.

Duh.

Re:The solution is obvious

[macs4all]

Apple has the clout to fight the carriers on crapware, bloatware, and lock-in. I hope Google in conjunction with hardware manufacturers get the same leverage soon.

Oh, please. Apple came first (Android Beta didn't come out until November, 2007, nearly a year after the original iPhone), and Google could have EASILY followed that model with the manufacturers and carriers if they wished to.

And at this point, Google has so many Android "seats" in the world that they can EASILY dictate terms to the distribution chain.

But again, they just don't give a flying fuck. That much is abundantly clear.

Re:The solution is obvious

[zieroh]

And it's pretty darn obvious from what Google's been doing in the last few years that this is not a situation that Google is happy with, nor is it a situation they could reasonably do much more about.

But it's a situation that they could reasonably have foreseen. But they didn't. There are two possible explanations for this:
1) They did not actually foresee this, in which case they're just stupid.
2) They did not actually give a shit, in which they (and everyone who bought an Android phone) got exactly what they deserve.

Re:The solution is obvious

[Anonymous Coward]

Have you tried? I've successfully installed Lollipop on almost every Moto phone I've tried. There are some tricky models, but if you can find all the drivers you need (this is the easiest part, as they are always available via a quick google search) it's really not very difficult at all!

Re:The solution is obvious

[dumfrac]

In terms of batteries causing electronic waste, buying a new battery for an old phone is pretty much the same as receiving a battery with a new phone.

That was my point

Then I missed it. I though that you were arguing for building new phones and batteries, instead of just making batteries for old phones. I still content that buying new batteries to keep old phones going, instead of buying new phones, reduces the total electronic waste.

My point is that good hardware is being thrown away unnecessarily because manufacturers aren't supporting it for its full useful lifetime.

No one is stopping you from putting whatever software you want on a galaxy nexus, unlike phones from other manufacturers.

No argument from me here. Doesn't change the fact that it is bad form of Google not to provide an update the Google Galaxy Nexus.

Battery technology might also improve more rapidly in this scenario.

I don't think having stagnant markets is a great way to boost improve technology.

I disagree. If phones were required to last 5 years, it might encourage an arms race to produce the longest lasting battery, rather than the current scenario, in which manufacturers try to create the phone that can drain the battery the fastest. Consider: Manufacturer 1: my battery gives you 24 hours of high-usage battery life and will last 5 years, versus, Manufacturer 2: my battery gives you 8 hours of high-usage battery life and you will need a new battery after two years. I suspect that a fair number of people would buy a Google Galaxy Nexus today if Google still supported it, or a Google Nexus 4 is Google still sold it.

Re:The solution is obvious

[zieroh]

Why would they bother to fix it if the carriers aren't going to deploy the fix? Again, this isn't on Google, but on the carriers.

That's a convenient excuse. But ultimately, the consumer is still screwed, so it's pretty meaningless. And I would remind you that Google invented the entire mechanism that requires individual customization for each new phone, rather than having well-thought-out HW abstraction.

Re:The solution is obvious

[exomondo]

right, and apple simply blames the user, "you're holding it wrong"

That was an asshole thing to do but then there was a backlash and they did something about it. What is Google doing about this? Nothing, their solution is for users to buy new hardware that supports the new version.

Re:The solution is obvious

[macs4all]

The updates are NOT free. Android is NOT free. You have to PAY to get access to Android source code. You pay more if you want the newer versions. You have to agree to shit like bundling Google's apps and store (which now also cost money separate from Android itself) or guaranteeing a "flagship" phone launch with expected sales of X within a certain time frame if you want access to the latest builds.

All the more reason that Google could, at any time, change the distribution model such that kernel updates could be pushed out at any time, to any device. They just don't care to do the software redesign work and legal work to make that possible.

Even if Android was actually free, there are plenty of costs associated with pushing out an update. You've got to make sure the new version runs on the old devices (it won't). Then you've got to do QA. Then you've got to push the update out to the carriers. Then the carriers have to do their own validating. Then the carriers have to push it out.

Oh, Cry Me a River.

If Apple can do it (and they obviously do) and Google can do it for their Nexus brand (and they apparently do), then so can everyone else. It's called "the cost of doing business". Tough shit. STFU.

Re:The solution is obvious

[zieroh]

How did apple force the hardware vendors to send the patch to their customers? Because they *are* the hardware vendor.

Once you open up your code to 3rd parties, you can't control how it is used.

And yet Microsoft manages to issue security updates on a regular basis.

Re:The solution is obvious

[zieroh]

Google had a bug in their product, and they have fixed it. The carriers are the ones not allowing their customers to install the fixed version.

That's a very nice rationalization. But I think it's pretty obvious that the entirety of Android -- including the manner in which it is propagated through the HW vendors and carriers -- is in fact Google's design. They set the terms, they designed the system, they left out sensible HW abstraction.

Sorry, but no. Google is on the hook for this. You can fanboy all you want, but it's ultimately not very convincing.

Re:The solution is obvious

[exomondo]

And it's pretty darn obvious from what Google's been doing in the last few years that this is not a situation that Google is happy with, nor is it a situation they could reasonably do much more about.

Of course they could! They have the OHA through which they can have the licensed OEMs update their devices and then they only need to make sure those updates get to the devices through the carriers and Apple manages to do that just fine.

Re:The solution is obvious

[Anonymous Coward]

And just like Microsoft with Windows and Linux:

They fix bugs in newer versions of the OS.
They will sometimes fix bugs in older versions WHILE THEY ARE IN A SUPPORT PERIOD
They will not fix any bugs no matter how bad once they are out of support.

So to extend your comparison, Google have announced that 4.3 is now 2 versions old and is no longer in support period.

Microsoft ended XP support with many people still on XP, google did it with Android 4.3. Timelines are shorter in the mobile space. ... so why the outrage?

Re:The solution is obvious

[Anonymous Coward]

Google allowed their brand name to be prominently displayed on all Android devices that incorporated the Google Experince or Google Play, and Google managed those trademarks and licensing agreements. This includes those sold with Android 4.3, and Google could have chosen to only allow their Google brand to be displayed on phones that could allow the end users to actually upgrade them, Blame the 4 carriers - and also blame Google for allowing this situation in the ecosystem that they created.

Re:The solution is obvious

[groggy.android]

As another poster said, get a Nexus. The only beef I have against the Nexus is the lack of SD card support. In the past I could have gone for a Google Play Edition (GPE) device, which received fairly prompt Android updates, but Google appears to be phasing out the GPE program. Schade.

Re:The solution is obvious

[Eythian]

It is the hardware provider in much of the world. If you have shitty carriers, blame the shitty carriers. Otherwise, blame the hardware providers.

Re:The solution is obvious

[ganjadude]

apologies not sure how I overlooked that. I read into the "hesitant to buy apple" part. You go on to explain that his issue was not the norm. I simply was pointing out that there are always issues. If its not lack of support its a bad rollout causing downtime. Its not exclusive to apple by anymeans, but it seems bigger because they dont put out a phone every week like android phones seem to be released

Re:The solution is obvious

[thegarbz]

So Microsoft released a service pack for windows and Dell prevented you from installing it, do you attack Microsoft or Dell?

Google gets a nice pass because they are not requesting the end user to pay money, because they have systems in place for updates, because they fixed the problem along with providing some new features just like a service pack does all while providing a point release in version number.

The problem is solved from Google's end. They've even put systems in place so in the future they can resolve it without doing a point upgrade on Android. The problem now is that some asshats in the middle are preventing the updates from filtering down to the users.

Re:The solution is obvious

[thegarbz]

I ask, what's the difference between Windows XP Service Pack 1 and the a point release upgrade for Android?

Looks like they fixed the bug in 4.3 by releasing 4.4. The fact that you can't get it ... well that is something to take up with the device vendor, and I'm sure you wouldn't be blaming Linus if Dell was blocking an upgrade of a point release for the Linux Kernel.

Re:The solution is obvious

[thegarbz]

Except when did Microsoft end support for Windows XP without a service pack?

Seriously 4.3 to 4.4 can be largely considered just like a service pack. A few new features, plenty of bug fixes and clearly some security issues were fixed too. Ever try and install Windows XP and apply all sorts of updates without a service pack? The updates refuse to work saying you need SP1.

This is no different except that in the PC world it would be like Dell preventing you from installing Service Pack 1.

Re:The solution is obvious

[thegarbz]

My device (Galaxy series) shipped with 4.2. I got an update to 4.3, 4.4.1, 4.4.2, and 4.4.4 with a promise that 5.0 is in the works.

And this is Samsung who are apparently bad at this.

You need to pick your vendors a bit more carefully if updates are what you care about.

Re:The solution is obvious

[thegarbz]

True, but we do get OS updates from only one vendor: the OS vendor. If there's a driver bug or hardware bug, we get the driver update from the hardware vendor. This is not a hardware/hardware driver bug, so the update must come from the OS vendor, google.

The update HAS come from the OS vendor in the form of a point release. This isn't a case of not supporting windows XP. It's a case of complaining that you want a specific patch without installing a service pack.

The OS vendor has done their bit.

Re:The solution is obvious

[Chas]

It is the hardware provider in much of the world. If you have shitty carriers, blame the shitty carriers. Otherwise, blame the hardware providers.

And now! With more moving goalposts!

We blame global warming on cow farts!

DOWN WITH FARTING COWS!

It's aided by off-gassing volcanoes.

DOWN WITH OFF-GASSING VOLCANOES! And down with farting cows just in case!

And the ocean, as it warms, is retaining less CO2!

DOWN WITH WARMER OCEANS! And down with off-gassing volcanoes, and farting cows, just in case!

And it's the fault of our dependence of fossil fuels!

DOWN WITH FOSSIL FUELS! And down with warmer oceans, off-gassing volcanoes and farting cows, just in case!

Re:The solution is obvious

[exomondo]

The timeframes for Android are not of the same scale as those for Windows.

Ok so how long should we expect versions of Android to be supported for?

Re: The solution is obvious

[biojayc]

But they can be upgraded to KitKat. That was one of the main goals of KitKat, to be able to run on 512mb of ram.

Re:The solution is obvious

[CastrTroy]

the current model of the Nexus is a 6 inch monstrosity. I have no want, nor need for a 6 inch phone. They still sell the Nexus 5, but even that is a little high priced for my tastes. And the lack of SD expansion makes it a no go for me. I don't care what reasoning they have, there's nothing that will make me buy a phone that doesn't come with expandable storage.

Re:The solution is obvious

[devman]

It doesn't matter anyway as WebView in 4.3 and earlier is part of the system that is non-upgradable with out a new system image. Fixing the problem would require OEMs to update, they may as well just take 4.4. Note that WebView equivalent in 4.4 updates when Chrome updates via Play Store, so this won't be a problem in the future. It would be a lot of work for Google to backport the patch only to have OEMs ignore it anyway.

Re: The solution is obvious

[biojayc]

Yes the fix should come from the OS vendor. And they provided it. The hardware manufacturers are more than capable of updating there devices with it. Google doesn't have the ability to push updates to the phones that they didn't release. They do keep the parts that they have control over up to date, I.e. Google Play Services. They are doing what they can to mitigate these problems by pushing more and more of the is capabilities into google play services so they can update without carriers being involves, but then people get upset at that for other reasons. Its a sucky situation, and I wish Google commanded more control over the OS when manufacturers use it, but people get upset at Google for strongarming already. I can't imagine what people would say in that situation.

Re: The solution is obvious

[biojayc]

You do not have to pay for android source code. It is open source. You can download and compile it right now I'd you wish. That's what Amazon did with fire os and what cyanogenmod did. If you want to use Googles apps on a phone you sell, then yes there is an agreement to get access to googles apps on your companies phones.

Re:The solution is obvious

[exomondo]

It doesn't matter anyway as WebView in 4.3 and earlier is part of the system that is non-upgradable with out a new system image. Fixing the problem would require OEMs to update, they may as well just take 4.4.

It's just a software patch, OEMs can then patch their existing binaries since 4.4 won't work on most of the 4.3 devices.

Re:The solution is obvious

[jrumney]

If your wireless provider refuses to release updates, how are you expecting a backport of the fix to 4.3 to help?

Re:The solution is obvious

[Eythian]

Really? How about you set your goalposts to be "whoever is stopping you getting the updates." Sometimes it's the carrier, sometimes it's the hardware provider, sometimes (if you're on a nexus) it's Google. Blaming the appropriate party isn't moving goalposts, it just not being stupid.

Re: The solution is obvious

[Anonymous Coward]

...samsung?

Re:The solution is obvious

[Namarrgon]

Which phone is that? Motorola already announced Lollipop 5.0 support for the Moto X, G, E and Droid lines

Re: The solution is obvious

[rickb928]

1. Until the hardware no longer adequately supports the upgraded OS (typically 2-3 years lately)

2. Until the carrier no longer sees any advantage in porting to the new version (variable, but either 2 years for flagship phones or never for lower-end phones)

Don't hope for more than 2 years.

Re:The solution is obvious

[Anonymous Coward]

Ah that's right. It's just a phone, you'll have a new one in two years anyway.. so don't worry about the security on it. That doesn't exactly fly when you are trying to convince a CEO or CIO to use Android/Google technology over Microsoft or Apple.

Re:The solution is obvious

[unity]

" I've been considering Windows Phone, but their app selection is quite poor."

Exactly which types of apps have you been unable to find for WP? I'm always looking for development ideas. WP is pretty darn easy to devel for if you have windows devel experience.

I hear this bit about their app selection being poor, but I haven't really come across anything I needed that wasn't already available.

Re:The solution is obvious

[jschrod]

Blame for this issue lies soley at the feet of Verizon, At&T, Sprint, T-Mobile, etc.

In my case, the vendor is called Google -- I have a Galaxy Nexus. This phone is just two years old. No updates to 4.4, 4.3 is the last version supported.

Thus, I lay blame at the feet of the vendor -- Google.

PS: No need to tell me about CyanogenMod. I know about that. This is not about geeks being able to root their phone and replace the OS. This is about Google not doing proper support for a commercial product, a behavior that any other company in the IT business would be grilled about on virtual hot coals.

Re: The solution is obvious

[Anonymous Coward]

I'm betting you're an idiot.

Re:The solution is obvious

[exomondo]

Either you're wrong because you don't understand how a JVM works (a.k.a. Dalvik) or you're right and Google doesn't know how a JVM works.

I'm betting on the former.

The third option of course is that you don't realize that the Android operating system does not run on a JVM and therefore does need to be compiled for each architecture. Now you can be all you want but the fact is it is the third option.

Re:The solution is obvious

[perryizgr8]

I've got an HTC...

Stopped reading after this. If you buy HTC, you deserve the shit you get. Galaxy S3 was released alongside HTC One S and it is upgradable to jelly bean.

Re:The solution is obvious

[Anonymous Coward]

>Isn't this basically what Microsoft does with Windows, or what Linux does.

Microsoft enforces a single hardware standard; see https://msdn.microsoft.com/en-us/library/windows/hardware/dn423132.aspx.

Linux just piggybacks on that standard.

Re:The solution is obvious

[mdielmann]

Except for the part where MS has years where they provide security fixes for a given point release. And MS doesn't stop support for hardware in just a couple years. And your vendor doesn't block you from upgrading to a new point release.

But yes, except for all that, what have the Romans done for us?

Re:The solution is obvious

[Chas]

Because if you read the initial post. The guy is going "BLAME YOUR DEVICE MAKER!"

And I pointed out "Hey. The stopping points aren't necessarily JUST your device maker. Like in my case, it's my service provider."

To be followed up with "HEY! BLAME YOUR SERVICE PROVIDER (or your device maker, just in case...)"

Now that I've hung a lampshade on the moved goalposts of the original argument, we NOW have, from you "Hey! Blame whoever's stopping you!"

Which was the original gist of my argument in the first place.

Re:The solution is obvious

[Blaskowicz]

It might be a good idea. Not sure what the support policy is for Windows Phone 8 and later Windows 10 on phone, but the desktop variant is known for 11-year support cycles.
If you're refusing Apple and Android you have to find something else. Maybe Blackberry but it's expensive. So that leaves Windows and Firefox. Even with Firefox OS the upgrade situation is not clear with devices still on 1.3 and awaiting 2.x images, even though the OS is more free than Android and it doesn't have crapware. (but it is possible to install 2.x still)

Re:The solution is obvious

[bondsbw]

The earliest mainstream Galaxy device to have 4.2 was the S4 so I'll assume you have that. As it stands, it hasn't been 2 years since release and Lollipop is likely to come to the device before the 2 year mark, and that's as far as we know it will be updated.

Not sure what your point is... 2 years is good for Android, but compares poorly with competition.

Re:The solution is obvious

[Anonymous Coward]

That's because they were still selling the "ipad 2" as the "ipad mini" in 2014. In many countries they are required by statute to support the model or refund the people who bought it.

Re:The solution is obvious

[Blaskowicz]

You can install Windows 7 on a PC from 2002. Seen one such in the wild, it lacked 3D acceleration but that was fixed by installing an XP driver on Windows 7.
So there would be no outrage if you could install Android 5.0 on that abandoned Android 4.3 device, and if that Android 5.0 could use the drivers baked in the Android 4.3 installation so that most critical functionality keeps working (such as GPU, wifi and phone calls)

Re:The solution is obvious

[thegarbz]

My point was to the GP that there are plenty of devices on the market which receive more than zero updates.

As said I have received 4 updates (that I have noticed I assume 4.4.3 may have been on my phone at some point), and that a 5th one is in the works.

My point has nothing to do with length of support, only that many devices actually have a length greater than zero.

Re:The solution is obvious

[Blaskowicz]

Ending the iPod classic still is an issue. With no apps and no network connectivity, it was reasonable to keep it for a decade or more like consumer electronics used to (VCR, CD player, walkman)
Nothing stops them from making a new version with a 256GB flash drive instead of the hard disk drive (as 1.8" hard drives have been deprecated)

Re:The solution is obvious

[Anonymous Coward]

Cyanogen Kitkat and TouchWiz Kitkat are two totally separate beats. TW has a lot more features, and is therefore a little more "heavy".

You can't expect the general consumer to experience such a jump between Cyanogen and TW with a firmware update. Perhaps a manually installed update, but not an automatic one.

Re:The solution is obvious

[Anonymous Coward]

There are a handful of reasons...

Tell me what has been added to i things base OS over the past several years and compare them to Android. The past 3-4 generations of Android phones have to add a full NFC library and API (for example) and as such increase it's "footprint". i things get... a half-assed version limited to one thing.

With Android, and version you get is 100% unadulterated (assuming hardware availability - you can't support NFC in just software). With i things? You get a mish-mash of missing features depending on which device you have - most notably the voice assistant. Quite literally, there was no reason why they couldn't back-port to even the original phone/tablets (the software on which it was based supported as such) but they didn't --- even though they released a new OS for it.

So sure, your 5 year old device gets OS8... sorta, not really.

Re: The solution is obvious

[bondsbw]

I was that GP. You misunderstood my post.

We received updates. We just stopped receiving updates before our devices were even 2 years old. Actually most of the devices got their last update before 1.5 years.

Re:The solution is obvious

[Anonymous Coward]

Not even a full week, huh? You really are a weak-willed little twerp.

Re:The solution is obvious

[Anonymous Coward]

Except you have to remember that Android can update individual apps separately from it's core OS.

Bugs in, say, Google Maps are fixed without a major system update - you just go to the Play Store and download it.

i OS requires a system update. You're comparing apples to oranges (quite literally).

And don't forget, they randomly drop features (like voice assistants) from devices that COULD support it but don't.

Re: The solution is obvious

[Anonymous Coward]

Er, no, I didn't buy the device from my congressman.

Here in the UK, the responsibility for fixing aa defective product actually lies with whoever you bought the device from.

Re:The solution is obvious

[Anonymous Coward]

Enjoy your randomly missing features in your OS updates.

Android can update it's top-level software independently of OS updates, and can effectively prevent bugs from being abused. It does NOT require a system update, unlike your devices.

You can keep your smug, and enjoy blowing money on years old features, limited software, and monopolistic / price fixing company.

Re:The solution is obvious

[Blaskowicz]

Debian squeeze has been put into a new LTS scheme meaning its support has been increased to five years.

Re:The solution is obvious

[the_B0fh]

I know of one hardware vendor that does give a shit. However, too many haters here to mention that name.

Re:The solution is obvious

[Blaskowicz]

lol that phone has a 720p screen, 1GB RAM, dual cortex A9, dual camera, 16GB flash. It might be "old" but still better than low end phones. That's getting ridiculous, it is a bit like arguing an Xbox One is old and tired so it's no big deal if people can attack it at will to steal your microsoft accounts and whatever.

Now I have to inform my friend who uses a Galaxy Note that his data and mail accounts may be at risk unless we fuck with the OS and bootloader, or maybe take countermeasures such as install firefox and uninstalling every app. What a pain in the butt. No, he spent big bucks on it when it was new and it isn't damaged. Getting a new one is unreasonable.

Re:The solution is obvious

[thingummy]

Many people CAN do something to force phone vendors to release updates. Google can retroactively change their terms, as you say. Supreme courts of most countries, more so those where phone vendors are headquartered or have significant business, can also do so. Anonymous can hack into phone vendors' servers and release statements about not unhacking / stopping hacking until they release updates. YOU can hack them too!!! Pope can influence lots of them - he is respected in lot of Catholic world (and non-Catholic Christian world informally). Islamic clerics can issue fatwas.

But all of them have some goal higher than releasing updates for earlier phones. Supreme courts typically care more about their constitutions than phone updates. You have better things to do than hacking phone vendors' assets. Google has better things to do than losing remaining trust by retroactively changing contracts - remember their business model is to have access to a lot of world's data only on the basis of this weak-footed trust.

Re:The solution is obvious

[Blaskowicz]

Phones use little energy and possibly newer phones use more energy than older ones (bigger screen, more features, bigger battery, more games, more spyware apps)

To charge the true cost of energy, see carbon tax.
Sometimes energy efficiency is very questionable (hybrid cars's complexity and batteries, or a TV more efficient but bigger), there even may be surprises such as the fabrication of a LCD monitor costs more energy than that of a CRT one.

Re: The solution is obvious

[Anonymous Coward]

And you're a raving cunt. From Wikipedia:

"Development

Android is developed in private by Google until the latest changes and updates are ready to be released, at which point the source code is made available publicly.[97] This source code will only run without modification on select devices, usually the Nexus series of devices. The source code is, in turn, adapted by OEMs to run on their hardware.[98] Android's source code does not contain the often proprietary device drivers that are needed for certain hardware components.[99]"
http://en.wikipedia.org/wiki/Android_(operating_system)

He's saying if you want access to source code before it's public, you pay. I'm not into android and I already knew that. And it only took 5 seconds of googling to see an instance where a manufacturer contributed code to Google to include and wasn't, as if you had to pay to get that included.

Anyways, he's likely right.

Re:The solution is obvious

[paulatz]

Honestly, you cannot even compare the design and build quality of the two. But it is a matter of taste.

Re:The solution is obvious

[perryizgr8]

It is fine if you value design and build quality above usability, updates, battery life and features. But then you don't have a right to complain later that you aren't getting updates. You knew exactly what you were buying the HTC for: design and build quality. You got that. Be happy. Don't whine about updates. If you cared even a bit about functionality, you wouldn't have got an HTC.

Re:The solution is obvious

[Anonymous Coward]

If you think PC vendors don't mess with the user experience, you have probably never seen a Sony laptop out-of-the-box. The reason why your perception is different lies with Google, not the manufacturers. The manufacturers customize like they always do, to establish their brand. In the PC market, the user can just take a Windows installation DVD and undo all that shit, but Google never made an Android that a user can install on any phone. Android is a "firmware construction kit", not a user-installable OS. Google chose this architecture and bears full responsibility for it.

Re:The solution is obvious

[Christian Smith]

It's not a problem with the kernel or any part of the software-hardware interface - it's a bug in the browser component, which is purely software. They could patch it for everyone if they wanted.

They have. It's called Android KitKat.

And when you say "they", who is "they". My contention is "they" is the hardware vendor/carrier, not Google, for the reasons outlined above.

Re:The solution is obvious

[bemymonkey]

My Galaxy Nexus begs to differ. An original Google Nexus program phone, stuck on 4.3, with this bug. The entity responsible for pushing updates to this phone is Google...

Re:The solution is obvious

[bemymonkey]

What about those of us whose hardware provider is Google? Galaxy Nexus anyone?

Re:The solution is obvious

[bemymonkey]

This is totally different from microsoft refusing to fix XP bugs, given that upgrading is purchasing a new product.

In the case of Android users stuck on 4.3, upgrading to a newer Android version means purchasing a new phone - so pretty much the same thing here.

Re:The solution is obvious

[bemymonkey]

Well, I bought a phone directly from Google about two years ago - a Galaxy Nexus - and that's now stuck on 4.3, including this lovely WebView bug.

Re: The solution is obvious

[thegarbz]

Oh right.

Never mind then, situation normal. :-)

Re: The solution is obvious

[Anonymous Coward]

It'd be nice if Google contacted the hardware provider and bitched on my behalf.

Re:The solution is obvious

[LWATCDR]

XP was still for sale 24 months ago. People should not count support from launch but from end of sales IMHO.
It is the phone vendors and carriers that are not updating devices. It like blaming Linux for not updating a router that you rent from a cable company.
Google can not update those devices

Re:The solution is obvious

[Rich0]

Well, unlike the wireless phone companies, there where no vendors for the PCs that insist on putting their hands on the OS to customize the Android experience (mostly to detrimental effect, in my experience). So yes, Verizon, T-Mobile are on the hook for this one.

My plain vanilla Nexus 4 is still running fine with the latest and greatest, well latest, OS from Google. It is just staring to take some performance hits as compared to when it first came out.

Good thing you don't have a GSM Galaxy Nexus purchased directly from Google. I doubt they're patching those.

Re:The solution is obvious

[Rich0]

As for the costs, Cyanogen seems to prove that they can be pretty low. They support a lot of devices with very little funding to do so, partly because they are open source and rely on volunteers.

That, and their users don't seem to care if random small things break from time to time. Fortunately bluetooth stereo is much more mainstream now than it used to be, so the volunteer testers are far more likely to notice when it breaks. Back in the early days of CM it seemed like it only worked 70% of the time, but the average college student didn't use it so they didn't notice. That was before the M-series builds as well, so running "stable" meant just waiting for the next version of Android to come out so that you could use the last one, and it was basically abandonware.

Some companies pay them for support, which seems like a reasonable way to do long term updates.

As far as I've noticed, their paid firmware is just fine, probably because they actually give it serious QA, and of course it doesn't hurt that they have full access to the drivers/etc (which to be fair is a major handicap for their free efforts).

I also like that they have personally committed to updates for the phones they support, and they don't just say "it is up to your OEM." I get the impression that if a company like Oneplus folded that CM would still keep the OS updated for existing owners. Of course, they've yet to be tested on that.

Don't get me wrong, CM does great work. I just wouldn't say that they are without issue, or proof that the free software model works without any commercial ties. The areas where CM seems to go toe-to-toe with other OEMs in every regard is in the cases where they do have commercial ties.

Re:The solution is obvious

[Rich0]

Agree. I use Android, but they could really benefit from something like this:
https://www.google.com/chrome/...
or
http://windows.microsoft.com/e...
or
https://access.redhat.com/supp...
or
http://www.ubuntu.com/info/rel...

The first link is Google's, so it isn't like they don't know how to do this stuff.

Re:The solution is obvious

[Rich0]

My point was that it would not be microsoft's fault in this scenario, not that this scenario happened often. So maybe in the same way that people are not dumb enough to buy computers from comanies selling computers with windows XP in 2014, they should become smart enough not to buy phones with locked bootloaders (making them dependent on hardware vendors to get android updates).

So, people should be smart enough to not buy any phone that works on the Verizon network, any phone sold in an AT&T store as part of a contract, and any phone in a T-Mobile store sold under a purchase plan other than 1-2 models in the US?

You're basically saying that Android is great as long as you don't buy 99% of the devices on the market.

And even if you guy, eg, a Galaxy Nexus with an unlocked bootloader, the company that sold it to you (Google) only provided support for 1.5 years from the date the device FIRST went on sale. MS supports Windows for 10 years after the NEXT version of Windows goes on sale. That is why 95% of the PCs in businesses are STILL running Windows despite all the talk about the death of the desktop. I don't really have a problem with the death of the desktop, but businesses aren't going to buy into an alternative that isn't supported for a long time. They're fine with BYOD, since they're not the ones paying for support.

Re:The solution is obvious

[Anonymous Coward]

If you were to give yourself some time, it could have sold for $100 on eBay. Seriously.

Re:The solution is obvious

[BarbaraHudson]

Kitkat is NOT a patch. It's also something that most of the millions of people who are affected can install. Please, stop defending the undefendable. The Android system is now even more fractured than linux.

Re:The solution is obvious

[paulatz]

Also battery life is allright, and usability is not worst than Samsung craptastic interface. Just at providing updates they really suck . Also note that they said they one major update was coming, then they retracted.

And still I would not mind, if it was not for unpatched vulnerabilities.

Re:The solution is obvious

[Anonymous Coward]

No, it's your hardware provider that is your problem, not Google.

What if I have a Nexus?

Re:The solution is obvious

[c]

But it's a situation that they could reasonably have foreseen.

They might've believed having an "open" handset operating system would break the various carrier/manufacturer strangleholds on the market similar to how MS-DOS and the PC affected the computing market years ago.

In fact, I think while that might not have been the plan from the outset, I'm willing to bet that's the direction the strategy went as Android gained market share.

Whether or not they should have planned for failure (or the partial success they have largely due to the Nexus series) is an interesting. Apple demonstrated that it's entirely possible to have an ecosystem of up-to-date phones, so it's not exactly unreasonable to expect that Android could have pushed things that way.

Re:The solution is obvious

[Anonymous Coward]

With great power comes great responsibility.

Re:The solution is obvious

[Shirley Marquez]

Updating those older versions of Android would be pointless. If you have a device that never got an update to KitKat, it's not going to get a patch either because its manufacturer clearly doesn't care about keeping it up to date.

Switching to a different browser solves the vulnerability during web surfing. It doesn't help with apps that use WebView as a component. so those apps will have to be used with caution.

Re:The solution is obvious

[Shirley Marquez]

Cyanogenmod has KitKat and Lollipop builds for that phone.

Re:The solution is obvious

[Coren22]

And any manufacturer can update to 4.4, they just choose not to. It is a free update, just like a service pack. Google is saying they cannot fix the older version, the correct solution is to update to 4.4, or service pack 3, not to bitch that they won't support the RTM version of Windows indefinitely. Complain at the manufacturers that refuse to support their product. Google already released a patch, it just is a full system update as that is what is required to fix the problem.

Re: The solution is obvious

[Anonymous Coward]

Except you're wrong on every count.

Google probably don't see the point of writing updates for superceded versions that they need the OEM to write their bits for and then get the cell company to push. History shows clearly that if either do actually make an effort it will be months and months late.

Have you any idea what would happen if Google did try to strongarm as you suggest? Clue- there would be far fewer Android products and likely plenty more Windows ones very quickly. The cheap nature of supplying something running free as in beer software appeals far more than any sort of zealotry.

IMO the actual obvious answer is to lock OEM's and cell companies out of the OS so they can't float their crapware in it causing all these problems, but that's probably too easy and controversial...

Re:The solution is obvious

[Anonymous Coward]

However, any android devices can be updated using custom roms. There are kitkat roms for even 4-5 year old phones like HTC evo 4g. So that's the major upside of open system like android

Re:The solution is obvious

[Anonymous Coward]

This is all fancy dandy, but some companies (Samsung, not to name one) make a slew of variant of the same phone, and then claim to sell billions of their phones. A phone from ATT will be slightly different from one from Sprint, which will be slightly different than one from Verizon. I bought an international, unbranded and unlocked I9100 3 years ago. It was top of the line at the time. Samsung stopped supporting it 18 months after its release, while the iPhone 4 (over 4 years old) is still officially supported by Apple. It currently runs 4.1.3. I could try to install CM, but after reading on it, it seems a rather silly to upgrade my phone, espacially now that there are no more stable releases, only nightly releases, to add confusion. I blame Samsung, the hardware manufacturer for it, not Google. It took 6 months for Samsung to release 4.1.3, because of all the added layers.

Re:The solution is obvious

[TsuruchiBrian]

Don't forget to buy a new battery too.

Re:The solution is obvious

[TsuruchiBrian]

When Obama says "If you like your docotor you can keep your doctor", he's not saying that Obamacare will forcibly prevent your doctor from retiring.

Similarly when I say android upgrades are free, I'm not saying that people without a phone capable of running those upgrades will get such a phone for free in order to keep every aspect of running the latest android completely free.

By this definition of free upgrades, no software upgrades are free unless they provide people with hardware who don't already have it. Linux isn't free to people without computers...

Re:The solution is obvious

[TsuruchiBrian]

Sucks for you. Get a new phone. I bought a nexus 4 over 2 years ago, and it runs lollipop. It probably won't run the next major update. I don't expect hardware to be supported forever.

Re:The solution is obvious

[TsuruchiBrian]

So, people should be smart enough to not buy any phone that works on the Verizon network, any phone sold in an AT&T store as part of a contract, and any phone in a T-Mobile store sold under a purchase plan other than 1-2 models in the US?

Yes

You're basically saying that Android is great as long as you don't buy 99% of the devices on the market.

Yeah sort of like how iphones are great, and 99% of other phones are not.

There are about as many great android phones as iphones, but there are also a bunch of bad android phones.

And even if you guy, eg, a Galaxy Nexus with an unlocked bootloader, the company that sold it to you (Google) only provided support for 1.5 years from the date the device FIRST went on sale.

It was nearly 2 years November 17th 2011 to Octover 31 2013, but yes. And you still have a phone with an unlocked bootloader that can run whatever software you want on it.

MS supports Windows for 10 years after the NEXT version of Windows goes on sale.

Is microsoft going to support windows phones 10 years after they are released? Supporting hardware and supporting software are 2 different things. Microsoft doesn't support very much hardware at all. They pass that duty on to hardware vendors.

That is why 95% of the PCs in businesses are STILL running Windows despite all the talk about the death of the desktop.

There are lots of reasons why microsoft has dominated the PC world. A lot of it has to do with luck.

I don't really have a problem with the death of the desktop, but businesses aren't going to buy into an alternative that isn't supported for a long time.

A lot of businesses use linux because it is better for many tasks. You can pay for support by licensing products through the company selling the product w/ a support package, or you can pay for support by hiring experts to manage products that are otherwise lacking support.

Windows is losing market share, now that more alternatives exist. Their product isn't bad, but it's just not the only game in town anymore.

Re:The solution is obvious

[Anonymous Coward]

Google gets a pass because Google isn't the one pushing updates to handsets. And because even if Google DID fix the problem, the handset manufacturers / carriers would most likely not push it to the handsets. And because if they were going to push it to the handsets, wouldn't a newer Android version be a better thing for them to push than a patched older version? It's not like the upgrade will cost them anything more than the patch...

Re:The solution is obvious

[Anonymous Coward]

I can't afford an iPhone

What? You can get an iPhone 5C on ATT for $0.99 these days. Data plans are the same for any "smartphone" Android, WP, or IOS.

Re:The solution is obvious

[Anonymous Coward]

Apple upgrades are shit and slow down the phone so much that people are dying for the next iphone.

Re:The solution is obvious

[TsuruchiBrian]

I suspect most phones running 4.3 could have been upgraded to 4.4 if the hardware vendors did the work to port the 4.4 release to their phones.

Re:The solution is obvious

[TsuruchiBrian]

XP is a version of Windows. Android 4.3 is a version of Android. They aren't just roughly analogous, they are exactly analogous.

Listen retard, XP is not a version of windows in the same sense that 4.3 is a version of android. When you patch android version 4.3 you get a new number (e.g. 4.3.1, or 4.4). When you patch windows XP you don't necessarily get a new version of windows (i.e. it's still just called XP)

If you bought your desktop from some store (let's say compUSA) and compUSA figured out a way to lock the CPU of the computer so that only executable code signed by compUSA could be run on this computer, and MS came out with a patch for windows XP but compUSA didn't bother signing the new windows XP version executables, you wouldn't be able to upgrade, but it wouldn't be Microsoft's fault, it would be compUSA's fault.

That is easily the dumbest statement I've seen on this thread.

If you don't understand what is being discussed, then your retarded opinion about what is dumb and what isn't is meaningless.

Re:The solution is obvious

[exomondo]

I suspect most phones running 4.3 could have been upgraded to 4.4 if the hardware vendors did the work to port the 4.4 release to their phones.

Even *if* your suspicions are correct the fact remains that they cannot be upgraded to 4.4.

Re:The solution is obvious

[TsuruchiBrian]

That fact does remain, but what I am arguing is that the real problem is the hardware vendors not google. They don't have much interest in supporting their products after they are sold, which would not be such a big deal if they didn't also take measures to actively prevent users from loading their own code onto those phones.

Until the hardware vendors change their ways, I think the most reasonable advice is "Don't buy phones with locked bootloaders, and preferably buy nexus phones from the google play store". It's not like apple where every iphone is a quality product. The android market requires you to be a little more tech savvy if you want to get a good product. The only thing that's going to prevent hardware maufacturers from making bad products is if people stop buying them.

Re:The solution is obvious

[Anonymous Coward]

Clearly Google has decided that the solution for this problem is to update Android. This is not an unreasonable solution. The problem is fixed, and how you get the fix is well documented.

The problem is when your carrier prevents you from upgrading. Blame for this issue lies soley at the feet of Verizon, At&T, Sprint, T-Mobile, etc.

Not just the carrier...also the phone manufacturers as well.
Their logic is, apparently, Why provide OS upgrades for our old handsets when we, the customers, should be buying their latest 'ooooh shiny' ones?.. so a nice big story about a 'wont fix' security hole should help them flog more,,cynical old me wonders just how engineered this situation is.

Re:The solution is obvious

[exomondo]

That fact does remain, but what I am arguing is that the real problem is the hardware vendors not google.

That's a fair position to take but in my opinion Google should see the situation and adapt to it by patching the older version especially since many of those phones do lack the capability to run 4.4 (though some may be able to skip 4.4 and run 5.0).

Until the hardware vendors change their ways, I think the most reasonable advice is "Don't buy phones with locked bootloaders, and preferably buy nexus phones from the google play store".

Even an unlocked bootloader isn't going to help you if you don't have a compatible system image, the binary drivers of one version don't necessarily work with the next because of the instability of the kernel ABI.

What Google should do is force a support requirement through the OHA.

Re:The solution is obvious

[rdnetto]

You might be thinking of the Play store and other Google apps, which as you say are not free. You can download and install them for free as a user, but if you want to ship them pre-installed on a device then there are licence agreements.

Out of curiosity, how exactly do you download the Play store before you have it installed?

Re: The solution is obvious

[Anonymous Coward]

Exactly, and totally agree. Get you system up-to-date, and it becomes a non-issue.

Re:The solution is obvious

[Zxern]

Does it matter? This bug not being fixed reflects very poorly on google and android as a whole, not the carriers, or the manufacturers. Google should at least put up a patch and then leave it in the hands of the carriers to push it our or not. To not even bother making a fix just proves the android fragmentation problem is a serious issue.

Re:The solution is obvious

[Zxern]

It would have to be a second hand/used sale as Microsoft won't sell a license for oems to install xp anymore.

Re:The solution is obvious

[azureel]

I agree about the point, that carriers are preventing upgrade (also some distributors like Samsung). But how about "Galaxy Nexus", Google's own device?
It is not getting a patch as well.
https://developers.google.com/...

Re: The solution is obvious

[Anonymous Coward]

Free? Wow wish I could live in that diluted universe.

Re:The solution is obvious

[fateblossom]

You do not understand. You can't just upgrade to Kit Kat, or Lolipop is the manufactures did not make an update. And they often do not.
Don't blame the carrier for that.

Sure the carrier locked phones sometimes gets the update later. But lets take the Samsung S3 (mini).
My sister has the mini and it's unlocked, and carrier free but she cant upgrade it to kitkat or lolipop. Because Samsung has not made an update.
That has nothing to do with the carrier, but the manufactures

Re:The solution is obvious

[TsuruchiBrian]

That's a fair position to take but in my opinion Google should see the situation and adapt to it by patching the older version especially since many of those phones do lack the capability to run 4.4 (though some may be able to skip 4.4 and run 5.0).

How long should they realistically keep doing this? I know it is common to support some hardware for decades, but people just don't keep cell phones that long. Typically they are kept for the length of a standard contract. The lithium batteries don't last much longer than that.

I think what makes more sense is for google to support older devices in some kind of limited capacity (e.g. turning off certain features or just coming out with an alternate release called "android lite" or something.)

Continually patching older releases may provide some short term good (if the hardware vendors are even willing to push those patches), but it also allows hardware vendors a convenient way to skirt their responsibility to port newer android versions to their phones.

Even an unlocked bootloader isn't going to help you if you don't have a compatible system image, the binary drivers of one version don't necessarily work with the next because of the instability of the kernel ABI.

I know most people aren't capable of rolling their own android version, but if you have a popular phone, chances are that there are people willing to develop custom android versions for your phone. While unlocked bootloaders doesn't magically make compatible software appear, simply not being actively hindered in loading different software is a giant step in the right direction.

What Google should do is force a support requirement through the OHA.

Maybe this would work. But I still think a consumer demand based approach could work just as well or even better. Maybe google could just give out grades to android hardware vendors based on things like releasing phones with unlocked bootloaders and releasing timely OS upgrades.

I also think that a big problem is that a lot of people still buy phones from their carriers. Nobody buys televisions from their cable company. Everything that can be done to disrupt this system will be a step in the right direction.

Re:The solution is obvious

[TsuruchiBrian]

That misses my point. And also it would not have to be a second hand sale. When an OEM sells a computer with windows XP does not depend on when the OEM copy of windows XP was purchased. I think I even still have an unopened OEM windows XP license somewhere.

Re:The solution is obvious

[Anonymous Coward]

If you are unable/unwilling to flash a custom ROM, then you can mitigate the issue by avoiding webview. You just need to use a browser that doesn't use webview for rendering content (e.g. Chrome or Firefox), and also avoid other apps that make use of webview.

Re:The solution is obvious

[exomondo]

How long should they realistically keep doing this? I know it is common to support some hardware for decades, but people just don't keep cell phones that long.

Well if you look at the usage of versions prior to 4.4 it is most of the Android userbase. I don't think there's a hard and fast rule on how long but given that most people are still using earlier versions I think it's pretty clear there needs to be some support.

Continually patching older releases may provide some short term good (if the hardware vendors are even willing to push those patches), but it also allows hardware vendors a convenient way to skirt their responsibility to port newer android versions to their phones.

Well really this is a special case anyway, the problem has been mostly resolved in recent Android versions where this is all moved into the Google Play app/services so Google can update these things directly. Webview specifically has been moved there in later versions.

Maybe this would work. But I still think a consumer demand based approach could work just as well or even better.

I doubt it, most people would have no idea about vulnerabilities such as this or that there is a new version of Android for their phones. If it doesn't say "hey, here's an update" most people don't know or care.

Re:The solution is obvious

[Anonymous Coward]

How likely is that really? How often have Microsoft been sued for security holes in Windows and had to pay out lots of money?

Re:The solution is obvious

[TsuruchiBrian]

Well if you look at the usage of versions prior to 4.4 it is most of the Android userbase. I don't think there's a hard and fast rule on how long but given that most people are still using earlier versions I think it's pretty clear there needs to be some support.

Right, but if every phone was upgraded to the version it is technically able to be upgraded to by the hardware vendors, then I doubt there would be very many phones still running android 4.3 (that people were still using).

I doubt it, most people would have no idea about vulnerabilities such as this or that there is a new version of Android for their phones. If it doesn't say "hey, here's an update" most people don't know or care.

I suppose this is true of PCs and windows updates as well, but there is enough consumer demand that Microsoft continues to release patches, even if most users don't care. I was envisioning a similar level of people caring in the android market to force good behavior on the part of vendors.

Re:The solution is obvious

[zieroh]

If you don't understand what is being discussed, then your retarded opinion about what is dumb and what isn't is meaningless.

Thank you for reinforcing my point.

Re:The solution is obvious

[zieroh]

They might've believed having an "open" handset operating system would break the various carrier/manufacturer strangleholds on the market similar to how MS-DOS and the PC affected the computing market years ago.

But for that to work, they would have had to have a meaningful way to abstract HW from SW. Branching the sources (or customizing the distribution, or whatever you want to call it) is simply not a mechanism that lends itself to widespread availability of updates. And this is the crux of my point: they SHOULD have known that. If they didn't know that, then why not?

Re:The solution is obvious

[c]

But for that to work, they would have had to have a meaningful way to abstract HW from SW.

Arguably, they do.

There's a fundamental problem with things like closed source drivers and folks down the chain forking Android to add their secret sauce, but at its heart Android is basically a big JVM on top of a Linux kernel.

Branching the sources isn't the only way to do it. It's just how things seem to work. That the assorted manufacturers and carriers are particularly shitty FLOSS software development collaborators, and that the smartphone hardware ecosystem is basically a collection of one-offs... that's a hard thing to fix.

Honestly, given the state of the industry when Android kicked off, I'm surprised things have gone as smoothly as they have.

Re:The solution is obvious

[TsuruchiBrian]

You're point was just wrong. And I actually explained *why* your point is wrong. Simply reasserting your point doesn't count as supporting evidence for your point.

Re:The solution is obvious

[exomondo]

Right, but if every phone was upgraded to the version it is technically able to be upgraded to by the hardware vendors, then I doubt there would be very many phones still running android 4.3 (that people were still using).

Well that's a pretty key point, is there any evidence to support that? Also it isn't just 4.3, this vulnerability is anything prior to 4.4.

I suppose this is true of PCs and windows updates as well, but there is enough consumer demand that Microsoft continues to release patches

Like I said, if it doesn't say "hey, here's an update" they won't care, Windows does that, Android does not. Android's approach to updates is a new operating system version rather than a patch.

Re:The solution is obvious

[Anonymous Coward]

And how is Google going to get it onto your device that is under the sole control of your carrier (probably even with a locked bootloader)? This isn't Google's fault. This is just a bunch of typical morons buying devices without checking that the hardware supports upgrades (e.g. not finding out if the bootloader is locked before buying) and not checking that the carrier has any history of providing updates. If you wanted updates, you should've bought a Nexus. Otherwise you fucked your own damn self. Deal with it and quit whining.

Re:The solution is obvious

[zieroh]

You're point was just wrong. And I actually explained *why* your point is wrong. Simply reasserting your point doesn't count as supporting evidence for your point.

I wasn't repeating my point. I was laughing at you.

Re:The solution is obvious

[zieroh]

Branching the sources isn't the only way to do it. It's just how things seem to work. That the assorted manufacturers and carriers are particularly shitty FLOSS software development collaborators, and that the smartphone hardware ecosystem is basically a collection of one-offs... that's a hard thing to fix.

While that seems vaguely plausible on the surface, I honestly have to wonder if the vendors branch the sources because it is the most direct way to accomplish their goals. Which again seems plausible, unless we consider that maybe branching the sources is the most direct way precisely because Google didn't give them a better way to do it.

There seem to be three possibilities:
1) The vendors don't actually have a better way than branching the sources
2) Google gave them an abstraction layer, but the vendors are chumps and choose to ignore it
3) Google gave them an abstraction layer which sucked and the vendors rightly bypassed it.

From my perspective, #1 and #3 are inexcusable, and squarely at Google's feet. #2 is fixable by contract (except for rogue players like Amazon), which is still squarely at Google's feet.

Let me put it another way: if Google isn't happy about this situation, why the fuck didn't they fix it a long time ago?

Re:The solution is obvious

[c]

While that seems vaguely plausible on the surface, I honestly have to wonder if the vendors branch the sources because it is the most direct way to accomplish their goals.

It's possible. But looking at how the hardware OEM's operate (particularly at the level of the SoC vendors), the process from the outside looks a heck of a lot like "branch, patch, compile, rm -rf". And it's worth pointing out that the crap the OEM's mod into Android (Touchwiz, Sense, etc) plus the bloatware on top has been getting less invasive as time goes on and the vendors have been getting a bit quicker to pick up Android version changes. So there does appear to have been some improvement.

But at the core of it, "giving back to the community" and "smartphone OEM" aren't phrases that one typically expects to see together.

Let me put it another way: if Google isn't happy about this situation, why the fuck didn't they fix it a long time ago?

I think the carriers and OEM's are probably a lot less amenable to arm twisting than you think. The carriers basically lost complete control over the iPhone, so I can't see them being enthusiastic about Android also becoming a black box to them, and the OEMs are going to make what the carriers are willing to buy, plus they still want to have their crapware and whatever to set themselves apart from the rest of the pack.

It's worth pointing out that by now, the major OEMs probably have enough Android expertise that breaking off and building directly from AOSP is a feasible option if Google tries to flex too much muscle.

And if you think things are bad now, think of how much worse it will get if a substantial chunk of phones don't even have a common Google Play-based core capable of patching an ever-increasing set of components.

That's not even getting into the anti-trust concerns Google's going to run up against if they start adding more conditions to their contracts. They're already getting grief over "forcing" the bundling of their apps, imagine what they'll get if they start "forcing" their own updates to the core O/S (I'm sure the contract wouldn't be written quite that way, but we all know how it would be twisted).

At this point, the only proper "fix" I can see is for Google to keep doing what they're doing. Keep improving Android, building and improve their collection of must-have apps, try to maintain a market of unlocked Android Nexus/One/GPE phones, and keep some pressure on the OEMs to get with the program. I'm also quite interested in seeing how the Google wireless offering might go... if they create a carrier which only accepts unlocked phones and isn't trying to rape the consumer for profits, the North American carriers could be in for a well-deserved ass-kicking.

Re:The solution is obvious

[sexconker]

Download the Android source from the official site for free: https://source.android.com/sou...

Android includes proprietary drivers and other code that you don't get to access unless you're a big OEM giving Google money, branding agreements, etc. Android also includes other code that does make it into the public release, but delayed for many months (often over a year).

The repository you linked isn't Android. It's an old version of stripped-down Android that no one can use to create a competitive high end device. Google does this because of what Amazon did with the Kindle line, and because of what they fear Samsung could do. (Hint: Fork Android, have your own store, and cut Google out of the picture.)

This is why Google made their apps separate (and not free) for OEMs. People want Google's apps, but they don't care about Android Caramel Apple when they're already on Lemon Meringue. By tying those apps to a CASH MONEY license or a branding / no fork / first born's soul agreement, Google always gets a piece.

This is also why Google doesn't want to patch old devices. Doing so just means people have less incentive to run the latest version of Android, which is the version Google can guarantee it gets paid for. Carriers have similar motivation - testing/pushing out the updates is costly, and NOT doing so encourages people to buy a new device and extend their contract.

Re: The solution is obvious

[sexconker]

You do not have to pay for android source code. It is open source. You can download and compile it right now I'd you wish. That's what Amazon did with fire os and what cyanogenmod did.

If you want to use Googles apps on a phone you sell, then yes there is an agreement to get access to googles apps on your companies phones.

Android is not open source. Android is not free.
The publicly available open source code is NOT the same as what is developed by Google (and collaboratively by OEMs) and released to market running on high end devices. This (and Google's apps) is what consumers want, and it's what they (and OEMs) pay actual money for.
The two are not comparable. AOSP is NOT Android.

Re:The solution is obvious

[mdielmann]

Okay, let me put it another way. If the model Google was using wasn't broken, and not a practical for security purposes in the real world, then why did they change their design to allow them to update core elements without having to wait for vendors to update their modified versions?

Google's actions make it clear that their design didn't support the business model they promoted.

Re: The solution is obvious

[Anonymous Coward]

what do you mean by pulling in XP? Microsoft supported their OS for something like 13 years, far beyond what Google, OEMs, and carriors support (or lack their of) lifespan.. I am NOT I'm microsoft employee or fan boy

Re:The solution is obvious

[TsuruchiBrian]

As I said, you have nothing (I guess except your retard laughing).

Re:The solution is obvious

[zieroh]

At this point, the only proper "fix" I can see is for Google to keep doing what they're doing. Keep improving Android, building and improve their collection of must-have apps, try to maintain a market of unlocked Android Nexus/One/GPE phones, and keep some pressure on the OEMs to get with the program.

And sadly, you may very well be right.

Re:The solution is obvious

[Rich0]

And even if you guy, eg, a Galaxy Nexus with an unlocked bootloader, the company that sold it to you (Google) only provided support for 1.5 years from the date the device FIRST went on sale.

It was nearly 2 years November 17th 2011 to Octover 31 2013, but yes. And you still have a phone with an unlocked bootloader that can run whatever software you want on it.

The last Galaxy Nexus update was made available on July 24th, 2013. But, whatever, if you bought the phone in Oct 2012 (when it was last available for purchase) you'd have gotten updates for 9 months, or maybe a year if you want to argue that a phone that it was still supported until Oct 2013.

Re:The solution is obvious

[Anonymous Coward]

OR, maybe you just don't understand a thing about Android. LOL.

No, there's no maybe about it.

Their excuse sucks

[BarbaraHudson]

They claim not to have the resources to do maintenance because it's 5 million lines of source code. Gee whiz, how many 100s of millions of lines of source code are there for OSes - and yet they don't get EOLed in a couple of years.

What other bugs (in this and other projects) are going to be labed WONT_FIX?

Re:Their excuse sucks

[ThePhilips]

Hipster developers do not do such lowly menial tasks as maintenance!

Re:Their excuse sucks

[Anonymous Coward]

it was fixed. it is fixed... in Android 4.4. Android 4.4 is free update. People don't have the patch because carriers don't patch 2 year old phones.

Re:Their excuse sucks

[BarbaraHudson]

it was fixed. it is fixed... in Android 4.4. Android 4.4 is free update. People don't have the patch because carriers don't patch 2 year old phones.

And this is a problem with the current android ecosystem.

Re:Their excuse sucks

[dumfrac]

NO. It is certainly NOT fixed. The Google Galaxy Nexus is a product created by Google. It runs stock Android, and Google has not released 4.4 for the *Google* Galaxy Nexus. Don't claim that Google has released a fix.

Re:Their excuse sucks

[BarbaraHudson]

So they really didn't fix it in Android 4.3. Not everyone wants to upgrade to the lastest and greatest - ask windows 7 users what they think of windows 8.

Re:Their excuse sucks

[Geordish]

It is fixed. The fixed version just hasn't been released for the Galaxy Nexus...

Re:Their excuse sucks

[monkeyzoo]

The "excuse" was omitted in the Slashdot post...

Here it is verbatim from Google on January 12:
"If the affected version [of WebView] is before 4.4, we generally do not develop the patches ourselves, but welcome patches with the report for consideration. Other than notifying OEMs, we will not be able to take action on any report that is affecting versions before 4.4 that are not accompanied with a patch."

That's not even a reason. It's a meaningless restatement of the question:
"Why are you not developing a patch for 4.3?"
"Because 4.3 is before 4.4. Thank you for your question. That's all the time we have."

Re:Their excuse sucks

[dumfrac]

You cannot support your claim, because you cannot point me to the commit to the WebView component in the 4.3 code base, i.e., Google has not fixed their product (the Google Galaxy Nexus). According to them, their official position is that they never will.

Re:Their excuse sucks

[mrbester]

It's worse than that. They are saying that if you don't submit a patch with your bug report then you can fuck off, because they don't care. Even if you do submit a patch they'll only "consider" it, meaning when they feel like getting around to it. Which will be never, because *they don't care*.

Re:Their excuse sucks

[Geordish]

Why does it need to be in the 4.3 code base?

As previously mentioned, Android versions are not like Windows versions - ie a massively different OS. They are incremental, and especially with the recent versions don't require massive additional resources. The fix is to upgrade from 4.3 -> 4.4. The Galaxy Nexus is capable of running 4.4.

Your argument here should be 'Why is Google not releasing 4.4 for the Galaxy Nexus'. I could support that statement.

Re:Their excuse sucks

[mrbester]

Even less want to buy a new phone because the only way to get a "fix" is to use a OS their current phone doesn't support. A car analogy is that you have to buy a new car because your current one doesn't have seat belts. They could be fitted, but it has been decided that they aren't going to be.

Re:Their excuse sucks

[dumfrac]

Depends on your definition of a patch. I tend to think of them as reasonable sized diffs to a code base, but some elements of the industry seem to be moving away from that model. I would say that it is fair to claim that Google has not fixed the problem for the Google Galaxy Nexus (and we can have a seperate discussion about the nature of patches). BTW, the CyanogenMod port of 4.4 to the Google Galaxy Nexus still has an unresolved problem (http://wiki.cyanogenmod.org/w/Known_Issues_page_for_maguro), so yeah, the Google Galaxy Nexus can sort of run 4.4.

Re:Their excuse sucks

[Geordish]

That's the kind of problem that would be easier to be fixed if the full source code was available to you. Cameras (among other things) tend to be a binary blob. Reading the associated bug, it actually appears to be the GPU driver that is out of date there.

The fact there are very few complaints is testament to it being able to run 4.4+.
(https://jira.cyanogenmod.org/browse/CYAN-1651?jql=status%20in%20(Open%2C%20%22In%20Progress%22%2C%20Reopened%2C%20%22In%20Review%22%2C%20QA)%20AND%20text%20~%20%22maguro%22)

Typically in porting a device that hasn't been officially upgraded a replacement driver must be found that supports the new API calls. Often drivers from phones with similar hardware is pulled in, which obviously will never work quite too well. This was a big thing when going from 2.x->4,x as the camera interface changed massively.

Looking at the bug report, they expect that to be fixed when they move to CM12.

Re:Their excuse sucks

[BarbaraHudson]

It's worse than that. They are saying that if you don't submit a patch with your bug report then you can fuck off, because they don't care. Even if you do submit a patch they'll only "consider" it, meaning when they feel like getting around to it. Which will be never, because *they don't care*.

Who the heck do Google think they are - Linus Torvalds?

Re:Their excuse sucks

[Anonymous Coward]

This!

Mod this up times infinity!

Re:Their excuse sucks

[CastrTroy]

Similarly, I have an LG Optimus G2X. It came with Android 2.2. It didn't get any updates at all. I was able to get it up to 2.3 by using the firmware from another carrier. This from a phone that debuted only about 6 months before Android 4 came out. You might think that LG or my carrier is the only one to blame. But when Google has their name engraved on the back, it gives me a bad impression of them when they put their name on a product that has so little support.

Re:Their excuse sucks

[rubycodez]

You are clueless. Linux kernel has 15 million lines of code but over 10,000 developers for that. You're saying they should hire 5,000 developers to make you happy instead of having customers upgrade?

Re:Their excuse sucks

[ganjadude]

no, the correct car analogy would be that the seatbelts in the car are not great and can cause death, but the car manufacturer is no longer producing that model. so you can buy aftermarket seatbelts (root +CM) or you can buy a new car. or you can live with the bad seatbelts

Re:Their excuse sucks

[meta-monkey]

I'm eagerly awaiting the inclusion of WebKit in systemd.

Re:Their excuse sucks

[Anonymous Coward]

It's worse than that. They are saying that if you don't submit a patch with your bug report then you can fuck off, because they don't care. Even if you do submit a patch they'll only "consider" it, meaning when they feel like getting around to it. Which will be never, because *they don't care*.

Who the heck do Google think they are - Linus Torvalds?

Google has fixed the issue. The fix is available in the printed Android source code contained in the publicly-accessible basement of Google headquarters in Mountain View, CA. Anyone is free to come and make a photocopy of the relevant page(s), take them home, type the fix into his copy of the Android source code, and rebuild and reflash his affected devices. Anyone not willing to take these simple free steps just doesn't care about system maintenance. /sarcasm

I bought my phone (mid-range Samsung) in December 2011 from T-Mobile. It's been on Android Gingerbread the entire time. Although not directly supported by Cyanogenmod, there are numerous CM and other ROMs available for it running Android versions up to 4.4.4. I'll get around to it one of these days...

Re:Their excuse sucks

[BarbaraHudson]

Don't be purposefully stupid - it shows. And no, linux does not have "10,000 developers at work" unless you cout everyone who ever worked on it in the last decade, no matter how small their contribution. And as everyone likes to point out, the kernel by itself is pretty useless - how many lines go in the average distro would be more accurate.

Also, the bug wasn't in the kernel, so comparing apples and oranges ...

Windows has about 50 million lines. When there's an exploit in, say, IE (a similar situation to Android), they fix it. Google's excuse absolutely sucks. I like my Android, but maybe I should look at an iThingee next time around, especially since they have much better support for visual assistance.

Re:Their excuse sucks

[Anonymous Coward]

Troll harder Barbara, we know you can do it...

Re:Their excuse sucks

[rubycodez]

wrong, that number was in last 8 years. Or over 1,200 contributed in the last six months.

no, Microsoft makes you install service packs or you're out of support. same thing here, quit your whining.

Re:Their excuse sucks

[BarbaraHudson]

Microsoft lets you install patches for their previous OSes. Google has said they won't even bother making a patch - you have to upgrade. For most users, that's not going to happen.

Why? They say that they haven't got the resources. Of course they don't - only about 10% - 12% of their employees are engineers, and many of those are involved in the ad side of things. Google works for advertisers, not users. Both Apple and Microsoft know that pissing off users has a direct effect on their bottom line. Google? Not so much, eh?

I guess free isn't that free after all.

Re:Their excuse sucks

[Anonymous Coward]

NO. It is certainly NOT fixed. The Google Galaxy Nexus is a product created by Google. It runs stock Android, and Google has not released 4.4 for the *Google* Galaxy Nexus. Don't claim that Google has released a fix.

I have two Google Nexus, both updated over the air to 5.0.2 so what are you talking about nexus not having a release?

Re:Their excuse sucks

[rubycodez]

microsoft inactivates your ability to get patches that you paid for just because you changed a hard disk. sometimes the indian that answers the phone argues with you about restoring that access.

meanwhile, in the land of free software, upgrading to new OS and apps is free. so you complain that they don't support a years old version, yet you should just upgrade.

quit yer whining.

Re:Their excuse sucks

[BarbaraHudson]

What does that have to do with Google refusing to even try to fix a problem in 4.3, knowing that the majority of their user base cannot upgrade to 4.4 because the telcos don't want to be bothered?

Article misses the point

[Anonymous Coward]

The WebView code was originally tied directly to the android version and HW manufactures aren't willing to deploy 4.4 since it would take effort on their part. To avoid this, in the newer versions of android, they have made it so there can be a play store update to fix and replace the webview-like modules so they can regain control of the patching process and not rely on handset companies.

Re:Article misses the point

[Anonymous Coward]

"HW manufactures aren't willing to deploy 4.4 since it would take effort on their part."

And they'd really like to sell you new device. A serious conflict of interest when allowing them to squat on the power to upgrade existing HW (short of rooting).

Re:Article misses the point

[ThePhilips]

The WebView code was originally tied directly to the android version and HW manufactures aren't willing to deploy 4.4 since it would take effort on their part.

4.4 changed WebView and that broke a number of apps.

And not simply broke. Google has removed sizable chunk of WebView functionality because it is not really WebView anymore, it is small Chrome browser window and the features everybody was relying upon where never part of Chrome and as such... tough luck.

To the company with the resources of Google, lame excuses like that are just unacceptable.

Re:Article misses the point

[Anonymous Coward]

and require that you have a google account tied to your phone to get security updates.

Re:Article misses the point

[goombah99]

4.4 won't run on devices with less than 512M so even if the carriers wanted to they can't upgrade.

Re:Article misses the point

[Anonymous Coward]

Actually KitKat does run on devices with less than 512M (it requires only 340MB), and it claimed to be more efficient than previous versions of Android ("project svelte").

Re:Article misses the point

[Anonymous Coward]

but when i say that android is absolute, undiluted crap, i get screamed at... "you're stupid, i don't have these problems, you're too picky, apple fanboi, what better is there, m$ fanboi, you run an unsupported rom, go back to stock rom, you run a stock rom, go install cm, your device is old, get a newer one, your device is very new, wait for a bugfix" yadda yadda yadda

i have an xperia z ultra. it is significantly more powerful than my netbook on which i run windows 7 (let's not even mention the computers i used to run fucking xp) and on which 7 are quite snappy. Do tell why am i stuck with android on such a powerful device and not a propr full-blown OS with functionality a thousand times better than on android?

Re:Article misses the point

[thegarbz]

Lame excuses like what? They have provided an update, the update changes the API somewhat. The bug is fixed and developers and vendors don't want to fix their end of the system, and now it's all Google's fault?

I'm not entirely sure who you're blaming for what.

Re:Article misses the point

[ThePhilips]

and now it's all Google's fault?

They have changed API, degraded functionality, and changed H/W requirements - in a point release.

Point release for adding and fixing features, NOT changing and removing features.

But basically with 4.x, Google simply given up to have any release strategy. Because 4.x series (and 5.x onwards) are most definitively rolling releases.

Alpha and beta testing using the paying customers? As if Google lacked money to hire testers or simply outsource the testing...

Re:Article misses the point

[thegarbz]

They have changed API, degraded functionality, and changed H/W requirements

So just like in a windows service pack? Oh but you didn't complain then because ....?

Re:Article misses the point

[ThePhilips]

MS changed H/W requirements only ONCE and only for the Vista.

That was pretty much the only time ever MS changed the H/W requirements for a released product.

They have done it ONCE in the whole MS Windows history. And that was because they have set H/W requirement too low to satisfy demands of few large OEMs.

MS sucks on many fronts - but software release and support process they have nailed at least 1.5 decade ago.

Google really has to sit down and realize that they, as the Android platform supplier, have responsibility to their users. They can't just do whatever the hell they want and expect the whole world to follow them. When shit hits the fan, they can't just pretend that they have nothing to do with it.

Re:Article misses the point

[thegarbz]

MS changed H/W requirements only ONCE and only for the Vista.

Horseshit, Try running XP with SP3 on a computer which had the minimum hardware requirements for XP 6 years earlier. I won't even describe it for you. It is something that needs to be experienced and you will be met with plenty of personal reflection time as you do.

Google really has to sit down and realize that they, as the Android platform supplier, have responsibility to their users. They can't just do whatever the hell they want and expect the whole world to follow them. When shit hits the fan, they can't just pretend that they have nothing to do with it.

Oh you mean like they already did by pulling these core components out of Android and into the Play Store so they could update them on the run as they went? You know the thing they have been doing progressively since version 2.3 and which they have announced effectively completed in version 5.0? That little thing? The thing which people then COMPLAIN about because evil Google is now putting core open source components into the Play Store and "removing openness" or some shit like that?

Yeah all these Google complains are getting stale.

Re:Article misses the point

[ThePhilips]

MS changed H/W requirements only ONCE and only for the Vista.

Horseshit, Try running XP with SP3 on a computer which had the minimum hardware requirements for XP 6 years earlier. I won't even describe it for you. It is something that needs to be experienced and you will be met with plenty of personal reflection time as you do.

You missing completely the point.

OEM can install XP on a system with minimum H/W requirements - and he would get the MS blessing and support.

OEM can NOT install Android on a system with less than minimum H/W requirements - because he would not get approval from Google.

Oh you mean like they already did by pulling these core components out of Android and into the Play Store so they could update them on the run as they went?

But where is the update in the Play Store which would bring that to the Android 2.x-4.x?

Those are all solvable problems ISVs routinely have to deal with. Except the Google.

Re:Article misses the point

[thegarbz]

But where is the update in the Play Store which would bring that to the Android 2.x-4.x?

It's called 5.0. You know, the latest version with all the bells and whistles? Or are you advocating now that Google goes back and releases an update that dramatically changes and breaks components of 2.x? Because that is entirely why they depreciated Webkit to begin with.

Re:Article misses the point

[ThePhilips]

Or are you advocating now that Google goes back and releases an update that dramatically changes and breaks components of 2.x?

Of course not.

What they should do, is to mimic all other companies which take development processes and security seriously:

cd ~/src/android-repo/
git co android-2.x
<fix the shit>
make all
make test
make release
git cm -a
git co android-3.x
<fix the shit>
make all
make test
make release
git cm -a
git co android-4.0.x
<fix the shit>
make all
make test
make release
git cm -a
git co android-4.1.x
<fix the shit>
make all
make test
make release
git cm -a
git co android-4.2.x
<fix the shit>
make all
make test
make release
git cm -a
git co android-4.3.x
<fix the shit>
make all
make test
make release
git cm -a

They have to repeat it for all the 4.x branched, because the idiots managed to make API breaking changes there. In literally every point release.

Then, they should send the changes to the OEMs, organize press conference, and announce that they did everything they could - the OEMs are tag now.

Nice troll

[MikeBabcock]

Like everyone else reporting on this story, it completely misses the point -- there's no *point* in Google writing a patch, none of the hardware companies involved would ever bother to deploy it. They have *no* control over that bit of code in your phone unless you're running a Nexus device.

Re:Nice troll

[Godai]

Also a point that gets largely glossed over is that this only affects apps that use Webview as a widget -- browser apps like Chrome or Opera aren't affected because they've updated themselves to use Chromium (or something else). This may affect 60% of Android users, but what percentage of those are using the browser inside an app to visit random sketchy websites? I'm guessing the actual user base at risk is quite small.

The way this is reported it sounds like if you use Chrome on anything south of 4.4, you're IN GRAVE MORTAL DANGER OF TEH HACKZ.

Re:Nice troll

[Mr D from 63]

Yes, 60% is very misleading, as is the intentional omission of how easy the problem is to avoid.

But, hey, why pass up a chance to bash?

Re:Nice troll

[OhPlz]

I have a Google Nexus. 4.3 is the last version supporting my phone. The phone does everything I need it to, so I don't want to waste money on a newer one. I think this is a blatant attempt to force people to buy newer phones. All their craplets get updated, but not the Android OS.

Re:Nice troll

[Anonymous Coward]

what percentage of those are using the browser inside an app to visit random sketchy websites? I'm guessing the actual user base at risk is quite small

Do the android Twitter, Facebook, etc clients not use the webview inside their apps? A not-insignificant amount of 'web-browsing' happens when people follow links in social media apps

Re:Nice troll

[Anonymous Coward]

Considering that even the Nexus4 can run Lolipop, I have to ask: which Nexus phone do you own?

Re:Nice troll

[omnichad]

They just said "Google Nexus" but they probably mean Galaxy Nexus.

Re:Nice troll

[dumfrac]

(Not the OP here.) I presume that it is the Google Galaxy Nexus. Google has not made 4.4 available for the Google Galaxy Nexus.

Re:Nice troll

[Pope Hagbard]

Which Nexus device are you using, exactly? Cyanogenmod might be an option; I've upgraded my Droid 4 to 4.4.4, and the last official release for that device is IIRC 4.1.2.

Re:Nice troll

[sootman]

But... but... but... open!

Re:Nice troll

[OhPlz]

Yea, it's the Galaxy Nexus that Google was selling. No 4.4.

Re:Nice troll

[WaffleMonster]

Like everyone else reporting on this story, it completely misses the point -- there's no *point* in Google writing a patch, none of the hardware companies involved would ever bother to deploy it. They have *no* control over that bit of code in your phone unless you're running a Nexus device.

This is just an excuse there are ways of architecting systems or adding strings and pressure that would have avoided these completely **predictable** unpleasantries from the start. This is like building a bridge that collapses during a wind storm and the builder/architect say hey not our fault we didn't cause the wind.

Re:Nice troll

[Godai]

I'll admit that I don't use any of those apps, so I can't say -- I would have assumed that they would open the default browsers of the system -- but maybe they do it in-app.

That said, I'd expect the big guys like Twitter or Facebook to upgrade to the newer component for that very reason -- someone gets hacked the user experience will fault Twitter or Facebook (and this case, with some good cause). Still, I hadn't thought of those cases, so maybe that does make this more dangerous than I thought!

Re:Nice troll

[ArcadeMan]

Yeah! Patch it yourself you goddamn hippies! /sarcasm

Re:Nice troll

[Solandri]

The original Google Nexus and Nexus S only had 512 MB of RAM. While it's possible to run Jelly Bean, Kit Kat, and Lollipop in 512 MB, I really don't recommend it. I did that on my original Galaxy S for a year. Kit Kat (which actually uses less RAM than Jelly Bean) leaves less than 100 MB free, and you're limited to using about 2-3 apps. The moment you exceed that the phone goes into a kill-loop where it runs out of RAM so it kills the oldest program, then it needs to load that program again so it kills the next oldest program, repeat.

The primary culprit is the Google Apps suite (Play store, email, maps, Chrome, Drive, etc). They've been growing in size and features as phone hardware has improved, leaving older 512MB devices in the dust. If you can figure out a way to uninstall unneeded apps, you may be able to get it to work. I decided it was time to retire my 4-year old phone and bought a new one. My laptop upgrade cycle is about 3 years, so the phone actually lasted longer than other comparable tech.

Re:Nice troll

[stephanruby]

Like everyone else reporting on this story, it completely misses the point...

Notice that this story is a repeat with always the same theme. It always includes a critic of Google going after Microsoft as well.

It's not just a troll posting this, it's most likely a paid troll doing it.

Re:Nice troll

[Pope Hagbard]

Turns out that Cyanogenmod supports that phone:

GSM version: http://wiki.cyanogenmod.org/w/...
Sprint version: http://wiki.cyanogenmod.org/w/...
Verizon version: http://wiki.cyanogenmod.org/w/...

GSM version gets the latest. Verizon and Sprint versions have been dropped, probably due to lack of maintainer interest, but the Verizon one at least gets something 4.4-based.

Re:Nice troll

[ganjadude]

believe it or not, FB app used to open chrome by default for me. in a recent update it now goes through an internal browser in the FB app. so it seems they went backwards

Re:Nice troll

[Anonymous Coward]

> what percentage of those are using the browser inside an app to visit random sketchy websites?

A very significant percentage. Anyone who uses Reddit is Fun, for example, clicks on links that are loaded in a local webview inside the app.

Re:Nice troll

[MikeBabcock]

My point was that only the Galaxy Nexus *could* get updated by Google, because they have the ability to do so. I think you believe too strongly in conspiracy theories to realize this is about not wasting energy on something that's nearly pointless to try and fix.

Their tablets have more RAM than the Galaxy Nexus; though you can easily install Cyanogen or Paranoid Android on it instead.

Re:Nice troll

[MikeBabcock]

Yes, it is, you can download the source code, root your phone, compile and install your own fix any time you want. Paranoid Android, Cyanogen and a dozen other options exist. Human laziness and the fact that manufacturers are trying to lock you out of doing such things notwithstanding, Android is pretty open.

Re:Nice troll

[thegarbz]

Except it's not just the browser. Webview is used by MANY applications for various reasons. The attack surface is actually quite large.

Re:Nice troll

[Eythian]

Because TI don't support some of the hardware in it, so they can't get new drivers for it. That hardware contract should have had more of a support length built into it.

Re:Nice troll

[chihowa]

Cyanogenmod is still releasing builds for the GSM Galaxy Nexus, but there's nobody looking after these builds on that platform.

There's a radio glitch in everything above CM 10.1.3 on the GSM Galaxy Nexus. Loss of signal from the cell radio will (sometimes?) leave the phone unable to reestablish a cellular data connection until the phone is rebooted.

Paranoid Android still actively supports the Galaxy Nexus, though.

Re:Nice troll

[Pope Hagbard]

Too bad. I had that radio glitch with 10.1.x on the Droid 4, but CM11 fixed it.

Re:Nice troll

[Anonymous Coward]

The basic problem is that Google fumbled the licensing for Android and are left with no way to fix vulnerabilities like this. Had they kept more control over security updates from the beginning, they could have avoided this situation. Microsoft manages to do security updates on all OSs it maintains; Google could have done the samae. Keep in mind that they set the terms for useage of Android.*

WRT the immediate problem, they should give the manufacturers an opportunity to deploy it. AFAIK manufacturers aren't philosophically opposed to sw updates; if Google found a way to make the update process smooth - either a general solution, or working with manufacturers on a case-by-case basis, developing a standard method of integrating their updates with the customized Android - then it stands to reason that manufacturers would work with them.

At the end of the day it is the phone owners who are hurt by this, and both Google and the manufacturers have an incentive to fix problems: both of their reputations are on the line, and both could lose business to manufacturers of smartphones with other OSs.

* Google's version of Android is indeed controlled by Google. It is true that some parts of Android are licensed under Free licenses, many other parts aren't. A manufacturer that wants the all the software we collectively refer to as 'android' on their phones must license proprietary Google software; thus, Google can set terms. See http://arstechnica.com/gadgets...

Here's a tidbit:

While it might not be an official requirement, being granted a Google apps license will go a whole lot easier if you join the Open Handset Alliance. The OHA is a group of companies committed to Androidâ"Google's Androidâ"and members are contractually prohibited from building non-Google approved devices. That's right, joining the OHA requires a company to sign its life away and promise to not build a device that runs a competing Android fork.

Re:Nice troll

[Anonymous Coward]

Get cyanogenmod. It not only gives you new apps and the latest Android with app permission controls, it will also make your Galaxy Nexus fast again. It is awesome.

Why Google? Shouldn't Microsoft patch XP?

[Anonymous Coward]

Why all the venom for Google? You don't see Microsoft releasing patches for Windows XP.

Not to be an apologist for Google, but

[NoNonAlphaCharsHere]

Apple and Microsoft control their own update process on all platforms; Google does not. It's the individual carriers who are getting in the way of Android updates.

Re:Not to be an apologist for Google, but

[finkployd]

No really an apology for google though, more of a "here is how google royally screwed up in their relationships with carriers that Apple and Microsoft seem to have gotten right".

Re:Not to be an apologist for Google, but

[Noah Haders]

Apple and Microsoft control their own update process on all platforms; Google does not. It's the individual carriers who are getting in the way of Android updates.

Google set it up this way. According to the Google Play dashboard, 61% of people are v4.3 or lower. you know that 90% of them will never update. And the google play store only collects phones that visit the service, imagine the tens of millions "grandma's phone" people who use an android because that is the default cheap phone without making use of the play store. Sounds like a basket of fail to me.

https://developer.android.com/...

Re:Not to be an apologist for Google, but

[Anonymous Coward]

In 4.4 they removed a bunch of functionality from the OS into apps. They can updates apps whenever they want because they control the Play Store. The browser(WebView) is one of those things they moved.

Re:Not to be an apologist for Google, but

[Lazere]

Alternatively; "Here is how Google royally screwed up writing their OS so that updating even relatively minor parts requires a full OS upgrade while Apple and Microsoft seem to have figured out how patching works."

Re:Not to be an apologist for Google, but

[finkployd]

Also a fair point. I cannot believe is 2015 and Google still hasn't figured this out.

Re:Not to be an apologist for Google, but

[Rick Zeman]

Apple and Microsoft control their own update process on all platforms; Google does not. It's the individual carriers who are getting in the way of Android updates.

And who entered into the contracts with carriers saying who is responsible for what? Google can't dodge some form of culpability for this.

Re:Not to be an apologist for Google, but

[Munchr]

Microsoft does NOT control their own update process for Windows phone. Updates are delayed by each carrier for "testing" before being released. You can visit Windows Phone Availability to see which carriers phones have been updated to the latest version, Denim. As it stands, only 1 carrier has issued the Denim update, and only to 2 phones. If you don't have one of those 2 phones from that specific carrier in the US, you can only obtain the Denim update by signing up as a developer. Of course, by doing so, you acknowledge that your carrier no longer has to support your phone since you are no longer running carrier approved firmware.

Re:Not to be an apologist for Google, but

[Anonymous Coward]

Alternatively: "Here is how Google made sure their operating systems are exactly the same on every device for a given version, instead a patchwork of KB bulletins that all conflict and can prevent the OS from booting if failing to install."

Re:Not to be an apologist for Google, but

[Anonymous Coward]

And what would this patching miracle be for Apple? If you are running say version iOS 6.1 and it is found to contain a nasty bug, Apple won't allow you to get 6.1.1 or 6.2. You are forced to get iOS 8.x. And what if your device is not supported by iOS8? You are fucked.

Re:Not to be an apologist for Google, but

[Anonymous Coward]

And who entered into the contracts with carriers saying who is responsible for what? Google can't dodge some form of culpability for this.

AOSP is open source... as such the carriers take the source code and modify it at their leisure, and then bring it to their various phones.

It's not a contract saying who is responsible for what, it's that Google no longer even controls the codebase that the carriers are using. Much like Linux, Google can push a new version, but if a distro refuses to forward-port or update, there's no patch available.

Re:Not to be an apologist for Google, but

[Anonymous Coward]

No because Google isn't even providing a patch.

When Microsoft EOLed Windows Phone 7, they didn't just say that you need to upgrade to Windows Phone 8 to get around security issues (by buying a new phone). This is Google's fault and until they write a patch, then it will remain their fault.

Once they write the patch, then it still remains largely their fault for allowing such a broken ecosystem to exist in the first place. They're the lead platform across the world and this is somehow still a problem; it's mostly Google's fault, followed very closely by the core manufacturers that abused the freedom. Google's desire to push more devices running any version of Android by enabling manufacturers to never look back is the root cause here.

Re:Not to be an apologist for Google, but

[ameoba]

It's easy for Microsoft - nobody's actually buying their phones.

Re:Not to be an apologist for Google, but

[Anonymous Coward]

Apple and Microsoft upgrade the entire OS as well. The difference is that they have fewer hardware manufacturers to deal with, and probably some contractual language set up so that they can force updates.

Android updates are at the mercy of Google, the hardware manufacturers, and the carriers.

Ideally, they would make more of the OS incrementally-updatable. Currently, all of the Google apps, including the Play Store, plus various libraries that have been shoved into the Play Store for the purpose of making them updatable, can be updated by Google without approval from the handset makers or the carriers.

Re:Not to be an apologist for Google, but

[Anonymous Coward]

it's as if they don't have experience with OS design/coding, contrary to the other companies!

Re:Not to be an apologist for Google, but

[BarbaraHudson]

it's as if they don't have experience with OS design/coding, contrary to the other companies!

They should have lots of experience, since they regularly abandon projects when they write newer projects.

Re:Not to be an apologist for Google, but

[thegarbz]

They have fixed that, they have been fixing that for a while now. Best of all the more core components they move from the OS to the Play Store so they can control the upgrade path the more developers and open source fanatics moan something about evil and monopoly.

Re:Not to be an apologist for Google, but

[Rick Zeman]

https://www.theinformation.com...

Re:Not to be an apologist for Google, but

[Rich0]

Apple and Microsoft control their own update process on all platforms; Google does not. It's the individual carriers who are getting in the way of Android updates.

They control the updates on the GSM Galaxy Nexus phone. It isn't getting the security patch.

Use trunk or it is not my problem.

[ThePhilips]

The explanation I read elsewhere (RTFA quotes from different interview) sounds alot like the excuse of some incompetent developers: use trunk or it is not my problem!

If they had developed a small patch for the problem, I'm pretty sure OEMs wouldn't have a problem pushing it to the users.

But it seems they can't because as all developers working exclusively in the trunk, they have rewrote everything already several times, and looking at the old stuff is... wew! It's old! It's absolutely horrible! Use snapshot from the trunk!! We fixed everything!! It's all better!! We promise!! Honestly!!

Re:Use trunk or it is not my problem.

[Anonymous Coward]

The issue is that they removed functionality from the OS to apps. (they can update apps daily without carrier approval) The fix is in the app trunk not in the OS trunk. The OS trunk no longer has WebView.

Re:Use trunk or it is not my problem.

[ThePhilips]

The OS trunk no longer has WebView.

Of course it has.

There is such thing called "backups".

All my employers, including the most technologically handicapped, always *always* did backups of all releases sent out to the customers. Most did both binary and source code backups, with somebody performing a build/regression tests about once per year to see that the backups are still valid and working. (Though the reasons often was more pragmatical: test not the old release, but the old build environment and that it still works on new hardware/OS/etc).

Usually, to fix an old problem, one has to get the backup, extract the sources and fix the damn problem. (And create new point-point release and new set of backups for the release.)

If Google had fscked up such a routine part of software development, my trust in them just sunk to even lower level than it was before.

And if they use the same methods to develop the self-driving car....

Re:Use trunk or it is not my problem.

[slimjim8094]

If they had developed a small patch for the problem, I'm pretty sure OEMs wouldn't have a problem pushing it to the users.

Hahahahahahahahaha, seriously? This is fixed in 4.4 and the OEMs aren't rolling that out. What makes you think they'll roll out anything, especially because most manufacturers have a long history of not rolling stuff out?

I'm guessing Google just got tired of making patches nobody would ever see.

Re:Use trunk or it is not my problem.

[ThePhilips]

If they had developed a small patch for the problem, I'm pretty sure OEMs wouldn't have a problem pushing it to the users.

Hahahahahahahahaha, seriously? This is fixed in 4.4 [...]

It's not really a fix, if the H/W requirements have been changed/increased.

Android 4.3 vs. 4.4.

Check this for more.

Or more to the point: how do you know that your device is compatible with official golden blessed Android 4.4? CyanogenMod guys can do whatever the hell they want - except calling it "Android".

Totally agree

[isafbma]

I think that the users of the default browser are probably doing a lot of other stuff that will compromise security. The advanced users will mostly install a different browser from the Play Store.

Re:Totally agree

[Anonymous Coward]

Speaking of which, what third party browsers are not vulnerable, and which ones just use WebView? For example, I use Dolphin, which is based on WebKit, but not really knowing much about WebKit, I don't even know whether it's just the same as WebView or something different.

Gioogle is Irresponsible

[QuietLagoon]

...Ludwig went on to explain that backporting a patch would be a herculean effort....

Google is acting irresponsibly to the users of the vulnerable devices by refusing to patch the vulnerability in its software. Period.

.
imo, there is NO excuse why this vulnerability will not be patched. NONE.

Google has the resources to fix the vulnerability, what they are saying is that they do not have the desire to do so.

Re:Gioogle is Irresponsible

[Anonymous Coward]

The patch is there. 4.4. This doesn't take them off of KitKat, it's the latest version of Kitkat. They've even patched kitkat with other upgrades recently. The hate needs to be directed to the phone manufacturers and phone companies who are not implementing the patch.

Re:Gioogle is Irresponsible

[Anonymous Coward]

There's no excuse to use a garbage browser when you can update to a chrome or firefox version that doesn't have the vulnerability.

It's not like the Android browser is irreplaceable like iOS is.

And if you don't like it, you're more than welcome to patch it yourself, change operating systems, or even change phones.

Re:Gioogle is Irresponsible

[ThePhilips]

4.4 is not the "patch". Not only it contains major redesigns of the software, but also it has different hardware requirements compared to previous 4.x versions.

Re:Gioogle is Irresponsible

[dumfrac]

Except, 4.4 has been released by the manufacturer (Google) for the Google Galaxy Nexus, so the patch is certinaly not "there".

Re:Gioogle is Irresponsible

[BarbaraHudson]

You missed the point - they haven't updated Ice Cream Sandwich) (4.0 - 4.04) and Jelly Bean (4.1 - 4.3.1) to fix this problem. Installing 4.4 definitely takes them off their old version, and it's not an option for many (probably most) people.

I remember back when Google used to not be evil.

[He Who Has No Name]

(sigh).

Android Patching

[Xinef Jyinaer]

I don't get how this can make the front page twice. This time TFS has nothing to do with the TFA, but neither are relevant. Google has already patched this, that is what 4.4 is. If you can't get 4.4 pushed to your phone then chances are you are not going to get another patch to this pushed to your phone. At that point the way Android patches are being pushed it is entirely out of googles hands...

Re:Android Patching

[caseih]

Android 4.4 isn't really an update for me. Broken SD support is a deal breaker.

Wonder if cyanogenmod will backport the fix? Or is it time to switch from Dolphin to Firefox?

Re:Android Patching

[dumfrac]

You are wrong. To wit, Google is entirely responsible for patching the Google Galaxy Nexus. The latest release for this device (manufacturered by Google) is 4.3.

Re:Android Patching

[Xinef Jyinaer]

My Galaxy nexus was running cyanogenmod at 4.4(and had always been using chrome instead of the default browser) as soon as it was available. Given the way the smartphone market has been (most people upgrade their phones within 2/3 years. I knew when I got my Galaxy nexus that I couldn't expect any OS updates after 18 months. I do however see your point. Though there a lot of other phones that google releasing a patch for would do nothing.

Re:Android Patching

[BarbaraHudson]

And that is Google's fault, for allowing the carriers to control what gets patched and what doesn't. They made a bad deal just to get quicker acceptance, and now we're stuck with it.

Re:Android Patching

[dumfrac]

And I'm considering putting CyanogenMod on my Galaxy Nexus. BTW, have they ever fixed the camera bug? It is a problem for daily use?

Re:Android Patching

[Anonymous Coward]

Dolphin is not susceptible to the problem.

Re:Android Patching

[mrbester]

4.4 is a different version to 4.3, not a patch or "service pack". Why is it so difficult for people to understand this basic premise? Just because it is touted as a point release doesn't make it one. See OSX, where if your hardware isn't 64-bit you don't get to run 10.7 or later with all the bugfixes that go along with the later versions unless you fork out for a new computer.

Re:Android Patching

[Xinef Jyinaer]

It's not my daily use phone anymore I upgraded to the nexus 6 a few weeks ago. I never had any issues using the camera. Admittedly I didn't use it for a camera very often.

Re:Android Patching

[Anonymous Coward]

A manufacturer rewriting their Android release shouldn't be expected at this point considering it never was before. However, I don't see why you couldn't expect them to roll a security update (e.g., 4.3.1) that does the right thing.

This is a pretty common problem in software -- supporting older releases. The fact that it's Google and they appear unable and unwilling to do it is just a shocking disappointment.

Re:Android Patching

[Anonymous Coward]

Hur dur Google defense force

Re:Why Google? Shouldn't Microsoft patch XP?

[Anonymous Coward]

Why all the venom for Google? You don't see Microsoft releasing patches for Windows XP.

You're right. They only supported it directly for almost 13 years, the bastards..and are still updating it if you're an embedded/point of sale type install. The nerve!

Solution: update the browser

[danbob999]

You can get an updated browser through Google Play store. Many are available. Using a browser that comes pre-loaded with the OS and to rely on your phone manufacturer/carrier to update it is security risk.

Re:Solution: update the browser

[Pope Hagbard]

So many people don't know that you can install a different browser; for them a smartphone is just as much an appliance as their toaster.

Re:Solution: update the browser

[maorb]

That solves the browser issue, but many apps (especially those that have in app advertising) remain vulnerable whenever they load an ad. So people using the free versions of many popular apps can still fall victim to this vulnerability.

Re:Solution: update the browser

[bananaquackmoo]

I'm going to drive a car but don't know how. I think I should blame the car manufacturer when I don't read the warnings, don't read instructions, don't bother to get a license, nor do I even try to learn how to drive.

Re:Solution: update the browser

[Pope Hagbard]

Ah, there's an entry on my Slashdot Bingo card: an irrelevant and inaccurate car analogy.

Re:Solution: update the browser

[danbob999]

Good to know. One more reason for not tolerating adware.

Re:Why Google? Shouldn't Microsoft patch XP?

[Minwee]

Why all the venom for Google? You don't see Microsoft releasing patches for Windows XP.

Windows XP wasn't released on July 24, 2013.

At best...

[rot26]

At best, their excuse can be summarized as "we can fix this for some users, but not all, therefore we are not going to fix it at all".

This isn't Google's problem.

[Anonymous Coward]

If it was as easy as deploying an update to an apk through the play store, Google would do it. Google DOES do it. System updates are handled by the Carrier. We all know damn well that carriers do not have incentives to provide device updates. You should never expect an android device to receive major version updates. If thats important to you buy an apple device, just don't complain about bending.

In short, do your god-damned research before buying that shiny new brick.

Re:This isn't Google's problem.

[Anonymous Coward]

Google could have done it for the full OS, by not foolishly trusting carriers to provide OS updates for Google's own software. Google made a shitty decision, and now you're blaming their users. If this drives people to go buy an Apple device, then it *is* Google's problem, like it or not.

Re:This isn't Google's problem.

[Anonymous Coward]

It is Google's problem on Nexus devices. The Galaxy Nexus is a Nexus device. The Galaxy Nexus is stuck on 4.3.

Either make 4.4 or 5.0 run on the Galaxy Nexus; or fix 4.3, and release an updated 4.3 for the Galaxy Nexus.

Re:I remember back when Google used to not be evil

[NoNonAlphaCharsHere]

I am altering the deal; pray I do not alter it any further.

Re:I remember back when Google used to not be evil

[Anonymous Coward]

No, you remember when you still believed Googles feel good bullshit. Sorry, but there is a difference.

To be fair...

[Junta]

What are the chances that a vendor that declines to update 4.3 to 4.4 would be willing to do an update for a 4.3.x if Google bothered to do it.

I think it smells bad, but trying to target users with vendors holding back 4.4 but willing to do another 4.3.x update is tricky. This is why google moved toward moving stuff in a more modular fashion: to get the ability to update relevant portions without demanding the vendor get in the middle.

Re:To be fair...

[Anonymous Coward]

4.4 won't necessarily run efficiently on hardware designed for 4.3 so I can see why a phone maker might not want to update it. But then there's also the cost of getting the software certified..

Re:To be fair...

[Rich0]

What are the chances that a vendor that declines to update 4.3 to 4.4 would be willing to do an update for a 4.3.x if Google bothered to do it.

Considering that Google won't even do this for their pre-4.4 Nexus phones, I'd say that the chances are pretty low. The fact that Google still won't fix its own phones doesn't let it off the hook. They don't actually make ANY commitment to update Nexus devices at all, and have no documented end of life policy. They're basically not serious about security.

Re:Why Google? Shouldn't Microsoft patch XP?

[ibwolf]

Why all the venom for Google? You don't see Microsoft releasing patches for Windows XP.

Windows XP wasn't released on July 24, 2013.

And upgrades from Windows XP to Vista/7/8 also weren't free.

Re:I remember back when Google used to not be evil

[Tablizer]

Money corrupts. Often its the mentality that "since our competition are jerks, we should be jerks to counter them."

ding ding ding

[OrangeTide]

there's no *point* in Google writing a patch, none of the hardware companies involved would ever bother to deploy it.

This has been my experience in the industry as well. I don't see OEMs scrambling to get the latest updates from the chip vendor or from Google. And I see chip vendors who basically abandon support for older chips on newer releases.

I blame Google, OEMs and Vendors for the problem and not really the carriers. While carriers usually want software to be qualified before an update is allowed, there are many carriers with different rules and many phones that are not under contract.

Carriers are less particular about OS updates(patches) than they were a few years ago, and have switched mainly to being worried about OS upgrades. Either because it might cause lots of customer support calls with broken phones or it will cut into their phone sales (they sell phones through 2 years service contracts, you thought they were free?).

Do No Evil = Do Not Patch Old Android

[BoRegardless]

After all, you might break something.

Google explains why...

[sribe]

But the summary does not. Sheesh.

Re:Google explains why...

[Pope Hagbard]

It's not like Slashdot has ever had editorial integrity. Besides, getting people angry is a proven method of generating clicks.

Re:Google explains why...

[Anonymous Coward]

It's not like Slashdot has ever had editorial integrity. Besides, getting people angry is a proven method of generating clicks.

Editorial integriry on Slashdot has become a roll of the Dice.

Re:Google explains why...

[Pope Hagbard]

Bah. This place didn't have editorial integrity when they were independent.

Google Project Zero

[Anonymous Coward]

I am sure that Google Project Zero will write a working exploit for this vulnerability and then release it 90 days from now. Oh they won't? I thought that was the responsible thing to do? Maybe some security researcher should help them with this.

Re:Why Google? Shouldn't Microsoft patch XP?

[tomknight]

Are you being deliberately dense?

Okay, try this.
Windows 7 was released in 2009, and will get security fixes until 2020.
Even Windows Vista (released in 2007 for home) will get security fixes until 2017.

Let's look at phone versions instead:
Windows Phone 7 was released in October 2010 and left support in October 2014.
Windows Phone 8 was released in October 2012 and will be supported until January 2016.

Looks like Windows users are getting a little better support from their supplier.

Easy problem to fix

[DrProton]

This "vulnerability" can be completely avoided by installing Firefox or Chrome on your android 4.3 device and using either as the default browser. It's irresponsible of /. to ring the security panic bell without mention of how one can simply neuter the threat.

Re:Easy problem to fix

[Anonymous Coward]

Too bad that doesn't fix any of the gazillion apps that use WebView to display web content within them.

Re:Easy problem to fix

[thegarbz]

Except for the MANY Android applications which use Webview.

This isn't about a browser, it's about a rendering engine within the OS.

Re:Easy problem to fix

[Anonymous Coward]

Surely this leaves the code available to run when invoked from any app, a bit like vulnerabilities in Trident on 'doze could be got at through Outlook Express / HHelp and so forth?

Re:Easy problem to fix

[Anonymous Coward]

What about all the apps that have a WebView component? Do we developers need to re-invent the wheel just to have a browser page embeded in our apps?

Fuck Google

[Anonymous Coward]

Glad I jumped ship years ago.

OH NO!!!

[WillyWanker]

Not a security hole in my phone's browser!??!?!? Whatever will we do? How will we go on??? The sky is falling! The sky is falling! What a world...what a world...

Re:OH NO!!!

[Anonymous Coward]

Hope you never type passwords or credit card numbers on your phone (exploit could allow keylogging malware).

Or keep contacts (exploit could harvest contacts for spamming)

Or use it to talk (exploit could record calls or let someone listen in)

Or sync it to your PC (exploit could drop malware onto the PC).

So if you just turn off networking/cell and use it as an MP3 player you should be good!

Good thing Android is open source!

[Anonymous Coward]

We can patch it ourselves! Right? Right?!

Re:Good thing Android is open source!

[mx b]

We can patch it ourselves! Right? Right?!

Right, it is open source and we can patch it. Actually, Google already did that for us in Android 4.4. It's open source, so just download and enjoy!

Where it all goes wrong is the carriers/vendors. We get phones from carriers that are locked down and encrypted to prevent us from installing our open source patches on our open source operating system. We have to ask their permission, and most of the time the answer is "Fuck off, we're not supporting that".

Some make fun of GPLv3, but here is a great example of why RMS made the changed to GPLv3 that he did. GPLv3 was designed to prevent vendors from doing exactly this; GPLv3 requires that, if your device uses open source software and you in any way lock the device, then you MUST provide the decryption keys so that a user may reflash the firmware if they so choose. It's fine if you want to do a SecureBoot type thing for security, but you have to give the user an option to disable it or use the key to do whatever they want to accomplish. RMS knew it's not really free if you can never reflash the device to implement your changes.

Android according to their page is Apache licensed (aside from Linux kernel which is GPLv2). Apache is more in the BSD anything-goes category, and while that might be many people's preferred license (and honestly in a perfect world, it probably would be), it is not a perfect world and we need to have rules to prevent people from taking the community's hardwork and then saying "ha-ha!" to that same community as it prevents the community from hacking and modding. Until we live in a world without copyrights and lock-down devices, the GPLv3 attempts to address this, and it may have made a difference in this situation if the carriers were bound to the GPLv3 rather than the Apache license.

Re:Good thing Android is open source!

[Anonymous Coward]

There are alternative firmwares out there, you know. For example, CyanogenMod users have had access to 4.4 for quite some time now.

Re:Why Google? Shouldn't Microsoft patch XP?

[monkeyzoo]

Why all the venom for Google? You don't see Microsoft releasing patches for Windows XP.

Windows XP wasn't released on July 24, 2013.

And upgrades from Windows XP to Vista/7/8 also weren't free.

But they were at least POSSIBLE, unlike Android upgrades from 4.3 to 4.4 on widely deployed hardware! It can't be called free if you have to buy a new phone to do it.
(Two

Who's liable?

[Anonymous Coward]

If we have a security update that closes an "important" hole, and if a class of customers get ripped off because the hole's not closed - either through not distributing a patch or making the patches O/S available, who's liable? The cell provider? Google? both? Both have deep pockets, but the latter has about the deepest...

Browser options without the problem

[Anonymous Coward]

Actually, the vulnerability didn't exist in Gingerbread, it came after that. While a small set, it's still not technically accurate to say it's hit all Android before 4.3

A number of browsers have been tested and are not susceptible to the problem, even on a 4.0 to 4.3 system.

These include Chrome, Firefox, UC Browser (with Cloud Boost on), Opera, and Dolphin.

I suppose I could claim that Google has provided an easy-to-download fix for everyone in the form of the Chrome browser but I guess the conversation is going to rage into the whole magilla about other updates, etc etc.

I'm just here to point out to those concerned - you have browser options for this particular issue.

You can test yours by Googling "cyberoam android vulnerability" and choosing the XNSS test link. Sorry, I'm posting as an AC because I can't find my login credentials lol.

Cheers,
EarlyMon

Re:Browser options without the problem

[Anonymous Coward]

Actually, the vulnerability didn't exist in Gingerbread, it came after that. While a small set, it's still not technically accurate to say it's hit all Android before 4.3

A number of browsers have been tested and are not susceptible to the problem, even on a 4.0 to 4.3 system.

These include Chrome, Firefox, UC Browser (with Cloud Boost on), Opera, and Dolphin.

I suppose I could claim that Google has provided an easy-to-download fix for everyone in the form of the Chrome browser but I guess the conversation is going to rage into the whole magilla about other updates, etc etc.

I'm just here to point out to those concerned - you have browser options for this particular issue.

You can test yours by Googling "cyberoam android vulnerability" and choosing the XNSS test link. Sorry, I'm posting as an AC because I can't find my login credentials lol.

Cheers,
EarlyMon

UXSS test link - sorry - can't edit as an AC.

Awesome!

[Anonymous Coward]

The LG E970 AT&T sold me just over a year ago is running 4.1.2. They should be obligated to give me a new phone that is not vulnerable.

How is it the carrier's fault?

[Brannon]

All those carriers sell iPhones too and every iPhone is software upgradeable--and has been from day one.

Seems more like an Android problem to me.

Google phone, made by Google, sold by Google.

[Brannon]

Sure it uses some internal components made by other companies, so does the iPhone, so does every consumer product. That's not an excuse to stop supporting a product made by your company.

Re:Google phone, made by Google, sold by Google.

[Coren22]

Tell that to all the people who bought computers that had incompatible drivers for Vista. MS should have just decompiled the drivers and given updated drivers for free for all those people who couldn't find any drivers.

Good

[johanw]

Does this mean that there now exists a universal root method for all Android = 4.3? And it won't even be patched. That would be great!

Misdirected Rage

[tom229]

I don't really understand the rage being directed at Google here. They have fixed the issue in new versions of Android. If they back-ported the fix to 4.3 (assuming that's even possible) what would make carriers/manufacturers implement the fix when they already aren't updating the core version? Nothing. And they wouldn't. The carriers/manufacturers have financially abandoned these older models in favor or their new stuff.

People are used to a big brother company controlling everything about a software experience (Apple, Microsoft). The google approach is open. Unfortunately this requires the user to do a little bit of thinking, make an informed choice, and support the right companies with their money.

Re:Misdirected Rage

[Rich0]

I don't really understand the rage being directed at Google here. They have fixed the issue in new versions of Android. If they back-ported the fix to 4.3 (assuming that's even possible) what would make carriers/manufacturers implement the fix when they already aren't updating the core version? Nothing. And they wouldn't. The carriers/manufacturers have financially abandoned these older models in favor or their new stuff.

They could deploy it to their own phones. Half of the Google-sold phone models are vulnerable to this bug.

People are used to a big brother company controlling everything about a software experience (Apple, Microsoft). The google approach is open. Unfortunately this requires the user to do a little bit of thinking, make an informed choice, and support the right companies with their money.

Which company would you buy an Android phone from to ensure that it received updates for the life of the contract, assuming your contract started on the last day the phone was available for sale?

Re:Misdirected Rage

[tom229]

I would, and do, buy the nexus and sony phones. The nexus 4 is upgradable to Android 5.0, and the xperia z1 is still upgradable to 4.4.4 i think.

Re:Misdirected Rage

[Rich0]

I would, and do, buy the nexus and sony phones. The nexus 4 is upgradable to Android 5.0, and the xperia z1 is still upgradable to 4.4.4 i think.

And the Nexus 4 would still be under contract if you bought it on a 2 year contract on the last day that it was sold. Let's see if it gets the next update.

That said, Google has been getting better. The Nexus 4 is the longest-supported Nexus phone to date. The previous ones didn't get any updates after about 1.5 years from their first sale.

embedded OS

[goombah99]

This is not an unreasonable solution.

What???? it's totally unreasonable for a web connected but embedded OS.

Re:I remember back when Google used to not be evil

[Anonymous Coward]

nice reference!

Kafka said

[goombah99]

You become what you hate.

BULLSHIT

[Anonymous Coward]

Like everyone else reporting on this story, it completely misses the point -- there's no *point* in Google writing a patch, none of the hardware companies involved would ever bother to deploy it. They have *no* control over that bit of code in your phone unless you're running a Nexus device.

I call BULLSHIT.

Release the patch, THEN blame the carriers if they won't deploy it.

And you fell for the misdirection...

Re:BULLSHIT

[MikeBabcock]

You obviously don't write software for a living. It takes effort to redirect people to an unmaintained code base and have them both write and investigate possible side-effects of their patch and then deploy it in a format that's usable by all the manufacturers with devices out there. Its an actual cost to an actual company doing actual business that just isn't worthwhile.

Being an open OS, there's nothing stopping Motorola, Samsung or LG from patching their own versions of 4.3 either, just as they modified it with their UI and other extensions. Feel free to whine to them instead; unless you bought a Nexus device, they sold you the phone, Google didn't.

The basic issue isn't Google

[Anonymous Coward]

The basic issue isn't Google. It's that even if they patched the issue phone, tablet and whatnot vendors still need to issue an update for their devices. Which isn't going to happen for most devices released more than a year ago. The main problem is that the browser came build in with the OS. This sort of issue is one of the reason Google is slowly moving much of the base Android into packages so it can issue updates in the google store without needing a vendor to push an update.

Re:Why Google? Shouldn't Microsoft patch XP?

[Anonymous Coward]

Until your ISP starts blocking Windows Update, which is for all intents and purposes what the carriers are doing to Android.

Fuck off, you disgusting little wanker.

Isn't Google's fault, or is it?

[internet-redstar]

Many remarks say that Google isn't to blame as they provide bug-free versions of Android as well.
HW vendors are indeed not interested to provide upgrades for hw they no longer sell.

While that is true, it was Google's choice to allow binary device drivers for Android interaction by the vendors.
It are these proprietary device drivers which are preventing initiatives such as Cyanogenmod and others to provide a clear upgrade path.
It illustrates the big mistake Google makes in this regard (allowing binary drivers and focusing on Apache licenses).
The position of Google is strong enough to make a stance in the interest of the users (and the world) that all Android drivers should be OpenSourced... in that way the users can 'bake their own' and get their own responsability with respect to upgrades.
The current situation brings the responsibility upon unwilling HW vendors, unwilling providers and ultimately Google.

Sooner or later this is going to blow up into the face of Google because bigger security problems will one day be found!
It's time Google takes a stance for OpenSource software in the interest of the users and the larger common good (certainly now it's completely on par with their own interests)!

Re:Isn't Google's fault, or is it?

[thegarbz]

The driver model isn't changing appreciably between versions. This is why Cyanogen is capable of cranking out new versions of android for a lot of devices within a few days of release, it is why they can move binary blobs from one device to another without major hassles.

Blaming this on drivers is not the right approach. The fault lies squarely at the feet of the vendors who refuse to push updates because they are too interested in crapping out yet more phones instead of supporting the ones they have on the market.

Apple is almost that bad

[Sycraft-fu]

They support two prior versions of OS-X and that's it. So OS-X 10.7, released 3 years ago, is unsupported as of October 2014. I guess that works if you have the attitude of just always updating to the latest OS, but it can be an issue for various enterprise setups that prefer to version freeze for longer times, or for 3rd party software/hardware that doesn't get updated. Also can screw you over if Apple decides to change hardware like with the PPC to Intel change.

No listing in Project Zero

[Anonymous Coward]

I might have missed it, but I am a little surprised to not find this possible exploit listed in the Project Zero database...

Render unto Ceasar

[youngatheart]

Why does Google keep getting slammed for being the bad guy for releasing information about vulnerabilities? I read about people finding and publishing vulnerabilities all the time and follow discussions on what is responsible disclosure and nobody but Google gets treated like this.

Yahoo does the 90 days thing too. Most I've seen do a lot less than 90 days before disclosure. I understand worrying about script kiddies, but I'd rather know I have a vulnerability than just blithely hope nobody but Google found it.

The odds are that a lot of this stuff is known long before Yahoo or Google or Secunia or whoever announces it. The three months Google is leaving me vulnerable to the talented hackers makes me a lot more nervous than the people who find out about it in the news.

Can't they include it in "Google Play Services"?

[jonwil]

Google seems to be using "Google Play Services" (a piece of middle-ware downloaded from Google Play) as a way to support newer APIs on older Android versions and make sure apps can run on these older Android builds. Why can't they just put the newer web browser engine into either "Google Play Services" or some other downloadable bit that goes on Google Play and gives all Android users the same browser engine. Good for apps that embed it since they get the same behavior on all Android versions. Good for Google since it only has to maintain one browser engine version and doesn't need to care about older versions anymore. And good for users since they get a better browser experience (and less bugs) even on older Android versions.

But Google *does* now update components w/o OS

[Phil Urich]

Alternatively; "Here is how Google royally screwed up writing their OS so that updating even relatively minor parts requires a full OS upgrade while Apple and Microsoft seem to have figured out how patching works."

But that's precisely one of the reasons why they aren't bothering to patch this; in fully up-to-date Android releases, WebView has been replaced by a Blink component which Google can update via the Play Store, independently of OS updates. Many, many components of Android are like this these days (which is a problem for anyone not wanting Play Services, but that's another story). And actually Apple is a bad example, since they still for many OS components need to update the entire OS, it's just that unlike Google they've retained tight control and thus can push out those updates whenever they want.

Microsoft didn't sell the hardware, Google did.

[Brannon]

We're talking about the unpatched Google Nexus stuck a 4.3, no option to upgrade.

One word

[Anonymous Coward]

That would be ONE word: Cyanogenmod

Talking about Goog not M$

[Anonymous Coward]

It's almost as if, and I know this will be hard for you to comprehend so bear with me, Google and Microsoft are TWO different companies! If Microshaft was a total douchetastic company, then Google must be one as well. Thanks for enlightening me, AC.

Re:Talking about Goog not M$

[Anonymous Coward]

It's almost as if, and I know this will be hard for you to comprehend so bear with me, Google and Microsoft are TWO different companies!

yes well clearly if you are going to compare two companies they do indeed need to be two different companies.

If Microshaft was a total douchetastic company, then Google must be one as well.

no, in this specific case google is far worse. they dont give a shit about the customer and are happy to allow the oems to use Android to force those customers to buy new handsets which allows google to extort more license fees.

Re:Talking about Goog not M$

[BronsCon]

which allows google to extort more license fees

What?

Anyone know if Webview can be "disabled"?

[Kernel Kurtz]

I have a rooted phone running 4.3. I use Chrome for browsing, but realize other apps may use webview and be vulnerable. In fact they make it easy for developers to do so.

http://developer.android.com/g...

I'm wondering if I can simply disable it by deleting/renaming a library or something similar, or will that make the entire OS unstable? I don't care if it breaks apps - those would only the vulnerable ones anyway. Absent that, it looks like it is possible to remove access to individual apps through their manifest files.

http://developer.android.com/g...

But of course as I said that would break them.

I'm not a developer, but maybe a script that will search out all manifest files (as root of course) and neuter any vulnerable apps by altering them would be useful. Once you know which ones are broken you can set about safely fixing them.

Any thoughts?

*Samsung* Galaxy Nexus

[Anonymous Coward]

If it has Galaxy in the name, no matter whose logo is painted on it, it was made by Samsung.

BYOD / Compliance

[dagarath]

Issues like this shoot a big hole through BYOD and any consideration of security compliance. You now have a deliberately insecure device with no supported patch available. Good luck with your auditors.

KitKat

[Namarrgon]

Phones with 512MB can, however, be upgraded to KitKat 4.4, which reduced the minimim required RAM back to 512MB.

By design

[p51d007]

Google wants more licenses on devices. Carriers, device makers want to sell more devices. So, google doesn't patch an older OS, the carriers & phone makers say the update won't work on their devices, freaking out people and making it easier to sell them a new device...Google, the carriers, the manufacturers win.

a digital restrictions / proprietary app issue

[Anonymous Coward]

Everybody always harps on the free software foundation and yet this is exactly what happens when we go "open source". We end up with an unworkable system. It's not enough to simply go mostly free. We need to demand the sources for EVERYTHING. Including drivers and boycott companies using digital restrictions to lock down the hardware. Some of the companies and/or products I'd recommend avoiding (not sure about the phone market specifically- but I'd probably look at replicant.us for ideas):

Say no to HP, Dell, Sony, Apple, Toshiba, Lenovo/IBM laptops. Actually say no to them and any company that forces a proprietary operating system down your throat or hardware dependent on non-free drivers/firmware. Unfortunately there aren't many choices left. ThinkPenguin.com (US/UK/worldwide) is good for such hardware, and there is one other (unfortunately refurbished Lenovo, which is bad, but the DRM is removed at least) for laptops (in Europe): shop.gluglug.org.uk. There is also another laptop coming (not x86 based which should solve the non-free BIOS issue, etc as well and not be dependent on a company like Lenovo which is hurting its users).

Avoid printers that aren't HP (and avoid a lot of HP printers too, many depend on non-free blobs, but fortunately HP itself indirectly tells you what is good/bad via docs at hplipopensource.com; they document what is dependent on non-free firmware and plug-ins).

Avoid wifi cards that don't have an 802.11n atheros chip. Avoid tablets right now because they're all dependent on non-free firmware and most all non-free graphics.

Avoid AMD and NVIDIA graphics. Both companies are hostile to free software. AMD despite its propaganda hasn't released sufficient code/specs for a fully free driver. NVIDIA's driver is completely closed (though there is a reverse engineered one for older graphics cards).

02210

[Anonymous Coward]

This is the reason that I dunno Android will replace MacOs, Windows or Linux.Google just toss the builds to anybody who is willing to give a payment for place Google apps and the store. And Google forces the users of the hardware to open a G+ account and expect that they put their credit card number for buy things.

After this, what happens next is not their business. File a trouble ticket and good luck.

typical google

[Anonymous Coward]

they have a policy of develop -> bin-> move on.

this is a big worry for those of us considering chromebooks for corporate

official paperweight policy is 5 years from when product is first released (so as most of the stuff has been released a while ago we are talking 3-4 years lifespan)

One way to fix this

[Anonymous Coward]

Write an exploit of this that redirects google analytics and get it deployed to a few million hand sets and I expect a proper fix would happen from all the major vendors.

Sue them If you are paying for service with a vuln

[Anonymous Coward]

Folks, you are paying top dollar for service plans that make promises of secure transactions.

Sue them - sue everybody - Google, AT&T, Verizon, Sprint/Nextel/whomever-they-are-this-week.

Promises were made, and the courts are there for YOUR satisfaction. Sue them together as a class action suit, and one of the wireless companies will break.

Cancel your service NOW

[Anonymous Coward]

Better yet, just cancel your service and go with another provider or as a pay-go plan with a third party provider. Immediate results, a new phone, and satisfaction of a message delivered. Terminate your service as a breach of contract - defective and unsecured communications.

Do NOT renew your service

[Anonymous Coward]

Renewing your service with the same provider will most likely eliminate you from future class action suits. The provider would have proven they took steps to remedy the problem, by forcing YOU to BUY a new phone. You should get the phone YOU want FOR FREE, and not something from the discount shelf.

Rubbish

[fluffynuts]

I have a Galaxy S1 i9000 which has 384mb of RAM, running cm11 (kitkat) better than it ever ran gingerbread. Indeed, it's officially supported by cm11.

Stop gulping down (and propagating) the excuses spewed forth by hardware vendors. Sure, more RAM is better - and the more the merrier - but there is no "can't" in this equation. Hardware vendors are just playing Apple's favorite game: planned obsolescence so you can fork out for another device and toss your current one on the giant ewaste heap to make it the problem of some developing nation so desperate for income they'll take the toxic crap.