Slashdot Mirror
Motorola Confirms That It Will Not Commit To Monthly Security Patches (arstechnica.com)
If you are planning to purchase the Moto Z or a Moto G4 smartphone, be prepared to not see security updates rolling out to your phone every month -- and in a timely fashion. After Ars Technica called out Motorola's security policy as "unacceptable" and "insecure," in a recent review, the company tried to handle the PR disaster, but later folded. In a statement to the publication, the company said: Motorola understands that keeping phones up to date with Android security patches is important to our customers. We strive to push security patches as quickly as possible. However, because of the amount of testing and approvals that are necessary to deploy them, it's difficult to do this on a monthly basis for all our devices. It is often most efficient for us to bundle security updates in a scheduled Maintenance Release (MR) or OS upgrade. As we previously stated, Moto Z Droid Edition will receive Android Security Bulletins. Moto G4 will also receive them.Monthy security updates -- or the lack thereof -- remains one of the concerning issues that plagues the vast majority of Android devices. Unless it's a high-end smartphone, it is often rare to see the smartphone OEM keep the device's software updated for more than a year. Even with a flagship phone, the software update -- and corresponding security patches -- are typically guaranteed for only 18 to 24 months. Reports suggest that Google has been taking this issue seriously, and at some point, it was considering publicly shaming its partners that didn't roll out security updates to their respective devices fast enough.
It's actually pretty easy to roll out regular patches, especially considering the upstream testing... ... unless you're adding a ton of vendor/carrier crapware. Testing and maintaining *that* might be an issue.
Yet Motorola's solution is (apparently) not "DONT FUCKING DO THAT" but instead "don't bother with patching". Yay. Go team dumbass.
You specifically advertised the 2015 Moto E with the following line: "And while other smartphones in this category don't always support upgrades, we won't forget about you, and we'll make sure your Moto E stays up to date after you buy it."
Then you stopped providing updates for it (of ANY kind) after 219 days.
Fuck you, fuck you so hard. I've made it very clear to everybody I know that they should never, under any circumstances, buy any Motorola or Lenovo products.
This is what the ecosystem allows. You want to be open, that means that you're stuck with this, unless you can write the updates in ways that allows patching through the app store without affecting the vendor "customizations".
Perhaps Google should rethink its strategy of how they offer software and encourage some type of buy-in on updates for support in the hardware and software dev process
No exceptions. A phone is a critical communications device, and if the OEM won't supply critical upgrades, then they must allow others to do so.
DMCA exceptions should be established, and vendors should not be allowed to sell phones within the U.S. without providing all required unlock keys into an escrow. Upon 6 months of patch inactivity, the keys go public.
It saddens me, as a one-time Motorolan myself, but when other vendors are perfectly capable of providing timely security updates, I'm not going to buy products from a company that willfully ignores its customers' security.
If it is too much work, Motorola, then you fix that problem. You don't just pass the buck to the end user. If it is taking too long, that means you're adding too much bloated cruft to the OS. Get rid of it and do your job properly, or suffer the consequences of anyone who knows a little about security avoiding your products, and recommending friends, family and colleagues to do the same.
However, because of the amount of testing and approvals that are necessary to deploy them, it's difficult to do this on a monthly basis for all our devices.
no one disagrees that it takes manpower to do full regression tests after patches. but the thing is, for most of the time you are NOT writing the patches, just integrating it!
now, that aside, we all know that world labor is less than dirt-cheap. YOU HAVE NO EXCUSE TO AVOID GETTING THINGS DONE in this cheap-as-chips world labor market.
fuck you. you claim you are poor? double fuck you for lying about it and we all can see that, too.
--
"It is now safe to switch off your computer."
In my view, this problem can only be solved by improving the Android OS itself. They need to carve out way more things out of the core OS and make them updateable through the Play Store. Microsoft manages to do this via Windows Updates, I don't see why Google can't figure it out. What makes things worse are carrier specific builds. Apple managed to do tell them to F off, Google should too.
According to wikipedia, Apple took this phone out behind the woodshed in 2012.
Any phone vendor who cuts support for a model should be REQUIRED to open the platform for 3rd-party maintenance. A phone is not a general purpose computer, and there should be special rules for it.
. ... or secure to use.
Unless google changes its stance on Android security, Android will not be patched regularly