Slashdot Mirror
Google Now Requires Partner OEMs To Offer Two Years of Security Updates To Popular Phones (theverge.com)
Confidential contracts obtained by news outlet The Verge show many Android smartphone vendors now have explicit obligations to keep their phones updated. From the report: A contract obtained by The Verge requires Android device makers to regularly install updates for any popular phone or tablet for at least two years. Google's contract with Android partners stipulates that they must provide "at least four security updates" within one year of the phone's launch. Security updates are mandated within the second year as well, though without a specified minimum number of releases.
David Kleidermacher, Google's head of Android security, referred to these terms earlier this year during a talk at Google I/O. Kleidermacher said that Google had added a provision into its agreements with partners to roll out "regular" security updates. But it wasn't clear which devices those would apply to, how often those updates would come, or for how long. The terms cover any device launched after January 31st, 2018 that's been activated by more than 100,000 users. Starting July 31st, the patching requirements were applied to 75 percent of a manufacturer's "security mandatory models." Starting on January 31st, 2019, Google will require that all security mandatory devices receive these updates.
David Kleidermacher, Google's head of Android security, referred to these terms earlier this year during a talk at Google I/O. Kleidermacher said that Google had added a provision into its agreements with partners to roll out "regular" security updates. But it wasn't clear which devices those would apply to, how often those updates would come, or for how long. The terms cover any device launched after January 31st, 2018 that's been activated by more than 100,000 users. Starting July 31st, the patching requirements were applied to 75 percent of a manufacturer's "security mandatory models." Starting on January 31st, 2019, Google will require that all security mandatory devices receive these updates.
Clearly the WindowsME security model is working for them, why should they change now?
It's a step in the right direction, but not long enough. Many people use the same phone for more than two years. Buying a new phone is expensive. It's wasteful to throw out older devices that are still more than capable of meeting the needs of their users. This should be more like five years rather than two.
a work-around to this requirement is that, in my opinion, manufacturers now release firmware bugs that cause an infinite boot-loop after 1 year and they will then refuse to fix the problem -- I've seen what appears to be one live example of this
So that they dont have to provide security updates?
So the OEM will just say "Sorry, that phone is not popular."
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
Two whole years!
#DeleteChrome
2 years for popular phones? What defines a "popular" phone?
How about 3 years for ALL phones? You want to use android? Then provide f__king updates. Don't want to provide updates? Then GTFO.
Oh who am I joking? The consumer is the product. They care more about looking like they're doing something useful than actually doing something useful.
If Google really wants to fix the message that is Android security, they should not mandate that manufacturers provide updates. They should mandate that manufacturers provide hardware that can be updated be it by Google or others. 99% of the hardware in Android phones and tablets can be accessed through drivers and interfaces that are standardized. There's simply no reason that anyone should have to rely upon a manufacturer to provide updates when manufacturers are, generally, the worst people to rely upon for anything but the actual release hardware.
It's amazing just how badly Android, the open source OS, has become a complete clusterfuck. Just goes to show you how much TiVo-ization is a thing.
I hate to be paranoid, but couldn't even something like this be considered anti-competitive by the EU if they wanted more money out of Google?
I cannot believe a sane person would actually be against this. Is there something wrong with you? Do you like not getting security updates? Do you want your phone hijacked?
Google Play is the one thing keeping malware from being worse than it already is. Unless there's an alternative app store that certifies that it thoroughly tests submitted apps, then I will grant them about as much trust as I would for free candy from Bill Cosby.
IMO Google hasn't gone nearly far enough. The rule should be simple. Security updates for at least 3 years for any android device you release to the public. Period. Don't like it? You are forbidden from using the Android trademark. Very simple.
Heaven forbid Google used their power for the public good.
Let me get this reasoning straight.
The provider of the OS is saying "thou shalt provide 2 years of updates", so the OEM's should combat that with "Well, I don't wanna use your store"?
So you're effectively saying each OEM is on their own for an OS AND app store?
It should be two years starting from the date that the last phone is sold. Otherwise this is meaningless.
And it sounds like 2 years from LAUNCH? That's seriously weak. How about 2 years from end of sales!? That would at least be a start, unless we're really OK with becoming a society that throws multi-hundred-dollar devices i the trash EVERY FRICKING YEAR!
iphone 5s, released in 2013, is still supported by IOS 12 in 2018. Even people who change phones every two years would prefer to be able to resell a functional device. A phone without updates is a brick to me.
So, a several-hundred dollar piece of consumer technology now has a lifespan cap of two years. Ridiculous.
Sounds like planned obsolescence to me.
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
Mod parent comment up!
The "2 years" Google is now giving is what has been already established. Everyone is expected to spend $700 to $1100 every 2 years on a new cell phone.
There is NO REASON for Google to be abusive. A mid-level Google manager told me years ago that Google is making more money than it knows how to spend.
Google has moved from "Do no evil" to "Let's be destructive to others if that will make money". One article: Google Removes 'Don't Be Evil' Clause From Its Code of Conduct (May 18, 2018)
Another article: Google erases 'Don't be evil' from code of conduct after 18 years (May 21, 2018)
As others have said, it should be from LAST day of sale for any model -- and more like 5 years, not 2.
Hah, CAPTCHA 'update'
I cannot believe a sane person would actually be against this. Is there something wrong with you? Do you like not getting security updates? Do you want your phone hijacked?
Google Play is the one thing keeping malware from being worse than it already is. Unless there's an alternative app store that certifies that it thoroughly tests submitted apps, then I will grant them about as much trust as I would for free candy from Bill Cosby.
IMO Google hasn't gone nearly far enough. The rule should be simple. Security updates for at least 3 years for any android device you release to the public. Period. Don't like it? You are forbidden from using the Android trademark. Very simple.
Heaven forbid Google used their power for the public good.
Every time I have argued this, I was told that Android is Open Source, and thus Google couldn't FORCE the OEMs to do ANYTHING.
Guess I was right after all...
Stupid Slashtards.
what about the phone carriers? ban there rom's or force some like samsung to give out an knox safe base rom file.
I don't get it, you don't want security updates?
OEMs like Lenovo are the worst. Except for a couple of flagship models Lenovo regularly release products that receive no updates, ever. Not a single update.
Why phones only? And as others have pointed out, what's the definition of "popular", and why just 2 years?
This still does nothing for me or any of the 4 Android tablets I have.
I'd be a real sucker if I purchased *yet* another Android device if it was based on a belief that this one, for real this time, will really, really get updates, pinky-swear.
I despise the fruity company, and I've already been burned too many times by Android. What's left for me? Windows tablets?
I bought a crap car in college for less than my last phone. Drove it for 7 yrs. Seems that something costing $400+ should be expected to have updates for at least 5 yrs.
My current phone has 5 sub-models. So, while they are "popular" when grouped together, they are not when taken as each model alone.
5 yrs seems to be the minimal acceptable amount for a $400-$1800 device.
Your crap second hand car had zero free vendor support.
Although, I just had the airbags replaced for free in my 2005 car. That's a safety thing though.
It's never had a software update, ever.
Cars don't get recalled when the keyless entry systems get hacked, even when it's still under warranty they generally don't fix it.
All this nonsense about fragmentation, etc... Google could have done this at anytime. They have finally taken responsibility for the wares they create. Quite happy to hear this. Two years is better than nothing. Would have been happier with three years. By the time people purchase these phones, a good 9 months could have passed. Means that end-users might only be receiving actual OTA updates for about a year.
inb4 F-droid.
If Google really wants Android to stop sucking, it's simpler than trying herd that particular batch of feral cats. They need to learn the lesson Apple learned when they made the mistake of partnering with Motorola on the ROKR... the same lesson Google themselves should have taken to heart years ago... and kick all these crap composite like Samsung, HTC, Xiaomi, and the aforementioned Motorola, revoke all their licenses, bring the hardware in-house along with the software, and do it all themselves. They also need to revoke the carriers' ability to pollute Android with their bloatware, adware, UI skins, and other trash.
Google is a much more competent company than any of their cellular partners. And vanilla Android, as developed by Google and untainted by any handset manufacturer to cellular carrier, is not a bad OS. The problem with Android is just that they're letting half-competent... and actively maleficent in some cases... randos screw up their shit.
Imagine all the people...
IMO Google hasn't gone nearly far enough. The rule should be simple. Security updates for at least 3 years for any android device you release to the public. Period. Don't like it? You are forbidden from using the Android trademark. Very simple.
Agreed, which is why I stick to phones from the Android One program, which has this exact requirement.
Stop this nonsense and just make Android One the only valid certified Android.
Updates come directly from google, how it should be.
On a long enough timeline, the survival rate for everyone drops to zero.
Empty threats are fun. Or did you miss the anti-trust rulling against Google recently which identified that the App Store itself formed a significant amount of market power for Google in the Android eco-system?
I just run Lineage.
Thanks for the tip! Looks like only one phone on the Android One program is targeted for the US marked (Nokia 7.1 available at the end of this month).
To Copy from One is Plagiarism; To Copy from Many is Research.
The Nexus 6 (Motorola XT1103 Shamu) has better performance and features compared to many current phones but the last security update was October 2017 (7.1.1). It is just obsolete because of the lack of updates.