Slashdot Mirror
Google Now Requires Partner OEMs To Offer Two Years of Security Updates To Popular Phones (theverge.com)
Confidential contracts obtained by news outlet The Verge show many Android smartphone vendors now have explicit obligations to keep their phones updated. From the report: A contract obtained by The Verge requires Android device makers to regularly install updates for any popular phone or tablet for at least two years. Google's contract with Android partners stipulates that they must provide "at least four security updates" within one year of the phone's launch. Security updates are mandated within the second year as well, though without a specified minimum number of releases.
David Kleidermacher, Google's head of Android security, referred to these terms earlier this year during a talk at Google I/O. Kleidermacher said that Google had added a provision into its agreements with partners to roll out "regular" security updates. But it wasn't clear which devices those would apply to, how often those updates would come, or for how long. The terms cover any device launched after January 31st, 2018 that's been activated by more than 100,000 users. Starting July 31st, the patching requirements were applied to 75 percent of a manufacturer's "security mandatory models." Starting on January 31st, 2019, Google will require that all security mandatory devices receive these updates.
David Kleidermacher, Google's head of Android security, referred to these terms earlier this year during a talk at Google I/O. Kleidermacher said that Google had added a provision into its agreements with partners to roll out "regular" security updates. But it wasn't clear which devices those would apply to, how often those updates would come, or for how long. The terms cover any device launched after January 31st, 2018 that's been activated by more than 100,000 users. Starting July 31st, the patching requirements were applied to 75 percent of a manufacturer's "security mandatory models." Starting on January 31st, 2019, Google will require that all security mandatory devices receive these updates.
It's a step in the right direction, but not long enough. Many people use the same phone for more than two years. Buying a new phone is expensive. It's wasteful to throw out older devices that are still more than capable of meeting the needs of their users. This should be more like five years rather than two.
Does Android use the "fail to boot up" or the "crash before it can be hacked" security model?
So the OEM will just say "Sorry, that phone is not popular."
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
Two whole years!
#DeleteChrome
2 years for popular phones? What defines a "popular" phone?
How about 3 years for ALL phones? You want to use android? Then provide f__king updates. Don't want to provide updates? Then GTFO.
Oh who am I joking? The consumer is the product. They care more about looking like they're doing something useful than actually doing something useful.
I hate to be paranoid, but couldn't even something like this be considered anti-competitive by the EU if they wanted more money out of Google?
I cannot believe a sane person would actually be against this. Is there something wrong with you? Do you like not getting security updates? Do you want your phone hijacked?
Google Play is the one thing keeping malware from being worse than it already is. Unless there's an alternative app store that certifies that it thoroughly tests submitted apps, then I will grant them about as much trust as I would for free candy from Bill Cosby.
IMO Google hasn't gone nearly far enough. The rule should be simple. Security updates for at least 3 years for any android device you release to the public. Period. Don't like it? You are forbidden from using the Android trademark. Very simple.
Heaven forbid Google used their power for the public good.
It should be two years starting from the date that the last phone is sold. Otherwise this is meaningless.
And it sounds like 2 years from LAUNCH? That's seriously weak. How about 2 years from end of sales!? That would at least be a start, unless we're really OK with becoming a society that throws multi-hundred-dollar devices i the trash EVERY FRICKING YEAR!
iphone 5s, released in 2013, is still supported by IOS 12 in 2018. Even people who change phones every two years would prefer to be able to resell a functional device. A phone without updates is a brick to me.
So, a several-hundred dollar piece of consumer technology now has a lifespan cap of two years. Ridiculous.
Sounds like planned obsolescence to me.
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
Mod parent comment up!
The "2 years" Google is now giving is what has been already established. Everyone is expected to spend $700 to $1100 every 2 years on a new cell phone.
There is NO REASON for Google to be abusive. A mid-level Google manager told me years ago that Google is making more money than it knows how to spend.
Google has moved from "Do no evil" to "Let's be destructive to others if that will make money". One article: Google Removes 'Don't Be Evil' Clause From Its Code of Conduct (May 18, 2018)
Another article: Google erases 'Don't be evil' from code of conduct after 18 years (May 21, 2018)
I cannot believe a sane person would actually be against this. Is there something wrong with you? Do you like not getting security updates? Do you want your phone hijacked?
Google Play is the one thing keeping malware from being worse than it already is. Unless there's an alternative app store that certifies that it thoroughly tests submitted apps, then I will grant them about as much trust as I would for free candy from Bill Cosby.
IMO Google hasn't gone nearly far enough. The rule should be simple. Security updates for at least 3 years for any android device you release to the public. Period. Don't like it? You are forbidden from using the Android trademark. Very simple.
Heaven forbid Google used their power for the public good.
Every time I have argued this, I was told that Android is Open Source, and thus Google couldn't FORCE the OEMs to do ANYTHING.
Guess I was right after all...
Stupid Slashtards.
what about the phone carriers? ban there rom's or force some like samsung to give out an knox safe base rom file.
Those issues were resolved through study of the Ballmer Peak
https://xkcd.com/323/
That'll only work in countries with pathetic consumer protection laws, like USA.
Perhaps you should have read TFS instead of just the title, where it states "phones and tablets"
It's all devices that OEM's want to use the Play Store on.
Your crap second hand car had zero free vendor support.
Although, I just had the airbags replaced for free in my 2005 car. That's a safety thing though.
It's never had a software update, ever.
Cars don't get recalled when the keyless entry systems get hacked, even when it's still under warranty they generally don't fix it.
All this nonsense about fragmentation, etc... Google could have done this at anytime. They have finally taken responsibility for the wares they create. Quite happy to hear this. Two years is better than nothing. Would have been happier with three years. By the time people purchase these phones, a good 9 months could have passed. Means that end-users might only be receiving actual OTA updates for about a year.
I don't think you addressed the core of AC's complaint.
The summary uses the term "popular phones and tablets." What does "popular" mean?
Even in TFA it says:
What does "popular" mean?
To answer my own question on what's "popular," TFA goes on to say:
How many individual models of Android phones and tablets actually reach sales and activations of 100,000 units? I expect to the majority of phone and tablet buyers this will continue mean absolutely nothing: same old neglect and no updates.
inb4 F-droid.
In terms of global sales, 100,000 isn't that much.
Let's pretend someone wants to sell a $500 phone and not provide support.
That's $50M in revenue to cover all the tooling, manufacturing, design, components, marketing, shipping, retail margin, taxes, etc.
The manufacturing and components alone are going to cost $100, that's $10M gone already.
The non-recurring costs for tooling so you can start manufacture will be in the millions.
You need to pay people to develop the original software build.
It'll cost you up to $100,000 for PTCRB and FCC certification just so you can import it to USA. You'll probably want to do compliance testing with other authorities, like CE
It's just not worth it to plan for such low volumes.
If Google really wants Android to stop sucking, it's simpler than trying herd that particular batch of feral cats. They need to learn the lesson Apple learned when they made the mistake of partnering with Motorola on the ROKR... the same lesson Google themselves should have taken to heart years ago... and kick all these crap composite like Samsung, HTC, Xiaomi, and the aforementioned Motorola, revoke all their licenses, bring the hardware in-house along with the software, and do it all themselves. They also need to revoke the carriers' ability to pollute Android with their bloatware, adware, UI skins, and other trash.
Google is a much more competent company than any of their cellular partners. And vanilla Android, as developed by Google and untainted by any handset manufacturer to cellular carrier, is not a bad OS. The problem with Android is just that they're letting half-competent... and actively maleficent in some cases... randos screw up their shit.
Imagine all the people...
IMO Google hasn't gone nearly far enough. The rule should be simple. Security updates for at least 3 years for any android device you release to the public. Period. Don't like it? You are forbidden from using the Android trademark. Very simple.
Agreed, which is why I stick to phones from the Android One program, which has this exact requirement.
Stop this nonsense and just make Android One the only valid certified Android.
Updates come directly from google, how it should be.
On a long enough timeline, the survival rate for everyone drops to zero.
Empty threats are fun. Or did you miss the anti-trust rulling against Google recently which identified that the App Store itself formed a significant amount of market power for Google in the Android eco-system?
Thanks for the tip! Looks like only one phone on the Android One program is targeted for the US marked (Nokia 7.1 available at the end of this month).
To Copy from One is Plagiarism; To Copy from Many is Research.
The Nexus 6 (Motorola XT1103 Shamu) has better performance and features compared to many current phones but the last security update was October 2017 (7.1.1). It is just obsolete because of the lack of updates.