Google: Android patch gap makes n-days as dangerous as zero-days

BrikoX@lemmy.zip to Android@lemdro.id – 87 points –
bleepingcomputer.com
12

I still don't understand why OEMs are so slow to release updates when LineageOS can ship weekly builds that are more stable than stock ROMs, other than pure negligence.

People claim QA and carrier QA and such, but when it's a security patch to some core Android thing, you really only need to review it once and just rebuild everything and skip the QA on it. Or, you know, don't release 50 devices every year.

Part of it is also partly down to users just ignoring updates. I know people who complain about getting monthly updates let alone weekly. Another part (from experience) is also likely to be internal beurocracy where things just take ages because there's so many unnecessary stages to go through before a release.

Patch updates really should be auto install by default for those users (but still let users opt out manually through settings if they want). Probably on home WiFi and while charging, just like Google Play does by default.

With A/B devices, there's no reason not to. It's completely invisible to the user, and takes effect next time they reboot or run out of battery. Just needs maybe a single notification when it's all done to tell the user to reboot when it's convenient for them, or reboot overnight when the device is idle and charging. Completely transparent.

My girlfriend's phone applies patches automatically and puts a notification up suggesting to restart or schedule a restart over night and it just gets ignored. I press the button whenever I see it though.

People don't like being inconvenienced even if there's an option just do do everything over night while charging, and even if everything was automatic and updates were just installed over night I guarantee people would find something to complain about. Unfortunately there's no winning, but I agree that increased security from opt out updates would be beneficial.

With A/B devices

The problem is, many popular devices still don't have A/B partitions - Samsung being one of them.

I'm not sure even if the S24 / Fold 5 have it, haven't heard anyone mention anything about this yet.

This. I think they looked at the numbers and the vast majority of users never install updates.

When my wife used iPhone she purposely avoided installing updates because it might change how the phone works and slow it down.

I replaced that phone with a TCL and it gets zero updates. So she's happy.

There are also networks that want to have the final decision on everything. For example with blackberry 10, the poor users with Verizon had a 1-2 year delay in getting updates

And lineageOS is awesome with their source(dt, vendor, kernel, etc) quality too!

You can easily compile them with a good manifest and expect good comaptibility with other roms with small rebasing changes

Closed ecosystems where users are not in control of their devices are a risk to society. I'm including closed source baseband drivers as .

Yes, but this also has absolutely nothing to do with the ecosystem. This is part of AOSP which is not a walled garden, hence why it affected all other Androids as well.

Google has started removing support for dialer and other key components which means eventually people will moved to closed garden.