Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google confirms Android attacks; no fix for most Samsung users

forbes.com

Post reply on HN
Print view View original

51–60 of 177 posts

Re: Google confirms Android attacks; no fix for most Samsung users

#51

Post by arghwhat »

kwanbix wrote: post #29
charcircuit wrote: post #17

>But in reality, Samsung (and the other Android OEMs) cannot compete with Google and its unique control over hardware and software. Yes, they can. We are talking about applying provided security patches to source code, and then releasing a new version of their OS. For patches that have existed for months. The time from patch to release should be on the order l of days from receiving the patches to having a validated…

The problem is that each OEM releases 50 different models per year, vs Google (or Apple) that release 3 or 4 models.

That's still one OS. Customization is mostly userspace "system" apps that they swap out and maintain, but reused across all their phones with some small variation. Hardware enablement will differ between models, but that's just the cost of doing business.

Can be a pain to move the whole suite to a new major (porting all their inhouse apps, getting all the hardware enablement from vendors updated to match, ...), but we're not dealing with a major upgrade here.

A security patch is "just" a matter of taking the last release, applying the diff, build, qa, release. No customization.

Re: Google confirms Android attacks; no fix for most Samsung users

#52

Post by mrgoldenbrown »

kwanbix wrote: post #29
charcircuit wrote: post #17

>But in reality, Samsung (and the other Android OEMs) cannot compete with Google and its unique control over hardware and software. Yes, they can. We are talking about applying provided security patches to source code, and then releasing a new version of their OS. For patches that have existed for months. The time from patch to release should be on the order l of days from receiving the patches to having a validated…

The problem is that each OEM releases 50 different models per year, vs Google (or Apple) that release 3 or 4 models.

If they choose to release 50 models, they need to factor in the cost to maintain security on 50 models.

Re: Google confirms Android attacks; no fix for most Samsung users

#53

Post by mrgoldenbrown »

Terr_ wrote: post #34
jeffbee wrote: post #27

Earlier quoted context omitted.

Just go to the software update, touch the button, then touch it a second time, and that will give you all available updates immediately, regardless of your random position in the rollout process.

Not working for me on Android 16, additional taps of the "Check for update" button in the bottom-right don't change the fact that it says "Your system is up to date" and that the last change was last month.

I see same behavior on my 8.

Re: Google confirms Android attacks; no fix for most Samsung users

#54

Post by reactordev »

crote wrote: post #47
reactordev wrote: post #38

Earlier quoted context omitted.

>How many different models of PCs get released? If you want to go that route, each manufacturer is responsible for their own drivers for windows, linux, and possibly Mac (though if it’s novel enough, they will do it). Then think about the components that make up a PC. Motherboard, CPU, Memory Control, IO, OS, Audio, Video. Each of those needs to release patches. So its orders of magnitude more than any Android OS. It…

The big difference with PC hardware is that the OS will get most driver updates for the individual components directly from the OEM. A driver update for, say, a sound card will directly be available to every machine with that sound card installed. The PC vendor doesn't have to be involved in any way. It's the other way around with Android. Google does a new core release, and each individual manufacturer is responsibl…

Again, no sympathy as that’s the route they chose. Rely on Google for everything OS and make a phone whereas Apple made a phone and supplied an OS.

Apple made a product. Google made a software revenue stream. Entirely different things and now the Android makers are crying foul that they too have to do product engineering support. Nah. This is what you get when you rely on out of house innovation. I hope they all close shop. Not because I like Apple, but because they aren’t in the business of making products, only selling you hardware with bolt on software that it vaguely supports. Like buying a raspberry pi that can make phone calls. Google has them all by the balls.

Re: Google confirms Android attacks; no fix for most Samsung users

#55

Post by pajko »

baal80spam wrote: post #6

This requires user action, right? User needs to install the APK by hand? In other words - if I don't install any crap on my phone I am safe?

Both mentioned CVEs seem to be about local privilege escalation. So basically yes, if you don't install crap apps, there's a high chance that you are protected. Problem is that it might not seem to be a crap app, but a nice-looking game, etc. Also an attack can come in with an update of any app you have already installed on your phone.

Re: Google confirms Android attacks; no fix for most Samsung users

#58

Post by mschuster91 »

xnx wrote: post #5

No fix yet for Samsung. Being reliant on the hardware manufacturer (or network operator?) for OS updates is the crazy world we live in.

That's always the case, even on Windows, even on Linux for closed-source third party drivers. The only exception is macOS because Apple insists on writing the drivers themselves - that was, in addition to Soldergate, the reason why Apple dropped NVIDIA.

Re: Google confirms Android attacks; no fix for most Samsung users

#59

Post by freitasm »

int0x29 wrote: post #45
kelnos wrote: post #11

> This [update] was rushed out to all Pixel users. Pixel 8 here, still don't have the update. That's... not great.

I think your carrier hasn't approved it yet. T-mobile seems to lag on these things. I also can't seem to find a system update. A Google Play system update does seem to exist

We have an OS security update that is only release to users of a specific hardware, once approved by their mobile operator. It may be added to vendor-specific OS versions some time later (weeks, month or never). The vendor-specific may not be approved by a telco if the vendor doesn't have a relationship with that telco.

Now think that millions of people use the same OS on many different flavours, on different hardware, on multiple operators.

What an inneficient way of doing things.

Post reply on HN