6 ms·

Even if Google patches this, there's an incredible delay in getting the patch to users. Android in fundamentally flawed in this respect. http://www.extremetech

Even if Google patches this, there's an incredible delay in getting the patch to users. Android in fundamentally flawed in this respect. http://www.extremetech.com/mobile/197346-google-throws-nearly-a-billion-android-users-under-the-bus-refuses-to-patch-os-vulnerability http://www.extremetech.com/mobile/197346-google-throws-nearl...

kreutzwj 11y ago
Agreed. There is a major issue, not sure if in the rest of the world, but in Canada, the service provider has to request, and commonly pay for, the patch to which the manufacturer completes and then the service provider then pushes out to their devices. At least that is how it was when the E911 issue happened, it may be better now, but knowing Telecoms in Canada, I wouldn't be surprised if it wasn't.
- canistr 11y ago
  It's not better. Look at the proposed target released dates for StageFright patches by Telus. And considering that it is not even fully patches, this only adds to the insanity of the situation with regards to Android fragmentation and carrier's controlling releases. http://forum.telus.com/thread/54211/category/top/board/Mobility/android-s-stagefright-vulnerability http://forum.telus.com/thread/54211/category/top/board/Mobil... OEM Model Target Release HTC One M7 August 14th HTC One M8 August 14th HTC One M9 August 14th HTC Desire 320a August 28th HTC Desire 601 August 14th LG Nexus 4 Completed LG Nexus 5 Completed Motorola Nexus 6 Completed Samsung Galaxy S5 August 11th SamsungGalaxy S5 Active August 11th Samsung Galaxy Alpha August 21st Samsung Galaxy Grand Prime August 21st Samsung Galaxy S6 Completed Samsung Galaxy S6 Edge Completed Samsung Galaxy S4 August 28th Samsung Galaxy Note 3 August 30th Samsung Galaxy Note 4 August 11th Samsung Galaxy Core September 4th Samsung Galaxy Tab S 8.4 September 4th Samsung Galaxy Tab S 10.5 September 4th Sony Xperia Z3 August 14th
  - kreutzwj 11y ago
    Yeah, I just checked Rogers, it looks even worse and not even updated for if it is completed. http://communityforums.rogers.com/t5/forums/forumtopicpage/board-id/Android/message-id/32172#M32172 http://communityforums.rogers.com/t5/forums/forumtopicpage/b...
lumpygravy 11y ago
Indeed. Even the supposedly quickly updated Moto X did not receive a patch yet two weeks after the fact [1]. I feel sorry for all those people who are still stuck on Kit Kat or even worse Jelly Bean. https://www.reddit.com/r/MotoX/comments/3gugxa/anyone_got_the_stagefright_fix_update_yet/ https://www.reddit.com/r/MotoX/comments/3gugxa/anyone_got_th...
- ocdtrekkie 11y ago
  And for those of us who don't want Lollipop, we'll never be offered the update. We have to either accept a bad system "upgrade" or stay insecure.
  - eropple 11y ago
    I feel for people whose providers won't upgrade them and I think they've got a good complaint, but if you choose to get off the upgrade path I think it's reasonable to assert that you're assuming responsibility for your own choices and security. I expect it can be backported to 4.x via custom ROMs for folks in that spot.
    - ocdtrekkie 11y ago
      Here's the problem: It's a DROID Turbo. It's locked down by Verizon/Motorola, and neither root nor bootloader unlock has been achieved. So it's not even an option. The problem is that the "upgrade path" and the "security fix" path need to be separate things. People should not be forced to have their device changed in an unacceptable manner (I did not buy a device with 'material design' for a reason, and being forced to get it to get a security fix is an unacceptable situation.)
      - eropple 11y ago
        I think, honestly, the only real answer is "don't buy locked devices if you want to make those choices." Google doesn't control those devices, and that part of Android is open source. You can make those decisions, but you're earning the consequences with them. This, as it happens, is why I buy phones with unlockable bootloaders. My current phone uses the OEM build, but I like having that choice.
nadams 11y ago
> Even if Google patches this, there's an incredible delay in getting the patch to users. I don't think delay is the problem - not being able to get or apply the patch yourself is the problem. Ignoring the somewhat ridiculous requirements to compile Android (200GB of HD space and 16GB of RAM [1]) - you couldn't put it on your Android device due to proprietary drivers for wireless and/or video. Assuming you can get an updated version - I have noticed that after getting root on my Nexus 6 it won't install new versions of Android. I don't know if it's a by-product of getting root/installing a new recovery or if they have an actual check. I have a legitimate reason for root because I use FreeOTP and it does not have an export feature - so I use Titanium backup to backup and restore the app. Getting the OTP QR codes for: dropbox, gmail, Microsoft account, facebook, srchub, github, paypal etc would take a very long time and considerable effort to recover (hint gitlab). [1] https://source.android.com/source/building.html https://source.android.com/source/building.html
- SamReidHughes 11y ago
  > I don't think delay is the problem - not being able to get or apply the patch yourself is the problem. Almost all users would be incapable of applying patches themselves.
  - nadams 11y ago
    > Almost all users would be incapable of applying patches themselves. There are currently 357,101 registered users on XDA developers. Saying "almost" every android user can't apply a patch is somewhat far fetched. Most procedures on XDA developers have a much better step by step documentation than most SDKs I've seen - and every time I've used them it's been successful. I've only had one issue regarding flashing a radio - but that was my fault for not reading/paying attention and Motorola for not allowing a lower version of radio to be flashed... Yes - there are grandmas and people who don't even know what Linux is would not be able to apply the patch themselves - but you are going to find that in any market.
    - SamReidHughes 11y ago
AUmrysh 11y ago
This was one of the big motivating factors for me getting a nexus 6 (aside from the size) and putting it on the fi network. I got 2 updates in the period of a week. I think the problem is vendors and carriers wanting to modify and inject their crapware and custom UIs into Android. Google is happy to provide upgrades to the OS in a timely fashion (and are going to start monthly updates), it's the vendors/carriers that delay these updates or don't even bother to port them over to devices. Google is moving much of the core Android functionality over to specific apps that they can update as needed from the play store, instead of integrating them directly into the OS. This is good, because it allows them to push the updates quicker. They run the risk that carriers will get sick of the lack of control over the "experience" they can provide, and fork android, but it's a necessary step in many ways to ensure things like this MMS exploit can be patched on some devices at all, as vendors abandon some phones quickly, leaving users vulnerable. If every vendor and carrier used stock nexus android without modification, the updates could be pushed out in days. The linked article blames google for these problems, but that is, in my opinion, misguided.

kreutzwj 11y ago

Agreed. There is a major issue, not sure if in the rest of the world, but in Canada, the service provider has to request, and commonly pay for, the patch to which the manufacturer completes and then the service provider then pushes out to their devices. At least that is how it was when the E911 issue happened, it may be better now, but knowing Telecoms in Canada, I wouldn't be surprised if it wasn't.

canistr 11y ago
It's not better. Look at the proposed target released dates for StageFright patches by Telus. And considering that it is not even fully patches, this only adds to the insanity of the situation with regards to Android fragmentation and carrier's controlling releases. http://forum.telus.com/thread/54211/category/top/board/Mobility/android-s-stagefright-vulnerability http://forum.telus.com/thread/54211/category/top/board/Mobil... OEM Model Target Release HTC One M7 August 14th HTC One M8 August 14th HTC One M9 August 14th HTC Desire 320a August 28th HTC Desire 601 August 14th LG Nexus 4 Completed LG Nexus 5 Completed Motorola Nexus 6 Completed Samsung Galaxy S5 August 11th SamsungGalaxy S5 Active August 11th Samsung Galaxy Alpha August 21st Samsung Galaxy Grand Prime August 21st Samsung Galaxy S6 Completed Samsung Galaxy S6 Edge Completed Samsung Galaxy S4 August 28th Samsung Galaxy Note 3 August 30th Samsung Galaxy Note 4 August 11th Samsung Galaxy Core September 4th Samsung Galaxy Tab S 8.4 September 4th Samsung Galaxy Tab S 10.5 September 4th Sony Xperia Z3 August 14th
- kreutzwj 11y ago
  Yeah, I just checked Rogers, it looks even worse and not even updated for if it is completed. http://communityforums.rogers.com/t5/forums/forumtopicpage/board-id/Android/message-id/32172#M32172 http://communityforums.rogers.com/t5/forums/forumtopicpage/b...

lumpygravy 11y ago

Indeed. Even the supposedly quickly updated Moto X did not receive a patch yet two weeks after the fact [1]. I feel sorry for all those people who are still stuck on Kit Kat or even worse Jelly Bean. https://www.reddit.com/r/MotoX/comments/3gugxa/anyone_got_the_stagefright_fix_update_yet/ https://www.reddit.com/r/MotoX/comments/3gugxa/anyone_got_th...

ocdtrekkie 11y ago
And for those of us who don't want Lollipop, we'll never be offered the update. We have to either accept a bad system "upgrade" or stay insecure.
- eropple 11y ago
  I feel for people whose providers won't upgrade them and I think they've got a good complaint, but if you choose to get off the upgrade path I think it's reasonable to assert that you're assuming responsibility for your own choices and security. I expect it can be backported to 4.x via custom ROMs for folks in that spot.
  - ocdtrekkie 11y ago
    Here's the problem: It's a DROID Turbo. It's locked down by Verizon/Motorola, and neither root nor bootloader unlock has been achieved. So it's not even an option. The problem is that the "upgrade path" and the "security fix" path need to be separate things. People should not be forced to have their device changed in an unacceptable manner (I did not buy a device with 'material design' for a reason, and being forced to get it to get a security fix is an unacceptable situation.)
    - eropple 11y ago
      I think, honestly, the only real answer is "don't buy locked devices if you want to make those choices." Google doesn't control those devices, and that part of Android is open source. You can make those decisions, but you're earning the consequences with them. This, as it happens, is why I buy phones with unlockable bootloaders. My current phone uses the OEM build, but I like having that choice.

nadams 11y ago

> Even if Google patches this, there's an incredible delay in getting the patch to users. I don't think delay is the problem - not being able to get or apply the patch yourself is the problem. Ignoring the somewhat ridiculous requirements to compile Android (200GB of HD space and 16GB of RAM [1]) - you couldn't put it on your Android device due to proprietary drivers for wireless and/or video. Assuming you can get an updated version - I have noticed that after getting root on my Nexus 6 it won't install new versions of Android. I don't know if it's a by-product of getting root/installing a new recovery or if they have an actual check. I have a legitimate reason for root because I use FreeOTP and it does not have an export feature - so I use Titanium backup to backup and restore the app. Getting the OTP QR codes for: dropbox, gmail, Microsoft account, facebook, srchub, github, paypal etc would take a very long time and considerable effort to recover (hint gitlab). [1] https://source.android.com/source/building.html https://source.android.com/source/building.html

SamReidHughes 11y ago
> I don't think delay is the problem - not being able to get or apply the patch yourself is the problem. Almost all users would be incapable of applying patches themselves.
- nadams 11y ago
  > Almost all users would be incapable of applying patches themselves. There are currently 357,101 registered users on XDA developers. Saying "almost" every android user can't apply a patch is somewhat far fetched. Most procedures on XDA developers have a much better step by step documentation than most SDKs I've seen - and every time I've used them it's been successful. I've only had one issue regarding flashing a radio - but that was my fault for not reading/paying attention and Motorola for not allowing a lower version of radio to be flashed... Yes - there are grandmas and people who don't even know what Linux is would not be able to apply the patch themselves - but you are going to find that in any market.
  - SamReidHughes 11y ago

AUmrysh 11y ago

This was one of the big motivating factors for me getting a nexus 6 (aside from the size) and putting it on the fi network. I got 2 updates in the period of a week. I think the problem is vendors and carriers wanting to modify and inject their crapware and custom UIs into Android. Google is happy to provide upgrades to the OS in a timely fashion (and are going to start monthly updates), it's the vendors/carriers that delay these updates or don't even bother to port them over to devices. Google is moving much of the core Android functionality over to specific apps that they can update as needed from the play store, instead of integrating them directly into the OS. This is good, because it allows them to push the updates quicker. They run the risk that carriers will get sick of the lack of control over the "experience" they can provide, and fork android, but it's a necessary step in many ways to ensure things like this MMS exploit can be patched on some devices at all, as vendors abandon some phones quickly, leaving users vulnerable. If every vendor and carrier used stock nexus android without modification, the updates could be pushed out in days. The linked article blames google for these problems, but that is, in my opinion, misguided.