Hacker News Reader

Comment by kodebach | Hacker News Reader

I can't prove it, but I still think this is (partly) due to a recent EU regulation majorly backfiring. I can't remember which one it was, but one of the recent regulations mandates that devices get updates for a certain period. Within that period a manufacturer must provide each update for all their devices in a short timeframe. The intention was to prevent flagships getting updates immediately and lower end devices having to wait months. However, due to some (also well intentioned) wording about open source, the release of the source code is counted as the first release of an update and starts the timer. I'm pretty sure Google is delaying public AOSP updates to give their partners (mainly Samsung I suppose) more time to finish building their updates on top of AOSP.

View on HN

> EU regulation majorly backfiring

I wouldn't be surprised if large corporations like Apple and Google intentionally use these tactics to pressure regulators through their European users. Siri AI is a prime example. While it's a complicated issue, I certainly wouldn't put such maneuvers past them.

It's funny that they keep trying, it has never once worked. I think US companies are projecting their dislike for regulation and keep being surprised that EU citizens don't agree. We do not love the EU government, but it sometimes does a good thing and we do like these, especially versus the anti-consumer crap that US companies like to pull.

Yes Us Companies Are doing this ofc

I don't think this is any corporate conspiracy. The truth is probably more mundane: regulation is treated as obstacle to navigate around with minimal amount of effort, and not a reason to give up on practices that makes money.

A system that leads to bad outcomes is a bad system.

When your system favors people into power that abuse that position instead of furthering the public interest, that provides a feedback signal leading to ever worse people and outcomes.

There is no need for a "conspiracy" to get to a point where it looks like one.

we do not love the EU government because there are billions being poured into promoting the discourse that the EU is a bad thing by both private and state actors.

My problem is the lack of democracy through the too-indirect way that the commission is elected. Von der Leyen was an extremely unpopular and horribly incompetent (at least in charge of defense) minister in Germany, then somehow she became president of the EU commission. Her skill seems to be politicking with other politicians. That would not have gotten her elected in an election by the people.

Sometimes its a good thing that people do not elect directly. They participate indirectly though. And there are general rules to follow. So its more stable framework than full public control each election cycle, because the populism happens and if you want to be elected you cant take unpopular decisions which sometimes are needed.

There are unpopular decisions that are actually good, and those that are simply bad for the population but good for people closer to power. I think the latter are more common in basically any system with too little public oversight.

If you are talking about judges, prosecutors or sheriffs I could understand your opinion, but we're talking about a political function here.

Indirect democracy is not really a lack of democracy. But I dislike the way it works now as well and would like for EU elections to be more direct. I'd also like to be able to vote for candidates from other member states.

However changes like these are deeply unpopular as they get interpreted as moving more powers to "Brussels" by right wing media.

Right wing media is usually owned by specific billionaires.

Their agenda isn't that of "ordinary people". Those rather get used for the interests of those "strategic investors".

Less power for Brussels means more power for rich people.

And it is the nation states that fight tooth and nails against more direct elections.

Nation states in the EU follow the direction their politicians get pointed at by the money that gets them elected.

A more powerful EU would mean less power for big corporations and wealthy individuals.

Right now, "EU washing" unpopular policies is a thing. National (usually corporate) interests can make EU laws happen, and when they have, national politicians say "Sorry, our hands are tied - EU law!". So I'm not at all optimistic that the EU political organization, of all things, will reduce corruption just by getting more power. But I do think that more direct elections to powerful EU positions will improve things.

This was really lame cope ten years ago and it's really lame cope now.

Because the European Union has come up with shitty laws and regulations.

It mandated USB for charging everywhere, but didn't do a thing about driving on the right side of the road.

We have the digital markets act, yet when someone tries to send emails to some big American email providers, they have to register first, otherwise they don't even make it to the spam folder. But hey, let's have a big round of applause for fining X/Elon Musk and Meta because we hate them. Who cares about decades old protocols and ways of doing things?

It takes time. And there will always be something to complain. But don't you agree that things are moving in positive direction?

Not quite. There's more and more you have to deal with instead of less. I don't want more laws to read and comply with, I want less.

I bet most people have not read any laws in past year. hell, some have not read any laws in their lives. And no i don't agree that i want fewer laws. By the way, how many laws is enough for you?

Most people don't read any law their entire lifetime and hope for the best. But are you willing to risk it, if you're trying to do something? It does not even have to be complicated, it can be something as simple as having a website. Suddenly you have to deal with GDPR and it's not an easy task, otherwise we wouldn't have so many discussions and consultants, not to mention the fact that some websites prefer to just block European users.

The PDF for GDPR has 88 pages [1]. And it's just one thing. The AI act has another 144 pages [2]. Who's gonna read them?

[1]: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...

[2]: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L...

Well DMCA is 60 pages, do you read it when you are creating a web page?

https://www.congress.gov/105/plaws/publ304/PLAW-105publ304.p...

We have civil code for everyday life, do you think people read that? I bet no, but anyway it describes rules by which people live. And when there is disagreement we open a book and see whos right. Do you think we should not have such rule book?

Blame the shitty tech companies, the DMA and similar attempts in the USA and many other countries stem from them stacking everything in their favour at the cost of everyone else's money, privacy, security and safety.

It's not like regulators were just bored and felt like fucking shit up, there is a nearly-global consensus these companies are exploiting consumers and markets.

Except that DMA didn't do anything for more fundamental problems like the email problem.

No, they just want to have something to brag about or think they know better (Soviet/communist style). Like, we're lazy and tired of having to carry our proprietary iPhone chargers, we know you're too, let's make USB mandatory.

Don't believe the chargers are a good example. There definitely must be some good ones. But Apple is being anti non-apple consumers (and often anti apple consumers, vide ridiculously expensive monitor stand) for a long time, doing everything to make sure nothing non apple can work well with apple products and vice versa.

I can (actually can't, but for the sake of argument let's pretend) imagine why my wife's Air Pods Pro 3 can't supply heart rate data to my phone for exercising. But why can't they report battery level? ffs

Even if Lightning is better in some aspects (USB-C tongues break sometimes), forcing people to have special cables just for apple devices, when every single thing runs on USB-C, feels like done out of spite. And then? Apple devices don't support any fast charging standard. Spite again.

It's hard to see it differently, but there might be better reasons and arguments that I can't or choose not to see. Probably because I don't love the company that forced poor parents to buy their kids expensive phones just so the kids wouldn't get ostracized for not having green or blue bubble in text messages.

If I don't like the product because of its charging mechanism, not reporting battery level etc, I don't buy it.

> USB-C tongues break sometimes

Unlike barrel chargers which are also simpler. No need for fancy electronics and protocols. Let's not forget non-compliant USB chargers. I remember reading about a Chinese mini-PC manufacturer that sold a computer with a charger which provided 19V or so from the start without any negotiation. Hopefully no one tried to use it with another device.

>Let's not forget non-compliant USB chargers. I remember reading about a Chinese mini-PC manufacturer that sold a computer with a charger which provided 19V or so from the start without any negotiation. Hopefully no one tried to use it with another device.

I actually (or somebody close, friend or family, can't recall) did exactly that. It was a few years ago and I don't remember what got fried. Some small electronics. It was a barrel charger and it fit. Too bad that fitting didn't mean the power levels were ok too.

> I don't like the product because of its charging mechanism, not reporting battery level etc, I don't buy it.

Why shouldn't my wife get headphones because a company is a dick and makes them not work with her husband's phone properly? Looks like a dismissive argument trying to excuse malicious business practices. (I'm not in or from US, maybe that's normal and OK there, so sorry for ranting about it, as it might be fine or even good for you if you're invested in Apple). Anyway, why not buy them, headphones work very well for my wife. Other than price not being adjusted to product performance and quality, AirPods Pro 3 are a very good product. HR reporting is a cool feature. And I don't have bud-type earphones, so I borrow hers for exercising.

Back to "don't buy it if you don't like it" argument: it doesn't argument against apple being dicks for making the product purposefully not work with an Android phone. And if it does, please explain it more clearly, I believe I'm not the only one holding the point of view that it just doesn't exonerate them.

As I see it, it's malicious compliance, as there's no laws YET forbidding what they're doing. (Somebody recently RE'd AirPods BT protocol/calls IIRC and found them reporting battery on non standard ?variable name?. He then got Android phone to show battery level after a small modification.

For comparison, I would bet a beer (I see betting more as gambling) that if Samsung created headphones with HR monitor, I would still be able to see battery level and HR in my Oura app on my OnePlus. And vice versa for 1+ headphones on Samsung. Do you see my point?

And for the record, apple has recently released many phones, both low and high end, that weren't overpriced. And I vehemently oppose anyone whom I'll have to tech support later, getting any phone different than apple - for a non technical user these phones are perfect. Good default's. Non customizable - perfect from point of view of tech support. Just works. Just to show that I'm anti anti consumer conduct, not anti apple.

> It mandated USB for charging everywhere, but didn't do a thing about driving on the right side of the road.

You forget that the worst offender took its toys and went away not too long ago.

> fining X/Elon Musk and Meta because we hate them.

They were fined because they broke the law. Many consider these fines, a slap on the wrist. Personally I support much harsher and detrimental punishments in such cases.

You misunderstood me. I wasn't saying they didn't break the law, I honestly have no idea if they did. I was only saying that some people like the law because it makes people/companies which they hate (possibly for valid reasons) suffer. In other words they like only the sentence.

> It's funny that they keep trying, it has never once worked.

Sure it has. Consider cookie banners: widespread malicious faux-compliance from the start, and approximately nothing was done about it for most of a decade, while people were tricked into believing they were GDPR’s fault. Even now when a little has been done about it, the significant majority of cookie banners are very obviously not compliant with GDPR or ePD requirements, and no consequences occur.

Giving their partners the time they need to finalise their releases legally seems like a... completely normal and correct thing to do? Why does everything have to be a big conspiracy?

Why would that be a normal and correct thing to do? They're delaying releases for everyone else.

https://grapheneos.social/@GrapheneOS/115164133992525834

https://news.ycombinator.com/item?id=49946698

So it is not normal/correct to have an agreement with a partner that excludes others?

Sometimes it is, sometimes it's not.

Normal? Sadly yes.

Correct? I suppose that depends on your definition. From a corporate perspective, perhaps. But from a consumer's perspective it's most certainly not the desired outcome.

No, not in an open-source project. Nor is it correct to build the project under the guise of open source and then pull the rug from underneath. Or any of the other anti-competitive, anti-consumer, anti-security crap they've been doing lately.

They don’t have agreements with graphene so what do they care? Google owes graphene absolutely nothing.

They care about their partners and about following the law. Google is not being spiteful here like some commenters are saying; instead, they have changed the way they work to make it compatible with a new law that applies to them.

It’s tiresome to see the same kind of snarky comments in every thread because they are not interesting at all. They are just lazy, and begging for votes.

They're skirting the law and they're likely to be breaking it too - if not on cybersecurity grounds then almost certainly on anti-competitive grounds.

Even if we set legality of their behavior aside, they deserve scorn for how they've been managing Android for the past couple of years - every Android user is worse off because of them. They broke off productive relationships with grapheneos and other projects which contributed patches and reported vulnerabilities upstream, they're engaging in anti-competitive conduct and imposing limits on OEMs, giving Pixel devices preferential access to new APIs.

They're simultaneously putting their own customers (Pixel owners) at risk of known, exploitable security vulnerabilities. They do this to help other OEMs legally skirt (maybe) the 4 month timeframe for patches which is very lax to begin with. Thereby opening a whopping 8 month window where Android users can get hacked by known vulnerabilities.

Their Android 17 QPR1 release was so buggy, it made many Pixel devices almost unusable and then they went radio silent. https://grapheneos.social/@GrapheneOS/117372129125340408

How cynical do you have to be to defend their stewardship of AOSP?

> Google is not being spiteful here like some commenters are saying; instead, they have changed the way they work to make it compatible with a new law that applies to them

Read the second link I posted above, this is patently false.

They absolutely do this.

There should be a rule that any assertion of conspiracy must at least have some evidence.

I worked at MS and was involved in several decisions to not ship in the EU because it just wasn’t worth the internal and external regulatory headache. There was no secret agenda, Satya never told me to stick it to the EU by withholding a feature in the hopes the masses would clamor for it and demand regulatory changes, which would eventually allow us to… ship the feature in a decade or so.

I’m super sympathetic to the EU’s intent, but their execution is so obviously self-defeating that it doesn’t take elaborate conspiracies to explain corporate response.

> There should be a rule that any assertion of conspiracy must at least have some evidence.

Broadly, I agree, and good grief do I wish people would follow this more often. But Google specifically has acted incredibly anti-competitively for several years now [0], especially regarding Android. This has gone on for such a long time that they have, in my mind, lost the benefit of any doubt.

As they continue to lock down Android [1], things that would have once been met with a "Wait and see" approach are instead met with suspicion and a default assumption that it's primarily (though not typically exclusively) done to serve their own interests.

So generally, yes! That which is asserted without evidence can be dismissed without evidence. However, Google's history is all the evidence I need to assume their actions are not done in good faith.

[0] https://arstechnica.com/gadgets/2018/07/googles-iron-grip-on...

[1] https://manualdousuario.net/en/blocking-unverified-apps-andr...

> but their execution is so obviously self-defeating

Well no. It’s not self defeating. It’s being defeated because these are US tech companies, protected by US monopoly power, and the fact that US lawmakers are captured by lobbyists and are incapable of passing similar laws to protect their constituents. Big difference.

Ah, so non-US companies are shipping every feature in the EU then?

It can't ever just be the fault of the regulation, of course.

It's an interesting theory. However, Samsung has already started to roll out One UI 9, which is built on top of Android 17 a month ago, so their clock has already started ticking.

I'm not familiar with the concrete wording of the regulation, but I would wager that the all the customization layers (like "One UI") that OEMs put on top of AOSP is the component for which the update clock should tick, and they should be unaffected of an underlying open source component (AOSP) being released.

Android 17 is old news, and OneUI 9 was what delayed the OS version bump for months, because Samsung planned to launch it with on new flagships first, during summer Unboxed event.

A problem with legislation in general is that it is often very open to interpretation. Especially legislation around fast-moving technology fields. It’s very difficult to write both broadly applicable legislation that requires minimal interpretation. And in fact leaving the regulation open to interpretation can be a feature from the point of view of authority.

The only interpretation that matters is that of the Authority of enforcement and judgement. The implementer’s interpretation doesn’t hold much weight.

We can say what we earnestly believe the regulations mean, and how they can be met, but if the authorities say “not good enough” that’s all that matters.

I posted about this 11 months ago [1]. The law you are referring to [2] absolutely makes distinctions between open/closed source. This is 100% why Google closed their source and now does security releases privately.

[1]: https://news.ycombinator.com/item?id=45911673

[2]: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ%3AJOL...

> Clause 1.2:

> (6) Operating system updates:

> (a)

> from the date of end of placement on the market to at least 5 years after that date, manufacturers, importers or authorised representatives shall, if they provide security updates, corrective updates or functionality updates to an operating system, make such updates available at no cost for all units of a product model with the same operating system;

> (b)

> the requirement referred to in point (a) shall apply both to operating system updates offered voluntarily by manufacturers, importers or authorised representatives and to operating system updates provided to comply with Union law;

> (c)

> security updates or corrective updates mentioned under point (a) need to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;

> (d)

> functionality updates mentioned under point (a) need to be available to the user at the latest 6 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;

> (e) an operating system update may combine security, corrective and functionality updates.

(c) and (d) treat binary releases as equivalent to source code releases, so that's rather the opposite of making a distinction between open and closed source. It would serve as an explanation if Google had started to release source code and binaries simultaneously, but it doesn't explain why the source code release is delayed even beyond that.

EDIT: I see that was already brought up multiple times when you posted about it 11 months ago.

As far as I understand, most OEMs are not allowed to release QPR1 or QPR3 either (not that OEMs outside maybe Samsung would be able to). So part of it also reeks of giving Pixel benefits over phones of other manufacturers.

the more I learn about how Google handles releases the more this looks like there being a need for anti trust actions

> As far as I understand, most OEMs are not allowed to release QPR1 or QPR3 either (not that OEMs outside maybe Samsung would be able to).

This is not true at all though. OEMs can release anything whenever they want.

Except for phones preinstalled with GrapheneOS (unless you are Samsung)

I have read in multiple sources that OEMs cannot roll out QPR1/3. E.g. see this thread:

https://grapheneos.social/@GrapheneOS/117282080803799576

Since they are working with two OEMs (one for GrapheneOS support and one for getting embargoed security patches), I think they know what they are taking about.

Nothing of that has to do with OEMs being forbidden from shipping QPRs though.

Graphene isn't OEM so they don't get access to Android repository before AOSP drops. OEMs - like Motorola for example - do have access to partner repository and can ship QPRs if they wish to do so. Most often OEMs do not want to push updates (and it took years to make them push regular major Android updates).

> I think they know what they are taking about.

Err, if you look at that account you'll find that the person running it has a penchant for overexaggeration and selective truth telling when they feel aggrieved.

Nothing of that has to do with OEMs being forbidden from shipping QPRs though.

Are reading the same post?

“ The new APIs are currently exclusive to the Pixel OS and aren't available to other Android OEMs. […] Non-Google Android OEMs and AOSP-based projects can ship yearly and QPR2 releases.”

the person running it has a penchant for overexaggeration and selective truth telling when they feel aggrieved.

Here we go again…

Well, Graphene's statement isn't true so not sure what do you want me to tell you ¯\_(ツ)_/¯

Maybe their own source at OEMs lied to them? The QPRs are in the same repo they're getting their security patches from.

The QPRs are in the same repo they're getting their security patches from.

That doesn't mean that they are actually allowed to release them. Big difference.

Let's chill with conspiracy theories. Code is still Apache licensed.

if that is the case then it should be brought to the respective overseen regulatory body, weather it is for them to clarify that this is not a valid interpretation of the law (it's at least clearly in conflict with the spirit of the law) and intentionally delaying public releases this way is a no-go or weather it is to amend the law to make it more explicitly illegal

either way if that is true it looks like a very intentional abuse/misinterpretation of existing regulations

What makes you think it’s misinterpretation?

FAQ https://ec.europa.eu/newsroom/dae/redirection/document/12233... [PDF]

https://digital-strategy.ec.europa.eu/en/policies/cra-manufa...

It's not a CRA obligation, but a rule from ecodesign requirements for smartphones (Reg. 2023/1670)

https://eur-lex.europa.eu/eli/reg/2023/1670/oj/eng#anx_II

So by delaying AOSP releases by 4 months, Google is allowing OEMs to leave their users exposed to known vulnerabilities for up to 8 months.

How does that prevent them from releasing 17 QPR1 now given that 17 QPR1 is already released "by the operating system provider or on any other product of the same brand"?

The second part explicitly addresses this, Pixels getting QPR1 starts the timer.

QPR and security updates are different things.

My understanding is as follows: They're delaying source code releases for security updates, but they're privately sharing source and binary security updates with partners. Source releases are embargoed, binary releases aren't (I assume it's to avoid triggering the ecodesign clock)

When patches go out to partners in October, they are immediately released by GrapheneOS for users who opt-in for "security preview" releases. Stock Pixel users might get them in December (triggering the ecodesign clock), and other brands could get them as late as April (per ecodesign requirements).

So the timeline could look like:

June: Vulnerability discovered

September: Vulnerability patched

October: Source and binary patch sent to partners. Patch can now be reverse engineered and actively exploited.

October, shortly after: GrapheneOS releases an update with the binary patch

December: Vulnerability is officially part of the December bulletin, Pixel officially gets the update

January: Samsung releases the update

April: Everyone else (legal worst case)

I didn't dispute that they're delaying source code releases for security patches, I only pointed out that these regulations can't explain why they choose not to publish QPR1/QPR3 while publishing QPR0/QPR2.

QPR and security updates are different things.

Not completely. Android Security Bulletins only have fixes for vulnerabilities marked high/critical in resent years. To get all other security fixes, you need QPRs and major releases.

Ecodesign is so nice! The vacuum energy reduction requirements that also introduced mandatory of suction power, aside from starting a market trend towards better suction, saved:

- 45 kWh per household per year

- 11.7 TWh of electricity in 2020 EU-wide

Literally just from better designed consumer vacuum cleaners.

https://energy-efficient-products.ec.europa.eu/product-list/...

It's Cyber Resilience Act (Regulation (EU) 2024/2847) - if there's a security patch that shows up in public, then the manufacturers are fined if they don't immediately roll it out as an update ("without undue delay").

I think that's the one that made a lot of OEMs pull back on opensource publishing, because their legal departments want to batch the CVE monitoring and reporting obligations into smaller batches.

nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".

As long as they start the process and it is not absurd from an industry standards perspective, they should be good. They can have slow processes, including being a good bit slower than their peers, without running afoul of "without undue delay".

> nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".

Well, the corporate lawyers think otherwise at those corporations, so I'm not sure how much your interpretation counts :)

I do not believe that any corporate lawyer would think that. It does not read like that in neither plain english nor legalese.

Maybe the misunderstanding stems from the related common misuse of "as soon as possible" as "immediately"?

A corporate lawyer would, however, always suggest to minimize/reduce/delay any legal obligations so as to minimize risk of liability, regardless of whether said obligation is easy to comply with or not.

They have literal 24 hour and 72 hour deadlines. Obviously, they might put a blind eye to it if you are reliable but delayed the reporting by a day, but the 24 hour and 72 hour deadlines are a fact. You have to initiate the reporting immediately.

This is impossible to happen.

Security flaws are discovered almost every day (now that they are automating it with AI there are a ton of reports), pretending the manufacturer releases an update in 1 day is nonsense.

Just building the code alone it would take a lot of time, and of course you have to test it at least a bit before giving it out to the end users, you can't pretend to rollout on a global scale a nightly build without first at least some level of QA risking bricking user devices.

And you have to consider that phone manufacturer doesn't work h24 and 7/7 of course to give out patches.

I think that we are fortunate if the whole process takes less than a month, not a day.

You are mixing unrelated requirements together here.

> The CRA requires manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of their product with digital elements. They need to submit an early warning within 24 hours of becoming aware, and a full notification within 72 hours.

These deadlines are entirely unrelated to the availability of security fixes and delays in deliverying them.

You are confusing two different articles. The 24-hour deadline relates to notifying the national Computer Security Incident Response Team in the event of the detection of a confirmed exploited vulnerability of one of the manufacturer’s products (Article 14). Submitting a bug report and opening a ticket does not constitute a confirmed exploitation in the wild. Nor does the publication of an exploit or a PoC constitute a confirmed exploitation of the vuln in the wild.

The part that’s probably bothering Google is this:

> 6. Manufacturers shall, upon identifying a vulnerability in a component, including in an open source-component, which is integrated in the product with digital elements report the vulnerability to the person or entity manufacturing or maintaining the component, and address and remediate the vulnerability in accordance with the vulnerability handling requirements set out in Part II of Annex I. Where manufacturers have developed a software or hardware modification to address the vulnerability in that component, they shall share the relevant code or documentation with the person or entity manufacturing or maintaining the component, where appropriate in a machine-readable format.

To put it very simply, the CRA calls on all stakeholders to cooperate in reporting incidents and vulnerabilities, establishes a national coordination mechanism, and aims to address vulnerabilities swiftly in order to maintain essential services within the European Union.

Aren’t most OEMs in violation anyway because Linux (as in the kernel) gets regular security patches and most OEMs are on ancient kernel versions?

Also, major Android releases and QPR2s have many security fixes (anything not marked high/critical), yet OEMs are not rolling them out (QPR2) or very late (major releases).

Just to say that OEMs were probably violating the act already before Google started withholding source code.

I also think it’s an attempt of Google closing up AOSP more, otherwise they wouldn’t make it so darn hard to get updated Pixel kernel trees.

probably yes

withholding security updates seems to avoid a law which requires rolling out security updates seems very much like something which needs to be fixed one way or another

I think it's mostly the "you need to monitor CVEs and write report within 24/72 hours" that causes OEMs pain and they prefer to have less work than more.

Also - the reality of what you think is ok and what a corporate legal department think its ok is... rarely the same -_-

Law: please do the minimum to protect users. Corps: screaming

This. CRA only means that you need to assess with 24/72h that you are affected or not by a published CVE.

Then there is no time limit to provide a mitigation. It should just be worked out without unnecessary delays. Once a mitigation is published, a report should be submitted with 14 days.

This reminds me of the OpenAI hack against Hugging Face.

Regulators present an impossible goal to the companies to implement, instead of implementing the goal, the companies try to reward hack their way around it.

The end result is that they basically try to make it impossible to know about vulnerabilities because that would start the clock.

But doing timely security updates is not impossible. Apple does it, GrapheneOS does it, Google does it with Pixel, Samsung is nearly doing it on flagships.

But many Android OEMs are probably terrible at software engineering and have their attention spread across multiple SoCs, etc. It’s their own fault.

Then they should leave it to others. Release specs and sources and let whoever wants, maintain the firmwares.

Ha ha ha, that'll take spyware to a whole new level. "You're running an old vulnerable version of Android, upgrade today to Android-45.123-robustdonut to get the latest security. Now with 100% genuine AI."

> But doing timely security updates is not impossible. Apple does it, GrapheneOS does it, Google does it with Pixel, Samsung is nearly doing it on flagships.

What does "timely" here mean? A lot of security patches for all these companies take ~weeks+ to actually make it to customers due to things like QA testing, carrier testing and release processes.

The time between disclosure and release can be rather long, months even for all of them. (I'm counting private disclosure here.)

What does "timely" here mean? A lot of security patches for all these companies take ~weeks+ to actually make it to customers

Google has an embargo period of up to 6 months on AOSP patches. This is why GrapheneOS already has April 2027 AOSP security patches now. Even though some patches are already known for 6 months, they still manage to ship it 1-3 months late. 7-9 months after they got the patches already from Google.

due to things like QA testing, carrier testing and release processes.

Carrier testing is mostly a US thing. If you cannot roll out security patches within a few days, your QA and release processes are just totally broken. GrapheneOS can do it and they generally have far fewer regressions than Android OEMs.

Major releases and QPR2 take some time for testing, but they already have the access to sources months before they are released. Heck, Samsung releases major release betas and QPR2 betas quite a while before Google releases it as stable.

The problem is that the OEMs made a mess. First they just dropped phones on the market without doing any updates at all. Mid 2010s it was very normal for an OEM to do maybe one or two updates. Then Google had to push them to do better, among other reasons because Apple does much better and there were really big fails like Stagefright. Plus users wanted new Android releases. Then they did only 2-3 updates with very irregular software updates. Now they are under pressure from EU regulations and they actually have to support devices for a long time and do regular updates, but they just don't have good release processes. Plus they made their own 'skins' on top of it that they have to rebase, etc.

Companies that have their ducks in a row better, abuse the release process to push sales of new devices. E.g. Samsung withholds major/QPR releases for a while so that only their latest device have it, e.g. recently Fold 8/Flip 8.

People should stop beingapologists for multi-billion dollar companies.

I'm not sure what you're trying to say here - I've mostly said that for the corporations you highlighted, "timely" can still mean months for a given security patch to be deployed as things stand.

That's the reality - yes, even for Apple.

If you think they could and should be better - I guess I agree, but it doesn't change the reality.

From what I see [1] if you search for 'undue delay', it's only:

> an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it

> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively

> without undue delay and in any event within 24 hours of the manufacturer becoming aware of it

> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident

"Sorry your honour, we only became 'aware of it' 2 years later, pinky promise ;)".

So any competant authority would have to prove when they 'became aware of it', whatever the test to pass that threshold means.

[1]: https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng

That’s not true; the only way to be found guilty following a CRA is to conceal the active exploitation of a vulnerability, fail to alert the national coordinator, fail to propose a mitigation within a reasonable timeframe, or be openly negligent in the management of the cybersecurity of one’s products.

“Please stop using this version of my product or this particular feature; it is vulnerable” is an acceptable mitigation measure.

A CVE isn't an active exploitation and don't trigger anything.

These CRA provisions will be in effect from December 2027 onwards.

If this is the case, I wonder why isn't Google publicly saying this. Because right now, it looks like they've stopped publishing the sources just because they felt like it, which has understandably generated a lot of backlash, but I feel like all the backlash would go away if they pointed at the EU regulations.

Why will they care what HN says about them? The people here don't like them anyway. They care what customers think, not developers.

Interesting theory. Is there a distinction between phone release and os release there? I would imagine the time starts when the model goes in sale, not when the os releases.

Otherwise I would expect Google would also wait with pixel updates

So it's the regulator's fault that a trillion dollar company is acting against the public interest? That's some unproven theory indeed.

This vicious European Union, which stifles innovation and works against the public interest – for example (checks his notes) by mandating USB-C charging and replaceable batteries!

Google hasn't delayed pushing releases to AOSP but rather stopped pushing Pixel exclusive releases to AOSP. Android 17 QPR1 and Android 17 QPR3 are Pixel exclusive releases which won't be pushed to AOSP under the current policy. For 2/4 quarters per year, Pixels are on a major release of Android exclusive to Pixels and not released to AOSP. Non-Pixel devices don't get QPR1 or QPR3 releases. This is part of Google dropping support for Pixel devices from AOSP and giving them an artificial advantage over other Android devices.

See https://news.ycombinator.com/item?id=50112059 for a more detailed explanation.

I'm not disagreeing with you, and I don't understand the market.

But surely, unless the regulation is written in an especially thoughtless way, the clock would start at either the time the device manufacturer has access to the upstream fix, or the time that the manufacturer provides an update to any of their devices (which implies access to an upstream fix).

So public source release would only impose additional burden on device manufacturers if it is the first time that they are seeing the upstream fix.

Right?

This is such a bad excuse, if they've released the update on a single phone then the timer would have already started - why delay AOSP after that?

No, it's not. (source: used to work on Android at Google, and its as simple as it seems, more and more MBA-style management meant more and more didn't care, which meant it was more and more poorly resourced, until it was discovered by revealed preferences that no one cared, at least, no one cared enough to speak up)

> due to a recent EU regulation majorly backfiring

And why should a regulation in EU affect rest of the world. Or for that matter, any US regulation. The arrogance of these nations and the ignorance of tech companies is ruining the entire Internet.

Because making things everywhere compliant is cheaper than having both a non-EU and EU versions of software. See also: Brussels effect[0].

It's simple economics. The companies are also allowed to either do special versions to comply with local laws or even to pull out of the market. They just choose not to for reasons.

[0]: <https://en.wikipedia.org/wiki/Brussels_effect>

Sure, American courts ask for age verification, the entire world needs to comply now. Then people wonder why so much surveillance. You can’t see past Brussels effects, because ignorance.

Reply on news.ycombinator.com