> security updates or corrective updates mentioned under point (a) need to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
https://eur-lex.europa.eu/eli/reg/2023/1670/oj/eng#anx_II
So by delaying AOSP releases by 4 months, Google is allowing OEMs to leave their users exposed to known vulnerabilities for up to 8 months.
The second part explicitly addresses this, Pixels getting QPR1 starts the timer.
My understanding is as follows: They're delaying source code releases for security updates, but they're privately sharing source and binary security updates with partners. Source releases are embargoed, binary releases aren't (I assume it's to avoid triggering the ecodesign clock)
When patches go out to partners in October, they are immediately released by GrapheneOS for users who opt-in for "security preview" releases. Stock Pixel users might get them in December (triggering the ecodesign clock), and other brands could get them as late as April (per ecodesign requirements).
So the timeline could look like:
June: Vulnerability discovered
September: Vulnerability patched
October: Source and binary patch sent to partners. Patch can now be reverse engineered and actively exploited.
October, shortly after: GrapheneOS releases an update with the binary patch
December: Vulnerability is officially part of the December bulletin, Pixel officially gets the update
January: Samsung releases the update
April: Everyone else (legal worst case)
Not completely. Android Security Bulletins only have fixes for vulnerabilities marked high/critical in resent years. To get all other security fixes, you need QPRs and major releases.
- 45 kWh per household per year
- 11.7 TWh of electricity in 2020 EU-wide
Literally just from better designed consumer vacuum cleaners.
https://energy-efficient-products.ec.europa.eu/product-list/...