Aren’t most OEMs in violation anyway because Linux (as in the kernel) gets regular security patches and most OEMs are on ancient kernel versions?

Also, major Android releases and QPR2s have many security fixes (anything not marked high/critical), yet OEMs are not rolling them out (QPR2) or very late (major releases).

Just to say that OEMs were probably violating the act already before Google started withholding source code.

I also think it’s an attempt of Google closing up AOSP more, otherwise they wouldn’t make it so darn hard to get updated Pixel kernel trees.

▲

dathinab 4 hours ago | parent | next [-]

probably yes

withholding security updates seems to avoid a law which requires rolling out security updates seems very much like something which needs to be fixed one way or another

▲

imtringued 3 hours ago | parent | prev | next [-]

This reminds me of the OpenAI hack against Hugging Face.

Regulators present an impossible goal to the companies to implement, instead of implementing the goal, the companies try to reward hack their way around it.

The end result is that they basically try to make it impossible to know about vulnerabilities because that would start the clock.

▲

microtonal 2 hours ago | parent [-]

But doing timely security updates is not impossible. Apple does it, GrapheneOS does it, Google does it with Pixel, Samsung is nearly doing it on flagships.

But many Android OEMs are probably terrible at software engineering and have their attention spread across multiple SoCs, etc. It’s their own fault.

	▲	hardbass 43 minutes ago \| parent [-]
		Then they should leave it to others. Release specs and sources and let whoever wants, maintain the firmwares.

▲

izacus 3 hours ago | parent | prev [-]

I think it's mostly the "you need to monitor CVEs and write report within 24/72 hours" that causes OEMs pain and they prefer to have less work than more.

Also - the reality of what you think is ok and what a corporate legal department think its ok is... rarely the same -_-

	▲	themagic80 38 minutes ago \| parent [-]
		Law: please do the minimum to protect users. Corps: screaming