Android has its merits, but more and more I am reminded of this aptly titled article (proudly mentioned by Tim Cook during the WWDC keynote): "Android Fragmentation Turning Devices Into a Toxic Hellstew of Vulnerabilities" [1]. These kinds of incredibly serious, system level issues are a significant competitive disadvantage, and they keep happening. Google needs to build fast security update requirements into their Android license agreements with device makers. At least then, when these things are discovered and publicized, tens of millions of people won't be left vulnerable.
Note that this isn't an "incredibly serious system level issue." This is an issue with a browser that Google hasn't supported for several years, since they replaced it with Chrome. It also doesn't affect alternative browsers like Firefox or Opera.
Note that if Apple had a similar vulnerability, you likely couldn't work around it by using an alternative browser, because all browsers are required to use Safari's rendering engine.
Chrome has made some strides this year, but the Android Browser still leads by a point. That'll probably change next month or two I'd guess. But unless I'm entirely off base and talking about the wrong thing, I think your comment is very misleading.
If this happened with Safari, you'd likely see a patch pretty quickly, and it would be available to almost everyone at the same time.
In addition to the Browser app that is still widely use in devices with less-than-latest Android versions, It's present in every app that uses WebView. And you only get fixes to WebView via OS updates. (x)
(x) Maybe. Assuming someone bothers to incorporate them into to the OS update for your device and they make it through the hurdles between the engineer and OTA update certification.
WebView uses Chrome as of 4.4 as well. Also many apps that use WebView show only their own content in it. There are only a couple apps that show user specified content in app via WebView, like Reddit and HN.
Even if I were to go back to the old Internet app instead of Chrome, this bug is irrelevant to me since I use an app for GMail, Twitter, Facebook and anything else important. I can't remember the last time I used the mobile browser for anything that matters.
It's still a copy of the browser code that comes with the base OS, even if it dodges the bullet on this bug. The Chromium-based WebView doesn't receive updates like the Chrome app so will generally contain unpatched vulnerabilities, so the system level issue remains.
(Note that the rare-to-nonexsistent OS updates are still a problem, this WebView issue nonwithstanding. They are running old vulnerable Linux kernels which compromises the app sandbox)
Think of it the way Apple abandoned Safari for Windows without letting the users know. They're still using Safari for Windows, it's just completely insecure and they have no idea.
Even worse than that: They've been variously been saying "18 months from device release" and "up to 2 years" lately. So if you buy a device that's been out for a year you may be out of luck in 6 months.
I think Google needs to change that as well. Android is seen as a second class OS by a large percentage of people, and these kinds of revelations only increase that percentage. Google can do better, but for whatever reason they aren't.
This kind of thing, without a way to update hundreds of millions of older devices (mostly owned by laypeople that aren't going to be loading custom ROMs/rooting their phone), makes Android a second-class OS. They'll become aware of the issue when their bank account gets emptied or any of the other thousands of ways this could be exploited.
> Google can do better, but for whatever reason they aren't.
s/aren't/choose not to/
This is simply bad management – we're talking, what, a single engineer to backport critical fixes and some testing support. Contrast that against the damage this has done to Android's competitiveness – even the non-nerds I know talk about how they bought an iOS device because Android never gets updates – and increases the likelihood that they'll have a major security problem at some point when someone creates widespread exploit affecting all of those abandoned phones and the headlines talk about how many millions of people are at risk for a problem which was reported years ago.
The phone vendors and carriers had a large part in creating this problem but most of the reputation sticks to the platform and, as with the more general fragmentation problem, Google has been very slow to take it seriously.
>> we're talking, what, a single engineer to backport critical fixes and some testing support.
Understatement of the day? :) There is absolutely no way a single developer will be able to support huge/complex codebases like web-browsers across platform versions.
Also keep in mind that most of the original developers would have moved on from the project - due to lack of interest, greener pastures etc. I am wondering what kind of engineer would be willing to babysit a project like this - and if somebody is willing (for whatever reasons), would they be competent enough?
> Understatement of the day? :) There is absolutely no way a single developer will be able to support huge/complex codebases like web-browsers across platform versions.
Possibly but I wasn't talking about upgrading to the latest WebKit or the actual patch development – only the work required to backport a critical fix which has already been identified and fixed upstream. That's a fairly normal part of the support process at most places so I wouldn't expect it to be a huge amount of work unless you hit something which required an architectural change to fix.
Edit to add a link to the diffs which were posted earlier today:
Obviously not every patch is like that but there also aren't that many critical bugs – I'd be surprised if the engineer:tester ratio was anywhere near even on this kind of work.
> "...what kind of engineer would be willing..."
The kind that ends up on a layoff list when the inevitable
slowdown occurs. This is a zero-glory, zero-thanks task, with plenty of risk.
> "...support huge/complex codebases like web-browsers
> across platform versions..."
What could go wrong ?
[1] http://www.zdnet.com/android-fragmentation-turning-devices-i...