Google tells Android's Linux kernel to toughen up and fight off those horrible hacker bullies

Re: Patching speed is probably the issue

The risks of Android are routinely overblown – not to say that they don't exist – but the attack vectors are usually outside normal use patterns. This doesn't, however, excuse manufacturers from improving their woeful update practices.

What you suggest simply isn't possible at the moment because the kernel on each phone is owned by the manufacturer and any kind of OTA is going to rely on their keys, or you open the door to drive-by hacks of the kernel.

The only way things will change is if cases, such as the one currently winding its way through the Dutch courts, decide that manufacturers are at fault and impose sanctions / requirements. I'm not holding my breath on that one as the software industry has a dreadful record of providing security updates.

Re: Patching speed is probably the issue

>Really, why can't the core OS and libraries be auto-patched for security as most Linux distos do?

Because [technical reasons].

Re: Patching speed is probably the issue

I got four Android phones in the family, oldest is HTC m7. Other three are Samsungs. They all have stagefright patches (even though the m7 is stuck on Android 5, it still gets security patches). All were bought from Telstra, an Australian tell, which is supporting them. So mainstream users who buy phones from a good network provider should be OK for patches.

Re: Patching speed is probably the issue

Really, why can't the core OS and libraries be auto-patched for security as most Linux distros do?

I'm going to take a guess and presume the mobile phone operators being the control freaks they are want to test each an every patched first, also they probably worry about being blame for customers going on their data limits unknowingly, through this could be solve by making it only wifi only feature, auto patched over wifi. Another issue is Motorola and others laying their own software on top of android, there some potential for new security patches to break these software.

Re: About bloody time!

Instead of spending so much time looking for security bugs in third party products, Google could begin by looking for vulnerabilities in its own products. It could also fix security bugs in older versions of Android, since it is well aware of the fragmentation of the ecosystem.

Re: About bloody time!

>implement best security practices known, at least conceptually, since the 1970s.

Known since the 70s but not implemented in probably the most widely used proper (i.e. not RTOS) kernel in the world? I wonder if there is some level of "easier said than done" to this?