Some Androids can be HOSED by WiFi Direct vuln

Re: It would be quite annoying...

True, but some roles, such as mobile auditors with tablets and mobile printers, who have to print out an audit sheet at the end of their analysis of a laboratory, farm, food processing plant etc. would be in that mode very often. Get the timing right and you might be able to corrupt the audit information, for example.

Re: It would be quite annoying...

@Tom 35 and that is why I haven't bought a carrier locked phone for the last 8 years. I always buy my smartphone unlocked, then look for the carrier with the best deal.

Re: I think it's more the carriers then Google.

Nope, the article clearly states this vulnerability is currently in Google's wheelhouse. The carriers only muck things up after Google have fixed it.

But you unlike the MS exploits, you can't grouse that Google are artificially downplaying this vulnerability. The user has to activate a specific functionality which is then both time and space limited and only reboots the device. If someone comes up with a way to chain it to something else, Google might then upgrade the importance of this vulnerability.

Re: Not sure why that was downvoted

Should Microsoft tell people to use Firefox next time there's a critical IE bug?”

Yes, if they cared about their customers more than their customers wallets.

Re: Not sure why that was downvoted

@DougS

If it was only the default browser then it would be a piece of piss to replace it and nothing to worry about. Unfortunately, it's in the WebKitView which is used by lots of applications on affected devices. Similar things have happened in Windows: the browser was updated but the MSHTML component in, say Outlook, wasn't and thus remained vulnerable.

Google is only liable where it directly provided the OS to a user, or is contractually obliged by a manufacturer or network operator. This is legally a big difference. As there is a solution: upgrade the OS or simply swap out the components I think Google is pretty safe. But it might be worth having a few test cases.

Of course, one of the ironies resulting from the parlous state of Android updates (though no doubt much better than several years ago) is that Google is becoming more and more like Apple and Microsoft by exercising more and more control of the OS through PlayStore Services and licensing terms.

Re: Not sure why that was downvoted

"Google has effectively orphaned all Android 4.3 and earlier devices with their decision not to fix a very critical bug in the default browser."

Although I agree with the thrust of your post, I wonder if Google triage the bug reports based on the likely-hood of the fix ever reaching the users. The vast majority of Android users are on "branded and locked" versions from carriers or device makers and won't ever be updated even if Google spend the time and money to fix them.

Having said that,Google made a rod for their own backs in the basic design of android and it's contracts with device builders/suppliers who were allowed to block system updates other than from themselves.

Maybe in later versions they will design the system so that system libraries, core OS, Kernel etc can be updated without screwing with the carrier/supplier branding and apps.

Well, we can but dream :-(

> Whereas - and correct me if I'm wrong here - even if/when Google patch an Android bug, you're still at the mercy of your telco rolling out the update... if I understand the situation correctly!

Well, to be fair, one is a system connected directly to the software vendor and the other is a cellphone connected to an operator.

WinPhones don't get bugs in the OS fixed every patch Tuesday although I suppose the browser might be thought of as an app (it looks and acts like one). However, I have never had a browser 'app' updates and I get three or four updates per week, sometimes per day.

Of course, most updates on PCs are security updates and WinPhones are not really in need of such things because of sandboxing and the fact that they difficult to target and are not much of a target to begin with.

Still, it would be interesting if a massive security flaw were discovered that required an OS update whether one would be rushed out and the rolling update system compressed to make it faster.

Especially since there is a ongoing OS rollout at the moment.

"They're roughly in the place Microsoft reached in the win 8 fiasco"

I'd put them nearer the start of the browser-wars era Microsoft ie: right before their arrogance resulted in a legal action that then destroyed a lot of the general public's trust in them.

Re: A charming mental image.

@Teiwaz last week there were a bunch of "older than 90 days" bugs fixed in Chrome - funny though, Google didn't shame the Chrome team at 90s days, they just included the information in the release notes at 120 days or so...