I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic [LWN.net]

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 21, 2016 2:57 UTC (Thu) by MattJD (subscriber, #91390)
In reply to: I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic by b7j0c
Parent article: Dutch consumer group sues Samsung over Android updates (OSNews)

Right, except those monthly patches are akin to what Debian Stable provides. Google seems to have moved to a yearly (thought they may go back to twice yearly) feature release cycle. Those updates will be huge, and will introduce those bugs. But the monthly patches are smaller and targeted in nature, fixing security bugs (with some other important fixes on the side, not features).

I won't argue your preferences (I run Debian Stable on my servers for that development cycle, so I understand why people want that). I'm just saying those two patches you have received aren't major changes, they are minor fixes targeting security. They seem to be what you want, which is why I was curious you didn't like them.

to post comments

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 21, 2016 16:54 UTC (Thu) by b7j0c (guest, #27559) [Link] (1 responses)

> Right, except those monthly patches are akin to what Debian Stable provides

except mostly done in secret

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Feb 2, 2016 7:55 UTC (Tue) by thestinger (guest, #91827) [Link]

The source code is released alongside the security bulletins and the over-the-air updates and each issue has a CVE assigned to it. There are clear commit messages and no obfuscation. In what sense is it done in secret? It's the standard method of doing vulnerability disclosure is done for open-source projects. There are few open source projects with comparable transparency when it comes to security vulnerabilities.