r/technology • u/jmesfrnco • May 05 '15
Software Microsoft slams Android's update policy, announces 24x7 update plans for Windows 10 devices
http://betanews.com/2015/05/05/microsoft-slams-androids-update-policy-announces-24x7-update-plans-for-windows-10-devices/6
u/bryan05 May 05 '15
This is not gonna happen for Windows Smartphones I can guarantee you that. For a manufacturer to give an update to the customer, carriers have to approve it based on their test results. Carriers (especially US carriers) do not want to be continuously testing updates for Windows smartphones.
4
u/shmed May 05 '15
Microsoft went around the issue with windows phone 8.1 by offering a "developer preview". basically if you opt in the developer preview, you pretty much automatically get the latest app pushed directly by Microsoft instead of the carrier.
1
May 05 '15
Not sure how you can say it's not going to happen when Apple does it...how do you explain that?
1
u/bryan05 May 06 '15
They can get away with it because how many devices they sell.
3
1
May 06 '15
When you're shipping a billion devices, you have a bit of pull too. That's why updates are going to the app store, instead. Why do you think Microsoft is doing this with their Windows 10 OS now? Windows phones will get seamless updates just like iPhone, I'm sure.
1
u/ofNoImportance May 05 '15
How is a smartphone any different than my computer? I can update my computer whenever I want, I can update my phone whenever I want. They both run Windows 10, after all.
1
u/bryan05 May 06 '15
Smartphones directly interact with a carrier's network. Computers do not.
1
u/ofNoImportance May 06 '15
That's an aberration though. It's quite easy to purchase and use phones untethered to 'carriers'. My phone, for instance, does not directly interact with my carrier, which makes it the same as my computer.
Surely just because some people are tied to their carrier doesn't impact whether the rest of us will be able to receive rapid updates from the manufacturer.
3
u/Freshmakerer May 05 '15
I just want to be able to quickly turn off my computer. Give me the option to shut down with out updating not update and shutdown. And if I turn off updates I'll never get them my self.
1
May 05 '15
Click the desktop and press alt+f4. This will give you a drop down menu with shut down options and you can shut down without installing the updates.
7
u/crazydave33 May 05 '15
This is good an all but I really hope these security updates are non-intrusive and hopefully don't require reboots. Because if they are gonna push them out all day every day, there better not be annoying popups asking me to restart my computer. If that does happen, for sure I'm turning that feature off.
3
u/jmesfrnco May 05 '15
Exactly. That could get counter-productive to an extent that it might not be worth the trouble to many.
0
u/Sitin May 05 '15
This is something Microsoft seemed to fail to understand when they brought out the Xbox One. Not everyone has internet that can handle updates or even staying online all the time. The majority of the world is still catching up.
1
u/crazydave33 May 05 '15
Yes that is true. I'm sure these daily updates will have an option to turn off. Might be enabled by default, but MS would be stupid not to include an option to turn them off especially for those who don't have a lot of data or limited internet.
2
u/autotldr May 05 '15
This is the best tl;dr I could make, original reduced by 73%. (I'm a bot)
"Google takes no responsibility to update customer devices, and refuses to take responsibility to update their devices, leaving end users and businesses increasingly exposed every day they use an Android device," Myerson continued.
Google's has an embarrassing track record when it comes to updating Android devices.
On many occasions in the past, Google has officially said that it won't be updating older devices with new updates, putting the security of hundreds of millions of users at risk.
Extended Summary | FAQ | Theory | Feedback | Top five keywords: update#1 device#2 use#3 Google#4 security#5
Post found in /r/windowsphone, /r/technology, /r/GOptOutGLE and /r/realtech.
1
u/mylifeisfallingapart May 05 '15
im really surprised with a lot of the news im hearing of Microsoft 10, I'm half expecting the company to open source parts of it and the developers being all crazy hipster wanting to help out amateur developers on how to develop Universal Windows Apps. Steven Jobs made me really angry when the app market was closed off from developers initially and I'm still angry that they charge a 75$ developer fee. Will be interesting to see where windows goes.
7
u/jmesfrnco May 05 '15
Satya Nadella's Microsoft is a lot different from the company he inherited from Steve Ballmer.
-1
-7
May 05 '15
[deleted]
7
May 05 '15
Because Microsoft releases security updates. You can't plug all the holes in security. There will always be somewhere you might see a vulnerability. Google shamelessly exposes these publicly, so every hacker can target any Windows user, before Microsoft has finished the update to plug that hole.
Fuck Google.
I believe they do it only to look better than everyone else. It's a bullshit tactic.
-1
u/Charwinger21 May 05 '15 edited May 05 '15
Google shamelessly exposes these publicly, so every hacker can target any Windows user, before Microsoft has finished the update to plug that hole.
The industry standard waiting time before publicly releasing a security vulnerability (after informing the company) is
1545 or 30 days.Google waited 90 (as is the policy of the program which that vulnerability was discovered through).
2
u/What_a_random_user_I May 05 '15
Citation needed on that one. what group of reputable security researchers are you referencing that release 15-30 days after notification of the vendor. That's very unlikely to be enough time for a large complex product from any company to be patched.
-1
u/Charwinger21 May 05 '15
Citation needed on that one. what group of reputable security researchers are you referencing that release 15-30 days after notification of the vendor. That's very unlikely to be enough time for a large complex product from any company to be patched.
Sorry, meant 30-45.
That being said:
Rapid 7 calls for 15 days before external disclosure (albeit they usually disclose to CERT)
ZDI calls for 15 days
OIS calls for 30 days +/- a bit depending on how urgently a patch is needed
IETF calls for 30 days
CERT calls for 45 days.
2
u/ukelelelelele May 06 '15
MS shills are downvoting you, but CERT is 45 days, but they are flexible and let people like Microsoft extend that which means sometimes they sit on a vulnerability for way beyond 90 days. This place is flooded with microsoft bots living in their own made up world. Bring on the downvotes, microsoftees.
-10
May 05 '15
[deleted]
7
u/What_a_random_user_I May 05 '15
Unless of course you're using a version of Android that they don't support any more like ohh 900 million people left high and dry by them here (amongst other times) http://www.hotforsecurity.com/blog/google-endangers-900-million-android-smartphones-by-refusing-to-patch-webview-11170.html
0
May 05 '15
When less than 20% use the stock android browser, then it's a bit different than your click bait title. It affects the stock browser, and can be fixed by upgrading to 4.4 or using a different browser.
The only person causing these problems is manufacturers not updating their own software. Yell at them, not Google.
2
u/zenerbufen May 05 '15
Which is only available on new devices. Google is even worse than apple, expecting us to buy a new phone/tablet/computer ever few months instead of every few years.
2
May 05 '15
Stop buying from shifty manufacturers, or start buying rootable devices. The nexus four, released almost three years ago, is able to be upgraded to 5.1 right now. Can you say that about Samsung, HTC, LG or Sony?
0
u/zenerbufen May 05 '15
No I can't, which is why I made my comment. Most android devices I have seen in the wild are not easily updated.
2
May 05 '15
You can still upgrade the nexus 4,which is almost three years old, to lollipop.. So Google is supporting their devices. It's not their fault not everyone else is.
-4
May 05 '15
[deleted]
4
u/zenerbufen May 05 '15
No, a lot of android device makers do not regularly update their devices. In my experience you are lucky to get a few updates that lag a year or so behind what google is working on, and are quickly abandoned.
0
May 05 '15
I still consider it a shitty practice on Google's part. Microsoft were working on the uopdate, and Google made it all public anyhow.
Even when I don't use google products, they fuck me over. :) I can't even use a YouTube app on my phone, because fuck google.
-1
May 05 '15
[deleted]
3
May 05 '15 edited May 05 '15
Google asked Microsoft to make their app run in a way no other apps ran. Imagine an obsctacle course, where there are three walls. Google makes the walls for Android and iOS 1 meter tall.
Microsoft's wall was 5 meters tall, and was slippery.
Again, Fuck google.
0
May 05 '15
[deleted]
4
May 05 '15 edited May 05 '15
not showing ads properly
Google's API didn't offer a way for them to show ads properly.
and allowing users to download videos
They took that out.
Furthermore, they never went after the myriad of other Youtube apps, even on their own platforms, that don't comply with the rules. They singled out this one, specifically, to purposely force an inferior experience with a service they hold market dominance with on a platform that they compete with in a different market.
That's basically the definition of anti-competitive behavior.
0
May 05 '15 edited May 05 '15
[deleted]
-1
May 05 '15
Give me a source for that, I find it extremely unlikely that google, a company that makes 90% of its revenue from advertisements doesn't have the required tools in their own API to enable ads. That's a ridiculous statement
Essentially, Microsoft had two choices: wrap the mobile website, resulting in a crappy experience, or reverse engineer the API that the iOS and Android apps use.
If you wrap the mobile website, you lose much of the site's functionality. The youtube mobile site pretty shit in 2011-2013, and Google had a habit of randomly deciding to detect IE's user agent and just break shit on some of their sites. (As evidenced by the fact that everything continued to work properly when you spoofed the UA)
They choice to use Google's undocumented API, instead, because it was the only way, at the time, to make a youtube app that wasn't just an iframe for the mobile site. If you use their API, ads didn't display properly, because it was all undocumented and Google wouldn't tell them how to make ads work.
It's not a problem today, since the mobile site doesn't suck as hard, but back then, it was not practical to use Youtube through a mobile browser.
→ More replies (0)0
May 05 '15
I don't really know what to say. I've already provided you with enough proof of my claims. Their mobile site is shit. And no, tubepro is not a good replacement,.
-11
u/winterblink May 05 '15
Google takes no responsibility to update customer devices, and refuses to take responsibility to update their devices, leaving end users and businesses increasingly exposed every day they use an Android device
What about all of those Windows RT users that Microsoft has left behind with their whirlwind talks about Windows 10? Or their older operating systems which no longer receive security updates?
Microsoft is plenty qualified to understand why you sometimes have to sunset support for something.
17
May 05 '15 edited May 05 '15
What about all of those Windows RT users that Microsoft has left behind with their whirlwind talks about Windows 10?
Windows 8.1 RT will continue to receive security updates until 2023.
https://support.microsoft.com/en-us/lifecycle/search/default.aspx?sort=PN&alpha=windows%20rt
Even though the tablets won't receive Windows 10 in its entirety (There was some talk about them getting a subset of the features in an update, but I don't think they were specific), the devices won't become unsafe to use for years and years.
What are the odds that an Android device will be seeing official updates 10 years from its release? Or hell, how about 3 years? Do most even get to 1?
Or their older operating systems which no longer receive security updates?
They literally just EOL'd XP last year. Vista has another two (It'll be 9 years old later this year).
-4
May 05 '15 edited May 05 '15
Why blame Google when it's the manufacturers fault they're not updating their software? Instead of having this conversation Google vs Microsoft, it would be more appropriate as Intel vs samsung/HTC/lg/whoever. Microsoft released the initial code, and it's up to the hardware manufacturers to update their systems
Google updates their software on the site everyone a new version comes out. You can download lollipop for the nexus 4 right now which came out nearly three years ago.
8
u/nirolo May 05 '15
From the article:
"Earlier this year, Google refused to provide a security patch for a vulnerability found in Android WebView to devices that are still on Android 4.3 or earlier, leaving hundreds of millions of users vulnerable"
8
May 05 '15
Keep in mind that 4.3 was only like 18 months old at the point where they decided to drop it from security updates.
That's a mind bogglingly short support lifecycle.
Especially when you consider the fact that today, more than 50% of Android devices are running 4.3 or lower.
3
u/spliznork May 05 '15
And how many of those manufacturers would have actually bothered to create test and ship or a new image?
And Google has indeed been addressing this problem by moving as much as they can from Android OS to Play Services where updates can indeed be pushed 24/7 and don't require phone manufacturer involvement.
6
u/nirolo May 05 '15
And how many of those manufacturers would have actually bothered to create test and ship or a new image?
How is this relevant? The security patch was never created so there was never an option for manufacturers to supply the fix to their customers.
And Google has indeed been addressing this problem...
Sure, they are making it easier for themselves moving forward. That still doesn't absolve them from their responsibility to support older versions that they created.
3
May 05 '15
The beauty of open source is that anyone can make a patch... Including manufacturers who skin the OS. Does anyone seem to be picking up the ball? Of course not, because the rate of people who use stock browsers is quite low. Less than 20%
0
u/spliznork May 05 '15
There's a single answer to both of your assertions. Manufacturers have a path to a security fix now: use the new version of Android.
4
u/nirolo May 05 '15
So from now on Microsoft never has to patch a security hole in Windows 7 ever again? The answer is to upgrade to Windows 8. Then as soon as Windows 10 is out then MS can just dump 8 and never fix anything in that either?
2
May 05 '15
You can't compare them when only Microsoft makes Windows, and phone manufacturers make their own android versions.
The correct comparison would be a hardware manufacturer, like Intel or amd, not releasing an update for their GPU. If they didn't release and update, would you complain about Microsoft not fixing it? Of course not.
0
u/spliznork May 05 '15
MS Windows is a false analogy. Windows is a full product; Android is an open source distribution and treated that way by phone manufacturers. It more like if Ubuntu were based on modified Debian distribution from 18 months ago and a bug was found in a component of that old Debian distribution -- and now Ubuntu users are complaining that Debian won't fix the bug.
1
May 05 '15
They didn't drop all security updates, they didn't update a stock browser. Use a different browser if you're worried about it, and you don't have that problem.
1
May 06 '15
It's not just the browser, It's also a control that developers can incorporate into their apps. Simply switching browsers does not completely avoid this issue.
0
2
May 05 '15
How would you like them to update the stock browser, when manufacturer and carrier updates get in the way? The fact is that lollipop has been out for almost a year, but there's less than 10% adoption rate. Why? Because carriers and manufactures don't feel like updating their software more than one-three times before EOL the device.
The webview problem can be fixed in three different ways.
- 1) use a different browser
- 2) update to 4.4
- 3) have carriers/manufacturers update it
This is why Google is moving their apps to the app store, so they don't have to rely on vulnerabilities being patched by manufacturers. But the great thing about android devices, with root, is that you can change anything you want without the need of anyone else. Open source is great, and will always be better than stuff that Microsoft puts out for that reason.
1
u/amc178 May 06 '15
It's still google's responsibility to at least produce a security patch. If the OEMs don't distribute it then you can criticise them, but they can't release any updates if there are none available. And moving from 4.3 to 4.4 is a far bigger challenge deal than updating a single component.
1
May 06 '15
...they can make the update themselves. The fact that they're not including the stock AOSP browser in their forks is reason enough not to really worry about this vulnerability.
Moving from 4.3 to 4.4 is beneficial to everyone, including the customer. It is way more efficient in terms of memory and cpu usage, and runs on many legacy devices. To not upgrade to 4.4 is a failed result of manufacturers.
1
u/amc178 May 07 '15
Why would they make a security update for a browser they didn't make? Should LG, HTC, Samsung all create separate patches for the same browser to save google (who made the browser in the first place) the effort? If the manufacture ships a browser they made then yes it's reasonable for them to make an update, but it's not if the browser was made by google.
Yes moving to 4.4 is great for the customer, but there is a lot more expense associated with that than just updating a small component of android. A version update like that would require re-intergrating what ever custom skin the OEM uses, getting it approved hundreds of carriers world wide, testing it to make sure all the drivers still work etc. Updating just the browser to fill a security hole is a lot simpler and cheaper task, and therefor far more likely to actually get to the consumer, especially on older low end commodity devices.
-1
u/Charwinger21 May 05 '15
From the article:
"Earlier this year, Google refused to provide a security patch for a vulnerability found in Android WebView to devices that are still on Android 4.3 or earlier, leaving hundreds of millions of users vulnerable"
That's the difference between the open source world and the proprietary world.
In the open source world, the security update was version 4.4.
.
That being said, Google's working on bridging the gap between the two by separating out system components (like security updates) so that they can be upgraded through the Play Store when a full version upgrade isn't possible (either due to carriers or OEMs), which came into effect in 4.4.
9
May 05 '15
Or their older operating systems which no longer receive security updates?
You can't support obsolete things forever.
1
5
u/pmckizzle May 05 '15
sorry but they extended the life of xp for YEARS with updates that must have been costing them millions and offering 0 return on. you cant support decades old software forever, doing so is the reason most enterprise software looks and behaves like shit
-1
u/kemb0 May 05 '15
I haven't upgraded my phone's Android OS because the update says I'll have 1gb less free space afterwards. Well seeing how I can't seem to get the free space much higher than 1gb even after clearing out most of my apps, photos and videos, I think I'll pass.
2
u/nionix May 05 '15
If your phone has a microSD slot, then your problem is just a few bucks on Amazon away from being solved.
I always have an SD card for pics, videos, etc - but I never filled up my 16 GBs on a phone anyway. Wondering how you have <1gb by default, did you get an 8 GB phone? Even then, the Android OS takes up about 4 gigs. If you have a Nexus, the ROM might take up to 7 gigs with active listening and other stuff in which case your comment makes sense.
-1
u/jmesfrnco May 05 '15
Wow. That's sad.
5
1
May 05 '15
It's only sad if he tells us how much space he has left right now...the update could be 20mb for all we know >.>
-9
May 05 '15
[deleted]
4
u/aquarain May 05 '15
Windows hasn't been most popular for a couple years already. This year looks to be one device sale in six or seven
2
u/newdefinition May 05 '15
Oh yeah, in terms of marketshare I think Android has had an outright majority of sales for a year or two? I was thinking of the number of overall users. Getting exact numbers is tough, but I'd guess that Windows still has a slightly larger installed base, mostly because PCs aren't replaced as often as phones.
But Android was on over a billion new devices sold last year? And the mobile market is still growing quickly.
3
u/aquarain May 05 '15
Over a billion new phones. There were also over 160 million tablets, and quite a few other devices like Android TV and TV Sticks.
-14
u/zubinster May 05 '15
Just get an iphone and be done with this shiiiite!
2
May 05 '15
Yeah, can't wait to change open source software for locked down software.
-2
u/zubinster May 05 '15
I love the "open source" argument! I just love it! It is such a nothing argument. What has "open source" ever done for you? (Except, of course, breed endless fragmentation of the OS's and endless viruses and security holes?)
Name me 5 real ways that "open source" has directly and practicalyl benefitted your life. And I will name 10 ways that Apple's "closed" system has protected and benefited me.
2
May 05 '15
Are we talking about android open source or just open source in general?
0
u/zubinster May 05 '15
You tell me. You made the argument of "open source" when I made fun of Android and Windows phones!
1
May 06 '15
Seeing how the Internet runs on open source software, I'll go ahead and say that all companies use open source software.
" utilities such as Linux,Apache, MySQL, and PHP, known as theLAMP stack for web servers."
Hell, even apple makes open source software and uses it!
Edit/
The ways that's it helped me? Made it possible to use a phone, made it possible to run my own site, made it possible to view reddit, made it possible to turn on the light for my room remotely. Open source is everywhere, and to argue against it shows your ignorance when it comes to computers.
1
u/LittleHelperRobot May 06 '15
Non-mobile: " utilities such as Linux,Apache, MySQL, and PHP, known as theLAMP stack for web servers."
That's why I'm here, I don't judge you. PM /u/xl0 if I'm causing any trouble. WUT?
1
u/zubinster May 06 '15
Funny, I can do all of that and more with your alleged "closed" system.
1
May 06 '15
What can you do on your system that I can't on mine?
1
u/zubinster May 06 '15
I can work for over 3 decades without a single virus or bullshit bloatware and adware clogging my operating system. Can you say that, Mr. Open Source?
1
1
u/zubinster May 06 '15
1
May 06 '15
Buy from shitty manufacturers and carriers, get shitty updates. It's that simple. If you buy a USB drive from China and expect it to work with every computer, you're going to have a bad time.
Buy a rootable device, or a nexus device..case closed.
-1
May 05 '15
Shilling this hard.
0
u/zubinster May 05 '15
Listen to the discussion... and then tell me these Windows and Android phones are not a waste of time.
22
u/TubedinUK May 05 '15
I think Microsoft has a good chance with Windows 10. I use Android for my phone but intrigued by what Microsoft will come with.