Google Is Making Android Security Updates Mandatory

Google Is Making Android Security Updates Mandatory

Most Android phones get updates, but they don’t get very many of them. This has been an issue even for very expensive and popular phones, which quickly end up with old security patches that can’t protect you from every online threat. Google is reportedly rolling out a new Android licensing agreement to OEMs that will require security updates for two years on certain devices.

The new contract, obtained by The Verge, says that Android device makers will have to deploy at least four security patches for new phones in the first year they are on the market. They will need to continue supporting devices in the year following with patches, but Google does not specify how many.

These new rules only apply for phones launched after January 31, 2019. In addition, this is meant to target “popular” devices. Google deems phone or tablet with at least 100,000 activations to be popular enough to warrant a high level of support. Google apparently started enforcing this on a limited basis over the summer. In August, 75 percent of each device maker’s popular phones were subject to the new rules. Next year, all of them will be.

Companies can’t just roll out any old security patch and call it a day, either. The patches need to cover all the flaws reported as of the patch date noted in the system software, and the patch level cannot be more than 90 days in the past. For the first year, that basically guarantees quarterly updates. Even without a required number of updates in a device’s second year, users should still get reasonably new security fixes.

Google Is Making Android Security Updates Mandatory

You can always check the security patch level of a phone in the system settings, a feature implemented by Google after the Stagefright vulnerability several years ago. On many devices, the patch date is also a link to the official Android patch notes so you can see which vulnerabilities it covers.

This is all separate from system updates, which are still sluggish even after the deployment of Project Treble in Android Oreo. It takes more time and resources to develop a new underlying version of Android for a phone than it does to patch security holes. Google has provided some guidelines on system updates but nothing as strict as these supposed security guidelines. While getting the newest features is fun, a more secure phone is arguably much more vital.

Continue reading

Samsung Starts Rolling Out Galaxy S20 Android 11 Update on Verizon
Samsung Starts Rolling Out Galaxy S20 Android 11 Update on Verizon

Not only does this include the Googley Android 11 enhancements, but it also has numerous Samsung-specific changes as part of the One UI 3.0 revamp.

Deep Space Nine Project Update: Why MakeMKV-Derived Files Don’t Work
Deep Space Nine Project Update: Why MakeMKV-Derived Files Don’t Work

The question of why a MakeMKV source doesn't work has come up again and again, so we decided to investigate it.

Intel Rebrands Its Future Process Nodes, Updates Roadmap
Intel Rebrands Its Future Process Nodes, Updates Roadmap

Intel has rebranded its future process nodes and shared an update on manufacturing improvements it expects to introduce over the next four years.

I Wrote the First Full Review of the Voodoo 5 6000. 3dfx Isn’t Coming Back [Updated]
I Wrote the First Full Review of the Voodoo 5 6000. 3dfx Isn’t Coming Back [Updated]

Nearly 20 years ago, I wrote the first review of the Voodoo 5 6000. As much as I loved 3dfx, I don't think this is the company to resurrect it.