Android Stagefright may help solve fragmentation issues?

[ChrisChinchilla]

This is the latest editorial from my Newsletter, subscribe here.

There have been two long-term issues with the Android platform that this week have taken steps to resolution.

After the announcement of the Stagefright bug timed with the Black Hat and Def Con conferences, Android manufacturers scrambled into disaster recovery mode. The outcome was Samsung, LG, Google and others all committing to regular monthly fixes and updates for Android.

The announcement just mentioned security updates, but may help solve the general fragmentation issue that Android has. As regular updates may become a conduit for other updates.

Manufacturers have been receiving these updates from Google for years, but have not passed them on to end users. If there’s anything positive from Stagefright, it has been a recognition that the current relationship between Google and its partners is not working and needs to be solved.

Your opinions are most definitely welcome.

[James_Hibbard]

Not according to this article: Waiting for Android’s inevitable security Armageddon

Here’s a quote:

@ars technica

The Android ecosystem’s reaction to the “Stagefright” vulnerability is an example of how terrible things are. An estimated 95 percent of Android devices have a have a remote arbitrary code execution just by receiving malicious video MMS. Android has other protections in place to stop this vulnerability from running amok on your smartphone, but it’s still really scary. As you might expect, Google, Samsung, and LG have all pledged to “Take Security Seriously” and issue a fix as soon as possible.

Their “fix” is going to be to patch 2.6 percent of all active Android devices. Tops. That’s the percentage of Android devices that are running Android 5.1 today, nearly five months after the OS was released.

It finishes with an update:

@ars technica

Update: In general, Google patches the AOSP code base for older versions of Android—currently Android 4.4 and up get security patches in a code base somewhere. The problem is that carriers and OEMs usually do not take this code base and turn it into an update for end users. Major OEMs have announced plans to do things a little differently for Stagefright specifically. Assuming carriers cooperate (In the US, so far only Sprint has indicated it will) it sounds like updates will hit flagships that are three years old and up (including the Galaxy S III and 4), which means our “2.6 percent” estimate could work out to be a little higher. Maybe Stagefright-specific fixes will come to 4 or 5 or 10 percent of the market.

I’m disillusioned with the state of mobile security in general.

[jrepsub]

This changes absolutely nothing. The spinsters are trying to make it sound like stagefright is a good thing. But – it’s been years with the current (broken) state of affairs with major fragmentation; they’ve already had every opportunity and loads of time to adjust… this little incident will not change anything.

I’ll welcome being proved wrong, however. But since past performance is the best predictor of future behavior… no change will come. Fragmentation and very broken security are here to stay with Android.

[ChrisChinchilla]

I think I was optimistic and overly positive…

But, well, you never know. Sometimes it can take standing on the edge of a precipice to make you realise mistakes solutions to them.

[MrBaseball34]

Yeah, right…I’ll believe that when I see it. Google should have kept the reigns on this OS and not let the vendors do anything with it. Easier to control that way.

I have a perfectly good Galaxy Nexus on 4.2.2 that I’ve been waiting on an update from Verizon for over 2 yrs.

I’m going to have to root this phone to update it myself because they won’t deliver the update PROMISED in 2013.