Why Can't Google Just Switch to Pushing Android Security Updates Directly to Users?

Question

Okay, I'll just begin with the question and then elaborate a bit below. It is:

Why has the world's dominant maker of non-Apple smartphone operating systems, Google, still not adopted a straight-to-the-user model of distributing security updates for Android, instead sticking with the current, obviously deeply flawed approach of relying on phone makers and wireless carriers to rapidly test, approve, and distribute them? How substantial would the technical obstacles really be in moving Android to the direct-update model if Google genuinely wanted to do it?

---

So, some additional not-good news came out yesterday regarding the fun Stagefright set of media player-component security bugs in Android. First, some newly-announced flaws in the same component appear to extend the scope of Android phones affected to virtually every one that's ever been made & sold. Second, there are apparently even more flaws in the same component that have been disclosed to Google and that are in the pipeline for public announcement soon, including some that will get a "critical" label. I'm not intimately familiar with the Android security scene, but this certainly seems like it's being held as the most important security event that Android has had to deal with so far.

Of course, the discovery of awful vulnerabilities, on any platform, always leads to the next question: "When is my device going to be patched?" Unfortunately, the way things work now with Android security updates--Google pushes them to hardware makers and carriers, who have to sign-off on off on them and be willing and to distribute the updates to users-- the vast majority of the 1 billion+ Android users can expect only one of two answers:

--For the lucky ones: it will be months. (This report, also linked above, quotes an estimate that it usually takes somewhere from 9-18 months for patches to get from Google to wind their way through testing and various approvals to a user's phone. Now, one assumes that with Stagefright that will be hurried up to some degree, but still...)

--For the unlucky ones: never. (Some Android makers barely provide any post-sale update servicing at all for their phones. Others seem to have an unwritten support period limit of maybe a year, or perhaps two, after which the user is out in the cold.)

All of which raises the question: Why can't Google just do what companies who make operating systems for other computers do--PCs and servers--for example-- and bypass OEMs and service providers to deliver security updates straight to the user?

Now, obviously there are probably both technical aspects to this and business aspects to this. I'm thinking more along the lines of technical aspects (though I admit that sometimes the two are less easy to separate from each other than one might think). In what ways could going to a process of Google directly issuing security updates--but not necessarily directly shipping any updates that involved anything beyond fixing security vulnerabilities--cause problems with hardware and/or software compatibility that could be so troublesome enough for users, phone makers, carriers, and Google itself that that factor could outweigh the value of getting these patches out much more quickly and far, far more widely than they are likely to under the present system? Or is it really a slam dunk in favor of Google going to direct distribution, as 99% of security news reporters & commentators seem to think?

Answer 1

The crux of the problem is that with only a few notable exceptions, every phone ships with a fork of Android, not with the software written by Google. So Google can't push changes to Samsung's phones any more than FreeBSD can push changes to Apple's Macbooks.

Android is Open Source, which is a bit unusual. This is the first time a major consumer operating system with this size of userbase (1.4 billion users and growing fast) has been an open source project rather than a centrally-controlled one. We're used to the idea of the creator of the OS being able to take responsibility for updating it. And as evidenced by this question, we somehow expect Google to be able to control Android the same way Microsoft controls Windows and Apple controls iOS.

But by allowing companies like Samsung and Sony and Motorola to ship their own modified version of Android, Google gives up that control in a way that they can't get it back. Samsung then takes over not only control of their own flavor of Android, but also responsibility for keeping it updated. And by allowing Verizon to fork Samsung's version, Samsung then sheds both control and responsibility now to Verizon.

Theoretically this all works; theoretically Verizon will be just as responsible and dependable as Google. Except when they're not.

So there's three possible solutions. Either:

• Manufacturers could start taking more responsibility for their OSes. Since Samsung's Android belongs to Samsung, we get nowhere unless Samsung takes some initiative on keeping it updated. This may require some cooperation with companies like Verizon if Samsung has allowed them to fork the code as well. This is more or less that status quo, but with more wishful thinking.

• Google could take back control of Android. By switching to a closed-source license, they could impose licensing restrictions like requiring companies like Samsung to push patches within a limited timeframe. Of course, if Google went this route, there'd be no end of shouts about how "evil" and "anti-consumer" they were being, despite the fact that they're literally the only major player that is Open Source to begin with. Politically this is probably a no-go.

• Companies like Verizon and Samsung could voluntarily give control back to Google without being forced into it by a licensing agreement. This is the sort of utopia arrangement where companies decide to do the right thing out of their own free will. Until a few weeks ago, this was the least likely of the three. But since the stagefright mess, several companies have pledged to do more or less exactly this.

So we'll see where it goes in the coming months and years.

Answer 2

It was a big issue till very recently, but

it is changing right now.

New Android versions (O and P) feature something called Project Treble.

From the linked page:

One thing we've consistently heard from our device-maker partners is that updating existing devices to a new version of Android is incredibly time consuming and costly.

With Android O, we've been working very closely with device makers and silicon manufacturers to take steps toward solving this problem, and we're excited to give you a sneak peek at Project Treble, the biggest change to the low-level system architecture of Android to date.

General idea is to separate the vendor compatibility layer from the rest of the system. New Google updates to the system core are compatible with all phones supporting Treble, without any additional work from the vendor.

Answer 3

Recently Google put a lot of effort into redefining Android’s low-level system architecture in a way that separates critical system components from vendor-specific code: Project Treble was introduced in Android 8, and its main goal is to separate device-specific vendor implementation from Android OS Framework. This separation significantly simplifies the Android update process for device manufacturers, but most importantly, it allows Google to push security updates to all devices, regardless of vendor-specific changes.

Source: https://android-developers.googleblog.com/2017/05/here-comes-treble-modular-base-for.html

The biggest issue after implementing Project Mainline was the fact that all updates, including security ones, had to be pushed to the device directly by the device manufacturers, who, unfortunately, in some cases, deliberately did not provide those updates in order to force users to buy new devices. This problem was solved in Android 10 with Project Mainline. Long story short, Project Mainline highly modularizes the Android ecosystem and allows core modules to be updated with Google Play, thus making critical updates independent from device manufacturers’ release cycles.

Source: https://source.android.com/docs/core/architecture/modular-system

Answer 4

Canonical and all other providers of forks of linux actually make sure security updates are immediately available for laptop/ desktop distros.

Therefore, it can only be lazy security and development practise by phone companies which aren't updating their forks of Android to be patched.