Google will soon require OEMs to roll out ‘regular’ Android security patches

[bizziet]

It would be nice to get timely security updates even on Pixel 2 XL. It's May 13th and still no update. So much for 1 click check for update.

 

[hallux]

The way they could enforce this, not sure if this would be an anti-trust issue, would be to say to OEMs that if they don't adhere to providing regular security updates then Google removes the rights to use Google apps on their phones.

That's not an anti-trust issue at all. Google already sets rules for allowing Google Play Services to be pre-installed on devices, this should be (and I think is being) added to those rules, and if they don't follow, the devices should become "uncertified". Shoot, it wouldn't take much for Google to put checks in based on device, OS and patch level to prevent the Play Store from installing apps on a device, those things are being checked already anyway...

 

[anon(7901790)]

It's about time Google did something about the sorry state of Android security patches, as an example my Nokia 8 is on the April security updates but my mums Nokia 3 is still on the March updates and still hasn't received Oreo yet. The way they could enforce this, not sure if this would be an anti-trust issue, would be to say to OEMs that if they don't adhere to providing regular security updates then Google removes the rights to use Google apps on their phones.

The problem is this isn't going fix the problem. Android is too fractured. The majority of devices are not running the latest version. Is Google going to provide security patches for Marshmallow or Iollipop?

https://www.emarketer.com/content/android-dominates-the-smartphone-market-globally-but-not-in-the-us

"According to figures from Android, less than 1% of Android devices were running its most recent software version, called "Oreo," as of early January. The majority of Android devices were either running the "Marshmallow" or "Nougat" versions—the second and third oldest software versions, respectively."

How many OS versions will OEMs be required to support? Two? Three? How much additional costs are consumers willing or able to pay?

 

[anon(7901790)]

That's not an anti-trust issue at all. Google already sets rules for allowing Google Play Services to be pre-installed on devices, this should be (and I think is being) added to those rules, and if they don't follow, the devices should become "uncertified". Shoot, it wouldn't take much for Google to put checks in based on device, OS and patch level to prevent the Play Store from installing apps on a device, those things are being checked already anyway...

Yes Google could do this. But, it could also backfire. Samsung could just go the route that Amazon has taken. It already had its own app store.

 

[neo158]

Yes Google could do this. But, it could also backfire. Samsung could just go the route that Amazon has taken. It already had its own app store.

The difference is that Amazon never used Google apps in the first place and Samsung would have a lot of unhappy users if they went that route anyway. Samsung is one of the worst for base system patches so this should help to keep their phones up to date as well. Have you also noticed that Samsung has no Android One phones?

 

[hallux]

The problem is this isn't going fix the problem. Android is too fractured. The majority of devices are not running the latest version. Is Google going to provide security patches for Marshmallow or Iollipop?

If I'm reading this properly, Google is still patching Marshmallow as of May, 2018 - https://source.android.com/security/bulletin/2018-05-01

 

[neo158]

Samsung already provides updao, at least on their flagships, that exceed the Enterprise requirements.

Only for Samsung software, this is Android security patches and "...exceed the Enterprise requirements" is a joke as this site says otherwise https://androidenterprisepartners.withgoogle.com/#!/results/browse-all/2

No Samsung devices on there at all. Not to mention the fact that Samsung has no Android One devices either.

 

[Itsa_Me_Mario]

Only for Samsung software, this is Android security patches and "...exceed the Enterprise requirements" is a joke as this site says otherwise https://androidenterprisepartners.withgoogle.com/#!/results/browse-all/2

No Samsung devices on there at all. Not to mention the fact that Samsung has no Android One devices either.

That list isn't all devices which meet the requirements, it is all devices that have been certified to meet the requirements. Two different population groups.

 

[anon(7901790)]

If I'm reading this properly, Google is still patching Marshmallow as of May, 2018 - https://source.android.com/security/bulletin/2018-05-01

I've received exactly two security updates on my Tab S2.

 

[Itsa_Me_Mario]

Yes Google could do this. But, it could also backfire. Samsung could just go the route that Amazon has taken. It already had its own app store.

And Samsung could do that, but it would be the end of Samsung as an Android OEM in developed countries.

 

[neo158]

That list isn't all devices which meet the requirements, it is all devices that have been certified to meet the requirements. Two different population groups.

Samsung doesn't even show up in the Enterprise device catalog as a manufacturer either.

 

[Itsa_Me_Mario]

Samsung doesn't even show up in the Enterprise device catalog as a manufacturer either.

That's because so far they're not participating in the program. They're not participating so far because they already have their own enterprise marketing program.

 

[hallux]

I've received exactly two security updates on my Tab S2.

That doesn't mean Google hasn't released a compatible patch, it just means Samsung hasn't put in the effort on the device (which is an absolute shame, and the reason people say Android tablets aren't worth looking at).

 

[neo158]

That's because so far they're not participating in the program. They're not participating so far because they already have their own enterprise marketing program.

How many companies actually use Knox, my guess is not a lot as it's restricted to Samsung only and with BYOD becoming a big thing that means people are free to use other devices than just Samsung.

 

[Itsa_Me_Mario]

How many companies actually use Knox, my guess is not a lot as it's restricted to Samsung only and with BYOD becoming a big thing that means people are free to use other devices than just Samsung.

Not sure Samsung's ever released that number

 

[anon(10000748)]

Except for the fact that Samsung spends less than 10% of their profits on r&d. They could easily spend an extra 3-5% of their profits on supporting older devices and still be one of the most profitable oems in the world.

For the most part car manufacturers do stop software production on their Entertainment Systems which would be the only comparable feature almost immediately after releasing it to the vehicle. They will still put out patches for bug fixes but that's the most that anyone should expect.

And it does cost the manufacturer is money and a lot of it. So then there's the issue of opportunity cost.

Say that the profit from selling you a phone is $100. Set all of the sunk costs in research and development and advertising up to that point Parts materials labor Etc are all taken care of and they now have $100 in pocket. The company decides that they are going to invest $80 out of the $100 into themselves. How much of that $80 do you want them to spend on paying software developers to update old phones and how much of that $80 do you want them to spend software developers to develop new features for the next phone and how much of that $80 do you want to go into research and development on future devices?

Now look at it from their perspective. Exact same numbers as before but every dollar that they invest in research and development or in future software development Etc has the potential to increase their revenue on the next line up. With the exception of the very weak argument for brand retention, every dollar they spend on updating existing devices is essentially lost. The argument for brand retention is called weak because in the mobile industry brand retention is as close to perfect as makes All Odds and almost none of that retention can be attributed to software support.

If consumers by large cared about software support then no one would be buying any devices except for iPhones and pixels. Consumers do not care about that as a whole and therefore Samsung is the number one OEM in the world. Samsung is the number one maker of the devices that people want to buy and the number one company out of all of them in terms of repeat buyers.

I can promise you one thing regarding updates. As soon as the market gets together and demands updates in any sort of a meaningful way that's going to stick that position into terms of dollars and cents for the oems, Samsung will lead the charge into making sure that security updates are rolling out monthly and OS updates are happening for 2 to 3 years after the release of the device. Samsung is really bad at writing software but they're really smart at determining what consumers want in phones and marketing their phones to those consumers.

 

[anon(7901790)]

Except for the fact that Samsung spends less than 10% of their profits on r&d. They could easily spend an extra 3-5% of their profits on supporting older devices and still be one of the most profitable oems in the world.

You might want to check your facts.

Samsung spent $12 billion on R&D in 2016. It's operating profit was around $27 billion for the same period.

https://www.androidauthority.com/samsung-invests-rd-tech-company-738575/

https://news.samsung.com/global/samsung-electronics-announces-fourth-quarter-and-fy-2016-results

 

[hallux]

You might want to check your facts.

Samsung spent $12 billion on R&D in 2016. It's operating profit was around $27 billion for the same period.

https://www.androidauthority.com/samsung-invests-rd-tech-company-738575/

https://news.samsung.com/global/samsung-electronics-announces-fourth-quarter-and-fy-2016-results

Change the word "profits" in @aidmyaim's message to "revenue" and it's probably not far off...

 

[anon(7901790)]

Change the word "profits" in @aidmyaim's message to "revenue" and it's probably not far off...

Yes. It's around 12ish%. But things like R&D comes out of profits.

 

[Itsa_Me_Mario]

Yes. It's around 12ish%. But things like R&D comes out of profits.

Sorta. R&D is a nebulous value that does get added to the BOM as a sunk cost on a per device basis, but it's calculated prior to the actual sales of the device and in many cases is a carried number from annualized sales on prior generations.

As an example, if Samsung spends $8 Billion on improving their AMOLED display technology, they're not going to allocate all that expense on the first device made to take advantage of that technology. Part of that expense is going to go into the costs of the displays themselves, which they will later sell to themselves and other customers. The rest of that cost is going to be distributed partially through every device that Samsung makes utilizing that technology and it will be a small portion of the R&D line item in the BOM for that generation of devices, and possibly the next. However, since they don't know how many Note 8's they're about to sell, they will forecast it based on prior sales and allocate approximately proportionally into that device and a few that follow for expense tracking purposes.

That said, there is a huge amount of R&D that is not allocated directly in this way, because it is generalized technological research and development - such as all the money that Samsung spends on developing Tizen. Are there things that they learn from that development which they can apply to their Android stuff? Yes. But that money still gets counted on the Tizen side of things, and since Tizen has a very low revenue stream ($0 except for any portion allocated from sale of watches, televisions, refrigerators, etc. which carry the software), that product is likely operating at a loss, meaning that it's expenses are being paid for by the profits of other products.