I nearly burst from laughter after reading this tweet and then article by Dan Gillmor:
New Android vulnerability + industry fecklessness = need for new laws/regs. My latest at @slate@FutureTenseNow: http://t.co/uzPgEJZYgD
— Dan Gillmor (@dangillmor)
What’s so funny? The free market is working in this case exactly as intended. A company in the market, e.x Apple, provides mobile devices that are usually secure and updated. Some consumers have voted with their dollars that isn’t as important to them as other criteria, so they bought an Android phone. There is no surprise here that if you buy an Android device, you highly likely will not get updates of any kind, security or otherwise.
What criteria stops people from buying an Apple device? Let’s return to Mr. Gillmor:
Apple's iOS devices, of course, are part of a tightly controlled ecosystem, and while Apple is far from perfect on security, it does update iPhones. But we shouldn't be required to turn over our computing and communications to control-freak companies in order to get necessary security updates.
So let me get this straight? Mr. Gillmor doesn’t want Apple devices because Apple is a “control-freak” company, so he invites the control-freak government to use laws & regulations & force Android implementors to be more control freaks about updates…like Apple. LOL. Sure, the government is always the lightest touch!
If Android users thought updates and security where higher priorities than cheap phones or “open source” software, then they wouldn’t have bought an Android device.
Returning this as not a bug, working as intended!
Epilogue
Google made this mess, they can still fix it. They already offer an Android Bug Bounty. They have a generic Patch Reward Program.
Instead of the heavy hand of laws and regulations, Google should start an Update Rewards program.
Every carrier or vendor that releases Android updates in a timely fashion (say within 1 month) gets a payment from Google.
Security Updates pay more than Feature Updates. To really sweeten the pot, Google can pay per user upgraded, get some vendor/carrier incentive to update as many users as possible.
Vendors/carriers have such thin margins, seems like they don’t have the money to cover testing and deploying Android updates without taking a loss.
Use some of that ad revenue to cover the costs. I mean, advertisers should be clamoring for this. After all, how can they trust the ad profiles Google vends with compromised devices?