HN Distilled

Essential insights from Hacker News discussions

Delayed Security Patches for AOSP (Android Open Source Project)

Original Article

Hacker News Discussion

Here's a summary of the themes discussed on Hacker News, with supporting quotes:

Google's Diminished Commitment to AOSP

A central theme is the perception that Google's commitment to the Android Open Source Project (AOSP) is waning. This is evidenced by the failure to push timely security tags for monthly releases, and a lack of response from Google on these issues.

  • "No tags were pushed to AOSP for the July 2025 monthly release of Android. We asked about this on the android-building group but each of our posts was rejected. We emailed people at Google we've previously contacted about mistakes pushing tags but received no response this time." - flotzam
  • "July monthly release was not pushed to AOSP and then neither was the August monthly release. September quarterly release hasn't been pushed yet." - flotzam
  • "neilv: Looks like PostmarketOS (mainline Linux for phones, with choice of frontend, such as Plasma Mobile or Phosh) has demoted all their previous "Main"-tier devices to "Community" or lower tier: ..." - neilv
  • "If it's true that Google is delaying AOSP security updates for months after fixing in closed, has anyone heard an explanation from Google about this?" - neilv
  • "Even a few days' lag of one distribution getting security updates (after the first release effectively disclosed the vulnerability) seems risky and highly questionable; weeks or months seems ludicrous." - neilv

Google's Increasingly Proprietary Android Strategy

Several users believe Google is intentionally making Android more proprietary, moving functionality away from AOSP and into proprietary Google apps and services. This is seen as a continuation of their "duopoly-abusive stage."

  • "This is entirely unsurprising. It's been clear that Google has been into their Android duopoly-abusive stage for a while now, with more and more of their Android changes moving into GMS or non-AOSP Google apps (like camera, messages, location services, etc) over the last decade. Graphene has been doomed to this fate for a long time, and anyone who thought otherwise was naively optimistic." - scottbez1
  • "Google sold Android to nerds as open source. We thought that mobile operating systems would be won by the "Linux of mobile OSs." But Google has made sure that didn't happen and we're left with devices more locked down than the proprietary Windows ecosystem we were hoping to leave in the past..." - mdasen
  • "The trick is adding a ton of features which expose extra attack surface that needs them to maintain and fix, under the pretense that it will make everyone's life easier. Make it complicated enough so that the community cannot maintain it, enabling the corporation to throw its weight around." - arcane23
  • "It’s the perfected form of what MS was trying to achieve with IE back in the 90s. All the power of a closed source monopoly, further enhanced by friends and foes alike incorporating your tech as a load-bearing pillar of their strategies, with a cloak of plausible deniability in the form of an open source repo protecting you from antitrust enforcement. A true have your cake and eat it situation." - cosmic_cheese

Calls for Antitrust Action and Ecosystem Splitting

The perceived user-hostile and potentially anti-competitive actions by Google have led to strong sentiments for antitrust intervention. Some believe that splitting Google from Android and Chrome is necessary to prevent a single entity from dominating the internet ecosystem.

  • "And so, Google's war on open Android continues. Fucking hell. Can Google stop being evil for like 5 minutes? It's like they can't go a week without coming up with some new fucked up thing to do to their already tormented mobile ecosystem." - ACCoutn37
  • "Now, I'm of the opinion that they should have been forced to sell off both, and maybe Chromebooks too, for the good measure. No company with a direction as vile and openly user-hostile as what Google currently demonstrates should have anywhere near this level of control over the ecosystem." - ACCoutn37
  • "Split it to a point where no one company can own the entire Internet ecosystem. Apply antitrust laws to keep it like this." - palata
  • "This is all the more likely now that Google has been emboldened by not having to sell off Chrome for anticompetitive reasons." - scottbez1
  • "Exactly. The only thing that can prevent this behaviour is regulations. But apparently nobody wants to regulate, so we're screwed." - palata
  • "The only reason that would make me fear from an antitrust judgement splitting Android from Google is that it may lose the Google contributions to AOSP." - palata
  • "So for me, Android should be split out of Google. Maybe the other Android manufacturers will start contributing to AOSP, and maybe Android will die. But let me be honest: if Google keeps going this way, I will move to an iPhone (and I've been using and developing for Android forever). We may as well try the split, and if it fails I'll end up with an iPhone anyway." - palata

Concerns Over Browser Forks and Google's Control of the Web

The discussion touches upon the sustainability of open-source browser forks like Brave or forks based on Chromium, given Google's overwhelming control over the web ecosystem. There's a debate about whether forks can truly survive and whether Firefox, with Mozilla's different position, might be a better base.

  • "This is all the more likely now that Google has been emboldened by not having to sell off Chrome for anticompetitive reasons. This is all the more likely now that Google has been emboldened by not having to sell off Chrome for anticompetitive reasons." - scottbez1
  • "The same is clearly coming for Chromium forks, which is why I've always thought the privacy and ad-blocking forks are a joke - if they ever gain enough marketshare, or if google just tires of the public open source charade, they have no chance of maintaining a modern browser on their own." - scottbez1
  • "Yep. If we’re gonna be forking browsers, Firefox should be the base, not Chromium. Mozilla is in much less of a position to abuse their position, and more Firefox forks means more chances that one catches on with some slice of the larger public and helps chip away at Blink hegemony." - cosmic_cheese
  • "But if they fuck with users enough, Chrome would just die off over time, and Firefox or various Chromium forks like Brave would take its place. This already happened to the browsing titan that was IE, and without the entire power of Google to push Chrome? It can happen again." - ACCoutn37

Desire for Simpler, More Secure Mobile Devices

A recurring sentiment is the wish for simpler, more secure mobile operating systems and hardware. Some users express dissatisfaction with the complexity and feature bloat of modern smartphones, arguing that it increases the attack surface and makes maintenance difficult for non-corporate entities.

  • "Seems like there needs to be a split of both hardware and software. Mobile phones morphed into something else lately. Not all of us need all the features of a smart phone, but still need a comms device. We need a simpler OS with simpler hardware that focuses on comms and less features. Simpler OS, lower attack surface, simpler to maintain without the help of a gigantic corporation. I don't need a supercomputer in my pocket." - arcane23
  • "gruez: >Not all of us need all the features of a smart phone, but still need a comms device. [...] I don't need a supercomputer in my pocket. What's stopping you from using a feature phone? arcane23: Security/privacy?" - gruez, arcane23
  • "arcane23: You missed my point, a simpler hardware/software phone needs less resources to maintain. No eyecandy/cushy features to maintain, security becomes easier to maintain by the community. No constantly added features and gimmicks which break and introduce weak points." - arcane23
  • "I don't need a supercomputer in my pocket." - arcane23

Skepticism About the Viability of Linux Phones

While Linux phones are discussed as an alternative, there's skepticism about their current ability to compete with AOSP in terms of security model and app compatibility. The difficulty in achieving daily-driver status for projects like PostmarketOS is highlighted.

  • "palata: Unfortunately, and as much as I like Linux for phones, I think it's very, very far from AOSP. It completely misses the AOSP security model and the apps (no, I don't believe that running waydroid on Linux is entirely viable, otherwise instead of Linux for phone we would have Waydroid as an alternative to Android)." - palata
  • "neilv: Looks like PostmarketOS (mainline Linux for phones, with choice of frontend, such as Plasma Mobile or Phosh) has demoted all their previous "Main"-tier devices to "Community" or lower tier: ..." - neilv
  • "fabrice_d: Main is described as "The most supported devices, with all the features and stability you'd expect from a regular OS." Unfortunately there was/is no device supported by postmarketOS that fits that description. You'll need at least good telephony support including 4G features like VoLTE, proper camera support (not potato polaroid from the 80s quality), Wifi, Bluetooth, geolocation, working GPU acceleration, media hardware decoders, decent battery life. And I'm probably forgetting a few things." - fabrice_d

The Economics of Secure, Low-Cost Devices

The cost of implementing robust security features is raised as a barrier to creating affordable, secure feature phones or simplified smartphones. The economies of scale that larger corporations benefit from are difficult for niche products to achieve.

  • "gruez: So you want a $100 feature phone that has serious security features like monthly security patches and dedicated security coprocessors? It's tough to make the economics of that work out. All the serious security features costs money to implement, either in the form of development costs or added costs to the BOM. Those costs can be absorbed if you're selling a $600 phone, but not a $100 phone." - gruez
  • "Back to your point, there's already a "split of hardware and software" in the PC market, and we know how it works out. Security there is a joke. Windows might be getting monthly security patches, but the same can't be said of the panoply of third party drivers/firmware." - gruez
  • "gruez: >a simpler hardware/software phone needs less resources to maintain. And a such a product is going to absolutely niche, which means no economies of scale producing or maintaining it. You try to justify that by saying it'll be maintained by "the community", but who's going to want to do unglamorous work fixing security issues, compared to developing features?" - gruez