Google announces monthy Nexus security patches; Samsung follows suit

[poofyhairguy]

When/If Cyanogen replaces all the Google bits their hodge-podge of other bits, no one will want those phones.

Yet right now in China there are plenty of Android users that get by without the Play Store. The Baidu App Store is a big deal there amoung others. Many phones sold lack gapps.

CM's fork OS will get picked up by the lowest end phone makers who aren't choosing between full Android and the CM OS, because full Android costs money. They will chose between the CM OS and rolling their own thing via AOSP like they keep doing. The first option eventually will have cheaper development costs and will give them access to revenue through an eventual CM Store. It is win win for you are selling phones in say India where the standard for experience is still often at a Blackberry level.

Will the CM OS ever be on a major phone in the US? No. Will that company have tens of millions of phones sold and be worth billions in five or so years? Yes.

Xiaomi got to where it is by forking old CM into Miui. And now look at them. The CM project has the talent and the vision to have that kind of future.

We will see.

 

[StrangerGuy]

I don't see how this is going work well at all. Even if Google is truly sincere, the device makers and carriers really has little incentive to update the phones.

Anyway I don't think Google is that sincere to begin when the whole Android business model was designed to insulate Google from the responsibility of end-user support.

 

[sweenish]

Yet right now in China there are plenty of Android users that get by without the Play Store. The Baidu App Store is a big deal there amoung others. Many phones sold lack gapps.

CM's fork OS will get picked up by the lowest end phone makers who aren't choosing between full Android and the CM OS, because full Android costs money. They will chose between the CM OS and rolling their own thing via AOSP like they keep doing. The first option eventually will have cheaper development costs and will give them access to revenue through an eventual CM Store. It is win win for you are selling phones in say India where the standard for experience is still often at a Blackberry level.

Will the CM OS ever be on a major phone in the US? No. Will that company have tens of millions of phones sold and be worth billions in five or so years? Yes.

Xiaomi got to where it is by forking old CM into Miui. And now look at them. The CM project has the talent and the vision to have that kind of future.

We will see.

Cyanogenmod has always been the worst ROM I've used. On Nexus devices. They never hit stable, and even the M releases had weird quirks in their behavior.

To say that they have the talent is hilarious. To me, anyway. I know other peoples' experiences are different. But I've never like CM. I appreciate what they are and that basically created "the scene," but their time has gone.

Basically, I'll leave the talent level of Cyanogen alone, as I find that to be subjective.

You're also ignoring Android One. And other phones intended for these markets like the Moto E. Given the choice, I think people will choose a Google-backed phone at the same price.

The China example is interesting, to be sure, though. I can't speculate to much, there. But CM hasn't announced they're going to use Baidu's store in China, either.

Let's count on three (two? I know one of them fell through before it was ever released) fingers how many phones CM OS is installed on. If it truly was going to take off, it would have taken off. But their CEO is a moron, and they burnt their highest profile bridge in under a year.

I've seen your rosy predictions of the future, and I put no stock in them. You certainly can't expect me to treat your baseless speculations as salient points.

 

[soccerballtux]

Yet right now in China there are plenty of Android users that get by without the Play Store. The Baidu App Store is a big deal there amoung others. Many phones sold lack gapps.

CM's fork OS will get picked up by the lowest end phone makers who aren't choosing between full Android and the CM OS, because full Android costs money. They will chose between the CM OS and rolling their own thing via AOSP like they keep doing. The first option eventually will have cheaper development costs and will give them access to revenue through an eventual CM Store. It is win win for you are selling phones in say India where the standard for experience is still often at a Blackberry level.

Will the CM OS ever be on a major phone in the US? No. Will that company have tens of millions of phones sold and be worth billions in five or so years? Yes.

Xiaomi got to where it is by forking old CM into Miui. And now look at them. The CM project has the talent and the vision to have that kind of future.

We will see.

the value of users who tolerate non-GApps phones is demonstrably lower, just like the value of Greek bonds is lower for a very legitimate reason than German bonds.

in other words, analysts can say the company might be 'worth billions' but that's an overvaluation

 

[soccerballtux]

I don't see how this is going work well at all. Even if Google is truly sincere, the device makers and carriers really has little incentive to update the phones.

Anyway I don't think Google is that sincere to begin when the whole Android business model was designed to insulate Google from the responsibility of end-user support.

if they would design their software better they wouldn't need to provide it

 

[soccerballtux]

Cyanogenmod has always been the worst ROM I've used. On Nexus devices. They never hit stable, and even the M releases had weird quirks in their behavior.

To say that they have the talent is hilarious. To me, anyway. I know other peoples' experiences are different. But I've never like CM. I appreciate what they are and that basically created "the scene," but their time has gone.

yeah, I've never, ever had a CM build that didn't end up with me pulling my hair out. Even with a complete and total wipe, with no app/data restores (instead, manually re-installing each) it would only be stable for about 2 months-- soon as I would update, the problems would start. Users that aren't having problems must be using it as heavily as I was.

Even something as simple as a fresh wipe and restoring app+data with TiBu would cause problems.

Paranoid Android was the closest I got, but still would eventually have troubles.

So I stuck with stock, and only CONSIDER changing the kernel, and even then it's been hit or miss.

and all these people running around parroting which nightly has been working best for them, when absolutely nothing major has changed in the last 5 weeks...

and to add to all that, CM acting like poopyheads to all the developers that invested effort in it....

it reminds me of Google promising iPhone fluidity with Project Butter and, like usual, leaving the job only 80% complete, where the last 20% is enough to make you hate them, but not enough to make you move to Apple.

 

[poofyhairguy]

Cyanogenmod has always been the worst ROM I've used. On Nexus devices. They never hit stable, and even the M releases had weird quirks in their behavior.

To say that they have the talent is hilarious. To me, anyway. I know other peoples' experiences are different. But I've never like CM. I appreciate what they are and that basically created "the scene," but their time has gone.

Basically, I'll leave the talent level of Cyanogen alone, as I find that to be subjective.

Fair enough. I guess what I would say is that CM even at its bug ridden worst is a better experience than many of those grey market Chinese ROMs. We will see what the fork OS is like though.

You're also ignoring Android One. And other phones intended for these markets like the Moto E. Given the choice, I think people will choose a Google-backed phone at the same price.

I am ignoring those phones because they are too expensive for the market I envision CM dominating. I am talking the sub-$60 phone market, what we would call prepaid throw aways in the states. On a $60 phone there is no margin to pay Google for a real Play Store experience. But $60 phones are the way the next billion people are getting on the internet. Not Android One at $100+.

The China example is interesting, to be sure, though. I can't speculate to much, there. But CM hasn't announced they're going to use Baidu's store in China, either.

Long-term they plan to make their own store. That is the real money maker for them and those companies that use their OS.

Let's count on three (two? I know one of them fell through before it was ever released) fingers how many phones CM OS is installed on. If it truly was going to take off, it would have taken off.

Actually CM OS aka the fork isn't on any phone yet. It isn't released yet. That is also why it can't take off.

Every phone running the old style CM (aka with gapps) has been a hit. CM has great positive brand value in the Android community. They will take that positive momentum directly into their fork OS.

Heck I don't use CM either, but their business model is clearly better than what Google offers to the bottom of the barrel hardware makers. I could never own a CM phone and it could still be a huge hit.

I've seen rosy predictions of the future, and I put no stock in them. You certainly can't expect me to treat your baseless speculations as salient points.

No way! All I expect anyone to do is wait and see. I am merely making a prediction that in five years the CM fork will be on tens of millions of phones. Time will tell if I am right and if they succeed.

 

[poofyhairguy]

the value of users who tolerate non-GApps phones is demonstrably lower

Sure, but its a fresh and unsaturated market. Not everyone can be Apple making billions of margin on high end products. Someone is going to make a decent amount getting the next billion people (who yes are worth less) on the internet. Eventually tens of millions of eyeballs on your free ad supported app can equal developed world smartphone users buying the $.99 app. There is a huge market out there for ever cheaper smartphones even if we are too spoiled to use one.

 

[skriefal]

Good news that they will be supporting security updates for devices for 3 years or 18 months after last sale.

Should be a minimum of 3 years after last sale. Many people do in fact keep their phones that long, and most who do are buying them during the closeout/free upgrade periods (near the end of availability of the model).

 

[lothar]

Yeah but it all coming out after Stagefright it is bad thing. It shows Android phone makers are only motivated to act when the heat is on.

Google has tried to push this for years, this is just another "Android Update Alliance." And just like the Android Update Alliance I expect the phone makers to skirt around this or ignore their new promises as soon as they think the coast is clear.

The problem is the business model. Right now any future updates eat into the profit margin for a device. There is very little in the way of after-sale revenues coming from these devices, so it is in their best interest to NOT update the devices as that cuts into that initial sale margin. The only reason LG, Samsung, etc. are promising security updates is because the PR cost is greater than the update cost. But in a year when Stagefright blows over that motive is gone.

Google has a way to fix it, but they won't do it because it sucks for them. Offer the phone makers a slice of Play Store revenue for their devices, but make it a stipulation that the device has to be up-to-date to get that revenue. You would see the Samsungs of the world RACING to beat the Nexus phones to updates if that was the case. Problem is Google would have to take a cut on Android profits to get there. SOMEONE has to pay for updates, and in mobile devices there is no expectation nor mechanism for the consumer to pay extra themselves to take on that burden.

If I could get a S6 and pay say $50 extra a year to get fast AOSP updates for the device I would do that in a second. But we aren't even given an option.

Umm...OEM's already get a slice of Google Play Store revenue.

Apple currently takes home 30% of App Store profits, with 70% going to developers. Google, on the other hand, gives developers 70% and now takes home 15%, before distributing the rest of the pie to carriers and manufacturers. The Information states that Google used to give carriers 15%, but recently dropped them to 5%.

So that means OEMs get 10% of Play Store revenue.
Google is already loosing a 15% cut to the OEMs and Carriers, unlike Apple which gets to keep all it's 30% to itself.

 

[lothar]

I am ignoring those phones because they are too expensive for the market I envision CM dominating. I am talking the sub-$60 phone market, what we would call prepaid throw aways in the states. On a $60 phone there is no margin to pay Google for a real Play Store experience. But $60 phones are the way the next billion people are getting on the internet. Not Android One at $100+.

A Google Play license cost OEM's 75 cents per device. Pennies.
And OEM's get 10% of all Play Store revenue on that device in return. If a user spent $7.50 on apps, or watched enough ads over the 2 years that they own the phone, the OEM has already broken even because they've made their 75 cents back or even more.

Samsung must be making a killing off Google at these prices.

 

[blankslate]

After the updates to Samsungs less than year old phones a few days ago carriers are starting to update the S4 and S4 Active to patch stagefright.

http://www.droid-life.com/2015/08/11/att-galaxy-s4-and-galaxy-s4-active-receive-stagefright-updates/

For those who still use a Galaxy S4 or Galaxy S4 Active on AT&T, your Stagefright security patch update is now ready to download and install. Once installed, you should no longer have to fear the MMS vulnerabilities that Stagefright brought to light.

http://www.christianitydaily.com/ar...-note-4-for-stagefright-hack-security-fix.htm

Sprint has recently started rolling out the Android 5.1.1 Lollipop update for its Samsung Galaxy S4.

Apart from the general improvements that the latest version of the Lollipop brings to the device, it also comes with a security patch designed against the Stagefright hack.

The Android 5.1.1 Lollipop released by Sprint for the Galaxy S4 upgrades the device's software build version to N910PVPU4COG5. It is almost 616MB in size and can be downloaded over the air, GSM Arena has learned.

It seems like the carriers are updating to a new version or just patching an in place OS version based on which option is less expensive for them.


....

 

[ThisIsChrisKim]

After the updates to Samsungs less than year old phones a few days ago carriers are starting to update the S4 and S4 Active to patch stagefright.

http://www.droid-life.com/2015/08/11/att-galaxy-s4-and-galaxy-s4-active-receive-stagefright-updates/



http://www.christianitydaily.com/ar...-note-4-for-stagefright-hack-security-fix.htm




It seems like the carriers are updating to a new version or just patching an in place OS version based on which option is less expensive for them.


....

Good to see Samsung doing a good job of rolling out the security patches. Aside from Google, I don't think others have rolled out yet?

 

[blankslate]

Good to see Samsung doing a good job of rolling out the security patches. Aside from Google, I don't think others have rolled out yet?

As far as I know not yet but he results searching android stagefright patch indicate that LG is working on it and this image taken from a talk about the vulnerability indicates that Sony is also working on it.

The S3 and G2 are also listed so that is good news as it indicates that manufacturers are looking even at even 2+ year old phones as devices to update.

Also it is still early in August so there are still a few more weeks before we can say the other manufacturers have dropped the ball.


....

 

[RossMAN]

Did any Nexus 5 owners receive an Android update today around 10.1MB?

 

[sweenish]

Actually CM OS aka the fork isn't on any phone yet. It isn't released yet. That is also why it can't take off.

You lost the argument when you said this. CM OS is on the 1+1.

Yes, it ships with gapps. It's still CM OS. When it ships without Google, no one will care.

The fork you're talking about is ALREADY a fork. That's what every custom ROM is. Throwing out Google for a hodgepodge of self-made and other third party stuff doesn't look ideal at all. So, like I said, if was going to get out there, it would be out there.

It will also allow their code base to deteriorate. Consider how much work they had to put in to officially qualify for GMS. Cyanogen was a mess, and they had to seriously clean it up to officially ship with the Play Store. And the 1+1 was still bug ridden.

Now, they don't have to code to a higher standard. Back to random reboots and the hackiest of hacks just for the sake of being able to toggle a thing.

Also, Android One is going to be hitting that $60 mark this year. I think that story was in the news between your post and now.

 

[rstove02]

Did any Nexus 5 owners receive an Android update today around 10.1MB?

Yep on Nexus 5

 

[Platypus]

Cyanogenmod has always been the worst ROM I've used. On Nexus devices. They never hit stable, and even the M releases had weird quirks in their behavior.

To say that they have the talent is hilarious. To me, anyway. I know other peoples' experiences are different. But I've never like CM. I appreciate what they are and that basically created "the scene," but their time has gone.

Basically, I'll leave the talent level of Cyanogen alone, as I find that to be subjective.

You're also ignoring Android One. And other phones intended for these markets like the Moto E. Given the choice, I think people will choose a Google-backed phone at the same price.

The China example is interesting, to be sure, though. I can't speculate to much, there. But CM hasn't announced they're going to use Baidu's store in China, either.

Let's count on three (two? I know one of them fell through before it was ever released) fingers how many phones CM OS is installed on. If it truly was going to take off, it would have taken off. But their CEO is a moron, and they burnt their highest profile bridge in under a year.

I've seen your rosy predictions of the future, and I put no stock in them. You certainly can't expect me to treat your baseless speculations as salient points.

I work on the CyanogenMod team (on the open source side) and I built the wiki along with fattire. I've also ported custom recovery firmware to 40+ devices and helped get CM off the ground on countless phones that ship with bullshit firmware from an OEM. CM has definitely fallen off and not kept up with the pace it used to be able to in my opinion, but there's a lot of reasons for this. You're only as good as your last product in a lot of people's minds but this is definitely a nuanced situation that blanket statements don't really apply to.

In my opinion, the problem is that CM is different on every device because there's a different volunteer maintainer for it. It may run buggy as hell on one device and really smooth on another, but unless you have those devices you're going to think it's subpar. The Nexus situation is something I've tried internally for years to fix, it's absolutely ridiculous to me that CM runs poorly on the most open phones on the planet, but no one stepped up to offer the help until it was too late. A lot of the core team has obviously moved into the Inc and focus has changed. I am happy that my friends and people I've worked with on the side for years are succeeding at their dream, but the reality is that with this shift in focus, something had to give.

I won't try to explain all the intensely complex internal workings of it, nor should it really matter. I'm just replying to say that the situation is much more complex than people here are making it out to be and to say that CM needed a cleanup in order to get certified is pretty wrong. Making the statement that they don't have talent or you think that the talent is hilarious is what prompted this reply. Some of the best people I've ever worked with period have contributed to CM, people who work at the companies you respect and use their products every day. People who spend thousands of volunteer hours unpaid to make something work for free. I find that comment tasteless and ignorant personally.

I don't want to derail this thread too heavily but I work in this industry if anyone has any thoughts or questions, drop me a PM or find me on IRC (utkanos on freenode)