221 points tharen 2 hours ago 99 comments
duttonw 2 hours ago | parent
slim 2 hours ago | parent
mschuster91 1 hour ago | parent
realusername 1 hour ago | parent
wiseowise 1 hour ago | parent
realusername 1 hour ago | parent
pydry 1 hour ago | parent
mschuster91 51 minutes ago | parent
That's the huge, huge carrot that Google carries in front of everyone thinking to fork Android.
realusername 45 minutes ago | parent
Google does have a card to play here, I don't disagree but they shouldn't overstate their hand either. The Google bits of Android are good enough to keep open-source ROMs and small manufacturers away but they aren't a silver bullet and won't save them if China stops playing the game.
TheDong 1 hour ago | parent
Though given how little those companies have respected their users so far, I feel like this is a bit of a monkey's paw.
eddythompson80 29 minutes ago | parent
hn_submit 53 minutes ago | parent
rjh29 32 minutes ago | parent
yieldcrv 1 hour ago | parent
just hang up the hat and never look back
DaSHacka 1 hour ago | parent
microtonal 1 hour ago | parent
jeroenhd 16 minutes ago | parent
Unlike on Android, there aren't that many third party iOS apps, though.
Plus, even with Google delaying shipping source code, at least they ship the source code. The traces of source you get with the open Darwin code are nowhere near comparable.
bpye 1 hour ago | parent
Being able to have a fully functional version of KDE Connect would also be a requirement.
jackdaniel 1 hour ago | parent
reddalo 1 hour ago | parent
We need an Android alternative, something that respects users' freedom.
tonyhart7 1 hour ago | parent
thbb123 1 hour ago | parent
Alternatives exist. They just need signifiant adoption.
reddalo 1 hour ago | parent
eddythompson80 1 hour ago | parent
fenaer 1 hour ago | parent
eddythompson80 1 hour ago | parent
CalRobert 1 hour ago | parent
Though I see signal usage creeping upwards. Maybe just my circle
flaburgan 1 hour ago | parent
microtonal 56 minutes ago | parent
seb1204 9 minutes ago | parent
m4rtink 6 minutes ago | parent
mrbn100ful 33 minutes ago | parent
Google can kill them in an instant, they need the AOSP source to survive.
d3Xt3r 1 hour ago | parent
DaSHacka 1 hour ago | parent
So really, the alternative is proper GNU/Linux (or as I've recently taken to calling it...)
pjmlp 54 minutes ago | parent
It is as close to GNU/Linux as Inferno was to UNIX System V.
Which is why Termux has to work around what is actually available as public APIs on the NDK.
jeroenhd 21 minutes ago | parent
Termux has to work around security restrictions in a way not dissimilar to how you would need to work around an extremely securely configured SELinux setup on RHEL.
fsflover 51 minutes ago | parent
See also:
https://news.ycombinator.com/item?id=50057296
microtonal 1 hour ago | parent
The alternative are other AOSP-based OSes like GrapheneOS and Lineage. Once they are used widely enough and funded enough, they could fork AOSP when needed. In some sense they have already soft-forked in that they use major and QPR2 releases, but put a lot of patches on top to fix issues, improve security, etc.
GrapheneOS has an estimated 500,000 active installs now, apparently LineageOS has 1.4M active installs. Probably around two orders of magnitude more than traditional Linux desktop-based phones, which have been trying since, checking notes, Maemo in 2005?
flaburgan 1 hour ago | parent
microtonal 49 minutes ago | parent
They are mostly relying on LineageOS now and putting their own cloud, microG, and App Store app and branding on top of Lineage. Even now they are not able to roll out Android releases and WebView updates timely. Them maintaining an AOSP fork would probably end up in an outdated, broken mess.
My money is on GrapheneOS and maybe LineageOS to do it when needed.
fsflover 1 hour ago | parent
TheDong 1 hour ago | parent
I have old Chromebooks and Nexus Tablets that are EoL, but I can install linux on them and give them a second life.
The source code for my old EoL pixel phones is out there, it's just a matter of effort to port Ubuntu or PureOS or one of the other Linux phone distros to them.
It's Apple that is being as evil as possible when it comes to stomping down alternatives, they don't release iOS source code, they bricked most of my old devices when they EoL'd them by not letting me unlock the bootloader and install my own OS, they don't release drivers.
I'm deeply unhappy with Google's current direction, but they're still lightyears from the level of evil Apple inflicts upon us.
cromka 42 minutes ago | parent
But that's not the case for other manufacturers, including ones way more popular than Google. Especially Samsung.
On average, a new Android device is almost as locked as iPhone is.
thisislife2 17 minutes ago | parent
izacus 1 hour ago | parent
The more successful Android alternative - iOS - that people love so much doesn't do any of that and it's apparently even more secure and earns even more money.
See post downbelow: https://news.ycombinator.com/item?id=50083579
So why? :)
preisschild 1 hour ago | parent
You can support independent Android development (for example, GrapheneOS)
userbinator 1 hour ago | parent
Not surprisingly, I get slight hints of Claudism in the text.
AI "opening" the source of software is one of the best things I've seen going for it so far.
croes 1 hour ago | parent
Who beside the open source community develops new features if they can be easily copied?
mrheosuper 1 hour ago | parent
kadoban 1 hour ago | parent
michaelt 1 hour ago | parent
msy 45 minutes ago | parent
That may well be the future for most commercial software (and software engineers) as margins collapse and AI tokenomics moves more power from labor to capital.
croes 19 minutes ago | parent
But why invest time and money when your features get copied as soon as you publish it?
tancop 49 minutes ago | parent
The only thing that made commercial software more innovative is most developers never had time to build and maintain a big open source project without support from their job. Now we have agents and it takes a lot less time to implement your ideas. That means slop filling up GitHub, but also that people who came up with good new features can make them real in their free time.
ReSkate is a good example, it's a project 90% coded by AI but the people working on it are passionate and most of them are experienced game modders. They know what made the old Skate games special and wanted to bring it back to the new one. Now it's better than vanilla Skate 4 and has tons of new features never seen in the OG trilogy. That project would never be possible without Claude taking care of the hard and boring RE work.
croes 20 minutes ago | parent
ben_w 48 minutes ago | parent
Not perfect, of course. All that hype about the vibe-cloned Adobe suite is, today, hype. Next year it might not be, though that depends on questions like "will investment bubble pop?" etc.
But we are at a level where, if you can describe a feature or process well enough to test it, an LLM can develop and optimise for that feature/process. That creates opportunities for businesses to have custom just-for-them business software, which nobody copies because nobody outside the business even bothers to learn exist.
stuaxo 1 hour ago | parent
p0w3n3d 1 hour ago | parent
microtonal 57 minutes ago | parent
Google should not be allowed to abuse its duopoly position in this way. I recommend EU citizens to report every case they are (potentially) affected by to the EU DMA team.
alerighi 51 minutes ago | parent
But to me big tech succeeded also lobbying the EU like they already did in the US, in fact they violate multiple EU rules (GDPR, etc.) without facing any consequence, and when they try to announce they would do something at the other side of the ocean they treat us that they will double or triple tariffs so...
LoganDark 41 minutes ago | parent
iOS being so difficult to jailbreak means that most apps don't have any verification at all. Even most DRM doesn't even try to verify that the device isn't jailbroken in order to access the highest resolutions or whatever. But if we ever add a first-party option for the device to be modified, then we start running into the Android situation where every app has some invasive root/tamper detection thing. Some apps already have anti-debugging things, but the situation on iOS could be far, far worse.
mentalgear 1 hour ago | parent
mentalgear 1 hour ago | parent
kodebach 1 hour ago | parent
izacus 1 hour ago | parent
I think that's the one that made a lot of OEMs pull back on opensource publishing, because their legal departments want to batch the CVE monitoring and reporting obligations into smaller batches.
arghwhat 1 hour ago | parent
As long as they start the process and it is not absurd from an industry standards perspective, they should be good. They can have slow processes, including being a good bit slower than their peers, without running afoul of "without undue delay".
izacus 38 minutes ago | parent
Well, the corporate lawyers think otherwise at those corporations, so I'm not sure how much your interpretation counts :)
imtringued 19 minutes ago | parent
alerighi 6 minutes ago | parent
Security flaws are discovered almost every day (now that they are automating it with AI there are a ton of reports), pretending the manufacturer releases an update in 1 day is nonsense.
Just building the code alone it would take a lot of time, and of course you have to test it at least a bit before giving it out to the end users, you can't pretend to rollout on a global scale a nightly build without first at least some level of QA risking bricking user devices.
And you have to consider that phone manufacturer doesn't work h24 and 7/7 of course to give out patches.
I think that we are fortunate if the whole process takes less than a month, not a day.
microtonal 1 hour ago | parent
Also, major Android releases and QPR2s have many security fixes (anything not marked high/critical), yet OEMs are not rolling them out (QPR2) or very late (major releases).
Just to say that OEMs were probably violating the act already before Google started withholding source code.
I also think it’s an attempt of Google closing up AOSP more, otherwise they wouldn’t make it so darn hard to get updated Pixel kernel trees.
dathinab 1 hour ago | parent
withholding security updates seems to avoid a law which requires rolling out security updates seems very much like something which needs to be fixed one way or another
izacus 39 minutes ago | parent
Also - the reality of what you think is ok and what a corporate legal department think its ok is... rarely the same -_-
imtringued 22 minutes ago | parent
Regulators present an impossible goal to the companies to implement, instead of implementing the goal, the companies try to reward hack their way around it.
The end result is that they basically try to make it impossible to know about vulnerabilities because that would start the clock.
aboringusername 50 minutes ago | parent
> an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it
> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively
> without undue delay and in any event within 24 hours of the manufacturer becoming aware of it
> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident
"Sorry your honour, we only became 'aware of it' 2 years later, pinky promise ;)".
So any competant authority would have to prove when they 'became aware of it', whatever the test to pass that threshold means.
notrealyme123 1 hour ago | parent
Otherwise I would expect Google would also wait with pixel updates
microtonal 1 hour ago | parent
dathinab 1 hour ago | parent
izacus 34 minutes ago | parent
This is not true at all though. OEMs can release anything whenever they want.
LoganDark 8 minutes ago | parent
geraneum 1 hour ago | parent
I wouldn't be surprised if large corporations like Apple and Google intentionally use these tactics to pressure regulators through their European users. Siri AI is a prime example. While it's a complicated issue, I certainly wouldn't put such maneuvers past them.
ahartmetz 59 minutes ago | parent
gvfsa 16 minutes ago | parent
aboringusername 1 hour ago | parent
[1]: https://news.ycombinator.com/item?id=45911673
[2]: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ%3AJOL...
> Clause 1.2:
> (6) Operating system updates:
> (a)
> from the date of end of placement on the market to at least 5 years after that date, manufacturers, importers or authorised representatives shall, if they provide security updates, corrective updates or functionality updates to an operating system, make such updates available at no cost for all units of a product model with the same operating system;
> (b)
> the requirement referred to in point (a) shall apply both to operating system updates offered voluntarily by manufacturers, importers or authorised representatives and to operating system updates provided to comply with Union law;
> (c)
> security updates or corrective updates mentioned under point (a) need to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
> (d)
> functionality updates mentioned under point (a) need to be available to the user at the latest 6 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
> (e) an operating system update may combine security, corrective and functionality updates.
dathinab 1 hour ago | parent
either way if that is true it looks like a very intentional abuse/misinterpretation of existing regulations
eddythompson80 57 minutes ago | parent
hobofan 27 minutes ago | parent
I'm not familiar with the concrete wording of the regulation, but I would wager that the all the customization layers (like "One UI") that OEMs put on top of AOSP is the component for which the update clock should tick, and they should be unaffected of an underlying open source component (AOSP) being released.
pjmlp 58 minutes ago | parent
NDK seems to be handled like a 20% project in terms of allocated resources, I bet it has not more that like 2 FTEs, given its progress since Android 2.1.
typ 48 minutes ago | parent
raverbashing 45 minutes ago | parent
NooneAtAll3 9 minutes ago | parent