zlacker

Delayed Security Patches for AOSP (Android Open Source Project)

submitted by transp+(OP) on 2025-09-07 14:36:32 | 230 points 109 comments
[view article] [source] [go to bottom]

NOTE: showing posts with links only show all posts
1. delect+Ta[view] [source] 2025-09-07 15:45:16
>>transp+(OP)
XCancel link which will show the thread context if you aren't logged in to Twitter: https://xcancel.com/grapheneos/status/1964561043906048183
2. flotza+qi[view] [source] 2025-09-07 16:31:07
>>transp+(OP)
"No tags were pushed to AOSP for the July 2025 monthly release of Android. We asked about this on the android-building group but each of our posts was rejected. We emailed people at Google we've previously contacted about mistakes pushing tags but received no response this time."

https://xcancel.com/GrapheneOS/status/1952413110947430786

"July monthly release was not pushed to AOSP and then neither was the August monthly release. September quarterly release hasn't been pushed yet."

https://xcancel.com/GrapheneOS/status/1963812920673861981

25. neilv+8p[view] [source] 2025-09-07 17:15:10
>>transp+(OP)
Looks like PostmarketOS (mainline Linux for phones, with choice of frontend, such as Plasma Mobile or Phosh) has demoted all their previous "Main"-tier devices to "Community" or lower tier:

https://wiki.postmarketos.org/wiki/Devices#Main

Anyone know whether this is a sign of a push for being daily driver quality? Or a sign that volunteers previously doing promising work have drifted away, and they're acknowledging that?

◧◩
30. fabric+Wq[view] [source] [discussion] 2025-09-07 17:24:11
>>neilv+8p
Main is described as "The most supported devices, with all the features and stability you'd expect from a regular OS."

Unfortunately there was/is no device supported by postmarketOS that fits that description. You'll need at least good telephony support including 4G features like VoLTE, proper camera support (not potato polaroid from the 80s quality), Wifi, Bluetooth, geolocation, working GPU acceleration, media hardware decoders, decent battery life. And I'm probably forgetting a few things.

Let's hope that initiatives like https://liberux.net/ will help make a fully working, long lasting device available!

◧◩◪◨⬒⬓⬔⧯
52. aspenm+VA[view] [source] [discussion] 2025-09-07 18:21:31
>>arcane+dy
I have crossed paths with them before. Yellow rock approach.

https://danieldashnawcouplestherapy.com/blog/yellow-rock-met...

◧◩◪◨⬒⬓⬔⧯▣
58. aspenm+aD[view] [source] [discussion] 2025-09-07 18:36:35
>>gruez+DB
The success of the Raspberry Pi proves that existence of competitors is no impediment to success with the proper connections with vendors and with the community.

The OpenWRT One is another example of collaborating with community trusted vendors to build a niche community based hardware product.

https://openwrt.org/toh/openwrt/one

59. bhoust+cD[view] [source] 2025-09-07 18:37:01
>>transp+(OP)
FYI the poster this story links to says that this title is incorrect:

https://x.com/grapheneos/status/1964757878910136346?s=46

They say this:

Our reply here was linked on Hacker News with an inaccurate title ("Delayed Security Patches for AOSP"). Security patch backports were pushed to AOSP on September 2nd for Android 13, 14 and 15 as expected.

More information is available at x.com/GrapheneOS/sta… explaining the situation with security patches. It would be better to have a thread linking to that instead. We have early access to the security patches, but we can't break the embargo. We can only release the sources once source release is allowed. We could make a security preview branch but the system simply doesn't make sense.

Android 16 QPR1 is a new major release, not a security patch release. Our reply is talking about 2 different issues. Android 16 QPR1 is what was delayed for AOSP and we don't currently know why. It's possible it was a mistake and it will be pushed on Monday.

61. strcat+yD[view] [source] 2025-09-07 18:40:30
>>transp+(OP)
This is an official response from GrapheneOS:

The title of this post linking our reply is inaccurate and is not what we said ("Delayed Security Patches for AOSP"). It should really be changed from "for AOSP" to "for Android". Security patch backports were pushed to AOSP on September 2nd for Android 13, 14 and 15 as expected. The issue isn't the security patches being delayed for AOSP. We didn't say patches are being delayed for AOSP.

Security patches for Android are being delayed as a whole. The delays aren't specific to AOSP. They're moving to quarterly security updates with 4 months of early OEM access instead of monthly security updates with 1 month of early OEM access. They realize that the patches distributed to OEMs are hardly secret once they're so broadly distributed. Therefore, they've relaxed the rules of the embargo and permitted releases of patches under certain rules without being allowed to providing a description or the sources for the patch. This is ridiculous because it's easy to reverse the patches from binary-only releases.

Google trying to cover for OEMs not keeping up with patches by making it seem as if the patches are now quarterly and largely being delivered on time while actually broadly disclosing them 4 months early and permitting quietly fixing them early.

We posted a much more detailed explanation at https://x.com/GrapheneOS/status/1964754118653952027. It would be better to link to our more detailed post.

◧◩
62. strcat+8E[view] [source] [discussion] 2025-09-07 18:45:15
>>scottb+ll
Security patches aren't being delayed for AOSP specifically but rather Android as a whole including the stock Pixel OS. The title is misinterpreting our reply. We didn't say they're delaying patches to AOSP specifically. Stock Pixel OS has delayed patches too.

A more detailed explanation is at https://x.com/GrapheneOS/status/1964754118653952027.

GrapheneOS has an OEM partner and early access to the security patches so our complaint isn't about us not having access. Google has added an exception to the embargo where binary-only patches can be released which we could use for a special security update branch but that's a ridiculous exception and it should be allowed to release the sources. It can be reversed from the security patches anyway and is trivial for Java and Kotlin. We can't break the embargo ourselves but we CAN publish the security patches early under the rules of the embargo via a special branch and people could reverse the patches from there which could then be applied to the regular GrapheneOS branch. The system is ridiculous and our hope is these changes are undone.

The title should really be changed from "for AOSP" to "for Android". There's a binary-only exception in the embargo now but that's not really about AOSP and isn't being used in practice even for Pixels. They've really just delayed all patches 4 months instead of 1 while also destroying any semblance of there being a real embargo (which was already very weak).

◧◩
66. strcat+XE[view] [source] [discussion] 2025-09-07 18:50:28
>>flotza+qi
That's about the monthly and quarterly releases of Android, not the Android security patches. The post title is misinterpreting what's wrong. There is a lot wrong but that's not it. The baseline Android security patches are being delayed for Android as a whole, not AOSP specifically.

Not having the very tiny monthly updates pushed to AOSP is an annoyance which will delay a subset of non-security bug fixes until the quarterly releases. It's a bad change, although we know have a good idea why it happened and need the reason it happened to be reversed for them to push those again.

We've been told by multiple people at Google that the quarterly releases would still be pushed and that monthly releases are largely being phased out. However, the quarterly update was not pushed as expected on September 3rd. If it's pushed on Monday, it will be 6 days late. There hasn't been a similar delay for quarterly and yearly releases in the past.

GrapheneOS can still provide security updates but not having the quarterly release is a major problem and it's not clear why it wasn't pushed when they said it was going to be pushed.

There's a separate issue not specifically tied to AOSP impacting security patches which is what the initial part of our reply was about. See https://x.com/GrapheneOS/status/1964754118653952027 for an explanation.

◧◩
67. strcat+2F[view] [source] [discussion] 2025-09-07 18:51:00
>>mdasen+Ll
Note the post title is incorrect. See >>45160975 . Android patches are being delayed in general, not only for AOSP.
◧◩
68. strcat+4F[view] [source] [discussion] 2025-09-07 18:51:04
>>delect+Ta
Note the post title is incorrect. See >>45160975 . Android patches are being delayed in general, not only for AOSP.
◧◩
69. strcat+6F[view] [source] [discussion] 2025-09-07 18:51:11
>>palata+Lo
Note the post title is incorrect. See >>45160975 . Android patches are being delayed in general, not only for AOSP.
◧◩
71. strcat+uF[view] [source] [discussion] 2025-09-07 18:54:36
>>bhoust+cD
X cut off the link you copied within our reply. Here's that link along with 2 alternatives other than X:

https://x.com/GrapheneOS/status/1964754118653952027

https://bsky.app/profile/grapheneos.org/post/3lyb6rx46tc2r

https://grapheneos.social/@GrapheneOS/115164133992525834

◧◩
72. strcat+HF[view] [source] [discussion] 2025-09-07 18:55:49
>>ACCoun+Wk
Note the post title is incorrect. See >>45160975 . Android patches are being delayed in general, not only for AOSP.
◧◩
75. Arnavi+6G[view] [source] [discussion] 2025-09-07 18:58:58
>>neilv+8p
I am the pmOS maintainer for the PinePhone. It was demoted from main to community because I was the only maintainer and one of the criteria for main is to have two or more maintainers. ( https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merg... ) Originally many pmOS core devs were maintainers, which is why it was in main, but they all lost interest and it was about to be demoted to testing / unmaintained, so I volunteered to become the maintainer to stop that from happening.

A blanket statement of a phone being "of daily driver quality or not" is impossible to make because everyone has different expectations of a "daily driver". I have been daily-driving the PinePhone since 2021 (it is my first and only smartphone) but that doesn't mean everyone else will be happy with it.

◧◩
78. transp+wI[view] [source] [discussion] 2025-09-07 19:16:28
>>bhoust+cD
Thanks for the clarification. 90 day embargo of patches for all Android is worse than delaying for AOSP, https://news.ycombinator.com/item?id=45158523#45161240

  They're giving OEMs 3-4 months of early access which we know for a fact is being widely leaked including to attackers.
◧◩◪◨⬒⬓⬔⧯
94. charci+W51[view] [source] [discussion] 2025-09-07 22:24:02
>>OutOfH+t51
Yes, anyone is free to contribute to AOSP and many manufacturers already do.

https://source.android.com/docs/setup/contribute/submit-patc...

[go to top]