We are already there and it is called Play Integrity (meets STRONG integrity) and Google is trying to get apps to use it to shut out competitors. They are succeeding to some extend (see the Volkswagen and IKEA Smart Home apps as recent successes for Google).
Google should not be allowed to abuse its duopoly position in this way. I recommend EU citizens to report every case they are (potentially) affected by to the EU DMA team.
Is your theory really that closed source software will just stop being developed? I can't find another way to read that, but you can't think Google is just going to give up and shut down, right?
I can't prove it, but I still think this is (partly) due to a recent EU regulation majorly backfiring.
I can't remember which one it was, but one of the recent regulations mandates that devices get updates for a certain period. Within that period a manufacturer must provide each update for all their devices in a short timeframe. The intention was to prevent flagships getting updates immediately and lower end devices having to wait months.
However, due to some (also well intentioned) wording about open source, the release of the source code is counted as the first release of an update and starts the timer.
I'm pretty sure Google is delaying public AOSP updates to give their partners (mainly Samsung I suppose) more time to finish building their updates on top of AOSP.
I wouldn't be surprised if large corporations like Apple and Google intentionally use these tactics to pressure regulators through their European users. Siri AI is a prime example. While it's a complicated issue, I certainly wouldn't put such maneuvers past them.
It's funny that they keep trying, it has never once worked. I think US companies are projecting their dislike for regulation and keep being surprised that EU citizens don't agree. We do not love the EU government, but it sometimes does a good thing and we do like these, especially versus the anti-consumer crap that US companies like to pull.
As far as I understand, most OEMs are not allowed to release QPR1 or QPR3 either (not that OEMs outside maybe Samsung would be able to). So part of it also reeks of giving Pixel benefits over phones of other manufacturers.
if that is the case then it should be brought to the respective overseen regulatory body, weather it is for them to clarify that this is not a valid interpretation of the law (it's at least clearly in conflict with the spirit of the law) and intentionally delaying public releases this way is a no-go or weather it is to amend the law to make it more explicitly illegal
either way if that is true it looks like a very intentional abuse/misinterpretation of existing regulations
Interesting theory. Is there a distinction between phone release and os release there? I would imagine the time starts when the model goes in sale, not when the os releases.
Otherwise I would expect Google would also wait with pixel updates
I posted about this 11 months ago [1]. The law you are referring to [2] absolutely makes distinctions between open/closed source. This is 100% why Google closed their source and now does security releases privately.
> from the date of end of placement on the market to at least 5 years after that date, manufacturers, importers or authorised representatives shall, if they provide security updates, corrective updates or functionality updates to an operating system, make such updates available at no cost for all units of a product model with the same operating system;
> (b)
> the requirement referred to in point (a) shall apply both to operating system updates offered voluntarily by manufacturers, importers or authorised representatives and to operating system updates provided to comply with Union law;
> (c)
> security updates or corrective updates mentioned under point (a) need to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
> (d)
> functionality updates mentioned under point (a) need to be available to the user at the latest 6 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
> (e) an operating system update may combine security, corrective and functionality updates.
It's Cyber Resilience Act (Regulation (EU) 2024/2847) - if there's a security patch that shows up in public, then the manufacturers are fined if they don't immediately roll it out as an update ("without undue delay").
I think that's the one that made a lot of OEMs pull back on opensource publishing, because their legal departments want to batch the CVE monitoring and reporting obligations into smaller batches.
Aren’t most OEMs in violation anyway because Linux (as in the kernel) gets regular security patches and most OEMs are on ancient kernel versions?
Also, major Android releases and QPR2s have many security fixes (anything not marked high/critical), yet OEMs are not rolling them out (QPR2) or very late (major releases).
Just to say that OEMs were probably violating the act already before Google started withholding source code.
I also think it’s an attempt of Google closing up AOSP more, otherwise they wouldn’t make it so darn hard to get updated Pixel kernel trees.
withholding security updates seems to avoid a law which requires rolling out security updates seems very much like something which needs to be fixed one way or another
nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".
As long as they start the process and it is not absurd from an industry standards perspective, they should be good. They can have slow processes, including being a good bit slower than their peers, without running afoul of "without undue delay".
Google is doing better here than Apple. Most google devices have an unlockable bootloader.
I have old Chromebooks and Nexus Tablets that are EoL, but I can install linux on them and give them a second life.
The source code for my old EoL pixel phones is out there, it's just a matter of effort to port Ubuntu or PureOS or one of the other Linux phone distros to them.
It's Apple that is being as evil as possible when it comes to stomping down alternatives, they don't release iOS source code, they bricked most of my old devices when they EoL'd them by not letting me unlock the bootloader and install my own OS, they don't release drivers.
I'm deeply unhappy with Google's current direction, but they're still lightyears from the level of evil Apple inflicts upon us.
They exist. But they don't support Android apps that are unfortunately necessary. For example, any phone without WhatsApp or banking apps support is dead on arrival in Europe.
Which is why /e/ OS and Graphene OS adoption is higher than projects such as PostmarketOS (now Nura) or Ubuntu Touch, even if they are already quite mature. I daily drove Ubuntu Touch for two years in 2019 and 2020, and it's the need of Signal which made me switch to /e/.
The problem doesn't lie with e/OS/, nor any other alternative. Google locks down capabilities with "Play Integrity", effectively attestation for official Google approved operating systems only. If you aren't on the list you fail the checks, and apps (like banking apps) will fail to run.
But it’s banking apps that opt into that. It’s not like Google is saying you must use Play Integrity. It’s a feature that banking apps are more likely to use. The EU could require banks to make apps for other operating systems.
Yes, let's throw away a fully mature smartphone OS (AOSP) and replace it by something that does not even have proper app sandboxing. /s
The alternative are other AOSP-based OSes like GrapheneOS and Lineage. Once they are used widely enough and funded enough, they could fork AOSP when needed. In some sense they have already soft-forked in that they use major and QPR2 releases, but put a lot of patches on top to fix issues, improve security, etc.
GrapheneOS has an estimated 500,000 active installs now, apparently LineageOS has 1.4M active installs. Probably around two orders of magnitude more than traditional Linux desktop-based phones, which have been trying since, checking notes, Maemo in 2005?
Btw /e/ OS people have already shared that they were getting ready for a hard fork of AOSP looking at how Google is acting.
But to be fair the challenge is more around the hardware support than the OS itself, so in the end it will be the chip makers which will decide which OS can run or not. If they go the AMD way then great, if they go the old nvidia way where even basic reclocking is impossible then we are screwed.
> We need an Android alternative, something that respects users' freedom.
The more successful Android alternative - iOS - that people love so much doesn't do any of that and it's apparently even more secure and earns even more money.
Good look with NDK issues, having the source code available would not help much anyway.
NDK seems to be handled like a 20% project in terms of allocated resources, I bet it has not more that like 2 FTEs, given its progress since Android 2.1.
8 out of the top 10 manufacturers are Chinese. Google has to be careful here, otherwise Android will end up as a Chinese consortium and their own version will just be available on Pixels.
Yes that's also a real possibility. The sanctions on Huawei were a terrible idea, it became a laboratory of what could be rolled out on the whole country if needed. Now this work has been done.
One character: a plain compare loop. Correct.
Not surprisingly, I get slight hints of Claudism in the text.
AI "opening" the source of software is one of the best things I've seen going for it so far.
Given they don't have the code, I think it's fair enough here. Sounds like with it, it would have been much easier to find.
Trusted Platform Computing in 3... 2... 1...
We are already there and it is called Play Integrity (meets STRONG integrity) and Google is trying to get apps to use it to shut out competitors. They are succeeding to some extend (see the Volkswagen and IKEA Smart Home apps as recent successes for Google).
Google should not be allowed to abuse its duopoly position in this way. I recommend EU citizens to report every case they are (potentially) affected by to the EU DMA team.
This ideea haunts me in my nightmares.
It could slow down progress.
Who beside the open source community develops new features if they can be easily copied?
Is your theory really that closed source software will just stop being developed? I can't find another way to read that, but you can't think Google is just going to give up and shut down, right?
"AI is going to lead to much less software being written" said no-one ever :)
Why use proprietary software when there is opensource one ?
I can't prove it, but I still think this is (partly) due to a recent EU regulation majorly backfiring. I can't remember which one it was, but one of the recent regulations mandates that devices get updates for a certain period. Within that period a manufacturer must provide each update for all their devices in a short timeframe. The intention was to prevent flagships getting updates immediately and lower end devices having to wait months. However, due to some (also well intentioned) wording about open source, the release of the source code is counted as the first release of an update and starts the timer. I'm pretty sure Google is delaying public AOSP updates to give their partners (mainly Samsung I suppose) more time to finish building their updates on top of AOSP.
> EU regulation majorly backfiring
I wouldn't be surprised if large corporations like Apple and Google intentionally use these tactics to pressure regulators through their European users. Siri AI is a prime example. While it's a complicated issue, I certainly wouldn't put such maneuvers past them.
It's funny that they keep trying, it has never once worked. I think US companies are projecting their dislike for regulation and keep being surprised that EU citizens don't agree. We do not love the EU government, but it sometimes does a good thing and we do like these, especially versus the anti-consumer crap that US companies like to pull.
As far as I understand, most OEMs are not allowed to release QPR1 or QPR3 either (not that OEMs outside maybe Samsung would be able to). So part of it also reeks of giving Pixel benefits over phones of other manufacturers.
the more I learn about how Google handles releases the more this looks like there being a need for anti trust actions
if that is the case then it should be brought to the respective overseen regulatory body, weather it is for them to clarify that this is not a valid interpretation of the law (it's at least clearly in conflict with the spirit of the law) and intentionally delaying public releases this way is a no-go or weather it is to amend the law to make it more explicitly illegal
either way if that is true it looks like a very intentional abuse/misinterpretation of existing regulations
What makes you think it’s misinterpretation?
Interesting theory. Is there a distinction between phone release and os release there? I would imagine the time starts when the model goes in sale, not when the os releases.
Otherwise I would expect Google would also wait with pixel updates
I posted about this 11 months ago [1]. The law you are referring to [2] absolutely makes distinctions between open/closed source. This is 100% why Google closed their source and now does security releases privately.
[1]: https://news.ycombinator.com/item?id=45911673
[2]: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ%3AJOL...
> Clause 1.2:
> (6) Operating system updates:
> (a)
> from the date of end of placement on the market to at least 5 years after that date, manufacturers, importers or authorised representatives shall, if they provide security updates, corrective updates or functionality updates to an operating system, make such updates available at no cost for all units of a product model with the same operating system;
> (b)
> the requirement referred to in point (a) shall apply both to operating system updates offered voluntarily by manufacturers, importers or authorised representatives and to operating system updates provided to comply with Union law;
> (c)
> security updates or corrective updates mentioned under point (a) need to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
> (d)
> functionality updates mentioned under point (a) need to be available to the user at the latest 6 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
> (e) an operating system update may combine security, corrective and functionality updates.
It's Cyber Resilience Act (Regulation (EU) 2024/2847) - if there's a security patch that shows up in public, then the manufacturers are fined if they don't immediately roll it out as an update ("without undue delay").
I think that's the one that made a lot of OEMs pull back on opensource publishing, because their legal departments want to batch the CVE monitoring and reporting obligations into smaller batches.
Aren’t most OEMs in violation anyway because Linux (as in the kernel) gets regular security patches and most OEMs are on ancient kernel versions?
Also, major Android releases and QPR2s have many security fixes (anything not marked high/critical), yet OEMs are not rolling them out (QPR2) or very late (major releases).
Just to say that OEMs were probably violating the act already before Google started withholding source code.
I also think it’s an attempt of Google closing up AOSP more, otherwise they wouldn’t make it so darn hard to get updated Pixel kernel trees.
probably yes
withholding security updates seems to avoid a law which requires rolling out security updates seems very much like something which needs to be fixed one way or another
nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".
As long as they start the process and it is not absurd from an industry standards perspective, they should be good. They can have slow processes, including being a good bit slower than their peers, without running afoul of "without undue delay".
The new Google motto seems to be "be as evil as you can".
We need an Android alternative, something that respects users' freedom.
Google is doing better here than Apple. Most google devices have an unlockable bootloader.
I have old Chromebooks and Nexus Tablets that are EoL, but I can install linux on them and give them a second life.
The source code for my old EoL pixel phones is out there, it's just a matter of effort to port Ubuntu or PureOS or one of the other Linux phone distros to them.
It's Apple that is being as evil as possible when it comes to stomping down alternatives, they don't release iOS source code, they bricked most of my old devices when they EoL'd them by not letting me unlock the bootloader and install my own OS, they don't release drivers.
I'm deeply unhappy with Google's current direction, but they're still lightyears from the level of evil Apple inflicts upon us.
Typing this from a e/os/ phone.
Alternatives exist. They just need signifiant adoption.
They exist. But they don't support Android apps that are unfortunately necessary. For example, any phone without WhatsApp or banking apps support is dead on arrival in Europe.
WhatsApp and my banking apps work fine on GrapheneOS (and /e/OS).
Which is why /e/ OS and Graphene OS adoption is higher than projects such as PostmarketOS (now Nura) or Ubuntu Touch, even if they are already quite mature. I daily drove Ubuntu Touch for two years in 2019 and 2020, and it's the need of Signal which made me switch to /e/.
Once upon a time WhatsApp had a j2me client…
Though I see signal usage creeping upwards. Maybe just my circle
Couldn’t the EU pass a law to require e/os/ to support WhatsApp or vice verse?
The problem doesn't lie with e/OS/, nor any other alternative. Google locks down capabilities with "Play Integrity", effectively attestation for official Google approved operating systems only. If you aren't on the list you fail the checks, and apps (like banking apps) will fail to run.
But it’s banking apps that opt into that. It’s not like Google is saying you must use Play Integrity. It’s a feature that banking apps are more likely to use. The EU could require banks to make apps for other operating systems.
> We need an Android alternative, something that respects users' freedom.
You can support independent Android development (for example, GrapheneOS)
There's already an alternative, it's called Linux.
Though, as the narcs are quick to point out, Android 'is' Linux.
So really, the alternative is proper GNU/Linux (or as I've recently taken to calling it...)
It really isn't, it more like Inferno would have replaced its kernel with the Linux kernel.
It is as close to GNU/Linux as Inferno was to UNIX System V.
Which is why Termux has to work around what is actually available as public APIs on the NDK.
Related recent discussion: https://news.ycombinator.com/item?id=50051530
Yes, let's throw away a fully mature smartphone OS (AOSP) and replace it by something that does not even have proper app sandboxing. /s
The alternative are other AOSP-based OSes like GrapheneOS and Lineage. Once they are used widely enough and funded enough, they could fork AOSP when needed. In some sense they have already soft-forked in that they use major and QPR2 releases, but put a lot of patches on top to fix issues, improve security, etc.
GrapheneOS has an estimated 500,000 active installs now, apparently LineageOS has 1.4M active installs. Probably around two orders of magnitude more than traditional Linux desktop-based phones, which have been trying since, checking notes, Maemo in 2005?
Btw /e/ OS people have already shared that they were getting ready for a hard fork of AOSP looking at how Google is acting. But to be fair the challenge is more around the hardware support than the OS itself, so in the end it will be the chip makers which will decide which OS can run or not. If they go the AMD way then great, if they go the old nvidia way where even basic reclocking is impossible then we are screwed.
> We need an Android alternative, something that respects users' freedom.
The more successful Android alternative - iOS - that people love so much doesn't do any of that and it's apparently even more secure and earns even more money.
See post downbelow: https://news.ycombinator.com/item?id=50083579
So why? :)
sure if there are another corpo that want to funding it
Good look with NDK issues, having the source code available would not help much anyway.
NDK seems to be handled like a 20% project in terms of allocated resources, I bet it has not more that like 2 FTEs, given its progress since Android 2.1.
Google not releasing won’t help now in the ai age….
I wonder if they use already / what their experience is with "REA Reverse – Engineer Anything" (https://news.ycombinator.com/item?id=50028275).
corporate incentives turned into a laughing stock :p
It's time to fork it
I wouldn't be surprised if Samsung or Xiaomi eventually forked to make their own "developed in the open" Android.
Though given how little those companies have respected their users so far, I feel like this is a bit of a monkey's paw.
What about OpenHarmony?
Even the big guns like Amazon can't afford keeping up with Google's speed.
8 out of the top 10 manufacturers are Chinese. Google has to be careful here, otherwise Android will end up as a Chinese consortium and their own version will just be available on Pixels.
Or China will migrate to Harmony and drop Android altogether.
Yes that's also a real possibility. The sanctions on Huawei were a terrible idea, it became a laboratory of what could be rolled out on the whole country if needed. Now this work has been done.
Sundar Pichai will need to take a class from Dario in open source fearmongering.
Fork them!
every generation of control freak eventually gets tired of Android as the features that actually have market traction get merged into iOS
just hang up the hat and never look back
At least for now, you can still install arbitrary APKs (after a 24-hour wait period). This alone still puts android leagues and bounds above iOS.
Even better, you can install your own AOSP-based OS that does not track you, will not have a 24 hour waiting period, etc.
That's device specific however. Pixels, yes, but say a Samsung device? Not any more - they nixed bootloader unlocking.
Until iOS lets me run a web browser that isn't WebKit, without geographic restrictions, I'm not interested. It's an absurd restriction.
Being able to have a fully functional version of KDE Connect was also be a requirement.