security update workflow

[linuzzz]

Hi all,

I have a doubt related to the security update procedures in the android "ecosystem"...let's suppose that a bug is discovered in a google application (gmail, calendar...) and that google will fix it "immediately". When I will receive this update? Should I wait for an update from my mobile manufacturer, or maybe from my carrier? How can I verify if the running application is the "latest one" with this security bug fixed or not?

I'm asking this thinking at the problem of the auth token transmitted in clear for some application, gcalendar for example, I know that google fixed it but I don't know how can I verify if my phone received this fix.

many thanks
Paolo

 

[wayrad]

Isn't that the one that got fixed in Android version 2.3.4? So you would just look at what Android version you're running, and if your phone hasn't been officially updated to 2.3.4, your options would be to wait, get a new phone, or root and install an updated custom Gingerbread ROM.

 

[jerofld]

Even most new phones are rolling out with 2.3.3. But didn't Google do a silent fix and push it to all phones?

 

[takeshi]

I have a doubt related to the security update procedures in the android "ecosystem"...let's suppose that a bug is discovered in a google application (gmail, calendar...) and that google will fix it "immediately". When I will receive this update? Should I wait for an update from my mobile manufacturer, or maybe from my carrier? How can I verify if the running application is the "latest one" with this security bug fixed or not?

Gmail's an app and is updated via the Market. You can compare the installed version to the version on the Market.

Calendar is part of the OS (or UI, depending on device). OS updates generally go through the carrier. The Nexus line, IIRC, is different in that they receive updates directly.

 

[linuzzz]

Gmail's an app and is updated via the Market. You can compare the installed version to the version on the Market.

Calendar is part of the OS (or UI, depending on device). OS updates generally go through the carrier. The Nexus line, IIRC, is different in that they receive updates directly.

so, also if google suddenly fix a vulnerability this is not enough for the final user?
I think that google/manufacturers/carriers should work togheter to guarantee the final user, security will be even more critical for android success in next years...what do You think about it?

I didn't receive any update from my carrier, so I suppose I'm still running an old version...

many thanks
Paolo