Fun fact: Google actually owns the most commonly used tool, BinDiff ;)
(I'm not saying it happens. I just theorise how the policy could have been envisaged)
I am so sick of security being compromised so stupid, lazy people don't have to do their jobs efficiently. Not like this is even unusual.
So, yes, making a GPL request will work for the very few components still under GPL, if a vendor releases a binary patch. But for most things outside of the kernel, patch diffing comes back into play, just like on every closed-source OS.
That sounds like it costs money and doesn’t net the mfg new sales.
Why wonder at all, it sucks and it's security is generally in shambles. Security is rarely very high on their priorities as features/prettiness is what sells their phones.
1. Release binary-only updates (opt-in). 2. Let the community (a) make GPL source requests for any GPLed components and (b) let the community reverse engineer the vulnerabilities from the binary updates. 3. Publish the source once everything is public anyways.
Which just shows how utterly ridiculous all this is.
To my recollection, they always maintained that being open-source doesn't matter for security, after all
mcflubbins•2h ago
I agree with their points in the thread, but could Graphene "become" an OEM to get access to the security patches sooner? Just curious.
[0] https://grapheneos.social/@GrapheneOS/115164297480036952
evgpbfhnr•2h ago
They just can't make an official release with it, because they can't publish the patch sources (embargoed) and their releases being open-source must match what they published...