Okay, I'll just begin with the question and then elaborate a bit below. It is:
Why has the world's dominant maker of non-Apple smartphone operating systems, Google, still not adopted a straight-to-the-user model of distributing security updates for Android, instead sticking with the current, obviously deeply flawed approach of relying on phone makers and wireless carriers to rapidly test, approve, and distribute them? How substantial would the technical obstacles really be in moving Android to the direct-update model if Google genuinely wanted to do it?
So, some additional not-good news came out yesterday regarding the fun Stagefright set of media player-component security bugs in Android. First, some newly-announced flaws in the same component appear to extend the scope of Android phones affected to virtually every one that's ever been made & sold. Second, there are apparently even more flaws in the same component that have been disclosed to Google and that are in the pipeline for public announcement soon, including some that will get a "critical" label. I'm not intimately familiar with the Android security scene, but this certainly seems like it's being held as the most important security event that Android has had to deal with so far.
Of course, the discovery of awful vulnerabilities, on any platform, always leads to the next question: "When is my device going to be patched?" Unfortunately, the way things work now with Android security updates--Google pushes them to hardware makers and carriers, who have to sign-off on off on them and be willing and to distribute the updates to users-- the vast majority of the 1 billion+ Android users can expect only one of two answers:
--For the lucky ones: it will be months. (This report, also linked above, quotes an estimate that it usually takes somewhere from 9-18 months for patches to get from Google to wind their way through testing and various approvals to a user's phone. Now, one assumes that with Stagefright that will be hurried up to some degree, but still...)
--For the unlucky ones: never. (Some Android makers barely provide any post-sale update servicing at all for their phones. Others seem to have an unwritten support period limit of maybe a year, or perhaps two, after which the user is out in the cold.)
All of which raises the question: Why can't Google just do what companies who make operating systems for other computers do--PCs and servers--for example-- and bypass OEMs and service providers to deliver security updates straight to the user?
Now, obviously there are probably both technical aspects to this and business aspects to this. I'm thinking more along the lines of technical aspects (though I admit that sometimes the two are less easy to separate from each other than one might think). In what ways could going to a process of Google directly issuing security updates--but not necessarily directly shipping any updates that involved anything beyond fixing security vulnerabilities--cause problems with hardware and/or software compatibility that could be so troublesome enough for users, phone makers, carriers, and Google itself that that factor could outweigh the value of getting these patches out much more quickly and far, far more widely than they are likely to under the present system? Or is it really a slam dunk in favor of Google going to direct distribution, as 99% of security news reporters & commentators seem to think?