It's funny that they keep trying, it has never once worked. I think US companies are projecting their dislike for regulation and keep being surprised that EU citizens don't agree. We do not love the EU government, but it sometimes does a good thing and we do like these, especially versus the anti-consumer crap that US companies like to pull.

They absolutely do this.

It can't ever just be the fault of the regulation, of course.

There should be a rule that any assertion of conspiracy must at least have some evidence.

I worked at MS and was involved in several decisions to not ship in the EU because it just wasn’t worth the internal and external regulatory headache. There was no secret agenda, Satya never told me to stick it to the EU by withholding a feature in the hopes the masses would clamor for it and demand regulatory changes, which would eventually allow us to… ship the feature in a decade or so.

I’m super sympathetic to the EU’s intent, but their execution is so obviously self-defeating that it doesn’t take elaborate conspiracies to explain corporate response.

Giving their partners the time they need to finalise their releases legally seems like a... completely normal and correct thing to do? Why does everything have to be a big conspiracy?

Android 17 is old news, and OneUI 9 was what delayed the OS version bump for months, because Samsung planned to launch it with on new flagships first, during summer Unboxed event.

the more I learn about how Google handles releases the more this looks like there being a need for anti trust actions

> As far as I understand, most OEMs are not allowed to release QPR1 or QPR3 either (not that OEMs outside maybe Samsung would be able to).

This is not true at all though. OEMs can release anything whenever they want.

What makes you think it’s misinterpretation?

(c) and (d) treat binary releases as equivalent to source code releases, so that's rather the opposite of making a distinction between open and closed source. It would serve as an explanation if Google had started to release source code and binaries simultaneously, but it doesn't explain why the source code release is delayed even beyond that.

EDIT: I see that was already brought up multiple times when you posted about it 11 months ago.

This vicious European Union, which stifles innovation and works against the public interest – for example (checks his notes) by mandating USB-C charging and replaceable batteries!

That’s not true; the only way to be found guilty following a CRA is to conceal the active exploitation of a vulnerability, fail to alert the national coordinator, fail to propose a mitigation within a reasonable timeframe, or be openly negligent in the management of the cybersecurity of one’s products.

“Please stop using this version of my product or this particular feature; it is vulnerable” is an acceptable mitigation measure.

A CVE isn't an active exploitation and don't trigger anything.

Aren’t most OEMs in violation anyway because Linux (as in the kernel) gets regular security patches and most OEMs are on ancient kernel versions?

Also, major Android releases and QPR2s have many security fixes (anything not marked high/critical), yet OEMs are not rolling them out (QPR2) or very late (major releases).

Just to say that OEMs were probably violating the act already before Google started withholding source code.

I also think it’s an attempt of Google closing up AOSP more, otherwise they wouldn’t make it so darn hard to get updated Pixel kernel trees.

nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".

As long as they start the process and it is not absurd from an industry standards perspective, they should be good. They can have slow processes, including being a good bit slower than their peers, without running afoul of "without undue delay".

From what I see [1] if you search for 'undue delay', it's only:

> an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it

> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively

> without undue delay and in any event within 24 hours of the manufacturer becoming aware of it

> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident

"Sorry your honour, we only became 'aware of it' 2 years later, pinky promise ;)".

So any competant authority would have to prove when they 'became aware of it', whatever the test to pass that threshold means.

[1]: https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng

Because making things everywhere compliant is cheaper than having both a non-EU and EU versions of software. See also: Brussels effect[0].

It's simple economics. The companies are also allowed to either do special versions to comply with local laws or even to pull out of the market. They just choose not to for reasons.

[0]: <https://en.wikipedia.org/wiki/Brussels_effect>

We are already there and it is called Play Integrity (meets STRONG integrity) and Google is trying to get apps to use it to shut out competitors. They are succeeding to some extend (see the Volkswagen and IKEA Smart Home apps as recent successes for Google).

Google should not be allowed to abuse its duopoly position in this way. I recommend EU citizens to report every case they are (potentially) affected by to the EU DMA team.

If AI is good enough to find RCE in google code, maybe it can crack TPM

This ideea haunts me in my nightmares.

Is your theory really that closed source software will just stop being developed? I can't find another way to read that, but you can't think Google is just going to give up and shut down, right?

AI's pretty good at copying features even when it's closed, or online.

Not perfect, of course. All that hype about the vibe-cloned Adobe suite is, today, hype. Next year it might not be, though that depends on questions like "will investment bubble pop?" etc.

But we are at a level where, if you can describe a feature or process well enough to test it, an LLM can develop and optimise for that feature/process. That creates opportunities for businesses to have custom just-for-them business software, which nobody copies because nobody outside the business even bothers to learn exist.

Why use proprietary software when there is opensource one ?

You think open source never develops new features?

The only thing that made commercial software more innovative is most developers never had time to build and maintain a big open source project without support from their job. Now we have agents and it takes a lot less time to implement your ideas. That means slop filling up GitHub, but also that people who came up with good new features can make them real in their free time.

ReSkate is a good example, it's a project 90% coded by AI but the people working on it are passionate and most of them are experienced game modders. They know what made the old Skate games special and wanted to bring it back to the new one. Now it's better than vanilla Skate 4 and has tons of new features never seen in the OG trilogy. That project would never be possible without Claude taking care of the hard and boring RE work.

> Most google devices have an unlockable bootloader.

But that's not the case for other manufacturers, including ones way more popular than Google. Especially Samsung.

On average, a new Android device is almost as locked as iPhone is.

Yeah, while I am loathe to trust Google again, will never be buying another Apple hardware again too - I used an alternative map app on an old iDevice and wrote them a 5-star review for their good features, for being better than Apple and Google maps (in some aspects) and especially for still supporting older devices. A new update for the app was released and suddenly I couldn't install it because App Store reported that my ios was outdated and not compatible with the new release. So I revised the review for the app to 2-stars pointing out they had suddenly dropped support for older iDevices which was one of their main attractive features. The developers of the app contacted me asking me to reconsider the review. According to them, they had released the latest update for the app for the "outdated" ios version / older iDEvices too, but Apple deliberately sat on it without approving it for the App store. According to them, Apple hasn't clarified the issue. If the developers are being truthful (and I do believe them), this is a deliberate and malicious act by Apple to push planned obsolescence of older iDevices.

They exist. But they don't support Android apps that are unfortunately necessary. For example, any phone without WhatsApp or banking apps support is dead on arrival in Europe.

How are /e/OS, GrapheneOS, or LineageOS alternatives?

Google can kill them in an instant, they need the AOSP source to survive.

Though, as the narcs are quick to point out, Android 'is' Linux.

So really, the alternative is proper GNU/Linux (or as I've recently taken to calling it...)

Related recent discussion: https://news.ycombinator.com/item?id=50051530

Yes, let's throw away a fully mature smartphone OS (AOSP) and replace it by something that does not even have proper app sandboxing. /s

The alternative are other AOSP-based OSes like GrapheneOS and Lineage. Once they are used widely enough and funded enough, they could fork AOSP when needed. In some sense they have already soft-forked in that they use major and QPR2 releases, but put a lot of patches on top to fix issues, improve security, etc.

GrapheneOS has an estimated 500,000 active installs now, apparently LineageOS has 1.4M active installs. Probably around two orders of magnitude more than traditional Linux desktop-based phones, which have been trying since, checking notes, Maemo in 2005?

Harmony is just another closed-down ecosystem controlled by a single company. It's already worse than Android with its late source releases.

It might become independent if they manage to fork it.

Yeah, you could get 95% of the way there with binary diffing

What makes you think Samsung or Xiaomi care about a “developed in the open” Android? Do they even open source any of their flavors?

What about OpenHarmony?

It is not that complex, and now that AI has gotten good it's gotten even easier.

This is so wrong. First off Linux. Secondly even among Android competitors, HarmonyOS.

8 out of the top 10 manufacturers are Chinese. Google has to be careful here, otherwise Android will end up as a Chinese consortium and their own version will just be available on Pixels.

Even better, you can install your own AOSP-based OS that does not track you, will not have a 24 hour waiting period, etc.

You can install third party stores and apps on iOS without a waiting period (in places with decent consumer rights); confirming three popups is all you need to install third party iOS apps.

Unlike on Android, there aren't that many third party iOS apps, though.

Plus, even with Google delaying shipping source code, at least they ship the source code. The traces of source you get with the open Darwin code are nowhere near comparable.