Data didn't just describe the situation, he accurately assessed what is at stake for himself and what the consequences might be. He recognised his life and his entire being may be in real danger. Recognising that requires understanding of the "self", as in Data demonstrated he knows and understands the difference between himself and other beings/things. He is aware that he is a separate being with autonomy, and that this being of self may end. That goes far beyond just describing the situation.
Spring is slow because it scans the classpath, uses reflection and generates proxy classes all at startup. You can avoid some of that using the Spring AOT feature in newer versions.
Or you can just use a different framework like Micronaut which does none of that and uses an annotation processor at compile time instead. (Similar to Spring AOT, with fewer limitations)
Sure, Java is slowly getting most of the features and sometimes even in a better form because they control the runtime (virtual threads arguably just work). But IMO Java is still incredibly verbose, Kotlin's type system is just better and I've genuinely never come across anything that would be easier to do in Java. Even virtual threads can be used from Kotlin.
For me, Java 8 was tolerable. Also used IJ a lot and it hides Java verbosity and reduced a lot of typing. That's why I didn't really see the need to switch. For better or worse, these days I don't even open IJ and just use VSCode + AI Badger mostly to review my changes. Language matters even less.
I would never use the proposed style for Java. This is simpler and easier to understand for anyone with basic knowledge of Java. Readability is more important than fancy features:
Most importantly IMO the JVM ecosystem has lots of solid, battle-tested, enterprise-grade frameworks like Spring and Quarkus, which do all the heavy lifting for those kinds of applications. The code can still be verbose, but that is solved by LLMs, as you said.
Rust has all the individual bits you need as libraries (web server, database access, etc.) but you have to wire it all together yourself. Sure LLMs can do that too, but how do you know the LLM did it correctly? There could be complex interactions between the individual libraries.
Using a complete framework solves that, you know its bits will work together correctly. It also makes the code structure of different applications look more similar, which probably helps LLMs understand it better too.
I'm no expert, but wouldn't a basic hardware firewall that allows incoming, but not outgoing connections solve the issue? Wouldn't even basic VLAN isolation achieve the same?
The humans can still open a TCP connection, SSH tunnel, etc. from the outside to remotely get data out of the training environment. But the agents cannot reach anything outside their isolated network.
Yes it would. It's not perfect like a literal air-gap, but it's the bare minimum. Had the agents breached a real, properly configured firewall product, that would've been a real watershed moment.
I can't prove it, but I still think this is (partly) due to a recent EU regulation majorly backfiring.
I can't remember which one it was, but one of the recent regulations mandates that devices get updates for a certain period. Within that period a manufacturer must provide each update for all their devices in a short timeframe. The intention was to prevent flagships getting updates immediately and lower end devices having to wait months.
However, due to some (also well intentioned) wording about open source, the release of the source code is counted as the first release of an update and starts the timer.
I'm pretty sure Google is delaying public AOSP updates to give their partners (mainly Samsung I suppose) more time to finish building their updates on top of AOSP.
I wouldn't be surprised if large corporations like Apple and Google intentionally use these tactics to pressure regulators through their European users. Siri AI is a prime example. While it's a complicated issue, I certainly wouldn't put such maneuvers past them.
It's funny that they keep trying, it has never once worked. I think US companies are projecting their dislike for regulation and keep being surprised that EU citizens don't agree. We do not love the EU government, but it sometimes does a good thing and we do like these, especially versus the anti-consumer crap that US companies like to pull.
we do not love the EU government because there are billions being poured into promoting the discourse that the EU is a bad thing by both private and state actors.
My problem is the lack of democracy through the too-indirect way that the commission is elected. Von der Leyen was an extremely unpopular and horribly incompetent (at least in charge of defense) minister in Germany, then somehow she became president of the EU commission. Her skill seems to be politicking with other politicians. That would not have gotten her elected in an election by the people.
Right now, "EU washing" unpopular policies is a thing. National (usually corporate) interests can make EU laws happen, and when they have, national politicians say "Sorry, our hands are tied - EU law!". So I'm not at all optimistic that the EU political organization, of all things, will reduce corruption just by getting more power. But I do think that more direct elections to powerful EU positions will improve things.
Sometimes its a good thing that people do not elect directly. They participate indirectly though. And there are general rules to follow. So its more stable framework than full public control each election cycle, because the populism happens and if you want to be elected you cant take unpopular decisions which sometimes are needed.
There are unpopular decisions that are actually good, and those that are simply bad for the population but good for people closer to power. I think the latter are more common in basically any system with too little public oversight.
Indirect democracy is not really a lack of democracy. But I dislike the way it works now as well and would like for EU elections to be more direct. I'd also like to be able to vote for candidates from other member states.
However changes like these are deeply unpopular as they get interpreted as moving more powers to "Brussels" by right wing media.
Because the European Union has come up with shitty laws and regulations.
It mandated USB for charging everywhere, but didn't do a thing about driving on the right side of the road.
We have the digital markets act, yet when someone tries to send emails to some big American email providers, they have to register first, otherwise they don't even make it to the spam folder. But hey, let's have a big round of applause for fining X/Elon Musk and Meta because we hate them. Who cares about decades old protocols and ways of doing things?
Blame the shitty tech companies, the DMA and similar attempts in the USA and many other countries stem from them stacking everything in their favour at the cost of everyone else's money, privacy, security and safety.
It's not like regulators were just bored and felt like fucking shit up, there is a nearly-global consensus these companies are exploiting consumers and markets.
Except that DMA didn't do anything for more fundamental problems like the email problem.
No, they just want to have something to brag about or think they know better (Soviet/communist style). Like, we're lazy and tired of having to carry our proprietary iPhone chargers, we know you're too, let's make USB mandatory.
Don't believe the chargers are a good example. There definitely must be some good ones. But Apple is being anti non-apple consumers (and often anti apple consumers, vide ridiculously expensive monitor stand) for a long time, doing everything to make sure nothing non apple can work well with apple products and vice versa.
I can (actually can't, but for the sake of argument let's pretend) imagine why my wife's Air Pods Pro 3 can't supply heart rate data to my phone for exercising. But why can't they report battery level? ffs
Even if Lightning is better in some aspects (USB-C tongues break sometimes), forcing people to have special cables just for apple devices, when every single thing runs on USB-C, feels like done out of spite. And then? Apple devices don't support any fast charging standard. Spite again.
It's hard to see it differently, but there might be better reasons and arguments that I can't or choose not to see. Probably because I don't love the company that forced poor parents to buy their kids expensive phones just so the kids wouldn't get ostracized for not having green or blue bubble in text messages.
If I don't like the product because of its charging mechanism, not reporting battery level etc, I don't buy it.
> USB-C tongues break sometimes
Unlike barrel chargers which are also simpler. No need for fancy electronics and protocols. Let's not forget non-compliant USB chargers. I remember reading about a Chinese mini-PC manufacturer that sold a computer with a charger which provided 19V or so from the start without any negotiation. Hopefully no one tried to use it with another device.
>Let's not forget non-compliant USB chargers. I remember reading about a Chinese mini-PC manufacturer that sold a computer with a charger which provided 19V or so from the start without any negotiation. Hopefully no one tried to use it with another device.
I actually (or somebody close, friend or family, can't recall) did exactly that. It was a few years ago and I don't remember what got fried. Some small electronics. It was a barrel charger and it fit. Too bad that fitting didn't mean the power levels were ok too.
> I don't like the product because of its charging mechanism, not reporting battery level etc, I don't buy it.
Why shouldn't my wife get headphones because a company is a dick and makes them not work with her husband's phone properly? Looks like a dismissive argument trying to excuse malicious business practices. (I'm not in or from US, maybe that's normal and OK there, so sorry for ranting about it, as it might be fine or even good for you if you're invested in Apple). Anyway, why not buy them, headphones work very well for my wife. Other than price not being adjusted to product performance and quality, AirPods Pro 3 are a very good product. HR reporting is a cool feature. And I don't have bud-type earphones, so I borrow hers for exercising.
Back to "don't buy it if you don't like it" argument: it doesn't argument against apple being dicks for making the product purposefully not work with an Android phone. And if it does, please explain it more clearly, I believe I'm not the only one holding the point of view that it just doesn't exonerate them.
As I see it, it's malicious compliance, as there's no laws YET forbidding what they're doing. (Somebody recently RE'd AirPods BT protocol/calls IIRC and found them reporting battery on non standard ?variable name?. He then got Android phone to show battery level after a small modification.
For comparison, I would bet a beer (I see betting more as gambling) that if Samsung created headphones with HR monitor, I would still be able to see battery level and HR in my Oura app on my OnePlus. And vice versa for 1+ headphones on Samsung. Do you see my point?
And for the record, apple has recently released many phones, both low and high end, that weren't overpriced. And I vehemently oppose anyone whom I'll have to tech support later, getting any phone different than apple - for a non technical user these phones are perfect. Good default's. Non customizable - perfect from point of view of tech support. Just works. Just to show that I'm anti anti consumer conduct, not anti apple.
I bet most people have not read any laws in past year. hell, some have not read any laws in their lives. And no i don't agree that i want fewer laws. By the way, how many laws is enough for you?
Most people don't read any law their entire lifetime and hope for the best.
But are you willing to risk it, if you're trying to do something? It does not even have to be complicated, it can be something as simple as having a website.
Suddenly you have to deal with GDPR and it's not an easy task, otherwise we wouldn't have so many discussions and consultants, not to mention the fact that some websites prefer to just block European users.
The PDF for GDPR has 88 pages [1]. And it's just one thing. The AI act has another 144 pages [2]. Who's gonna read them?
We have civil code for everyday life, do you think people read that? I bet no, but anyway it describes rules by which people live. And when there is disagreement we open a book and see whos right. Do you think we should not have such rule book?
> fining X/Elon Musk and Meta because we hate them.
They were fined because they broke the law. Many consider these fines, a slap on the wrist. Personally I support much harsher and detrimental punishments in such cases.
You misunderstood me. I wasn't saying they didn't break the law, I honestly have no idea if they did. I was only saying that some people like the law because it makes people/companies which they hate (possibly for valid reasons) suffer. In other words they like only the sentence.
I don't think this is any corporate conspiracy. The truth is probably more mundane: regulation is treated as obstacle to navigate around with minimal amount of effort, and not a reason to give up on practices that makes money.
A system that leads to bad outcomes is a bad system.
When your system favors people into power that abuse that position instead of furthering the public interest, that provides a feedback signal leading to ever worse people and outcomes.
There is no need for a "conspiracy" to get to a point where it looks like one.
> It's funny that they keep trying, it has never once worked.
Sure it has. Consider cookie banners: widespread malicious faux-compliance from the start, and approximately nothing was done about it for most of a decade, while people were tricked into believing they were GDPR’s fault. Even now when a little has been done about it, the significant majority of cookie banners are very obviously not compliant with GDPR or ePD requirements, and no consequences occur.
There should be a rule that any assertion of conspiracy must at least have some evidence.
I worked at MS and was involved in several decisions to not ship in the EU because it just wasn’t worth the internal and external regulatory headache. There was no secret agenda, Satya never told me to stick it to the EU by withholding a feature in the hopes the masses would clamor for it and demand regulatory changes, which would eventually allow us to… ship the feature in a decade or so.
I’m super sympathetic to the EU’s intent, but their execution is so obviously self-defeating that it doesn’t take elaborate conspiracies to explain corporate response.
> but their execution is so obviously self-defeating
Well no. It’s not self defeating. It’s being defeated because these are US tech companies, protected by US monopoly power, and the fact that US lawmakers are captured by lobbyists and are incapable of passing similar laws to protect their constituents. Big difference.
> There should be a rule that any assertion of conspiracy must at least have some evidence.
Broadly, I agree, and good grief do I wish people would follow this more often. But Google specifically has acted incredibly anti-competitively for several years now [0], especially regarding Android. This has gone on for such a long time that they have, in my mind, lost the benefit of any doubt.
As they continue to lock down Android [1], things that would have once been met with a "Wait and see" approach are instead met with suspicion and a default assumption that it's primarily (though not typically exclusively) done to serve their own interests.
So generally, yes! That which is asserted without evidence can be dismissed without evidence. However, Google's history is all the evidence I need to assume their actions are not done in good faith.
Giving their partners the time they need to finalise their releases legally seems like a... completely normal and correct thing to do? Why does everything have to be a big conspiracy?
No, not in an open-source project. Nor is it correct to build the project under the guise of open source and then pull the rug from underneath. Or any of the other anti-competitive, anti-consumer, anti-security crap they've been doing lately.
Correct? I suppose that depends on your definition. From a corporate perspective, perhaps. But from a consumer's perspective it's most certainly not the desired outcome.
They don’t have agreements with graphene so what do they care? Google owes graphene absolutely nothing.
They care about their partners and about following the law. Google is not being spiteful here like some commenters are saying; instead, they have changed the way they work to make it compatible with a new law that applies to them.
It’s tiresome to see the same kind of snarky comments in every thread because they are not interesting at all. They are just lazy, and begging for votes.
They're skirting the law and they're likely to be breaking it too - if not on cybersecurity grounds then almost certainly on anti-competitive grounds.
Even if we set legality of their behavior aside, they deserve scorn for how they've been managing Android for the past couple of years - every Android user is worse off because of them. They broke off productive relationships with grapheneos and other projects which contributed patches and reported vulnerabilities upstream, they're engaging in anti-competitive conduct and imposing limits on OEMs, giving Pixel devices preferential access to new APIs.
They're simultaneously putting their own customers (Pixel owners) at risk of known, exploitable security vulnerabilities. They do this to help other OEMs legally skirt (maybe) the 4 month timeframe for patches which is very lax to begin with. Thereby opening a whopping 8 month window where Android users can get hacked by known vulnerabilities.
How cynical do you have to be to defend their stewardship of AOSP?
> Google is not being spiteful here like some commenters are saying; instead, they have changed the way they work to make it compatible with a new law that applies to them
Read the second link I posted above, this is patently false.
Whether it's "right" depends on the goal of course, but in this case I'm not understanding your point because nobody is prosecuting those companies for doing this.
In any case, these kinds of blanket statements are not very useful, because each case tends to be judged on its own merits. For example, yes, enough people believe that monopolistic tactics are not "right" and laws reflect that.
But the goals are clear in this case, no? The regulator said "do X the way we tell you to" and the regulated decided to do Y instead in order not to break the regulation requiring them to do X in a certain way.
Sure, but what precisely is your concern? That people aren't pleased about being caught in the crossfire and are complaining about it, and you want them to stop doing that?
I’m not sure why you’d lump that together here? Motivations and context and the actual facts of a particular situation matter. Nobody has said “no group can ever use their power” which is what you’re hearing. People have said “certain uses of power are morally wrong” which is why the specifics matter.
It's an interesting theory. However, Samsung has already started to roll out One UI 9, which is built on top of Android 17 a month ago, so their clock has already started ticking.
I'm not familiar with the concrete wording of the regulation, but I would wager that the all the customization layers (like "One UI") that OEMs put on top of AOSP is the component for which the update clock should tick, and they should be unaffected of an underlying open source component (AOSP) being released.
A problem with legislation in general is that it is often very open to interpretation. Especially legislation around fast-moving technology fields. It’s very difficult to write both broadly applicable legislation that requires minimal interpretation. And in fact leaving the regulation open to interpretation can be a feature from the point of view of authority.
The only interpretation that matters is that of the Authority of enforcement and judgement. The implementer’s interpretation doesn’t hold much weight.
We can say what we earnestly believe the regulations mean, and how they can be met, but if the authorities say “not good enough” that’s all that matters.
Android 17 is old news, and OneUI 9 was what delayed the OS version bump for months, because Samsung planned to launch it with on new flagships first, during summer Unboxed event.
I posted about this 11 months ago [1]. The law you are referring to [2] absolutely makes distinctions between open/closed source. This is 100% why Google closed their source and now does security releases privately.
> from the date of end of placement on the market to at least 5 years after that date, manufacturers, importers or authorised representatives shall, if they provide security updates, corrective updates or functionality updates to an operating system, make such updates available at no cost for all units of a product model with the same operating system;
> (b)
> the requirement referred to in point (a) shall apply both to operating system updates offered voluntarily by manufacturers, importers or authorised representatives and to operating system updates provided to comply with Union law;
> (c)
> security updates or corrective updates mentioned under point (a) need to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
> (d)
> functionality updates mentioned under point (a) need to be available to the user at the latest 6 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
> (e) an operating system update may combine security, corrective and functionality updates.
(c) and (d) treat binary releases as equivalent to source code releases, so that's rather the opposite of making a distinction between open and closed source. It would serve as an explanation if Google had started to release source code and binaries simultaneously, but it doesn't explain why the source code release is delayed even beyond that.
EDIT: I see that was already brought up multiple times when you posted about it 11 months ago.
As far as I understand, most OEMs are not allowed to release QPR1 or QPR3 either (not that OEMs outside maybe Samsung would be able to). So part of it also reeks of giving Pixel benefits over phones of other manufacturers.
Since they are working with two OEMs (one for GrapheneOS support and one for getting embargoed security patches), I think they know what they are taking about.
Nothing of that has to do with OEMs being forbidden from shipping QPRs though.
Graphene isn't OEM so they don't get access to Android repository before AOSP drops. OEMs - like Motorola for example - do have access to partner repository and can ship QPRs if they wish to do so. Most often OEMs do not want to push updates (and it took years to make them push regular major Android updates).
> I think they know what they are taking about.
Err, if you look at that account you'll find that the person running it has a penchant for overexaggeration and selective truth telling when they feel aggrieved.
Nothing of that has to do with OEMs being forbidden from shipping QPRs though.
Are reading the same post?
“ The new APIs are currently exclusive to the Pixel OS and aren't available to other Android OEMs. […] Non-Google Android OEMs and AOSP-based projects can ship yearly and QPR2 releases.”
the person running it has a penchant for overexaggeration and selective truth telling when they feel aggrieved.
if that is the case then it should be brought to the respective overseen regulatory body, weather it is for them to clarify that this is not a valid interpretation of the law (it's at least clearly in conflict with the spirit of the law) and intentionally delaying public releases this way is a no-go or weather it is to amend the law to make it more explicitly illegal
either way if that is true it looks like a very intentional abuse/misinterpretation of existing regulations
It's not a CRA obligation, but a rule from ecodesign requirements for smartphones (Reg. 2023/1670)
> security updates or corrective updates mentioned under point (a) need to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
Ecodesign is so nice! The vacuum energy reduction requirements that also introduced mandatory of suction power, aside from starting a market trend towards better suction, saved:
- 45 kWh per household per year
- 11.7 TWh of electricity in 2020 EU-wide
Literally just from better designed consumer vacuum cleaners.
How does that prevent them from releasing 17 QPR1 now given that 17 QPR1 is already released "by the operating system provider or on any other product of the same brand"?
The second part explicitly addresses this, Pixels getting QPR1 starts the timer.
My understanding is as follows: They're delaying source code releases for security updates, but they're privately sharing source and binary security updates with partners. Source releases are embargoed, binary releases aren't (I assume it's to avoid triggering the ecodesign clock)
When patches go out to partners in October, they are immediately released by GrapheneOS for users who opt-in for "security preview" releases. Stock Pixel users might get them in December (triggering the ecodesign clock), and other brands could get them as late as April (per ecodesign requirements).
So the timeline could look like:
June: Vulnerability discovered
September: Vulnerability patched
October: Source and binary patch sent to partners. Patch can now be reverse engineered and actively exploited.
October, shortly after: GrapheneOS releases an update with the binary patch
December: Vulnerability is officially part of the December bulletin, Pixel officially gets the update
Not completely. Android Security Bulletins only have fixes for vulnerabilities marked high/critical in resent years. To get all other security fixes, you need QPRs and major releases.
I didn't dispute that they're delaying source code releases for security patches, I only pointed out that these regulations can't explain why they choose not to publish QPR1/QPR3 while publishing QPR0/QPR2.
It's Cyber Resilience Act (Regulation (EU) 2024/2847) - if there's a security patch that shows up in public, then the manufacturers are fined if they don't immediately roll it out as an update ("without undue delay").
I think that's the one that made a lot of OEMs pull back on opensource publishing, because their legal departments want to batch the CVE monitoring and reporting obligations into smaller batches.
Aren’t most OEMs in violation anyway because Linux (as in the kernel) gets regular security patches and most OEMs are on ancient kernel versions?
Also, major Android releases and QPR2s have many security fixes (anything not marked high/critical), yet OEMs are not rolling them out (QPR2) or very late (major releases).
Just to say that OEMs were probably violating the act already before Google started withholding source code.
I also think it’s an attempt of Google closing up AOSP more, otherwise they wouldn’t make it so darn hard to get updated Pixel kernel trees.
I think it's mostly the "you need to monitor CVEs and write report within 24/72 hours" that causes OEMs pain and they prefer to have less work than more.
Also - the reality of what you think is ok and what a corporate legal department think its ok is... rarely the same -_-
This. CRA only means that you need to assess with 24/72h that you are affected or not by a published CVE.
Then there is no time limit to provide a mitigation. It should just be worked out without unnecessary delays. Once a mitigation is published, a report should be submitted with 14 days.
This reminds me of the OpenAI hack against Hugging Face.
Regulators present an impossible goal to the companies to implement, instead of implementing the goal, the companies try to reward hack their way around it.
The end result is that they basically try to make it impossible to know about vulnerabilities because that would start the clock.
But doing timely security updates is not impossible. Apple does it, GrapheneOS does it, Google does it with Pixel, Samsung is nearly doing it on flagships.
But many Android OEMs are probably terrible at software engineering and have their attention spread across multiple SoCs, etc. It’s their own fault.
> But doing timely security updates is not impossible. Apple does it, GrapheneOS does it, Google does it with Pixel, Samsung is nearly doing it on flagships.
What does "timely" here mean? A lot of security patches for all these companies take ~weeks+ to actually make it to customers due to things like QA testing, carrier testing and release processes.
The time between disclosure and release can be rather long, months even for all of them. (I'm counting private disclosure here.)
What does "timely" here mean? A lot of security patches for all these companies take ~weeks+ to actually make it to customers
Google has an embargo period of up to 6 months on AOSP patches. This is why GrapheneOS already has April 2027 AOSP security patches now. Even though some patches are already known for 6 months, they still manage to ship it 1-3 months late. 7-9 months after they got the patches already from Google.
due to things like QA testing, carrier testing and release processes.
Carrier testing is mostly a US thing. If you cannot roll out security patches within a few days, your QA and release processes are just totally broken. GrapheneOS can do it and they generally have far fewer regressions than Android OEMs.
Major releases and QPR2 take some time for testing, but they already have the access to sources months before they are released. Heck, Samsung releases major release betas and QPR2 betas quite a while before Google releases it as stable.
The problem is that the OEMs made a mess. First they just dropped phones on the market without doing any updates at all. Mid 2010s it was very normal for an OEM to do maybe one or two updates. Then Google had to push them to do better, among other reasons because Apple does much better and there were really big fails like Stagefright. Plus users wanted new Android releases. Then they did only 2-3 updates with very irregular software updates. Now they are under pressure from EU regulations and they actually have to support devices for a long time and do regular updates, but they just don't have good release processes. Plus they made their own 'skins' on top of it that they have to rebase, etc.
Companies that have their ducks in a row better, abuse the release process to push sales of new devices. E.g. Samsung withholds major/QPR releases for a while so that only their latest device have it, e.g. recently Fold 8/Flip 8.
People should stop beingapologists for multi-billion dollar companies.
I'm not sure what you're trying to say here - I've mostly said that for the corporations you highlighted, "timely" can still mean months for a given security patch to be deployed as things stand.
That's the reality - yes, even for Apple.
If you think they could and should be better - I guess I agree, but it doesn't change the reality.
Ha ha ha, that'll take spyware to a whole new level. "You're running an old vulnerable version of Android, upgrade today to Android-45.123-robustdonut to get the latest security. Now with 100% genuine AI."
withholding security updates seems to avoid a law which requires rolling out security updates seems very much like something which needs to be fixed one way or another
From what I see [1] if you search for 'undue delay', it's only:
> an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it
> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively
> without undue delay and in any event within 24 hours of the manufacturer becoming aware of it
> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident
"Sorry your honour, we only became 'aware of it' 2 years later, pinky promise ;)".
So any competant authority would have to prove when they 'became aware of it', whatever the test to pass that threshold means.
That’s not true; the only way to be found guilty following a CRA is to conceal the active exploitation of a vulnerability, fail to alert the national coordinator, fail to propose a mitigation within a reasonable timeframe, or be openly negligent in the management of the cybersecurity of one’s products.
“Please stop using this version of my product or this particular feature; it is vulnerable” is an acceptable mitigation measure.
A CVE isn't an active exploitation and don't trigger anything.
nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".
As long as they start the process and it is not absurd from an industry standards perspective, they should be good. They can have slow processes, including being a good bit slower than their peers, without running afoul of "without undue delay".
They have literal 24 hour and 72 hour deadlines. Obviously, they might put a blind eye to it if you are reliable but delayed the reporting by a day, but the 24 hour and 72 hour deadlines are a fact. You have to initiate the reporting immediately.
You are mixing unrelated requirements together here.
> The CRA requires manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of their product with digital elements. They need to submit an early warning within 24 hours of becoming aware, and a full notification within 72 hours.
These deadlines are entirely unrelated to the availability of security fixes and delays in deliverying them.
You are confusing two different articles. The 24-hour deadline relates to notifying the national Computer Security Incident Response Team in the event of the detection of a confirmed exploited vulnerability of one of the manufacturer’s products (Article 14). Submitting a bug report and opening a ticket does not constitute a confirmed exploitation in the wild. Nor does the publication of an exploit or a PoC constitute a confirmed exploitation of the vuln in the wild.
The part that’s probably bothering Google is this:
> 6. Manufacturers shall, upon identifying a vulnerability in a component, including in an open source-component, which is integrated in the product with digital elements report the vulnerability to the person or entity manufacturing or maintaining the component, and address and remediate the vulnerability in accordance with the vulnerability handling requirements set out in Part II of Annex I. Where manufacturers have developed a software or hardware modification to address the vulnerability in that component, they shall share the relevant code or documentation with the person or entity manufacturing or maintaining the component, where appropriate in a machine-readable format.
To put it very simply, the CRA calls on all stakeholders to cooperate in reporting incidents and vulnerabilities, establishes a national coordination mechanism, and aims to address vulnerabilities swiftly in order to maintain essential services within the European Union.
Security flaws are discovered almost every day (now that they are automating it with AI there are a ton of reports), pretending the manufacturer releases an update in 1 day is nonsense.
Just building the code alone it would take a lot of time, and of course you have to test it at least a bit before giving it out to the end users, you can't pretend to rollout on a global scale a nightly build without first at least some level of QA risking bricking user devices.
And you have to consider that phone manufacturer doesn't work h24 and 7/7 of course to give out patches.
I think that we are fortunate if the whole process takes less than a month, not a day.
> nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".
Well, the corporate lawyers think otherwise at those corporations, so I'm not sure how much your interpretation counts :)
I do not believe that any corporate lawyer would think that. It does not read like that in neither plain english nor legalese.
Maybe the misunderstanding stems from the related common misuse of "as soon as possible" as "immediately"?
A corporate lawyer would, however, always suggest to minimize/reduce/delay any legal obligations so as to minimize risk of liability, regardless of whether said obligation is easy to comply with or not.
If this is the case, I wonder why isn't Google publicly saying this. Because right now, it looks like they've stopped publishing the sources just because they felt like it, which has understandably generated a lot of backlash, but I feel like all the backlash would go away if they pointed at the EU regulations.
Interesting theory. Is there a distinction between phone release and os release there? I would imagine the time starts when the model goes in sale, not when the os releases.
Otherwise I would expect Google would also wait with pixel updates
This vicious European Union, which stifles innovation and works against the public interest – for example (checks his notes) by mandating USB-C charging and replaceable batteries!
Google hasn't delayed pushing releases to AOSP but rather stopped pushing Pixel exclusive releases to AOSP. Android 17 QPR1 and Android 17 QPR3 are Pixel exclusive releases which won't be pushed to AOSP under the current policy. For 2/4 quarters per year, Pixels are on a major release of Android exclusive to Pixels and not released to AOSP. Non-Pixel devices don't get QPR1 or QPR3 releases. This is part of Google dropping support for Pixel devices from AOSP and giving them an artificial advantage over other Android devices.
I'm not disagreeing with you, and I don't understand the market.
But surely, unless the regulation is written in an especially thoughtless way, the clock would start at either the time the device manufacturer has access to the upstream fix, or the time that the manufacturer provides an update to any of their devices (which implies access to an upstream fix).
So public source release would only impose additional burden on device manufacturers if it is the first time that they are seeing the upstream fix.
No, it's not. (source: used to work on Android at Google, and its as simple as it seems, more and more MBA-style management meant more and more didn't care, which meant it was more and more poorly resourced, until it was discovered by revealed preferences that no one cared, at least, no one cared enough to speak up)
> due to a recent EU regulation majorly backfiring
And why should a regulation in EU affect rest of the world. Or for that matter, any US regulation. The arrogance of these nations and the ignorance of tech companies is ruining the entire Internet.
Because making things everywhere compliant is cheaper than having both a non-EU and EU versions of software. See also: Brussels effect[0].
It's simple economics. The companies are also allowed to either do special versions to comply with local laws or even to pull out of the market. They just choose not to for reasons.
Sure, American courts ask for age verification, the entire world needs to comply now. Then people wonder why so much surveillance. You can’t see past Brussels effects, because ignorance.
Who says inserting those NOPs didn't break other behaviour that OP isn't using. And then there's also Hyrum's law. This whole thing could be very non-trivial.
Fixing a bug for everyone is very different from fixing the bug just for yourself
And Apple platforms will use Swift until Apple invents a new language, Android still uses Kotlin, C++ will stick around for decades in automotive and aerospace where you need loads of expensive certifications and who knows if we'll ever be rid of COBOL (even with AI rewrites execs might not wanna risk the switch).
Do you have an example of where "the ideas don't combine well"? Or where an imperative approach is truly better?
In my experience the solution is often to use the appropriate architecture underneath your UI layer. Basically you build a data structure that represents your UI and always hand this entire structure to the declarative UI layer. Underneath the UI layer, you can still use imperative code to manipulate the data structures. The benefit of the reactive/declarative approach is that you don't have to think about how changes in the data need to be reflected in the UI. That's the framework's job.
Note: With "data structure" I don't mean "build a shadow DOM". I mean something specialized to your use case.
One example of where I think imperative generally does better is UI that requires substantial setup or customization.
In SwiftUI, that means endless chains of modifiers, and in Compose this means monstrous constructors and modifier chains. Both get really ugly and painful to read quickly, and there's not a lot that can be done about it apart from breaking everything out into smaller views (which only goes so far). The amount of boilerplate saved isn't worth the trade, in my opinion.
In an imperative setup, there's still a lot of code but there are more options for organization, readability, and overall clarity. One can break things up with comments, break out setup into functions with self-explanatory names (that the IDE can then quick jump to, as a bonus), etc.
Yes, it's easier to get tripped up with imperative frameworks if one isn't thoughtful with managing their data, but much of the time that code only needs to be gotten right once.
reply