This is horrible from a usability perspective. Note that large bulk laptop purchasers (schools, large enterprises with mostly web application requirements etc.) have been the biggest markets for chromebook. One of the biggest reasons for that popularity is the lower cost of management of chromebooks compared to windows or mac laptops. In that the base OS not only just works, it also just updates. A huge saving in admin time and headache. The other factor is that all user data is automatically in the cloud, which means backups/restores/replacements/upgrades are trivial operations now.
One way chromebooks can retain this ease of use/administration is by basically shipping a laptop with chrome running on Android OS but no other apps installable by the user (outside of chrome sandbox). This will get Google out of the two OS kernels management business but could still retain the essential goodness of the chromebook concept.
There are quite a few device management solutions out there for Android that can white list, black list, deny all installs of apps. It's very common to setup in business and already completely supported.
It's even far more powerful than that with capabilities to do things like deny certain apps/networks unless you have certain password complexity requirements, etc..
So each app will continue to ask for access to everything and you choose between being info-excluded or giving away your data.
> buy-in from the OEMs to push those patches
How does this work? Is there any legal obligation for manufacturers/vendors to provide these patches in X weeks?
If there isn't then I won't keep my hopes up.
> from moving big parts of the OS to userland so they can be updated separately from the core system
How exactly? By moving from Android to google proprietary apps? If so then this is a two-edged sword as it inevitably binds you to google spyware. Either you own an half-phone or you give away your data.
Sorry if I sound bitter but I see what Android could be and get defeated by what it is.
I never owned an iPhone but my next phone will be one. Maybe I'll still be disappointed, but at least won't have to deal with CM, Xprivacy, manual updates and all the other shenanigans.
Disclaimer: I'm an increasingly disappointed Android user.
I think you might misunderstand what the Marshmallow upgrade will allow. Users will have the ability to turn off any given permission for any given app. Don't want google maps to have GPS access? Cool, just turn it off and the app will have to deal with the lack of information. It's not a Windows model carte blanche per-run thing.
Sure, apps can be abusive and ask for more permissions than they need and refuse to run if they don't have them, but that's a problem with any conceivable permission system.
The OS could give fake data to the apps. Such as a arbitrary GPS location, or an empty contact list.
Famous last words. Take a look at the Android store, it's a wasteland of adware-ridden crap.
If you can't find a calculator app that doesn't require your contacts/GPS, I will personally build one.
Be the change!
Apps under the new model will only ask for permissions when they need it. So, when you decide to post a picture to Facebook, that's when Android asks if you want to give the Facebook app access to your pictures on storage. If you deny it, it lets the app know it doesn't have access. If it's an older app that doesn't understand, it gets fake data as if you had no photos (or no contacts, etc). At least that was my understanding from reading about it.
Note that this security model is similar to web apps wanting to "connect" with you Google account (or Twitter or Facebook for that matter) to access your contacts or similar.
It's disappointing. I saw a Chromebook used by a "normal" person for the first time this week. He loved it. The only benefit for me was the fact you could run Linux in some sense on it, and it was cheap and stealable without too much sadness!
But this merging of browser-OS and insecure Android has signed the death warrant on my devices. Goodbye Samsung and Sony.
When a user has control over updates, the company selling the product carries a relatively low responsibility. When a company does not allow a user to update, then that company carries a much higher responsibility.
If Google provides a security update and a company refuses to update their devices (or allow users to update), then that company has a lot to lose.
The Android ecosystem would be a lot better off if there were a couple large class-action lawsuits with big payouts. Companies really don't care until it hits their bottom line.
I surely won't pay what Google is asking for their devices, given lack of SD card and changeable battery.
Plus, they also proved they aren't trustworthy by not providing a path for those that gave them money for the Nexus with TI processor. As if Google didn't had the money to keep supporting them.
"What about security updates for my phone?" The hurdle is jumped, and the patron has the Google horse land on them, causing death