AOSP Source Releases Are So Late Developers Disassemble Libraries to Report Bugs

Re:AOSP Source Releases Are So Late Developers Disassemble L... by izacus on Wednesday October 14, 2026 @04:19AM (#50084153)

I think it's mostly the "you need to monitor CVEs and write report within 24/72 hours" that causes OEMs pain and they prefer to have less work than more.

Also - the reality of what you think is ok and what a corporate legal department think its ok is... rarely the same -_-

[ Parent | on HN ]

Re:AOSP Source Releases Are So Late Developers Disassemble L... by themagic80 on Wednesday October 14, 2026 @06:53AM (#50085578)

Law: please do the minimum to protect users. Corps: screaming

[ Parent | on HN ]

Re:AOSP Source Releases Are So Late Developers Disassemble L... by hommelix on Wednesday October 14, 2026 @10:05AM (#50087984)

This. CRA only means that you need to assess with 24/72h that you are affected or not by a published CVE.

Then there is no time limit to provide a mitigation. It should just be worked out without unnecessary delays. Once a mitigation is published, a report should be submitted with 14 days.

[ Parent | on HN ]