Google set the time frame and gave the go ahead for public disclosure based on their work with the manufactures.

>I think about how manufacturers drag their feet on normal updates

They do release security updates. (Or at least used to -- I haven't paid attention lately.)

The major upgrades change and break lots of shit for them. A backported security update generally does not.

Not really. Three months is common.

Well he's got to create some publicity for the Blackhat presentation. Though I only bought it in March, I know my android phone has downloaded several system updates since then. It isn't clear to me from TFA precisely how the signature validation process was broken, and I'm not familiar enough with Android architecture to be sure this is possible, but it seems like the validation for un-hacked devices should have been fixed by now.

I think Google itself sets a higher bar than even 5 or 3 months for other companies and itself.

http://www.darkreading.com/vulnerability/google-sets-new-agg...

Those are for bugs that are "under attack", where it's important that those being attacked have the information necessary. There's no evidence that this is being exploited in the wild (at this point).

"Under attack" allows people to distort reality as much as they want for their own benefit. Google sure looked like a tough cookie by disclosing bugs in 7 days and now it gets a pass.