Android endlessly updates directly from Google Play Services (bypassing carriers & OEMs)

[Robin Goodfellow]

In keeping with the push toward essentially perpetually updating the core OS
components of Android phones frequently for security "Google says it added
12 new modules that can be updated directly from the Play Store" in Android
11 according to https://www.androidcentral.com/android-11-review

Do you know which Android modules are now indefinitely frequently updated?
(ie they're independently evermore updated outside the carrier & OEM)

[Jim S]

Your point?
--
Jim S

[Robin Goodfellow]

Jim S <j...@jimXscott.co.uk> asked

>> Do you know which Android modules are now indefinitely frequently updated?
>> (ie they're independently evermore updated outside the carrier & OEM)
>
> Your point?

We can't claim we know how Android is updated if we don't know the answer to
the question or if we don't even understand what the question is asking.

However maybe I wasn't clear so I'll be more explicit because it would be
very useful to know which core operating system modules are updated directly
with no carrier and no OEM involved in that process.

To be clear, it's well known the OEMs and the carriers update the Android
operating system version about yearly they update security about montly
(give or take) for about three or four years.

It's far less well known that Google updates a huge portion of the Android
operating system independently of the OEMs and of the carriers - and Google
updates these components multiple times a month essentially ad infinitum.

I'm just asking if anyone knows more about Android than I do in that they
may know which core Android OS modules are updated by Google DIRECTLY in
those frequent security updates.

If we don't know the answer to this basic question then we know nothing of
how Android is updated because this is a key part of how Android is updated.

[Anssi Saari]

Robin Goodfellow <Ancient...@Heaven.Net> writes:

> In keeping with the push toward essentially perpetually updating the core OS
> components of Android phones frequently for security "Google says it added
> 12 new modules that can be updated directly from the Play Store" in Android
> 11 according to https://www.androidcentral.com/android-11-review

Interesting. This usually also means the modules become closed source
and the open source versions receive no further updates.

> Do you know which Android modules are now indefinitely frequently updated?
> (ie they're independently evermore updated outside the carrier & OEM)

No.

[Carlos E.R.]

On 01/05/2021 11.04, Anssi Saari wrote:
> Robin Goodfellow <Ancient...@Heaven.Net> writes:
>
>> In keeping with the push toward essentially perpetually updating the core OS
>> components of Android phones frequently for security "Google says it added
>> 12 new modules that can be updated directly from the Play Store" in Android
>> 11 according to https://www.androidcentral.com/android-11-review
>
> Interesting. This usually also means the modules become closed source
> and the open source versions receive no further updates.

I don't see how/why would that be.



--
Cheers, Carlos.

[Anssi Saari]

That's really your problem. It's what is, whether you see it or not.

If you meant to nitpick, I'd rephrase as "... the open source versions
receive no further updates *from Google* while the close source versions
will be further developed by Google." Anyone who forks AOSP is free to
make any updates they please, of course.

[Carlos E.R.]

I'm not nitpicking, I'm asking a serious question.

Why would that be?

Why would be any version changed from open source to closed source?


The software originates at google. The manufacturers took that software,
maybe changed/adapted it, then published the actual updates for us.

Now Google bypasses the manufacturers and send the updates to us,
directly. Why would they change their own software to closed source? How
do you know this? Why would they do this, what purpose?


--
Cheers, Carlos.

[Robin Goodfellow]

Anssi Saari <a...@sci.fi> asked

>> Do you know which Android modules are now indefinitely frequently updated?
>> (ie they're independently evermore updated outside the carrier & OEM)
>
> No.

Thanks for telling the truth. ';-\
Sadly I don't think anyone here knows how Android is really updated.

Certainly I don't.

This thread is an attempt to rectify our lack of Android update knowledge.
In Android 11 there are a dozen more than there were before is all we know.

I don't think any of us can claim to know how Android is updated if we don't
know the answer to the question of which Android core OS modules are updated
this way. Least of all me. Yet anyway. ';-\

Maybe this Projecte Mainline reporting app can help?
https://play.google.com/store/apps/details?id=com.arumcomm.mainlineupdater
"With this app, you can check for update of Android core OS components of
your Android device. You can also confirm the installed list of the
components in your device."

I tried to download that Arum Communications Mainline Updater but it doesn't
show up in my Android 11 Google Play (I'll have to get it separately).

The information talks about "Project Mainline" (or "Project Treble"?)
https://android-developers.googleblog.com/2019/05/fresher-os-with-projects-treble-and-mainline.html

Apparently the Android 10 & Android 11 core OS updates are described here
https://android-developers.googleblog.com/2019/05/fresher-os-with-projects-treble-and-mainline.html

"Mainline components are delivered as either APK or APEX files. APEX is a
new file format we developed, similar to APK but with the fundamental
difference that APEX is loaded much earlier in the booting process."

If we don't know about this stuff we have no business claiming we understand
how Android is updated nowadays.

"Project Mainline enables us to keep the OS on devices fresher, improve
consistency, and bring the latest AOSP code to users faster. Users will get
these critical fixes and enhancements without having to take a full
operating system update."

But we still don't know which core OS components update in Project Mainline.

[cris]

On 01/05/2021 12:49, Carlos E.R. wrote:

> The software originates at google. The manufacturers took that software,
> maybe changed/adapted it, then published the actual updates for us.
>
> Now Google bypasses the manufacturers and send the updates to us,
> directly.

I think it's a good idea Android now releases security updates without the
middleman of the manufacturers (who were too slow in pushing their updates).

Microsoft has been doing that for a long time, haven't they?
Probably even Linux perhaps (with updates to the kernel anyway)?

It's such a good idea to bypass the OE middleman that even Apple is recently
rumored to be considering following Android's lead in separating core OS
security updates from the iOS operating system (as of this month anyway).

�OS security fixes could soon be delivered separately from other updates, beta code suggests
https://9to5mac.com/2021/03/15/ios-security-fixes-could-soon-be-delivered-separately-from-other-updates-beta-code-suggests/

Apple could soon deliver iOS security updates independent from other updates
https://www.xda-developers.com/apple-ios-security-patch-release/

�pple iOS 14.5 code suggests security updates may be offered separately in the future
https://www.phonearena.com/news/Apples-iOS-14.5-code-points-to-security-updates-being-offered-separately-from-the-rest_id130766

[Robin Goodfellow]

Anssi Saari <a...@sci.fi> asked

> Anyone who forks AOSP is free to
> make any updates they please, of course.

This says the separation of coreOS is a boost to that AOSP effort
https://www.xda-developers.com/android-q-project-mainline-security/

They also mention APEX is perhaps yet another boon to the AOSP effort.
https://www.xda-developers.com/android-q-apex-biggest-thing-since-project-treble/

In fact almost everything about Project Mainline mentions AOSP benefiting
https://9to5google.com/2020/11/25/android-runtime-to-become-mainline-module-in-android-12/

But before we can proceed on your AOSP tangent we should first know which 25
modules are considered core OS update modules in Google Project Mainline.

This is a year old but it has about half of the Project Mainline modules
https://beebom.com/what-google-play-system-update-android/

Using keywords in that list I finally found the 25 coreOS modules!
https://www.xda-developers.com/android-project-mainline-modules-explanation/

APK Captive Portal Login -> com.google.android.captiveportallogin
APK Documents UI -> com.google.android.documentsui
APK ExtServices -> com.google.android.ext.services
APK Module Metadata -> com.google.android.modulemetadata
APK Network Stack Components -> com.google.android.networkstack
APK Network Stack Permission Configuration ->
com.google.android.networkstack.permissionconfig
APK Permission Controller -> com.google.android.permissioncontroller
APK Telemetry Train Version Package -> com.google.mainline.telemetry

APEX Android Neural Network API Runtime -> com.google.android.neuralnetworks
APEX Cell Broadcast -> com.google.android.cellbroadcast
APEX Conscrypt -> com.google.android.conscrypt
APEX dbd -> com.google.android.adbd
APEX DNS Resolver -> com.google.android.resolv
APEX ExtServices -> com.google.android.extservices
APEX IPsec/IKEv2 Library -> com.google.android.ipsec
APEX Media Codecs -> com.google.android.media.swcodec
APEX Media Framework Components -> com.google.android.media
APEX Media Provider -> com.google.android.mediaprovider
APEX Permission Controller -> com.google.android.permission
APEX SDK Extensions -> com.google.android.sdkext
APEX Statsd -> com.google.android.os.statsd
APEX Tethering -> com.google.android.tethering
APEX Time Zone Data -> com.google.android.tzdata
APEX Time Zone Data 2 -> com.google.android.tzdata2
APEX Wi-Fi3 -> com.google.android.wifi

[Gronk]

Carlos E.R. wrote:

>> Interesting. This usually also means the modules become closed source
>> and the open source versions receive no further updates.
>
> I don't see how/why would that be.

It's not.
<https://venturebeat.com/2019/05/08/google-details-project-mainline-updating-android-modules-via-google-play/>

"Google plans to keep Project Mainline source code for the modules in AOSP
and to fully open-source each update after release. Partners and the global
developer community will be able to contribute improvements and bug fixes."

[Carlos E.R.]

On 01/05/2021 20.03, cris wrote:
> On 01/05/2021 12:49, Carlos E.R. wrote:
>
>> The software originates at google. The manufacturers took that software,
>> maybe changed/adapted it, then published the actual updates for us.
>>
>> Now Google bypasses the manufacturers and send the updates to us,
>> directly.
>
> I think it's a good idea Android now releases security updates without the
> middleman of the manufacturers (who were too slow in pushing their updates).

Not only slow, but that they stop after very few years. It could be
good. But the customization done by the manufacturers would be lost, on
those pieces at least.

I don't understand how they are going to do it.

>
> Microsoft has been doing that for a long time, haven't they?
> Probably even Linux perhaps (with updates to the kernel anyway)?

Linux is different. The developers upstream only publish the source;
originally, everybody would have to compile everything at home or the
office.

Soon appeared people and organizations doing that compiling job, plus
the job of collecting all the pieces from every source (thousands of
them). It is not a single source as Android has.

> It's such a good idea to bypass the OE middleman that even Apple is recently
> rumored to be considering following Android's lead in separating core OS
> security updates from the iOS operating system (as of this month anyway).
>
> ���OS security fixes could soon be delivered separately from other updates, beta code suggests
> https://9to5mac.com/2021/03/15/ios-security-fixes-could-soon-be-delivered-separately-from-other-updates-beta-code-suggests/
>
> Apple could soon deliver iOS security updates independent from other updates
> https://www.xda-developers.com/apple-ios-security-patch-release/
>
> ���pple iOS 14.5 code suggests security updates may be offered separately in the future
> https://www.phonearena.com/news/Apples-iOS-14.5-code-points-to-security-updates-being-offered-separately-from-the-rest_id130766

--
Cheers, Carlos.

[Carlos E.R.]

Aha.

Ok, I understand that to the "users" they have to publish the ready to
install code, so that the phones automatically install it, but they also
publish the source code for anybody to see.

Makes sense.

--
Cheers, Carlos.

[cris]

On 01/05/2021 13:05, Carlos E.R. wrote:

> Not only slow, but that they stop after very few years.

Android updates only one set of Android components via the manufacturers.
The other sets of Android key components NEVER stop updating (essentially).
And most of those are constantly updated on a cadence train about weekly.

> It could be
> good. But the customization done by the manufacturers would be lost, on
> those pieces at least.

Have you really ever needed the customizations added by manufacturers?

> I don't understand how they are going to do it.

Very few people do.
Particularly the Apple people don't have a clue how bad iOS updates are.
Compared to Android.

Most of the manufacturers still push yearly Android updates for a while.
And these manufacturers still push out (about) monthly updates for years.

What's new in Android 10 is Google pushes out frequent core OS updates.
And they do that for as far as we know ad infinitum (until the end of time).

Also unlike iOS updates to key apps like Safari, Google pushes out updates
many times a month to the dozen or so key apps (YouTube, Chrome, Play, etc).

Again essentially for far longer than does Apple update its key apps.
People don't know this stuff because they only know what Apple tells them.

And what Apple doesn't tell them is that Android updates more frequently
and for longer periods of time for both core OS & key apps than does iOS.

>> Microsoft has been doing that for a long time, haven't they?
>> Probably even Linux perhaps (with updates to the kernel anyway)?
>
> Linux is different. The developers upstream only publish the source;
> originally, everybody would have to compile everything at home or the
> office.
>
> Soon appeared people and organizations doing that compiling job, plus
> the job of collecting all the pieces from every source (thousands of
> them). It is not a single source as Android has.

When I used Linux I would run a command to "update all" and it would run for
seemingly a long time updating a bazillion core components.

Isn't that similar in what Google is doing with the Android core functions?
And isn't Microsoft updating Windows 10 core OS monthly with Patch Tuesdays?
https://en.wikipedia.org/wiki/Patch_Tuesday

It makes sense updating core OS components frequently outside the OS itself.

[Carlos E.R.]

On 01/05/2021 21.49, cris wrote:
> On 01/05/2021 13:05, Carlos E.R. wrote:
>
>> Not only slow, but that they stop after very few years.
>
> Android updates only one set of Android components via the manufacturers.
> The other sets of Android key components NEVER stop updating (essentially).
> And most of those are constantly updated on a cadence train about weekly.
>
>> It could be
>> good. But the customization done by the manufacturers would be lost, on
>> those pieces at least.
>
> Have you really ever needed the customizations added by manufacturers?

I don't know, this instant :-)

I use a Motorola, which does few customizations. Initially I had a
Samsung which does a lot.

>
>> I don't understand how they are going to do it.
>
> Very few people do.
> Particularly the Apple people don't have a clue how bad iOS updates are.
> Compared to Android.
>
> Most of the manufacturers still push yearly Android updates for a while.
> And these manufacturers still push out (about) monthly updates for years.
>
> What's new in Android 10 is Google pushes out frequent core OS updates.
> And they do that for as far as we know ad infinitum (until the end of time).
>
> Also unlike iOS updates to key apps like Safari, Google pushes out updates
> many times a month to the dozen or so key apps (YouTube, Chrome, Play, etc).
>
> Again essentially for far longer than does Apple update its key apps.
> People don't know this stuff because they only know what Apple tells them.
>
> And what Apple doesn't tell them is that Android updates more frequently
> and for longer periods of time for both core OS & key apps than does iOS.

I really don't care about Apple, so don't tell me what they do or don't :-)

>
>>> Microsoft has been doing that for a long time, haven't they?
>>> Probably even Linux perhaps (with updates to the kernel anyway)?
>>
>> Linux is different. The developers upstream only publish the source;
>> originally, everybody would have to compile everything at home or the
>> office.
>>
>> Soon appeared people and organizations doing that compiling job, plus
>> the job of collecting all the pieces from every source (thousands of
>> them). It is not a single source as Android has.
>
> When I used Linux I would run a command to "update all" and it would run for
> seemingly a long time updating a bazillion core components.

Yes. Depends on what distro you use.

> Isn't that similar in what Google is doing with the Android core functions?

No. The update tools download updates prepared by your distribution, in
binary form, not from "upstream" which typically only prepare source
code. It is up to your distribution what updates they will select and
prepare.

> And isn't Microsoft updating Windows 10 core OS monthly with Patch Tuesdays?
> https://en.wikipedia.org/wiki/Patch_Tuesday

Yes.

>
> It makes sense updating core OS components frequently outside the OS itself.

--
Cheers, Carlos.

[cris]

On 01/05/2021 18:02, Carlos E.R. wrote:

>> Have you really ever needed the customizations added by manufacturers?
>
> I don't know, this instant :-)
>
> I use a Motorola, which does few customizations. Initially I had a
> Samsung which does a lot.

I've had them all it seems over time (I get a new phone about yearly).
I do my own customizations by adding whatever software I need.

The crap the manufacturers put on these phones is atrocious IMHO.
I've NEVER seen an app from the manufacturers that I couldn't do better.

> I really don't care about Apple, so don't tell me what they do or don't :-)

It bothers me how stupid the Apple people are when they condemn Android.
You did the same without understanding that Android is better than you said.

Key components of Android are updated multiple times a month indefinitely.
Dozens of core components of Android are updated about monthly for years.

But most people don't know how often and how long Android is updated.
They think it's only updated once a year (if that) which is just dead wrong.

While the iPhone owners are the most clueless, lots of Android users are
also unaware that about three dozen core components of Android are updated
constantly and for very long periods of time (much more than just 5 years).

>> When I used Linux I would run a command to "update all" and it would run for
>> seemingly a long time updating a bazillion core components.
>
> Yes. Depends on what distro you use.

I've used Redhat and Debian distros which worked (essentially) the same.
This is my point that most (if not almost all) OS's update the same way.

You break the OS into components and update them separately.
Only once in a while (about yearly) do you update the entire OS in one shot.

All during the year weekly and monthly you update the component parts.

I bring up iOS because it's the only OS that doesn't update component parts
frequently and forever like all other OSs do as a matter of design & habit.

>> Isn't that similar in what Google is doing with the Android core functions?
>
> No. The update tools download updates prepared by your distribution, in
> binary form, not from "upstream" which typically only prepare source
> code. It is up to your distribution what updates they will select and
> prepare.

It has been a while but from memory every once in a while I used to initiate
updates/upgrades en masse on Redhat and Debian systems almost the same way.

sudo apt update && sudo apt upgrade -y
sudo yum updateinfo list security && sudo upgrade

The point is that "someone" prepares the patches and the user adds them.
With minor differences that's what ALL operating systems do.

AFAICT there are five components to an Android phone that are updated.
The main manufacturers update Android roughly about yearly for a few years.
Main manufacturers update the about monthly patches for a few years also.
Google updates two dozen core OS components a few times a month forever.
Google also updates about a dozen key apps a few times a month forever.
The rest of your apps are forever updated asynchronously on their schedules.

That's how Android updates (which most people don't seem to understand).