Security → Re: Is this article FUD?

you may have only seen a couple but my guess would be there were way more. ATT is one of the worst companies when it comes to patching I(wish i kept logs of updates) but i can clearly remember 2 in the past hmm 3ish months and a couple others over the last yearish (may have been last 14 months and i got at least 4.

Another reason you might get fewer is in some cases webview bugs wont effect every phone the same in some cases it may have no effect. Some are carrier specific for one app they pre install. So while i might get 4 in a yearish others may only get 1 or 5 or 2 etc. also interestingly if you install a app not default to your phone you may get fewer because it may some how update web view esp a google made app.

Think of it this way if you do not have fire fox install on your computer you obviously wont need fire fox updates.

If i understand this correctly webview is basically a api and a app might use all of it some of it or none of it. So if the apps you have installed do not use specific features of web view and a bug is found in those feature only then web view wont update. If you have apps that do it will.

Does that make sense?

i know web view but i was saying nill to other updates ...my phone is older.... not expecting anything other than the dity cow update if i'm lucky.
thanks ash

So this went from an MS fud article to Apple vs. Android?

Don't blame me i didn't do it this time i SWARE!!!

He did it »i.dslr.net/nav/w50/12/42 ··· 1242.gif ......

But how can you patch the webview component? That's on the /system partition, nothing can touch that partition except for an OTA update.

The Android webview component is like mshtml.dll on Windows. It's part of the core Windows system and nothing can update that except for an approved update from Microsoft.

it gt patched like latest time was maybe 4 days ago on mine

your wrong about that as of

In older versions of Android (4.3 and below), WebView uses code based on Apple's Webkit %u2014 the same tech behind the Safari browser. In Android 4.4 and above, WebView is based on Chromium, the open-source base of Google Chrome (which uses Google's Blink engine.). In Android 5.0, WebView was broken out as a separate app, presumably to allow timely updates through Google Play without requiring firmware updates to be issued.

After 4.3 it became a seperate app and is patched way more often.

Sorry after 5.0 in 4.4 the code base changed and it was patched more often Left above for transparency as i missed it at first

I stand corrected. But there's more to Android than just WebView. There's the kernel, chipset drivers that are linked to the kernel, etc. If those don't get proper attention from the Android OEMs the system as a whole can be exploited. It's just like if a vulnerability is found in nVidia's graphics card driver, a program can take advantage of the vulnerability and exploit it to gain system level privileges.

This is why devices need proper patching throughout the entirety of the software chain, from the operating system up through the chain to the programs that run on it. The whole system can be broken if one link in the chain is weak.