> EU regulation majorly backfiring

I wouldn't be surprised if large corporations like Apple and Google intentionally use these tactics to pressure regulators through their European users. Siri AI is a prime example. While it's a complicated issue, I certainly wouldn't put such maneuvers past them.

It's an interesting theory. However, Samsung has already started to roll out One UI 9, which is built on top of Android 17 a month ago, so their clock has already started ticking.

I'm not familiar with the concrete wording of the regulation, but I would wager that the all the customization layers (like "One UI") that OEMs put on top of AOSP is the component for which the update clock should tick, and they should be unaffected of an underlying open source component (AOSP) being released.

As far as I understand, most OEMs are not allowed to release QPR1 or QPR3 either (not that OEMs outside maybe Samsung would be able to). So part of it also reeks of giving Pixel benefits over phones of other manufacturers.

if that is the case then it should be brought to the respective overseen regulatory body, weather it is for them to clarify that this is not a valid interpretation of the law (it's at least clearly in conflict with the spirit of the law) and intentionally delaying public releases this way is a no-go or weather it is to amend the law to make it more explicitly illegal

either way if that is true it looks like a very intentional abuse/misinterpretation of existing regulations

If this is the case, I wonder why isn't Google publicly saying this. Because right now, it looks like they've stopped publishing the sources just because they felt like it, which has understandably generated a lot of backlash, but I feel like all the backlash would go away if they pointed at the EU regulations.

Interesting theory. Is there a distinction between phone release and os release there? I would imagine the time starts when the model goes in sale, not when the os releases.

Otherwise I would expect Google would also wait with pixel updates

I'm not disagreeing with you, and I don't understand the market.

But surely, unless the regulation is written in an especially thoughtless way, the clock would start at either the time the device manufacturer has access to the upstream fix, or the time that the manufacturer provides an update to any of their devices (which implies access to an upstream fix).

So public source release would only impose additional burden on device manufacturers if it is the first time that they are seeing the upstream fix.

Right?

So it's the regulator's fault that a trillion dollar company is acting against the public interest? That's some unproven theory indeed.

I posted about this 11 months ago [1]. The law you are referring to [2] absolutely makes distinctions between open/closed source. This is 100% why Google closed their source and now does security releases privately.

[1]: https://news.ycombinator.com/item?id=45911673

[2]: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ%3AJOL...

> Clause 1.2:

> (6) Operating system updates:

> (a)

> from the date of end of placement on the market to at least 5 years after that date, manufacturers, importers or authorised representatives shall, if they provide security updates, corrective updates or functionality updates to an operating system, make such updates available at no cost for all units of a product model with the same operating system;

> (b)

> the requirement referred to in point (a) shall apply both to operating system updates offered voluntarily by manufacturers, importers or authorised representatives and to operating system updates provided to comply with Union law;

> (c)

> security updates or corrective updates mentioned under point (a) need to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;

> (d)

> functionality updates mentioned under point (a) need to be available to the user at the latest 6 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;

> (e) an operating system update may combine security, corrective and functionality updates.

This is such a bad excuse, if they've released the update on a single phone then the timer would have already started - why delay AOSP after that?

It's Cyber Resilience Act (Regulation (EU) 2024/2847) - if there's a security patch that shows up in public, then the manufacturers are fined if they don't immediately roll it out as an update ("without undue delay").

I think that's the one that made a lot of OEMs pull back on opensource publishing, because their legal departments want to batch the CVE monitoring and reporting obligations into smaller batches.

No, it's not. (source: used to work on Android at Google, and its as simple as it seems, more and more MBA-style management meant more and more didn't care, which meant it was more and more poorly resourced, until it was discovered by revealed preferences that no one cared, at least, no one cared enough to speak up)

> due to a recent EU regulation majorly backfiring

And why should a regulation in EU affect rest of the world. Or for that matter, any US regulation. The arrogance of these nations and the ignorance of tech companies is ruining the entire Internet.