alt Hacker NewsHow does that prevent them from releasing 17 QPR1 now given that 17 QPR1 is already released "by the operating system provider or on any other product of the same brand"?
The second part explicitly addresses this, Pixels getting QPR1 starts the timer.
QPR and security updates are different things.
My understanding is as follows: They're delaying source code releases for security updates, but they're privately sharing source and binary security updates with partners. Source releases are embargoed, binary releases aren't (I assume it's to avoid triggering the ecodesign clock)
When patches go out to partners in October, they are immediately released by GrapheneOS for users who opt-in for "security preview" releases. Stock Pixel users might get them in December (triggering the ecodesign clock), and other brands could get them as late as April (per ecodesign requirements).
So the timeline could look like:
June: Vulnerability discovered
September: Vulnerability patched
October: Source and binary patch sent to partners. Patch can now be reverse engineered and actively exploited.
October, shortly after: GrapheneOS releases an update with the binary patch
December: Vulnerability is officially part of the December bulletin, Pixel officially gets the update
January: Samsung releases the update
April: Everyone else (legal worst case)