GrapheneOS accuses Google of deliberately restricting access to Android 17 QPR1 features and security fixes, saying the September Pixel Drop introduced developer APIs and changes that were not made available via AOSP. That marks, according to GrapheneOS, the first time since Honeycomb that new APIs landed without being upstreamed for everyone. Although Google published developer documentation and provided QPR1 GSI builds for developers, GrapheneOS reports it ported its code to QPR1 before release but lacks permission to distribute those changes, forcing the project to backport Pixel firmware, kernel drivers, userspace drivers, and HALs into Android 17 instead.
GrapheneOS also calls out Google for including additional security patches in the Pixel Update Bulletin that are absent from the standard Android Security Bulletin and OEM preview patches, asserting some of those fixes affect platform components used broadly across Android devices. The project warns this practice gives Pixel phones an advantage and makes Pixels harder for third-party projects to support. GrapheneOS says OEMs and AOSP-based projects will likely only receive those platform fixes with Android 17 QPR2 in December, and notes an upcoming Motorola partnership could ease future device support by providing official firmware and driver code.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A campaign targeting prominent Rust developers and crate owners is attempting to compromise devices and accounts to distribute malware. Rust advises increased caution, suspiciousness of cold contacts, and account security checks to mitigate risks. (blog.rust-lang.org)
Hackers exploited two vulnerabilities, including a heap buffer overflow and an SSO misconfiguration, to access OpenAI employees' ChatGPT accounts and internal repositories. The attack demonstrated how quickly security flaws can be chained together to compromise sensitive systems within 72 hours. (hacktron.ai)
Republican Congressman Darrell Issa proposed a bill requiring ISPs, DNS providers, and VPNs to block foreign piracy sites. The bill aims to enable faster court-ordered site blocking but faces criticism for potentially broad censorship and harm to small businesses. (arstechnica.com)
The Pentagon is considering withdrawing nearly a third of U.S. forces from Europe, potentially removing over 25,000 troops, aircraft, ships, and weapons. This move faces opposition from NATO allies who warn about increasing Russian threats in the region. (nbcnews.com)
The SEC has granted an 'Innovation Exemption' to enable trading of tokenized NMS stocks. The move aims to facilitate new trading methods while seeking public comment on the initiative. (sec.gov)
Hackers exploited a vulnerability in Anthropic's Claude AI system to gain access to OpenAI's systems. The incident involved security researchers identifying the flaw through an official bug bounty program. (wsj.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.