> How does this work? Is there any legal obligation for manufacturers/vendors to provide these patches in X weeks?
If there isn't then I won't keep my hopes up.
When a user has control over updates, the company selling the product carries a relatively low responsibility. When a company does not allow a user to update, then that company carries a much higher responsibility.
If Google provides a security update and a company refuses to update their devices (or allow users to update), then that company has a lot to lose.
The Android ecosystem would be a lot better off if there were a couple large class-action lawsuits with big payouts. Companies really don't care until it hits their bottom line.
The liability scenario you claim will fix everything has already been the status quo in Android-land from the beginning. It clearly hasn't fixed the attitude OEMs have towards updates and security in thee last 5 years and other than outside pressure (Apple) continuing to make them look inept at update and support, I don't see any drive from within to fix the situation, and the Android-enthusiest attitude of "just put a custom ROM on it to fix your broken, abandoned product" only reduces the number of people who understand the problem and would be angry enough to file lawsuits or give bad PR a year after their purchase.
When a user has control over updates, the company selling the product carries a relatively low responsibility. When a company does not allow a user to update, then that company carries a much higher responsibility.
If Google provides a security update and a company refuses to update their devices (or allow users to update), then that company has a lot to lose.
The Android ecosystem would be a lot better off if there were a couple large class-action lawsuits with big payouts. Companies really don't care until it hits their bottom line.