patching

Would it be really hard to fix this OTA for all vehicles, reusing (and patching) their own bug?

This seems to be borne out by the arguments about, say, the speed of disclosure vs patching.

If they're just patching one or two obvious holes it'll likely be broken again by Blackhat.

But you can see where they come from, and they knowingly take the risk of patching up later once they have some success.

It is unsurprising that there was a bug in this patching.

Consider software security, how have they historically handled patching known vulnerabilities?

This also prevents users from being able to test their machines vulnerability after patching to verify that the patch remedies the problem in their installation.

I think that's the distinction that the analogy is going for -- the emulation going on is patching up some failures to do automatic effortless work by doing deliberate, focused, effortful work.

One problem may be that different versions of Android have different versions of libstagefright and just hot-patching that or dropping a replacement may brick older phones.

Any way to do that without patching the pgstyle.py file?

I ended up patching many places of the executable to prevent the crash.

There is no agreement, and seemingly no desire to quantify the risk and danger of different types of flaw, different strategies for patching them, different disclosure schedules, etc.

Perhaps its possible to pick up on the change from inside the Guest VM, and patching the problem on a public cloud would potentially expose the issue before members of the "Xen project Security Issues Predispose list" had a chance to patch?