- Android 17 QPR1: 84 APIs, Pixel-only to Dec
+ Quick Tunnels: 5-year-old product, #1 on HN
+ OpenAI used its LLMs to design its own chipAndroid 17 QPR one added eighty-four new APIs this week, and for three months exactly one phone maker may ship them. The one that owns Android. The week in three lines. On Monday, Google pushed Android 17 QPR one to twenty-five Pixel models. On Tuesday, GrapheneOS read the API diff and noticed the source code was not coming with it. And on Thursday, Cloudflare hit number one on Hacker News with Quick Tunnels, a five-year-old product with a new landing page. What did Pixel owners get that nobody else did? The official diff from API level thirty-seven to thirty-seven point one has eighty-four additions, two hundred thirty-three changes and zero removals, which Google's own statistics page rounds to about half a percent of the platform.
Half a percent sounds like nothing, until you read it. There is a whole new package, android dot hardware dot hid, with an access permission that lets an app talk to USB and Bluetooth peripherals directly, no custom driver required. If you write controller software, that is the API you wanted. You can ship it today, to Pixel owners, a market roughly the size of a mid-tier subreddit. Also in the diff, a version code called Cinnamon Bun One. So the dessert names are back, in a constant, where nobody can see them. Now the history, because the word GrapheneOS reached for was Honeycomb. Android 3 was the tablet-only release from twenty eleven, and Google kept the Honeycomb code back too, so for fifteen years it stayed the one exception.
Then in March twenty twenty-five, Google confirmed to Android Authority that all Android development was moving to its private internal branch, promising to keep publishing source after each release. Six months later, Android 16 QPR one shipped to Pixels on September third. Its source landed on the open source project on November eleventh, sixty-nine days late, after Google said it was coming in the coming weeks. In corporate English that means the quarter after this one. And then the rule quietly changed. Since Android 16, the first and third quarterly releases are Pixel-only, and only the yearly release and QPR two go to the open source project. So the eighty-four APIs reach Samsung, Motorola and the ROM crowd in December, with QPR two. Three months of Pixel exclusive. The APIs are the headline. The patches are the problem. GrapheneOS says the September Pixel Update Bulletin contains fixes to standard Android platform components, code every other OEM builds on, and those fixes are not in the public Security Bulletin or the preview patches partners get.
So for one quarter, Pixels are patched against bugs in code that three billion other devices also run, and the fix is sitting in a binary you can download but not read. GrapheneOS plans to reverse engineer their own patches out of that binary and ship them early, which rather defeats the purpose of hiding it, since anyone with a disassembler and worse intentions can do the same. On top of that, they requested the GPL kernel sources for the QPR one build on September first and got access on the sixteenth. Fifteen days, for a licence whose entire text fits in one sentence, give us the source. Here is the part that should worry the Pixel team. GrapheneOS had already ported to 17 QPR one before it shipped, and cannot release it, because that source is not public yet. So instead they are backporting the Pixel firmware, kernel drivers and HALs from QPR one onto plain Android 17, by hand, until December.
Their words, Pixels are now significantly harder to support than many other devices, and one of the only advantages of Pixels is now a disadvantage. Convenient timing, because in March they signed a long-term partnership with Motorola, official firmware and driver code included, and the same thread says upcoming Motorola devices will be far easier to support than Pixels. The most security-obsessed Android project on Earth spent seven years telling people to buy a Pixel, and Google has spent eighteen months talking them out of it. To be fair to Google, the top dissent on Hacker News is worth hearing. Google drops real source every half year, Pixels get four updates a year, and no app developer will depend on an API that only works on a phone with a rounding error of market share. So Pixel becomes a weird beta device for what everyone gets a quarter later, which, in his words, is a weird thing to get mad about.
Half a percent of an API is not a fork. But GrapheneOS raised the better question, whether Google's legal team knows it is giving its own phones months of early access to features and security fixes over the partners it licenses Android to, in a decade when Android's defence in every courtroom has been that it is the open one. The intern did not do this one. The intern would have at least pushed the branch.
Verdict: REVERT — 0.52 % of an API is a footnote; a 3-month Pixel-only security patch is a fork.
Sources
https://news.ycombinator.com/item?id=49758736
https://grapheneos.social/@GrapheneOS/117282080803799576
https://x.com/GrapheneOS/status/2100287654004662455
https://9to5google.com/2026/09/15/android-17-qpr1-pixel/
https://developer.android.com/sdk/api_diff/37.1/changes
https://developer.android.com/sdk/api_diff/37.1/changes/alldiffs_index_additions
https://grapheneos.social/@GrapheneOS/117282129725629495
https://grapheneos.social/@GrapheneOS/117282153215695312
https://grapheneos.social/@GrapheneOS/117282177699479853
https://x.com/GrapheneOS/status/2100291145414701181
https://grapheneos.social/@GrapheneOS/117282234112964975
https://x.com/GrapheneOS/status/1988373959658905883
https://www.androidauthority.com/android-16-qpr1-source-code-delay-3596650/
https://www.androidauthority.com/google-android-development-aosp-3538503/
https://x.com/GrapheneOS/status/2028448871374803007
https://grapheneos.social/@GrapheneOS/117282256937184868
https://grapheneos.social/@GrapheneOS/117282235587218845
https://grapheneos.social/@GrapheneOS/117282190165630051
https://news.ycombinator.com/item?id=49759896
https://news.ycombinator.com/item?id=49754785
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.
YouTube · thedailydiff.dev · forward this to the intern who deployed on Friday.