Fragmentation Leads To Android Insecurities 318
Rick Zeman writes "The Washington Post writes about how vendor fragmentation leads to security vulnerabilities and other exploits. This situation is '...making the world's most popular mobile operating system more vulnerable than its rivals to hackers, scam artists and a growing universe of malicious software' unlike Apple's iOS which they note has widely available updates several times a year. In light of many companies' Bring Your Own Device initiatives 'You have potentially millions of Androids making their way into the work space, accessing confidential documents,' said Christopher Soghoian, a former Federal Trade Commission technology expert who now works for the American Civil Liberties Union. 'It's like a really dry forest, and it's just waiting for a match.'"
Or... (Score:5, Insightful)
Or... (Score:4, Insightful)
You get one exploit that works against Android Gingerbread, and you've got one that works for 2+ years against the still most popular version, by a large margin.
Re:Or... (Score:5, Insightful)
Mod parent up. iOS is a single platform, but new releases (major, point, all) are adopted relatively quickly, and support long lines on the hardware end. Android, however, is slow moving in upgrade adoption - while ICS or JB might have security fixes, most devices are stuck on Gingerbread with no apparent upgrade path from vendors. And, even when Google release major updates, and even if your phone is very capable, odds are you're locked out of doing anything yourself by the manufacturer (or in some cases by your carrier - gf's Xperia had "Untrusted Apps" disabled and locked from being enabled, that's an AT&T "feature").
Re:Or... (Score:5, Informative)
TL;DR: You may not be able to upgrade your Gingerbread phone to ICS, but Google still patches known vulns on your system.
Re: (Score:3)
Re: (Score:3)
Interesting. Does that include system components as well, like the kernel?
That depends more on the device maker/carrier than Google.
Re: (Score:3)
Re: (Score:3)
most devices are stuck on Gingerbread with no apparent upgrade path from vendors.
Highlighting the part that I find most relevant. The problem isn't Android per se, it's vendors that lock you out of getting the most recent (security) updates to the OS. The play store has services that will keep even Gingerbread patched against known vulnerabilities (see comment 42829985 [slashdot.org]). If your vendor blocks you from using that... time to pick a new vendor.
Re:Or... (Score:5, Interesting)
You mean like the Android humble bundles?
Re: (Score:3)
how many times did your girlfriend need "untrusted apps"?
you're complaining about a "Feature" but when 99% of your userbase doesn't need it, then turn it off. that is, unless you still have telnet enabled on your system because "FEATURE!@$"
Disabled by default? Sure, that's both reasonable and prudent Locked from being enabled? That's like saying I can't install telnet on my system, which is a completely different situation than enabling it by default. The fact that most people have no use for telnet, and enabling it by default would be a huge security issue doesn't say shit about whether or not I might need to enable it, and by doing so would take responsibility for securing my own system.
Re:Or... (Score:5, Informative)
If someone is using an iPhone, at some point it was connected to iTunes to activate it (or it wouldn't be working).
That used to be the case but you can activate and iPhone or iPad without iTunes these days and never ever hook it up to a host computer.
Re: (Score:3)
That facility didn't even come into existence until decades after the plaform beceme a malware magnet.
Decades? Windows Update was available for Windows 95 and Windows 98. I don't think Windows was a malware magnet in the late 1970's.
Don't take this as a defense of Microsoft in any way, but merely a correction in the interest of accuracy.
Just download Avast mobile security (Score:5, Informative)
Re: (Score:3)
Re:Just download Avast mobile security (Score:5, Interesting)
What the hell?
How can anyone say, with a straight face, that you need to run AV software on a goddamn phone? A PHONE! What manner of circumstances lead to this being considered something that is perfectly normal?
If anything it just shows what a logistical clusterfuck Google created with the first few editions of Android and letting all and sundry create hardware without at least enforcing some form of automatic patching regime. Don't get me wrong, I think ICS is a wonderful OS for a phone, but to birthed straight into the world expecting to have to run AV software??? Look at yourself in the mirror and tell yourself that's a perfectly normal and rational thing.
Re: (Score:3)
How can anyone say, with a straight face, that you need to run AV software on a goddamn phone? A PHONE! What manner of circumstances lead to this being considered something that is perfectly normal?
The circumstances of these phones effectively being general purpose computers.
Re:Or... (Score:4, Informative)
Android phones rarely get updated. About half of all Android users are still running 2.3 or earlier and the uptake for new versions is glacially slow. This makes android extremely vulnerable. If someone discovers an attack for 2.x, it's game over for millions of phones. Android also has a leaky walled garden that allows users to easily bypass the Google Play store and go to any market place they may choose. Hell, it's not even unusual to find infected apps in the official Google Play store.
Re:Or... (Score:5, Insightful)
nexus one user, here. cm7.2 is 2.3.7
likely, that will be all it ever runs.
shame and pity that google designed this. they farked it up. would you tolerate a linux distro that ended just a few years after it started?
that's how I feel. abandoned.
I run linux hardware (x86) that is recent and I also have 10 yr old systems that are just fine (thanks) and I continue to get linux updates for them.
but not android.
stupid google. seriously. why do people give google a pass on shit like this? we would not put up with this on regular desk/server linux.
Re: (Score:2)
can you imagine the security epidemic faced by routers and set top boxes that never get updated... omg its the end of linux!
Re: (Score:2, Insightful)
Re: (Score:3)
Some of us didn't give the poor experience a pass and moved away from Android. More people need to do that and let google know we think it's shit.
Some of us didn't like being treated like a criminal, and locked out of its hardware, forced to use proprietary [and I locked to ituned] software, and hardware, with it being stuck in incremental versions of both, found the loving arms of Android with offered arguably better hardware; software; standards and value.
Want to buy my broken iPhone :)
iOs is poor (Score:3)
I'm sorry in context of this article itunes is simply an extra security vector on my computer, and at best is bloat. It offers a poor service, and poor value [where are the free upgrades to flac]. On its own without the i*** its simply a poor product, my favorite music player at the moment is clemetine http://www.clementine-player.org/ [clementine-player.org] I'll probably replace it with something else soon.
As for iOS...its simply looking tired.
Re: (Score:3)
Re:Or... (Score:5, Interesting)
Bullshit. The problem is Android's notion of a system application. These are things that can't be uninstalled and must be on the internal storage. Some of these really are system services, but others are just shovelware. The 512MB on the Nexus One is more than adequate for a more recent Android, if you move some of the non-essential crap onto the SD card. The Nexus One came with a 4GB SD card and supports up to 32GB, so there's no reason not to do this, except that then you'd be able to uninstall some of the Google stuff.
This model, by the way, is especially wasteful because often these system components need updating, and due to the design of the Android filesystem layout they can't overwrite the old components, so you end up having to have two copies of a load of stuff installed, and you can't delete the unused one even though that's the one on the smaller storage device...
Re: Or... (Score:4, Interesting)
Re:Or... (Score:4)
Hell, it's not even unusual to find infected apps in the official Google Play store.
Citation Needed.
Not a one off either. You said it's not unusual so please link us to the this supposed endemic problem in Google's Play Store.
Re: (Score:3, Informative)
A quick search revealed these gems
http://tech2.in.com/news/android/malware-found-in-updates-app-on-google-play/523862 [in.com]
http://www.androidauthority.com/google-hosted-malware-on-its-play-store-during-q3-but-how-much-131309/ [androidauthority.com]
http://arstechnica.com/security/2012/07/more-malware-found-hosted-in-google-android-market/ [arstechnica.com]
Time Keeps On Ticking (Score:3)
You said it's not unusual so please link us to the this supposed endemic problem in Google's Play Store.
The incredible speed and ease with which any developer can push an app into Play comes at a cost you know, even if you'll not admit it.
Google does scan binaries for viruses. But all the technical users know how effective virus scans really are.
Re: (Score:2)
Re:Or... (Score:5, Insightful)
It's funny.... when Apple or Microsoft comes up, all the highly rated comments are about how Android lets you escape the walled garden and get your apps wherever you want from whomever you want. But let the story be about malware and security problems with Android - and all of the sudden it's the users fault for going outside the walled garden.
Re:Or... (Score:5, Insightful)
It's funny.... when Apple or Microsoft comes up, all the highly rated comments are about how Android lets you escape the walled garden and get your apps wherever you want from whomever you want. But let the story be about malware and security problems with Android - and all of the sudden it's the users fault for going outside the walled garden.
When given responsibility, people are expected to be responsible for themselves.
Shock Horror.
Whenever there is a thread on viruses for Mac's, Mac Fanboys always blame the user as malware is only found in pirated programs. Whilst this is not strictly true in any modern OS (OS X, Windows or Linux) almost all malware these days is (knowingly or unknowingly) installed by the user.
The equivalent on relying on "walled gardens" for security is like trying to cut road accidents by mandating that people can only buy white Automatic Camry's with speed limiters. This ignores the fact that you can still crash a speed limited auto camry if you have no fecking clue how to drive.
Re:Or... (Score:5, Insightful)
When given responsibility, people are expected to be responsible for themselves.
The corollary is that it is IRRESPONSIBLE to give the masses a technology where it is IMPOSSIBLE for them to be responsible.
If Android were just being marketed at technical users, that would be one thing. But to claim it's superior because it allows so much more freedom than most non-technical people can realistically control, and then pushing it on those same people. is borderline criminal.
The iOS model is far superior. Technical users able to properly manage an open system are also able to fully unlock the system. But the default shipping mode is safe for people with little technical aptitude.
Re: (Score:3)
Re: (Score:3)
I think superiority is in the eye of the beholder. You value security over freedom. Not everyone shares your views.
Re:Or... (Score:5, Insightful)
Oh, I dunno. I kind of like having the choice of whether to stay in the walled garden or go outside every now and then at my discretion because I'd like to think that I know what I'm doing most of the time. Let's rephrase that a little: If someone decides to go outside the walled garden, well then, their security becomes their responsibility right? Perfectly reasonable thing if you asked me. Trouble is Apple doesn't like giving anyone this kind of choice, and that kinda makes you feel they're still trying to exercise ownership over your device even though you've paid them their ridiculous profit margins for it.
Re: (Score:2)
Oh, I dunno. I kind of like having the choice of whether to stay in the walled garden or go outside every now and then at my discretion because I'd like to think that I know what I'm doing most of the time.
Absolutely, kind of like Amsterdam, it's always there if I want it. Similarly I know the Android garden of infinite delight is always there. And if I ever feel like bending over and getting reamed I'll leave the walled garden. Just knowing its possible makes me feel so much better.
(Tongue firmly in cheek)
Re: (Score:2, Insightful)
Re: (Score:3)
Choosing your freedom is *always* more dangerous. That doesn't mean you shouldn't do it, though.....
Re:Or... (Score:4, Informative)
jailbreaking your iphone in usa is against the law
Nope, unlocking your phone is - which is different to jailbreaking.
Re:Or... (Score:5, Insightful)
iOS is a single target, get one sploit that works, you know it'll work on all of them.
The recent exnyos sploit only worked on some Samsung chips.
So.. hackers have more devices to attempt to hack!
Though all this is a waste of time if people use non-standard app stores and/or download warez, then what do they really expect?
To be fair, a couple of exploits have slipped into the Android Market over time, but by and large you are correct, it is the dodgy pirate black market where users hope they can avoid paying the 99 cents charged in the legitimate market where you are likely to get hacked.
Yet these stories, always couched in terms of "fragmentation" and "malware" always show up in the press whenever Apple needs a little diversion.
Fragmentation, because apple wants you to think that only a monolithic OS is safe. The variety of the Android world scares them to death.
Malware, because the they want to put the fear of alternative markets into the buying public. The emergence of alternative markets scares apple to death.
So every 3 or 4 months Apple plants these stories in the press. And every time, there is, predictable, absolutely ZERO outbreak of malware, except for the same patter of cheesy hacks found on Chinese websites by people looking to save a buck.
Re: (Score:2)
To be fair, a couple of exploits have slipped into the Android Market over time
Yes, in the sense that Apple is not on the verge of bankruptcy.
Re:Or... (Score:4, Insightful)
This does not change the fact that a lot of Android phones are running vastly outdated versions of their firmware with several known security holes - and the people owning these phones do not have the option of updating their phones.
Android is insecure, because of two factors - the manufacturers frequently simply don't give their users a way to update, and because the system requirements of the OS keep rising at an absurd pace, making many older phones incompatible with later releases of the OS.
Re:Or... (Score:5, Insightful)
There is no epidemic of exploits.
Most doors can be opened with a bump key. But that isn't happening either.
Re: (Score:3)
Most doors can be opened with a bump key. But that isn't happening either.
Most doors can't be opened with a bump key in mass numbers from the comfort of your own home, or a McDonalds near you.
Or Even (Score:5, Insightful)
We know iOS insecure because its jail broken every other week. Ironically done to have similar functionality of Android.
Re: (Score:3)
Given that Android phones are usually a lot cheaper than iPhones, people can upgrade by buying a new phone and still come out ahead financially.
Re: (Score:2)
Re: (Score:2)
That's nonsense. People don't switch from android because their phones don't look like everyone elses.
People only use one phone, they could care less that their neighbor's phone is slightly different.
I don't know a single person who has switched from android to another OS. It's always the other way around.
Re: (Score:2)
Re: (Score:2)
They will give you a new phone every other year for pete sake!
Re: (Score:3)
I already switched. I used Android, but I grew very tired of the dearth of OS updates - I was stuck on 2.2 despite buying my device when 2.3 was already out - and the poor selection and difficulty of browsing of the Market. Where the market has vastly improved and things like the Humble Bundle have significantly improved the selection, the phones ain't getting updated any more frequently.
And if Google doesn't bite the bullet and make it mandatory for manufacturers and carriers to provide updates, Android st
Re: (Score:2)
I remember... (Score:5, Insightful)
Not so long ago niche platforms and disparate architectures were slated to be good BECAUSE they were so diverse it wasn't worth the time to hack them individually...
I also remember a time not so long ago that Microsofties used to complain that the frequency and ease of attacks on public sites was due to their dominance and being a big target. I wonder what Linux admins say now, since they now dominate the data centre?
Re:I remember... (Score:5, Insightful)
Not so long ago niche platforms and disparate architectures were slated to be good BECAUSE they were so diverse it wasn't worth the time to hack them individually...
I also remember a time not so long ago that Microsofties used to complain that the frequency and ease of attacks on public sites was due to their dominance and being a big target. I wonder what Linux admins say now, since they now dominate the data centre?
But these are not niche platforms or disparate architectures. They are all compatible from the point of view of applications and malware. It is just the customization and vendor disinterest that prevents updates. It is as if Dell, Lenovo, HP, etc added their crapware so deeply into the Windows infrasture that Microsoft's security updates could not be applied and the vendors were not interested in creating or distributing adapted versions.
Updates are uneconomical (Score:5, Insightful)
It is just the customization and vendor disinterest that prevents updates. It is as if Dell, Lenovo, HP, etc added their crapware so deeply into the Windows infrasture that Microsoft's security updates could not be applied and the vendors were not interested in creating or distributing adapted versions.
On the contrary, it is vendor interest that prevents updates.
The first thing to know is that Google does not create Android releases. Google does continuous Android development, and any time after release N.M, but before N.(M+1), or (N+1).0, for new major releases, the code base is called after the current tree version number. When a vendor wants to release a new Android cell phone, there may be parts of the code base they've contributed back for specific chip and peripheral support, but what they do is take a cut of the code base and freeze it. Then they apply patches and finishing touches which don't get integrated back to the main Android code base as part of taking it from the raw, unproductized Android code base to a productized version which can be shipped to customers.
The dirty little secret here is that all productization is done by the device vendors, and not by Google, and that Google itself is basically incapable of productizing an operating system like Android. Instead, they rely on the device vendor to do this, and the device vendor, wanting product differentiation, willingly cooperates, or even insists, on this happening outside of Google.
What that means is that "Android version 4.1" is a meaningless way to compare Android devices with one another, since Samsung's version of 4.1 may not have identical bits with Sony's version of 4.1, since they were most likely cut from different development versions of the source tree, even if they were cut only hours apart.
The bottom line here is that, even with a working security fix back-ported to "Android 4.1" is most likely going to result in a product reintegration, since the patch(es) will have to be rolled forward from the Google release branch of 4.1 (which has no additional changes past the Google release date) to the vendor's version of 4.1, which is a set of patches and productization on top of some code branch somewhere between Google's 4.1 and their 4.2. This is nearly as much effort as developing a new "model 720" phone with COGS-reduced parts, and based on the original "model 710" phone from that same vendor. The team which works on this "improved Android 4.1 for the 710" is a set of people who isn't working on the "model 730". As far as a vendor is concerned, that's spending good money to update a product for previous customers who aren't paying them money for the new improved version of the product, because "the old version is good enough".
The second thing to know is that the carrier marketing model in the U.S. effectively discourages the carrier from updating the OS, even if the handset/tablet manufacturer were willing to integrate the bug fix and provide an update.
In the U.S., a carrier locks you into a 2 year contract, and then offers you a 6 month "early update" to lock you into that carrier again for another two years after 18 months. The upshot of this is that they get to keep the captive user as a subscriber, in trade for a new handset, which is subsidized by the carrier, and the old handset has been fully paid for (and then some) by the monthly bill portion which pays for the "free" handsets in the first place.
The net effect of this is that, if they update an old phone, unless they have a new phone with some compelling new feature(s), the customer is more likely to "ride out" the remaining six months on their contract, and then just switch carriers. The only real compelling features that differentiate one Android phone from another these days are the version of Android they are running. Sometimes there are minor changes in hardware, but frankly, there's usually no hardware change that's compelling enough to get someone to NOT
Re: (Score:2)
Not that long ago an exploit that only targeted 5% of smart phones would have a return so small it would not possibly be worth it. Now an exploit that targets 5% of smart phones represents millions of phones.
Not vendor fragmentation (Score:5, Insightful)
The problem isn't vendor fragmentation. The problem is vendor laziness. If you produce an Android device there is no legitimate why you can't provide regular updates.
Re:Not vendor fragmentation (Score:5, Interesting)
bullshit!
google abandoned the 'bad old hardware' (gfx chips were 'too old').
and so they stopped ALL updates of importance.
its not the vendors. don't blame them. its the creator of android. those guys messed up the design (split of gfx and non-gfx) and so we get 'end of lifed' systems that are FAR too young to be put to pasture.
sigh. really, deep sigh.
Re:Not vendor fragmentation (Score:4, Informative)
I call bullshit to your bullshit.
Go have a look at the list of supported devices by Cyanogenmod and look up how many of those devices actually offer vendor upgrades to Jellybean. Hint: very few. My device stopped being supported at Gingerbread because the vendor says "it was too slow". I am now running Jellybean and thanks to Google's tweaks it's runs faster and smoother than it ever did.
But hey let's not dwell on old hardware shall we? Jellybean was released in early July 2012. Just under 4 months later Samsung were still saying US customers will get their SIII update in "the coming months". You know when Cyanogenmod 10.1 supported the Galaxy S III? Within 3 weeks of release.
The problem IS vendor lazyness.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2, Informative)
Two reasons:
1) Hardware component manufacturers don't provide updated drivers. Many of them are binary blobs that aren't compatible with newer kernel/Android versions. Especially Qualcomm and Nvidia chipsets.
2) Carrier certification is *expensive*. Going through the effort of getting updates carrier-approved costs tens of thousands of dollars, per update.
Re:Not vendor fragmentation (Score:4, Insightful)
Is your old engine susceptible to remote control security bugs that can be activated by a teenager in Russia?
Not everything is conducive to a car analogy.
Re:Not vendor fragmentation (Score:4, Funny)
Disclaimer: my Fiat is definitely clapped out, and cant even be activated adequately by the ignition key!
Re: (Score:2)
No but I got a recall notice in the mail saying my car needs to come into a GM workshop to fix a problem for free and that I need to phone to arrange the time.
Car vendors to provide critical updates. Your analogy works quite well.
I blame the SoC vendors and Google (Score:5, Insightful)
If there was either a common hardware platform, like on the PC, where every PC is essentially compatible with every other PC, you could easily update your operating system without the manufacturer of the hardware.
However SoC vendors don't want that, since it would mean that a device maker could easily switch from one SoC to another one. Plus they still use undocumented proprietary hardware in those SoCs, that's why you have binary device driver blobs which are hard to port.
The other problem lies within Google. They should have mandated some sort of "BIOS" which would have allowed any operating system to see what kind of hardware there is. This wouldn't have been more than a few hundred bytes in the flash containing the bootloader. That way you could have a generic operating system image, which would read out that ROM and execute routines found in it to use the hardware and then, perhaps at a later stage, use specialized drivers... just like it's done on the PC.
The sort of fragmentation we currently have in the Android market is simply bad, but a logical consequence from bundling hardware with the operating system. I just hope that one day the Chinese will wake up, and design a common hardware platform allowing the user to boot its own operating system from the SD-card, and even move it from device to device.
Re: (Score:2)
Disclaimer: I'm going to use "PC" in a very sloppy sense, meaning any 386-derivative system which can, in theory, run DOS-games or a standard Linux distribution from scratch.
I wouldn't say so. It's been upgraded from, essentially a "home computer" with 64k RAM to something which now spans everything from larger embedded systems to huge server farms. Just keep in mind that only in the 1990s it would have been impossible to run a high performance webserver on a PC. Today special "PC"-architecture servers are
Re: (Score:2)
Re: (Score:2)
Actually IBM set the perfect example. In response to the clones they developed their PS/2 line. They were designed to be deliberately incompatible with normal PC parts, as well as having a new bus, the MCA. It did still run MS-Dos or Windows or OS/2, so it was software compatible, even games ran on it.
Needless to say it failed. Nobody wanted to have a proprietary system for which a network card costs multiple times as much as for the competitors. Needless to say it failed miserably, even though there were c
Re: (Score:2)
Why remember? Those still exist. How else would you get a 4 socket mainboard? (that's 4 CPU sockets, each one with its own RAM)
Re: (Score:2)
Well it actually would have changed things. Instead of having to port Android to every little device, which is extremely time consuming, you'd just need to compile it once. And you wouldn't even have needed drivers for all your hardware.
Android at least allows you to do that, but in reality you'll still be faced with closed source SoC vendor proprietary drivers. It's just a lot of wasted resources.
So far I don't see much competition between different SoCs, you select one and have to stay with it since going
missing disclaimer (Score:3, Informative)
TFA author is an iPhone user, according to his twit feed https://twitter.com/craigtimberg [twitter.com]
Fragmentation (Score:4, Insightful)
Trying to argue about fragmentation with people attacking Android is a losing battle. "Fragmentation" means there's too many different hardware form-factors. No, it means too many vendor-specific UIs. No, it means that we need to support multiple OS versions. No, it means that we can't guarantee what security patches have been applied.
Bah, from where I'm sitting, "fragmentation" means nothing more than "I don't like it" - a way of disparaging choice from those who don't want it.
Re: (Score:3)
This. They've actually been at it since before the first Android device was even launched, claiming it was a fatal ill. Despite the dire fragmentation it has succeeded handily.
I'm kind of curious how many millions have been spent Android-slandering in this way. Has to be quite a few. Any self-respecting for-fee product slanderer would have switched to another strategy that was failing less spectacularly by now. His customer might have switched to another more effective slanderer in some sort of normal
Re: (Score:2, Insightful)
And dismissing it is the easiest way to avoid the problem and do nothing about it.
Fragmentation is a problem as it undeniably results in a subpar experience: apps that may or may not work, much more testing required for developers, slow update process (due to all those pesky vendor UIs), and apps contorted to fit resolutions it's not designed for.
But most importantly of all, it guarantees you a platform where finding an exploit is lucrative: because most people will still be vulnerable months after it is an
Re: (Score:2)
Fragmentation is a problem as it undeniably results in a subpar experience:
I'm confused. You are implying that Android is 'Fragmented' and that Fragmentation causes a subpar experience. Those to ideas don't add up.
Re: (Score:2)
there's too many different hardware form-factors. No, it means too many vendor-specific UIs. No, it means that we need to support multiple OS versions. No, it means that we can't guarantee what security patches have been applied.
You realize all of these are valid criticisms, right?
Re: (Score:3)
Yeah. But when you address one, the issue shifts to another; when you address that, suddenly you're arguing about the next. Moving goalposts. Although I notice there are far you form-factor fragmentation arguments now that Apple's got at least three different form-factors under their belt...
Re: (Score:2)
Word (Score:2)
Trying to argue about fragmentation with people attacking Android is a losing battle. "Fragmentation" means there's too many different hardware form-factors. No, it means too many vendor-specific UIs. No, it means that we need to support multiple OS versions. No, it means that we can't guarantee what security patches have been applied.
Boy, it sounds like the kinds of attacks on Android feasibility are splitting into a lot of different forms. If only we had a word for that.
Re:Fragmentation (Score:5, Insightful)
Whether to continue supporting a phone is not up to Google. Much of that decision is up to the carriers, then the vendors. Those same folks that want to roll out new devices every 6-12 months.
If a vendor takes Android 4.0 and mods the fuck out of it for their device, is Google responsible for patching all the security problems they introduced? Should Google take on writing new versions of Android for that hacked up version?
I like how you ultimately defend your post by suggesting anyone that disagrees is a clueless rube. Brilliant.
You're blaming Google for what is simply the mess that is the cellphone industry. At least in the U.S..
Re: (Score:2)
uh..
fragmentation in this case just mans success.
it's so popular there's hundreds of different handsets available. don't like it? buy only one vendor. just like with your pc's.
Re: (Score:2)
Ubuntu phone - security updates are as easy as syncing with your local distro mirror. An LTS release would provide security updates for 3 years.
Fragmentation is not to blame (Score:5, Insightful)
Linux has huge diversity among its many distributions, and yet it doesn't suffer from the security problems described in the article. So-called "fragmentation" isn't really a valid technical reason for lack of security at all. If a system is designed for security then it will be secure, regardless of the number of its variations.
The real reason why Android is lacking in security is because Google hasn't focused on security. They decided not to include iptables/netfilter (the Linux firewall) as a standard facility in Android, which would have been very easy to do. And they haven't allowed users to block privileges demanded by apps after install. Instead you're offered only a package deal, either let the app do whatever it wants or don't install it, period. Android users are hence pressured into a corner, and the end result is often worse security than they would wish.
Don't blame fragmentation. Instead point a finger at Google designers who seem remarkably disinterested in supporting the Android user's security and privacy requirements.
Re: (Score:2)
Android's security is top notch, and your claim Google isn't focusing on it is bullshit. With every release it has gotten better than the one before it.
And those permissions you complain about? Yeah, that's something desktop Linux doesn't even have. Android wins that by default. Your attempt to turn a very obvious and straightforward advantage into some sort of negative is ridiculous.
iptables/netfilter doesn't help here in the least, by the way. They are completely pointless here.
Re: (Score:3, Insightful)
I guess you didn't read the article then.
Which implies that every earlier release has had insecurities which Google had to fix.
Desktop Linux doesn't install insecure apps from unknown 3rd parties as Android encourages. Because Android's approach to apps is vastly more dangerous, it requires a hugely more comprehensive
Re: (Score:3)
The real reason why Android is lacking in security is because Google hasn't focused on security. They decided not to include iptables/netfilter (the Linux firewall) as a standard facility in Android, which would have been very easy to do.
That's why I installed the free DroidWall [google.com] app from Google Play. Now I have an Android iptables firewall that is very versatile.
And they haven't allowed users to block privileges demanded by apps after install. Instead you're offered only a package deal, either let the app do whatever it wants or don't install it, period.
That's why I built and installed the free PDroid [xda-developers.com] framework into my free custom ROM. Now I can grant, deny, or spoof the permissions on all my apps.
If anyone's interested, I currently recommend using Auto-Patcher [xda-developers.com] as the tool to inject PDroid into your ROM. I also recommend using the OpenPDroid [xda-developers.com] option in Auto-Patcher, with PDroid Manager [google.com] as the front-end UI app.
So, both of the Android
Re: (Score:2)
They decided not to include iptables/netfilter (the Linux firewall) as a standard facility in Android, which would have been very easy to do
The vast majority of Android phones I've found actually do have iptables. You need to be root to do much with it, though....
Re:Fragmentation is not to blame (Score:4, Insightful)
Your missing the point. Users aren't failing to update, they're not provided with any updates at all.
um no (Score:2)
Android fragmentation FUD .. (Score:2)
"Android also gives you tools for creating apps that look great and take advantage of the hardware capabilities available on each device. It automatically adapts your UI to look it's best on each device, while giving you as much control as you want over your UI on different device types."
"you can create a single app binary [android.com] th
It's not the frequency, it's the penetration (Score:2)
ba-dum-tish
But seriously folks, it's not that Apple releases updates several times a year that's the important bit. It's that those updates are available instantly, worldwide, to everyone, on every carrier, to every device younger than about four years old, and the update process is so easy and convenient that everyone (close enough) installs the updates.
The biggest install base for iOS is always "the latest version". The biggest install base for Android is what, Honeycomb? Shit.
Re:It's not the frequency, it's the penetration (Score:5, Informative)
The biggest install base for iOS is always "the latest version". The biggest install base for Android is what, Honeycomb? Shit.
Even worse, it's still Gingerbread.
http://bgr.com/2012/12/04/android-version-distribution-december-2012/ [bgr.com]
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The biggest install base for Android is what, Honeycomb? Shit.
Try an earlier version, oh hmm ah, Gingerbread. [android.com]
Meanwhile at TCFKA RIM (Score:3)
Excuse me sir... {smile}
Is the solution paid OS updates ? (Score:2)
I'm wondering if the solution would not be for OS updates to be on sale, at a low-ish-price, ie 5 or 10 bucks. That way, OEMs can recoup part of their investment, and users can put their money were their mouth is. I personally don't care that much about OS updates, my Xoom has gone from 3.x to 4.0 to 4.1 and I really didn't notice any difference.
Hmm (Score:3)
I always thought its the responsibilty of the manufacturer of the device to make a product which sticks to certain definitions. I dont see many android products listet with security as a feature, therefore i also dont assume that the design of the preinstalled sw goes into that direction.
It's a feature, not a bug! (Score:2)
Obligitory Animal House [youtube.com]