3 ms·

> runtime-permission-prompt model So each app will continue to ask for access to everything and you choose between being info-excluded or giving away your data

by ilurk 11y ago

> runtime-permission-prompt model So each app will continue to ask for access to everything and you choose between being info-excluded or giving away your data. > buy-in from the OEMs to push those patches How does this work? Is there any legal obligation for manufacturers/vendors to provide these patches in X weeks? If there isn't then I won't keep my hopes up. > from moving big parts of the OS to userland so they can be updated separately from the core system How exactly? By moving from Android to google proprietary apps? If so then this is a two-edged sword as it inevitably binds you to google spyware. Either you own an half-phone or you give away your data. Sorry if I sound bitter but I see what Android could be and get defeated by what it is. I never owned an iPhone but my next phone will be one. Maybe I'll still be disappointed, but at least won't have to deal with CM, Xprivacy, manual updates and all the other shenanigans. Disclaimer: I'm an increasingly disappointed Android user.

AnkhMorporkian 11y ago
> So each app will continue to ask for access to everything and you choose between being info-excluded or giving away your data. I think you might misunderstand what the Marshmallow upgrade will allow. Users will have the ability to turn off any given permission for any given app. Don't want google maps to have GPS access? Cool, just turn it off and the app will have to deal with the lack of information. It's not a Windows model carte blanche per-run thing. Sure, apps can be abusive and ask for more permissions than they need and refuse to run if they don't have them, but that's a problem with any conceivable permission system.
- malka 11y ago
  > Sure, apps can be abusive and ask for more permissions than they need and refuse to run if they don't have them, but that's a problem with any conceivable permission system. The OS could give fake data to the apps. Such as a arbitrary GPS location, or an empty contact list.
  - oneeyedpigeon 11y ago
    Hopefully, that would be unnecessary. If my calculator app won't run without full access to my address book, I'll seek out an alternative calculator which will; at this extreme, with an open marketplace, there will surely be alternatives.
    - JetSpiegel 11y ago
      > with an open marketplace, there will surely be alternatives Famous last words. Take a look at the Android store, it's a wasteland of adware-ridden crap.
      - chrisacree 11y ago
        Alright, time to take a stand. If you can't find a calculator app that doesn't require your contacts/GPS, I will personally build one. Be the change!
  - gruez 11y ago
    there's xprivacy for that
  - guelo 11y ago
    Marshmallow does do this for legacy apps that are not designed for the new permission model.
  - s73v3r 11y ago
    That's not something that developers would stand for. As a developer, I want to know that a permission was denied, so I can take action. If a permission I asked for was denied, it's quite possible my app won't run correctly. And I don't want to deal with idiots leaving crappy reviews because they decided to deny permission.
JohnTHaller 11y ago
> So each app will continue to ask for access to everything and you choose between being info-excluded or giving away your data. Apps under the new model will only ask for permissions when they need it. So, when you decide to post a picture to Facebook, that's when Android asks if you want to give the Facebook app access to your pictures on storage. If you deny it, it lets the app know it doesn't have access. If it's an older app that doesn't understand, it gets fake data as if you had no photos (or no contacts, etc). At least that was my understanding from reading about it. Note that this security model is similar to web apps wanting to "connect" with you Google account (or Twitter or Facebook for that matter) to access your contacts or similar.
72deluxe 11y ago
Sadly I am also an increasingly disappointed Android user. I have been with Android since the TMobile G1 and with the lack of security updates, the changing of what's acceptable in the UI every year at I/O (sometimes contradicting what they said the previous year), and the apparent lack of direction I too am ditching all my Android devices and going to the iPhone. Looked a Blackberry Leap but it doesn't properly support video conferencing apps for my entire family (FaceTime + Hangouts + Skype). It's disappointing. I saw a Chromebook used by a "normal" person for the first time this week. He loved it. The only benefit for me was the fact you could run Linux in some sense on it, and it was cheap and stealable without too much sadness! But this merging of browser-OS and insecure Android has signed the death warrant on my devices. Goodbye Samsung and Sony.
hajile 11y ago
> How does this work? Is there any legal obligation for manufacturers/vendors to provide these patches in X weeks? If there isn't then I won't keep my hopes up. When a user has control over updates, the company selling the product carries a relatively low responsibility. When a company does not allow a user to update, then that company carries a much higher responsibility. If Google provides a security update and a company refuses to update their devices (or allow users to update), then that company has a lot to lose. The Android ecosystem would be a lot better off if there were a couple large class-action lawsuits with big payouts. Companies really don't care until it hits their bottom line.
- evilduck 11y ago
  The liability scenario you claim will fix everything has already been the status quo in Android-land from the beginning. It clearly hasn't fixed the attitude OEMs have towards updates and security in thee last 5 years and other than outside pressure (Apple) continuing to make them look inept at update and support, I don't see any drive from within to fix the situation, and the Android-enthusiest attitude of "just put a custom ROM on it to fix your broken, abandoned product" only reduces the number of people who understand the problem and would be angry enough to file lawsuits or give bad PR a year after their purchase.

by ilurk 11y ago

AnkhMorporkian 11y ago

> So each app will continue to ask for access to everything and you choose between being info-excluded or giving away your data. I think you might misunderstand what the Marshmallow upgrade will allow. Users will have the ability to turn off any given permission for any given app. Don't want google maps to have GPS access? Cool, just turn it off and the app will have to deal with the lack of information. It's not a Windows model carte blanche per-run thing. Sure, apps can be abusive and ask for more permissions than they need and refuse to run if they don't have them, but that's a problem with any conceivable permission system.

malka 11y ago
> Sure, apps can be abusive and ask for more permissions than they need and refuse to run if they don't have them, but that's a problem with any conceivable permission system. The OS could give fake data to the apps. Such as a arbitrary GPS location, or an empty contact list.
- oneeyedpigeon 11y ago
  Hopefully, that would be unnecessary. If my calculator app won't run without full access to my address book, I'll seek out an alternative calculator which will; at this extreme, with an open marketplace, there will surely be alternatives.
  - JetSpiegel 11y ago
    > with an open marketplace, there will surely be alternatives Famous last words. Take a look at the Android store, it's a wasteland of adware-ridden crap.
    - chrisacree 11y ago
      Alright, time to take a stand. If you can't find a calculator app that doesn't require your contacts/GPS, I will personally build one. Be the change!
- gruez 11y ago
  there's xprivacy for that
- guelo 11y ago
  Marshmallow does do this for legacy apps that are not designed for the new permission model.
- s73v3r 11y ago
  That's not something that developers would stand for. As a developer, I want to know that a permission was denied, so I can take action. If a permission I asked for was denied, it's quite possible my app won't run correctly. And I don't want to deal with idiots leaving crappy reviews because they decided to deny permission.

JohnTHaller 11y ago

> So each app will continue to ask for access to everything and you choose between being info-excluded or giving away your data. Apps under the new model will only ask for permissions when they need it. So, when you decide to post a picture to Facebook, that's when Android asks if you want to give the Facebook app access to your pictures on storage. If you deny it, it lets the app know it doesn't have access. If it's an older app that doesn't understand, it gets fake data as if you had no photos (or no contacts, etc). At least that was my understanding from reading about it. Note that this security model is similar to web apps wanting to "connect" with you Google account (or Twitter or Facebook for that matter) to access your contacts or similar.

72deluxe 11y ago

Sadly I am also an increasingly disappointed Android user. I have been with Android since the TMobile G1 and with the lack of security updates, the changing of what's acceptable in the UI every year at I/O (sometimes contradicting what they said the previous year), and the apparent lack of direction I too am ditching all my Android devices and going to the iPhone. Looked a Blackberry Leap but it doesn't properly support video conferencing apps for my entire family (FaceTime + Hangouts + Skype). It's disappointing. I saw a Chromebook used by a "normal" person for the first time this week. He loved it. The only benefit for me was the fact you could run Linux in some sense on it, and it was cheap and stealable without too much sadness! But this merging of browser-OS and insecure Android has signed the death warrant on my devices. Goodbye Samsung and Sony.

hajile 11y ago

> How does this work? Is there any legal obligation for manufacturers/vendors to provide these patches in X weeks? If there isn't then I won't keep my hopes up. When a user has control over updates, the company selling the product carries a relatively low responsibility. When a company does not allow a user to update, then that company carries a much higher responsibility. If Google provides a security update and a company refuses to update their devices (or allow users to update), then that company has a lot to lose. The Android ecosystem would be a lot better off if there were a couple large class-action lawsuits with big payouts. Companies really don't care until it hits their bottom line.

evilduck 11y ago
The liability scenario you claim will fix everything has already been the status quo in Android-land from the beginning. It clearly hasn't fixed the attitude OEMs have towards updates and security in thee last 5 years and other than outside pressure (Apple) continuing to make them look inept at update and support, I don't see any drive from within to fix the situation, and the Android-enthusiest attitude of "just put a custom ROM on it to fix your broken, abandoned product" only reduces the number of people who understand the problem and would be angry enough to file lawsuits or give bad PR a year after their purchase.