8 ms·

Who's going to make sure LineageOS users get security updates in a timely manner? Is anyone going to be paid to work on it? Any large OSS distribution is going

Who's going to make sure LineageOS users get security updates in a timely manner? Is anyone going to be paid to work on it? Any large OSS distribution is going to have a fairly continuous stream of security fixes to ship to their users, and that takes a fair amount of time, and I'm always concerned about whether any new project (okay—it's not quite new, but they have a fraction of the number of developers they did twelve months ago!) has the resources to ship them in a timely way.

em3rgent0rdr 10y ago
Yet somehow most stock ROMs are worse at maintaining security patches.
- libeclipse 10y ago
  This. It's actually astounding, albeit hardly surprising, that companies often have zero interest in pushing security patches to devices not being manufactured anymore.
  - realstuff 10y ago
    This is why for the first time since I started owning smartphones (2010), I am going to switch to iPhone.
    - Thrillington 10y ago
      That's not going to fix the problem. Installing updates on an iPhone older than a couple years bogs performance down to unusable levels.
      - realstuff 10y ago
        I am aware but at least I won't get hacked which is more important than performance.
        em3rgent0rdr 10y ago
        But even if Apple may be better than most android manufacturers, Apple still doesn't support devices it considers "Obsolete"...and there is nothing you can do about it other than buy a new phone since the bootloader is locked down. According to https://en.wikipedia.org/wiki/List_of_iOS_devices https://en.wikipedia.org/wiki/List_of_iOS_devices anything before iPhone 5 is considered "Oboslete" and they don't seem to be releasing updates. On the other hand, I've been happily using my Samsung S3 which cyanogenmod has been pushing latest android updates to nightly...and that is likely to continue as long as there are enough of us who care, even if cyanogen and samsung goes away.
        realstuff 10y ago
        cyanogen is no more.
        comex 10y ago
        For the record, the Galaxy S III was released in the same year as the iPhone 5 (2012), so for now your device hasn't lasted any longer than an iPhone. But I don't doubt that it will.
        dispose13432 10y ago
        SII last got an update a month and a half ago (https://download.cyanogenmod.org/?device=i777 https://download.cyanogenmod.org/?device=i777)
        lmns 10y ago
        Without any updates for the vendor blobs.
        gsnedders 10y ago
        Does the S3 get security updates to all the kernel-level vendor-provided blobs?
      - eigenvector 10y ago
        I have an iPhone 5 (4 year old phone) running the latest OS and it works fine. No, it's not as fast as the latest devices, but it works adequately if one desires to keep using their 4-year-old device.
      - givinguflac 10y ago
        While I agree that's been the case in the past, supported devices are fast enough now that it really doesn't slow them down anymore. Even the lowest supported device runs well on iOS 10, and it has gotten official updates years longer than all android devices I know of. Sure, one could install an updated and more secure rom (assuming it exists for your device). But, the vast majority of users don't care or won't bother to go through that process, rendering it a completely ineffective solution for the general consumer market.
        gurkendoktor 10y ago
        > supported devices are fast enough now that it really doesn't slow them down anymore That happens to be true now because Apple has dropped support for many iPad models with iOS 10, accounting for up to a third of all iPads in use. Running iOS 9 on the iPad 2, 3, and iPad mini was frustrating. This was only three months ago, so I wouldn't rule it out for the future yet.
  - g_p 10y ago
    If/when it becomes a risk they must mitigate against (be that a financial or reputational risk), I guess they will. Heck, until stagefright, Google didn't even release security bulletins. It was nigh-on impossible to keep track of all the vulnerabilities They only released security patches in new version releases. That wasn't good for vendors. Now Google has pushed forward, and it's the turn of OEMs. They shipped patches to StageFright due to the massive bad PR (headline news in many countries, was a talking point amongst even the vaguely tech savvy). Unless regulated or they feel they will lose money by not doing so, I don't imagine anything changing soon unfortunately. Qcom and other SoC makers are part of the problem too, since they try to drive chipset sales by only supporting older chipsets for a short time.
- gsnedders 10y ago
  Oh, I'm not denying most OEMs are terrible at this—this is the massive achilles heal of Android. OTOH, in a sense I have a higher expectation of "aftermarket" OSes insofar as they're actually pushing semi-regular updates which I'd hope would include all needed security updates.
g_p 10y ago
Not directly an answer, but one of the big issues with security patches for custom ROMs is the amount of patches they don't (read can't) ship. The proprietary blobs are very often not patched when the device is vendor-supported, and once it reaches end of life from the vendor (but the community ROMs give devices significantly extended longevity), there's no more patches to these blobs. Blobs incorporate the modem, baseband firmware, bootloaders, and many (most?) of the hardware drivers and imaging drivers. 51% of Android kernel vulnerabilities in vendor drivers are a result of missing or incorrect bounds checks, and over the whole Android kernel, 44% of all vulnerabilities were missing bounds checks, and 12% for null pointer dereference. Looking across the whole kernel, from Jan 2014 to April 2016, 85% of kernel bugs are born in vendor drivers, with the remainder in the core kernel. Vendors therefore are shown to write bad code. It's fairly safe to assume this is reflective of the quality of their blobs too - there's certainly a load of vulnerabilities in those if you look at the Android Security bulletins for bugs without a source reference for the fix. So agreement with your concern, but I'd just like to highlight that custom ROMs are not really a good security solution, as there's just so much to fix (at a kernel level, requiring detailed driver knowledge of the vendor/SoC stuff), and blobs that won't get updated after the vendor abandons the phone. Ref: https://events.linuxfoundation.org/sites/events/files/slides/Android-%20protecting%20the%20kernel.pdf https://events.linuxfoundation.org/sites/events/files/slides...
- gsnedders 10y ago
  Oh, that's totally true—though for many having some secure updates would be better than none, especially given the number of kernel bugs that are only locally exploitable (i.e., if the rest of the system is up-to-date, locally exploitable issues are less, but not none, of a concern). One thing I wish there was more visibility of is "is this device still getting security updates", because there's often almost no visibility about that (and while you obviously can't say the vendor won't fix future vulnerabilities, you can say whether the vendor has fixed all known vulnerabilities), even online, yet alone anything pushed to the device to let its user know it is no longer secure. e.g., http://web.archive.org/web/20161224231459/https://wiki.cyanogenmod.org/w/I9100_Info http://web.archive.org/web/20161224231459/https://wiki.cyano... is the old CyanogenMod wiki page for the Galaxy S2: the last "development channel" (i.e., unstable) build is 2016-12-18, the last "release channel" (i.e., stable) build is 2015-11-16. There is nothing on the device page to suggest the stable build is known to be insecure (though given the number of Android bugs found in the last year unquestionably is!), yet alone anything about upstream vendors dropping support for the device and the unstable build being known to be insecure too. How is LineageOS going to do better than that? That's a damn low bar.
TheAceOfHearts 10y ago
Something I've wondered about: why does Android require you flash a ROM to update the system? When you buy a windows laptop you'll usually get a bunch of vendor-specific crap, but after doing a clean install you can just pick up the drivers on their website and it'll all work fine. Why isn't this an option with Android?
- dispose13432 10y ago
  ARM's SoC lack of standards. In reality, we were really spoiled with IBM's massive mistake in standardizing the PC (the BIOS), so while Linux may not pick up your monitor, your monitor is made to work to a basic standard (VGA), so you can at least boot up, read the hard-drive, and have basic "keyboard" IO. This was really important before Win95 made the PC practically MS owned, as you could (and were expected to) install whatever OS you wanted, so they had to have a standard Boot Sector, etc. ARM SoC are meant to be built by a manufacturer to their specs (their CPU doesn't have to be compatible with anything because nothing is user-serviceable anyways). In other words, PCs were meant to be an Open Standard, while SoC are like old consoles/"dumb" phones. Unfortunately, due to MS dominance in the PC world, and the collapse of independent computer manufacturers (I remember the days when buying a cheap computer meant not going to Dell but going to the mom-and-pop shop down the block, but you had to know how to fix things if anything went bust), the PC is moving slowly but surely to the appliance world.
- jimmies 10y ago
  As I have been involved with OpenWRT/LEDE and how they make builds to different devices recently, I realized that making unified builds are actually possible. OpenWRT has the same kernel and root image for many different devices that use the same SoC. So once you have OpenWRT flashed on, the content of every OpenWRT update (for every device of the same SOC) is by and large the same. The only check in place is the artificial model check to make sure you don't unintentionally flash the wrong image. Android can technically do like OpenWRT does, but there is much more stuff involved in the Android world so making a universal build is harder. However, I personally can't think of a hard, technical barrier. New ideas for unifying devices and separating blobs such as device tree or separate vendor partition is getting traction and makers such as Sony are embracing it. Many Sony devices boot the same kernel, and that's why you consistently seeing Sony devices getting support and builds very early on from projects like CM. BTW, I have been trying to write an answer to you by saying a slightly different version of what dispose54312 said, but then realized it didn't make sense. I came to the conclusion (for myself) this is mostly "how it is done currently for Android." So I hope my unpopular answer is not crazily misguided, and please take my perspective with a grain of salt.
frik 10y ago
I want to read the full story, including how Microsoft was involved with Cyanogen(Inc/Mod). (yes, it was involved, use Google to search for previous news. For example at one point CyanogenInc partnered with MSFT so they have a Microsoft sponsored Android flavour with several Microsoft apps preinstalled. https://cyngn.com/press/cyanogen-announces-strategic-partnership-with-microsoft https://cyngn.com/press/cyanogen-announces-strategic-partner... http://www.businessinsider.de/why-microsoft-cuddled-up-to-cyanogen-2015-12?r=US&IR=T http://www.businessinsider.de/why-microsoft-cuddled-up-to-cy... Now it smells like the "embrace, extend and extinguish" strategy that MSFT is using with great success for decades https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish So I hope at one point we will get the full story.)
Tharkun 10y ago
Probably the same people who made sure CyanogenOS users got timely updates: no one. Last update for my phone was early september. Not holding my breath for this.

em3rgent0rdr 10y ago

Yet somehow most stock ROMs are worse at maintaining security patches.

libeclipse 10y ago
This. It's actually astounding, albeit hardly surprising, that companies often have zero interest in pushing security patches to devices not being manufactured anymore.
- realstuff 10y ago
  This is why for the first time since I started owning smartphones (2010), I am going to switch to iPhone.
  - Thrillington 10y ago
    That's not going to fix the problem. Installing updates on an iPhone older than a couple years bogs performance down to unusable levels.
    - realstuff 10y ago
      I am aware but at least I won't get hacked which is more important than performance.
      - em3rgent0rdr 10y ago
        But even if Apple may be better than most android manufacturers, Apple still doesn't support devices it considers "Obsolete"...and there is nothing you can do about it other than buy a new phone since the bootloader is locked down. According to https://en.wikipedia.org/wiki/List_of_iOS_devices https://en.wikipedia.org/wiki/List_of_iOS_devices anything before iPhone 5 is considered "Oboslete" and they don't seem to be releasing updates. On the other hand, I've been happily using my Samsung S3 which cyanogenmod has been pushing latest android updates to nightly...and that is likely to continue as long as there are enough of us who care, even if cyanogen and samsung goes away.
        realstuff 10y ago
        cyanogen is no more.
        comex 10y ago
        For the record, the Galaxy S III was released in the same year as the iPhone 5 (2012), so for now your device hasn't lasted any longer than an iPhone. But I don't doubt that it will.
        dispose13432 10y ago
        SII last got an update a month and a half ago (https://download.cyanogenmod.org/?device=i777 https://download.cyanogenmod.org/?device=i777)
        lmns 10y ago
        Without any updates for the vendor blobs.
        gsnedders 10y ago
        Does the S3 get security updates to all the kernel-level vendor-provided blobs?
    - eigenvector 10y ago
      I have an iPhone 5 (4 year old phone) running the latest OS and it works fine. No, it's not as fast as the latest devices, but it works adequately if one desires to keep using their 4-year-old device.
    - givinguflac 10y ago
      While I agree that's been the case in the past, supported devices are fast enough now that it really doesn't slow them down anymore. Even the lowest supported device runs well on iOS 10, and it has gotten official updates years longer than all android devices I know of. Sure, one could install an updated and more secure rom (assuming it exists for your device). But, the vast majority of users don't care or won't bother to go through that process, rendering it a completely ineffective solution for the general consumer market.
      - gurkendoktor 10y ago
        > supported devices are fast enough now that it really doesn't slow them down anymore That happens to be true now because Apple has dropped support for many iPad models with iOS 10, accounting for up to a third of all iPads in use. Running iOS 9 on the iPad 2, 3, and iPad mini was frustrating. This was only three months ago, so I wouldn't rule it out for the future yet.
- g_p 10y ago
  If/when it becomes a risk they must mitigate against (be that a financial or reputational risk), I guess they will. Heck, until stagefright, Google didn't even release security bulletins. It was nigh-on impossible to keep track of all the vulnerabilities They only released security patches in new version releases. That wasn't good for vendors. Now Google has pushed forward, and it's the turn of OEMs. They shipped patches to StageFright due to the massive bad PR (headline news in many countries, was a talking point amongst even the vaguely tech savvy). Unless regulated or they feel they will lose money by not doing so, I don't imagine anything changing soon unfortunately. Qcom and other SoC makers are part of the problem too, since they try to drive chipset sales by only supporting older chipsets for a short time.
gsnedders 10y ago
Oh, I'm not denying most OEMs are terrible at this—this is the massive achilles heal of Android. OTOH, in a sense I have a higher expectation of "aftermarket" OSes insofar as they're actually pushing semi-regular updates which I'd hope would include all needed security updates.

g_p 10y ago

Not directly an answer, but one of the big issues with security patches for custom ROMs is the amount of patches they don't (read can't) ship. The proprietary blobs are very often not patched when the device is vendor-supported, and once it reaches end of life from the vendor (but the community ROMs give devices significantly extended longevity), there's no more patches to these blobs. Blobs incorporate the modem, baseband firmware, bootloaders, and many (most?) of the hardware drivers and imaging drivers. 51% of Android kernel vulnerabilities in vendor drivers are a result of missing or incorrect bounds checks, and over the whole Android kernel, 44% of all vulnerabilities were missing bounds checks, and 12% for null pointer dereference. Looking across the whole kernel, from Jan 2014 to April 2016, 85% of kernel bugs are born in vendor drivers, with the remainder in the core kernel. Vendors therefore are shown to write bad code. It's fairly safe to assume this is reflective of the quality of their blobs too - there's certainly a load of vulnerabilities in those if you look at the Android Security bulletins for bugs without a source reference for the fix. So agreement with your concern, but I'd just like to highlight that custom ROMs are not really a good security solution, as there's just so much to fix (at a kernel level, requiring detailed driver knowledge of the vendor/SoC stuff), and blobs that won't get updated after the vendor abandons the phone. Ref: https://events.linuxfoundation.org/sites/events/files/slides/Android-%20protecting%20the%20kernel.pdf https://events.linuxfoundation.org/sites/events/files/slides...

gsnedders 10y ago
Oh, that's totally true—though for many having some secure updates would be better than none, especially given the number of kernel bugs that are only locally exploitable (i.e., if the rest of the system is up-to-date, locally exploitable issues are less, but not none, of a concern). One thing I wish there was more visibility of is "is this device still getting security updates", because there's often almost no visibility about that (and while you obviously can't say the vendor won't fix future vulnerabilities, you can say whether the vendor has fixed all known vulnerabilities), even online, yet alone anything pushed to the device to let its user know it is no longer secure. e.g., http://web.archive.org/web/20161224231459/https://wiki.cyanogenmod.org/w/I9100_Info http://web.archive.org/web/20161224231459/https://wiki.cyano... is the old CyanogenMod wiki page for the Galaxy S2: the last "development channel" (i.e., unstable) build is 2016-12-18, the last "release channel" (i.e., stable) build is 2015-11-16. There is nothing on the device page to suggest the stable build is known to be insecure (though given the number of Android bugs found in the last year unquestionably is!), yet alone anything about upstream vendors dropping support for the device and the unstable build being known to be insecure too. How is LineageOS going to do better than that? That's a damn low bar.

TheAceOfHearts 10y ago

Something I've wondered about: why does Android require you flash a ROM to update the system? When you buy a windows laptop you'll usually get a bunch of vendor-specific crap, but after doing a clean install you can just pick up the drivers on their website and it'll all work fine. Why isn't this an option with Android?

dispose13432 10y ago
ARM's SoC lack of standards. In reality, we were really spoiled with IBM's massive mistake in standardizing the PC (the BIOS), so while Linux may not pick up your monitor, your monitor is made to work to a basic standard (VGA), so you can at least boot up, read the hard-drive, and have basic "keyboard" IO. This was really important before Win95 made the PC practically MS owned, as you could (and were expected to) install whatever OS you wanted, so they had to have a standard Boot Sector, etc. ARM SoC are meant to be built by a manufacturer to their specs (their CPU doesn't have to be compatible with anything because nothing is user-serviceable anyways). In other words, PCs were meant to be an Open Standard, while SoC are like old consoles/"dumb" phones. Unfortunately, due to MS dominance in the PC world, and the collapse of independent computer manufacturers (I remember the days when buying a cheap computer meant not going to Dell but going to the mom-and-pop shop down the block, but you had to know how to fix things if anything went bust), the PC is moving slowly but surely to the appliance world.
jimmies 10y ago
As I have been involved with OpenWRT/LEDE and how they make builds to different devices recently, I realized that making unified builds are actually possible. OpenWRT has the same kernel and root image for many different devices that use the same SoC. So once you have OpenWRT flashed on, the content of every OpenWRT update (for every device of the same SOC) is by and large the same. The only check in place is the artificial model check to make sure you don't unintentionally flash the wrong image. Android can technically do like OpenWRT does, but there is much more stuff involved in the Android world so making a universal build is harder. However, I personally can't think of a hard, technical barrier. New ideas for unifying devices and separating blobs such as device tree or separate vendor partition is getting traction and makers such as Sony are embracing it. Many Sony devices boot the same kernel, and that's why you consistently seeing Sony devices getting support and builds very early on from projects like CM. BTW, I have been trying to write an answer to you by saying a slightly different version of what dispose54312 said, but then realized it didn't make sense. I came to the conclusion (for myself) this is mostly "how it is done currently for Android." So I hope my unpopular answer is not crazily misguided, and please take my perspective with a grain of salt.

frik 10y ago

I want to read the full story, including how Microsoft was involved with Cyanogen(Inc/Mod). (yes, it was involved, use Google to search for previous news. For example at one point CyanogenInc partnered with MSFT so they have a Microsoft sponsored Android flavour with several Microsoft apps preinstalled. https://cyngn.com/press/cyanogen-announces-strategic-partnership-with-microsoft https://cyngn.com/press/cyanogen-announces-strategic-partner... http://www.businessinsider.de/why-microsoft-cuddled-up-to-cyanogen-2015-12?r=US&IR=T http://www.businessinsider.de/why-microsoft-cuddled-up-to-cy... Now it smells like the "embrace, extend and extinguish" strategy that MSFT is using with great success for decades https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish So I hope at one point we will get the full story.)

Tharkun 10y ago

Probably the same people who made sure CyanogenOS users got timely updates: no one. Last update for my phone was early september. Not holding my breath for this.