4 ms·

It's worth keeping in mind which vendors are being talked about here. Treble fixes the problem of "manufacturer who didn't do any customization can't update be

It's worth keeping in mind which vendors are being talked about here. Treble fixes the problem of "manufacturer who didn't do any customization can't update because Qualcomm never updated their drivers & friends" by ensuring that the level that the Qualcomms, Nvidias, etc... build against is forwards-compatible. So small manufacturer can just take a new android source drop from google and plop it on top of the binaries they originally got from qualcomm or whoever and tada! done. It doesn't help with the "OEM injected so much 'customization' that it's a disaster to move forward and will forever be abandonware"

zanny 10y ago
If only a project existed to support devices beyond what the original manufacturers were willing to put out with singular consistent releases across all hardware. Oh yeah, Lineage. If only the company that made the OS actually supported the effort to perpetually support devices with a single OS the way Android should have been from day 1.
- oridecon 10y ago
  The problem is that you have to trust Lineage's (just an example) developers and release process. If you want Google Apps installed you need to trust another 3rd party like http://opengapps.org http://opengapps.org or https://microg.org/ https://microg.org/. At this point I'm not so sure what's better: an updated OS or one full of known exploits.
  - zifnab06 10y ago
    Why wouldn't they be trustable? You always have the option of building it yourself. (disclaimer, I'm one of the leads & run their infrastructure)
    - oridecon 10y ago
      Like I said, it was just an example. I don't have the time or knowledge to review an entire custom ISO and after that another ISO from the Gapps provider that I choose. I'm sure there are some tricks to cut down the review process time but anyway. It's a trade-off. I'm installing custom software to improve security, but at the same time, can I trust that this solution won't be a source of malware? I hope this didn't came out as accusatory, I was just trying to show another aspect of using custom ROMs.
      - zifnab06 10y ago
        It didn't - I'm mostly curious what people's thoughts are on things. For what its worth, the mirror selection software we're using [1] won't send you to a mirror that has a modified file. If a mirror is doing something malicious (and that doesn't catch it), builds are signed and can be verified [2]. Obviously there's some level of trust involved (build infrastructure isn't auditable, android builds aren't reproducible). [1] https://github.com/etix/mirrorbits https://github.com/etix/mirrorbits [2] https://wiki.lineageos.org/verifying-builds https://wiki.lineageos.org/verifying-builds
lern_too_spel 10y ago
I think you're the only one that got it. If the goal is to be able to update the Android OS without the carrier or device manufacturer having to do any work, the CTS would no longer be necessary because Google would control everything that the CTS tests.

zanny 10y ago

If only a project existed to support devices beyond what the original manufacturers were willing to put out with singular consistent releases across all hardware. Oh yeah, Lineage. If only the company that made the OS actually supported the effort to perpetually support devices with a single OS the way Android should have been from day 1.

oridecon 10y ago
The problem is that you have to trust Lineage's (just an example) developers and release process. If you want Google Apps installed you need to trust another 3rd party like http://opengapps.org http://opengapps.org or https://microg.org/ https://microg.org/. At this point I'm not so sure what's better: an updated OS or one full of known exploits.
- zifnab06 10y ago
  Why wouldn't they be trustable? You always have the option of building it yourself. (disclaimer, I'm one of the leads & run their infrastructure)
  - oridecon 10y ago
    Like I said, it was just an example. I don't have the time or knowledge to review an entire custom ISO and after that another ISO from the Gapps provider that I choose. I'm sure there are some tricks to cut down the review process time but anyway. It's a trade-off. I'm installing custom software to improve security, but at the same time, can I trust that this solution won't be a source of malware? I hope this didn't came out as accusatory, I was just trying to show another aspect of using custom ROMs.
    - zifnab06 10y ago
      It didn't - I'm mostly curious what people's thoughts are on things. For what its worth, the mirror selection software we're using [1] won't send you to a mirror that has a modified file. If a mirror is doing something malicious (and that doesn't catch it), builds are signed and can be verified [2]. Obviously there's some level of trust involved (build infrastructure isn't auditable, android builds aren't reproducible). [1] https://github.com/etix/mirrorbits https://github.com/etix/mirrorbits [2] https://wiki.lineageos.org/verifying-builds https://wiki.lineageos.org/verifying-builds

lern_too_spel 10y ago

I think you're the only one that got it. If the goal is to be able to update the Android OS without the carrier or device manufacturer having to do any work, the CTS would no longer be necessary because Google would control everything that the CTS tests.