4 ms·

> "when each and every single device is stuck on an old kernel often with a bunch of important CVEs unpatched" As an iPhone user, I've heard about how one of t

> "when each and every single device is stuck on an old kernel often with a bunch of important CVEs unpatched" As an iPhone user, I've heard about how one of the benefits of Android is that it's built on OSS, so that if you wanted to have a fully secure phone, you could just download the latest kernel and patches and software and install it yourself. Is this actually possible for Android users?

kuschku 9y ago
Phone manufacturers always buy the drivers from chip manufacturers, and under closed licenses. The source is rarely ever published, you can't download the kernel patches and do anything. Often you'll wait months or years to get the kernel the manufacturer used, and it will have been so old that none of the drivers will work on a recent linux kernel anymore at all. The situation isn't exactly great. And torvalds believes it to be more important to talk nice to these companies than to enforce the GPL, so nothing's been moving in the past decade at all.
- piracykills 9y ago
  Yeah, the only hope we've got is to move to a more Windows-style driver model, which is what Treble attempts to do, abstracting the HAL from the kernel and application software. This is already shipping in Android O and new devices on O or P must be Treble certified to ship Play Store, so we should see this improved greatly in upcoming devices.
  - pjmlp 9y ago
    If only OEMs weren't the ones expected to do Treble updates....
    - piracykills 9y ago
      If they are fully compatible it means community updates can work better too - not needing to worry about the HAL as much. Yes, Google might need to take one more step of saying "and we ship the security updates" before the average user benefits - but that can be done down the line if the situation merits it. Developers and power users will be able to take advantage of it even sooner. A single codebase for LineageOS? Yes please!
      - pjmlp 9y ago
        Community updates don't count for regular users, nor does LinageOS.
pedrocr 9y ago
> Is this actually possible for Android users? Not even close. Android security is a joke. I don't even like to login to my email from it.
- bitmapbrother 9y ago
  Are you sure it isn't iOS security that's the real joke? I mean, just do a search on YouTube for all of the lock screen bypasses. And then there's Cellebrite and their ability to unlock any iOS device for the relatively paltry sum of $1500 or you could just wait for a 2 for 1 special and do 2 for $750. The Pixel phones are virtually unhackable and not one has ever fallen at a PwnToOwn event. iOS devices, on the other hand, always fall at these events.
TheAceOfHearts 9y ago
To an extent. You'd have to be pretty tech savvy and fairly involved in both ecosystems to actually run your own android builds and stay on top of security. I know of one example of an Android OS which is focused on security and privacy. Check out CopperheadOS [0]. Their technical overview [1] details some of the improvements. * Possible disclaimer? I run CopperheadOS on my old Nexus 5X. [0] https://copperhead.co/android/ https://copperhead.co/android/ [1] https://copperhead.co/android/docs/technical_overview https://copperhead.co/android/docs/technical_overview

kuschku 9y ago

Phone manufacturers always buy the drivers from chip manufacturers, and under closed licenses. The source is rarely ever published, you can't download the kernel patches and do anything. Often you'll wait months or years to get the kernel the manufacturer used, and it will have been so old that none of the drivers will work on a recent linux kernel anymore at all. The situation isn't exactly great. And torvalds believes it to be more important to talk nice to these companies than to enforce the GPL, so nothing's been moving in the past decade at all.

piracykills 9y ago
Yeah, the only hope we've got is to move to a more Windows-style driver model, which is what Treble attempts to do, abstracting the HAL from the kernel and application software. This is already shipping in Android O and new devices on O or P must be Treble certified to ship Play Store, so we should see this improved greatly in upcoming devices.
- pjmlp 9y ago
  If only OEMs weren't the ones expected to do Treble updates....
  - piracykills 9y ago
    If they are fully compatible it means community updates can work better too - not needing to worry about the HAL as much. Yes, Google might need to take one more step of saying "and we ship the security updates" before the average user benefits - but that can be done down the line if the situation merits it. Developers and power users will be able to take advantage of it even sooner. A single codebase for LineageOS? Yes please!
    - pjmlp 9y ago
      Community updates don't count for regular users, nor does LinageOS.

pedrocr 9y ago

> Is this actually possible for Android users? Not even close. Android security is a joke. I don't even like to login to my email from it.

bitmapbrother 9y ago
Are you sure it isn't iOS security that's the real joke? I mean, just do a search on YouTube for all of the lock screen bypasses. And then there's Cellebrite and their ability to unlock any iOS device for the relatively paltry sum of $1500 or you could just wait for a 2 for 1 special and do 2 for $750. The Pixel phones are virtually unhackable and not one has ever fallen at a PwnToOwn event. iOS devices, on the other hand, always fall at these events.

TheAceOfHearts 9y ago

To an extent. You'd have to be pretty tech savvy and fairly involved in both ecosystems to actually run your own android builds and stay on top of security. I know of one example of an Android OS which is focused on security and privacy. Check out CopperheadOS [0]. Their technical overview [1] details some of the improvements. * Possible disclaimer? I run CopperheadOS on my old Nexus 5X. [0] https://copperhead.co/android/ https://copperhead.co/android/ [1] https://copperhead.co/android/docs/technical_overview https://copperhead.co/android/docs/technical_overview