5 ms·

>> We encourage all users to update to the latest version of Android where possible. Good luck with that.

by TwoNineA 8y ago

Despegar 8y ago
It's fine, Google updates everything through Google Play Services now.
- graeme 8y ago
  Is this sarcasm or serious? If serious, how does this work in practice on older phones that don't get oa updates but do get play store updates? I see this mentioned a lot on reddit, but unless there are no security updates happening through android itself it seems ill informed.
  - voltagex_ 8y ago
    I deleted a couple of responses to this but the short version is that no, Skia (the affected component) is not being updated through the Play Store Framework. Flippant responses to security issues are not useful.
    - graeme 8y ago
      Thanks! I was 99% sure the common reddit response was wrongheaded. I'll make this point explicitly when I see it, that phones may get some updates, but that old phones don't get the security patches at an os level. Am not on android so I didn't want to be mistaken in how it worked.
      - voltagex_ 8y ago
        I don't have the info on Project Treble (Android 8 and up) - this changes things as the "Android Framework" is separated out from the rest of the phone firmware. It's not clear if this would include kernel and driver updates (I don't think so), but it's very likely things like Skia and codecs would be able to be updated faster. Very happy to be corrected. It also looks like not all devices running 8.0 were required to be Treble compliant. Hi, Samsung.
        graeme 8y ago
        Gotcha. So for 8.0 devices onwards the issue will be less severe. Still some unpatched bugs, but a smaller portion of them.
  - hnzix 8y ago
    I jailbroke my Android tablet. El Goog won't let me update it unless I flash a new ROM. Because how dare you control your own device!
    - Arnt 8y ago
      Flippant responses to security issues aren't helpful. In your case, (I presume) you are both the owner and the only user with physical access, and "you control your own device" is unique. In my case I'm the owner, but other people may have temporary physical access, and the identity of the "you" is therefore somewhat ambiguous. As owner I want protection against one of the possible values of "you", see?
      - rocqua 8y ago
        Whilst that makes sense for many versions of secure boot, it doesn't make sense for blocking updates to a flashed ROM. If the owner of the device flashed their ROM, they want updates. If someone other than the owner flashed the ROM, the true owner of the device is screwed anyway. Blocking updates won't save the true owner. Instead, this seems nothing more than lockdown for the sake of control.
        Arnt 8y ago
        As I understand it, the flashing breaks a chain of trust. Once a device has booted from software written by others, your own software can never again be truly confident that it is in full control. It was written to flash by untrusted software, it may have been modified on the way such that it thinks it's unmodified, such that the signatures match when it checks itself, but actual execution uses a modification by that untrusted code. It's a bit like that paper about modifying the compiler. https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html From the owner's point of view, being able to update the ROM is the manufacturer's statement that nothing done by a user with physical access survives.
        zozbot123 8y ago
agumonkey 8y ago
for those who don't speak google, they approximately said 'buy a new phone'
tssva 8y ago
My phone gets the latest Android updates the day they are released even though it is a discontinued phone and not from Google. The issue isn't Google or Android. It is phone manufacturers.
- archvile 8y ago
  AND carriers. Don't forget the carriers.
- SketchySeaBeast 8y ago
  > The issue isn't Google or Android. It is phone manufacturers. To be fair, Google only guarantees support of even the Pixel for 3 years... so it still kind of is.
- JeremyBanks 8y ago
  Heh. I got the Galaxy Nexus when it was the flagship, and I never got a single update. I got the Nexus 5X a couple of years ago, and Google is failing to provide this update for that phone. If Google can't even get it right on their own devices, they can't be shifting the blame to manufacturers. The only remotely-safe choice is an iPhone.

>> We encourage all users to update to the latest version of Android where possible. Good luck with that.

Despegar 8y ago

It's fine, Google updates everything through Google Play Services now.

graeme 8y ago
Is this sarcasm or serious? If serious, how does this work in practice on older phones that don't get oa updates but do get play store updates? I see this mentioned a lot on reddit, but unless there are no security updates happening through android itself it seems ill informed.
- voltagex_ 8y ago
  I deleted a couple of responses to this but the short version is that no, Skia (the affected component) is not being updated through the Play Store Framework. Flippant responses to security issues are not useful.
  - graeme 8y ago
    Thanks! I was 99% sure the common reddit response was wrongheaded. I'll make this point explicitly when I see it, that phones may get some updates, but that old phones don't get the security patches at an os level. Am not on android so I didn't want to be mistaken in how it worked.
    - voltagex_ 8y ago
      I don't have the info on Project Treble (Android 8 and up) - this changes things as the "Android Framework" is separated out from the rest of the phone firmware. It's not clear if this would include kernel and driver updates (I don't think so), but it's very likely things like Skia and codecs would be able to be updated faster. Very happy to be corrected. It also looks like not all devices running 8.0 were required to be Treble compliant. Hi, Samsung.
      - graeme 8y ago
        Gotcha. So for 8.0 devices onwards the issue will be less severe. Still some unpatched bugs, but a smaller portion of them.
- hnzix 8y ago
  I jailbroke my Android tablet. El Goog won't let me update it unless I flash a new ROM. Because how dare you control your own device!
  - Arnt 8y ago
    Flippant responses to security issues aren't helpful. In your case, (I presume) you are both the owner and the only user with physical access, and "you control your own device" is unique. In my case I'm the owner, but other people may have temporary physical access, and the identity of the "you" is therefore somewhat ambiguous. As owner I want protection against one of the possible values of "you", see?
    - rocqua 8y ago
      Whilst that makes sense for many versions of secure boot, it doesn't make sense for blocking updates to a flashed ROM. If the owner of the device flashed their ROM, they want updates. If someone other than the owner flashed the ROM, the true owner of the device is screwed anyway. Blocking updates won't save the true owner. Instead, this seems nothing more than lockdown for the sake of control.
      - Arnt 8y ago
        As I understand it, the flashing breaks a chain of trust. Once a device has booted from software written by others, your own software can never again be truly confident that it is in full control. It was written to flash by untrusted software, it may have been modified on the way such that it thinks it's unmodified, such that the signatures match when it checks itself, but actual execution uses a modification by that untrusted code. It's a bit like that paper about modifying the compiler. https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html From the owner's point of view, being able to update the ROM is the manufacturer's statement that nothing done by a user with physical access survives.
        zozbot123 8y ago

agumonkey 8y ago

for those who don't speak google, they approximately said 'buy a new phone'

tssva 8y ago

My phone gets the latest Android updates the day they are released even though it is a discontinued phone and not from Google. The issue isn't Google or Android. It is phone manufacturers.

archvile 8y ago
AND carriers. Don't forget the carriers.
SketchySeaBeast 8y ago
> The issue isn't Google or Android. It is phone manufacturers. To be fair, Google only guarantees support of even the Pixel for 3 years... so it still kind of is.
JeremyBanks 8y ago
Heh. I got the Galaxy Nexus when it was the flagship, and I never got a single update. I got the Nexus 5X a couple of years ago, and Google is failing to provide this update for that phone. If Google can't even get it right on their own devices, they can't be shifting the blame to manufacturers. The only remotely-safe choice is an iPhone.