5 ms·

It's fine, Google updates everything through Google Play Services now.

graeme 8y ago
Is this sarcasm or serious? If serious, how does this work in practice on older phones that don't get oa updates but do get play store updates? I see this mentioned a lot on reddit, but unless there are no security updates happening through android itself it seems ill informed.
- voltagex_ 8y ago
  I deleted a couple of responses to this but the short version is that no, Skia (the affected component) is not being updated through the Play Store Framework. Flippant responses to security issues are not useful.
  - graeme 8y ago
    Thanks! I was 99% sure the common reddit response was wrongheaded. I'll make this point explicitly when I see it, that phones may get some updates, but that old phones don't get the security patches at an os level. Am not on android so I didn't want to be mistaken in how it worked.
    - voltagex_ 8y ago
      I don't have the info on Project Treble (Android 8 and up) - this changes things as the "Android Framework" is separated out from the rest of the phone firmware. It's not clear if this would include kernel and driver updates (I don't think so), but it's very likely things like Skia and codecs would be able to be updated faster. Very happy to be corrected. It also looks like not all devices running 8.0 were required to be Treble compliant. Hi, Samsung.
      - graeme 8y ago
        Gotcha. So for 8.0 devices onwards the issue will be less severe. Still some unpatched bugs, but a smaller portion of them.
- hnzix 8y ago
  I jailbroke my Android tablet. El Goog won't let me update it unless I flash a new ROM. Because how dare you control your own device!
  - Arnt 8y ago
    Flippant responses to security issues aren't helpful. In your case, (I presume) you are both the owner and the only user with physical access, and "you control your own device" is unique. In my case I'm the owner, but other people may have temporary physical access, and the identity of the "you" is therefore somewhat ambiguous. As owner I want protection against one of the possible values of "you", see?
    - rocqua 8y ago
      Whilst that makes sense for many versions of secure boot, it doesn't make sense for blocking updates to a flashed ROM. If the owner of the device flashed their ROM, they want updates. If someone other than the owner flashed the ROM, the true owner of the device is screwed anyway. Blocking updates won't save the true owner. Instead, this seems nothing more than lockdown for the sake of control.
      - Arnt 8y ago
        As I understand it, the flashing breaks a chain of trust. Once a device has booted from software written by others, your own software can never again be truly confident that it is in full control. It was written to flash by untrusted software, it may have been modified on the way such that it thinks it's unmodified, such that the signatures match when it checks itself, but actual execution uses a modification by that untrusted code. It's a bit like that paper about modifying the compiler. https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html From the owner's point of view, being able to update the ROM is the manufacturer's statement that nothing done by a user with physical access survives.
        zozbot123 8y ago

Is this sarcasm or serious? If serious, how does this work in practice on older phones that don't get oa updates but do get play store updates? I see this mentioned a lot on reddit, but unless there are no security updates happening through android itself it seems ill informed.

voltagex_ 8y ago
I deleted a couple of responses to this but the short version is that no, Skia (the affected component) is not being updated through the Play Store Framework. Flippant responses to security issues are not useful.
- graeme 8y ago
  Thanks! I was 99% sure the common reddit response was wrongheaded. I'll make this point explicitly when I see it, that phones may get some updates, but that old phones don't get the security patches at an os level. Am not on android so I didn't want to be mistaken in how it worked.
  - voltagex_ 8y ago
    I don't have the info on Project Treble (Android 8 and up) - this changes things as the "Android Framework" is separated out from the rest of the phone firmware. It's not clear if this would include kernel and driver updates (I don't think so), but it's very likely things like Skia and codecs would be able to be updated faster. Very happy to be corrected. It also looks like not all devices running 8.0 were required to be Treble compliant. Hi, Samsung.
    - graeme 8y ago
      Gotcha. So for 8.0 devices onwards the issue will be less severe. Still some unpatched bugs, but a smaller portion of them.
hnzix 8y ago
I jailbroke my Android tablet. El Goog won't let me update it unless I flash a new ROM. Because how dare you control your own device!
- Arnt 8y ago
  Flippant responses to security issues aren't helpful. In your case, (I presume) you are both the owner and the only user with physical access, and "you control your own device" is unique. In my case I'm the owner, but other people may have temporary physical access, and the identity of the "you" is therefore somewhat ambiguous. As owner I want protection against one of the possible values of "you", see?
  - rocqua 8y ago
    Whilst that makes sense for many versions of secure boot, it doesn't make sense for blocking updates to a flashed ROM. If the owner of the device flashed their ROM, they want updates. If someone other than the owner flashed the ROM, the true owner of the device is screwed anyway. Blocking updates won't save the true owner. Instead, this seems nothing more than lockdown for the sake of control.
    - Arnt 8y ago
      As I understand it, the flashing breaks a chain of trust. Once a device has booted from software written by others, your own software can never again be truly confident that it is in full control. It was written to flash by untrusted software, it may have been modified on the way such that it thinks it's unmodified, such that the signatures match when it checks itself, but actual execution uses a modification by that untrusted code. It's a bit like that paper about modifying the compiler. https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html From the owner's point of view, being able to update the ROM is the manufacturer's statement that nothing done by a user with physical access survives.
      - zozbot123 8y ago