6 ms·

I love project zeros write-ups, but I wish they published more about Android.

by bepvte 8y ago

close04 8y ago
I remember seeing more Google product related articles on their blog up until a couple of years ago. Then they stopped or slowed down, or at least they seem to concentrate a lot more on Apple and Microsoft. I guess some bugs are disclosed internally and fixed before they go public and some may not warrant blog posts. I am sure they're working on finding bugs in Google code but just like any other company they're not going to shoot themselves in the foot by advertising these internal findings more than needed.
- zamadatix 8y ago
  Just to take a look I opened the Project Zero main blog page and the newest article was on a bug in https://github.com/google/skia/ https://github.com/google/skia/ so I'm not sure I can take your comment with any ounce of credibility.
  - deleted 8y ago
    [deleted]
- londons_explore 8y ago
  Most security researchers are specialized in just a few pieces of software. If their Android expert leaves the team, there could be a gap in android exploits till a new one is hired.
magicalist 8y ago
The most recent post is a pretty fantastic one about exploiting polygon convexity in skia. https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexity-confusion.html https://googleprojectzero.blogspot.com/2019/02/the-curious-c...
mehrdada 8y ago
Haha, there has to be a proper security system/ecosystem on Android to be interesting to break, not one that effectively needs giving every app you want to share a single photo with the entire filesystem access, for example.
- pjmlp 8y ago
  That depends pretty much on which version one is talking about.
  - mehrdada 8y ago
    I recently tried Android again on Pixel 3 and effectively I have to find a way to send a file to an app without the storage permission. Is that an app-specific thing? I have yet to find an app that doesn’t do that. I understand the issues with the older versions that required install-time permission grant and this is not that issue.
    - pjmlp 8y ago
      Android still allowed an workaround for older apps, as the old OS behavior will be done for apps that still target older versions. This is no longer allowed for new apps since January, as the minimum allowed version to be targeted is Oreo (8.1). Regarding the storage, with Oreo as minimum version, the changes introduced in Nougat will be enforced, just like with UWP and iOS, only indirect access is allowed (SAF). https://developer.android.com/about/versions/nougat/android-7.0-changes#sharing-files https://developer.android.com/about/versions/nougat/android-... https://developer.android.com/guide/topics/providers/document-provider https://developer.android.com/guide/topics/providers/documen...
      - mehrdada 8y ago
        Thanks for the clarification, good to know!

I love project zeros write-ups, but I wish they published more about Android.

by bepvte 8y ago

I love project zeros write-ups, but I wish they published more about Android.

I remember seeing more Google product related articles on their blog up until a couple of years ago. Then they stopped or slowed down, or at least they seem to concentrate a lot more on Apple and Microsoft. I guess some bugs are disclosed internally and fixed before they go public and some may not warrant blog posts. I am sure they're working on finding bugs in Google code but just like any other company they're not going to shoot themselves in the foot by advertising these internal findings more than needed.

zamadatix 8y ago
Just to take a look I opened the Project Zero main blog page and the newest article was on a bug in https://github.com/google/skia/ https://github.com/google/skia/ so I'm not sure I can take your comment with any ounce of credibility.
- deleted 8y ago
  [deleted]
londons_explore 8y ago
Most security researchers are specialized in just a few pieces of software. If their Android expert leaves the team, there could be a gap in android exploits till a new one is hired.

magicalist 8y ago

The most recent post is a pretty fantastic one about exploiting polygon convexity in skia. https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexity-confusion.html https://googleprojectzero.blogspot.com/2019/02/the-curious-c...

mehrdada 8y ago

Haha, there has to be a proper security system/ecosystem on Android to be interesting to break, not one that effectively needs giving every app you want to share a single photo with the entire filesystem access, for example.

pjmlp 8y ago
That depends pretty much on which version one is talking about.
- mehrdada 8y ago
  I recently tried Android again on Pixel 3 and effectively I have to find a way to send a file to an app without the storage permission. Is that an app-specific thing? I have yet to find an app that doesn’t do that. I understand the issues with the older versions that required install-time permission grant and this is not that issue.
  - pjmlp 8y ago
    Android still allowed an workaround for older apps, as the old OS behavior will be done for apps that still target older versions. This is no longer allowed for new apps since January, as the minimum allowed version to be targeted is Oreo (8.1). Regarding the storage, with Oreo as minimum version, the changes introduced in Nougat will be enforced, just like with UWP and iOS, only indirect access is allowed (SAF). https://developer.android.com/about/versions/nougat/android-7.0-changes#sharing-files https://developer.android.com/about/versions/nougat/android-... https://developer.android.com/guide/topics/providers/document-provider https://developer.android.com/guide/topics/providers/documen...
    - mehrdada 8y ago
      Thanks for the clarification, good to know!