4 ms·
It's also kind-of not fair to blame only the brand/manufacturer, they are complicit -- yes -- but no the only party to blame. I work for a company that, in bet
by milankragujevic 7y ago
It's also kind-of not fair to blame only the brand/manufacturer, they are complicit -- yes -- but no the only party to blame.
I work for a company that, in between other things, develops and sells Android devices (TVs, tablets, phones, watches, etc.)
We buy a design from a Chinese developer, customize it, add apps and other "value-add" bulls*it, and then import the manufactured products and sell them.
The problem is, we recently found malware in the OS images which were provided by the manufacturer/developer, and traces back to Mediatek themselves, but we were not made aware of it. On request, the developer removed the malware and we sent an OTA to all devices of most models that removes the malware.
The point I'm making is that in many cases, the backdoors and spyware aren't even provided by the company that sells the phones, they are usually secretly put in much closer to the actual manufacturer/developer of the device and/or SoC.
- pmlnr 7y agoI blame automatic OTA, not the manufacturer. There should be rigorous virus scanning of each OTA before sent to the customer and even then it shouldn't be allowed to be automatically installed.
- milankragujevic 7y agoGoogle actually serves the OTA for most devices, meaning they can "see" and check for malware. The files are stored on and downloaded from their serves. Given the "rigorous" testing the apply to devices before they get Google Play certification, I assume they could revoke the certification remotely if malware is detected in an OTA, or even reject the OTA binary.
- deleted 7y ago[deleted]
- ryukafalz 7y ago>It's also kind-of not fair to blame only the brand/manufacturer, they are complicit -- yes -- but no the only party to blame. I blame the manufacturer for two reasons. First, because they're the highest level in the chain that's likely to have any knowledge of this stuff. Second, because they're the one selling it to consumers, and they have a responsibility to their customers to perform due diligence regarding the software they're including with the device. If batteries start exploding, the device manufacturer can't just throw up their hands and blame their suppliers. The same is true of software. Yes, that probably means accepting huge binary blobs from the ODM or SoC manufacturer puts the company selling it at risk. They can choose to accept that risk, or they can demand better. They have a whole lot more influence on the process than us consumers do. (There are precious few options for consumers. I'm holding out hope for the Librem 5 and PinePhone here.)
- milankragujevic 7y agoOkay, that is a fair point. In the EU, thankfully, we have laws that protect consumers from such incidents, including malware and faulty software, and the party selling the device is the responsible one, no matter what the EULA/TOS/LOL/etc. say.