8 ms·
Google to Samsung: Stop messing with Linux kernel code. It's hurting Android
- pg_is_a_butt 7y agoMe to Google: Stop messing with not being evil. It's hurting Everyone.
- boring_twenties 7y agoIf arbitrary code execution, according to Samsung, is of "moderate" severity, I'd hate to see what their idea of a real bug is!
- gradys 7y agoThe highest level of severity is reserved for anything that allows users to uninstall the crapware they ship with their phones.
- cjbprime 7y agoHN snark is doing great recently. See also: https://news.ycombinator.com/item?id=22300333 https://news.ycombinator.com/item?id=22300333
- raverbashing 7y agoNo kidding It's ridiculous how a brand new phone from Samsung comes with non user-removable Facebook spyware and all their Bixby stuff that all want you to create an account
- Aweorih 7y agoAt least can you disable facebook, Bixby sadly not..
- amphibian87 7y agoI broke my phone and bought a cheap burner phone, it was 20 dollars and honestly I'm not sure I'll ever buy a nice phone again. It's 720/1gig of RAM but it's only a mild annoyance, it's just as good as my old expensive one. Anyway it came preinstalled with FB and I'm wondering now if, even though I deactivated it, it spies. That's for sure why the phone was for sale at that price, it's subsidized with lots of bloat ware
- tbrock 7y agoVote with your wallet and buy pixels or Apple phones.
- raverbashing 7y agoPixels are not so easy to buy for some reason (outside of the US), only through the web site and some stores. I'm also voting with my wallet against Apple taking out the headphone jack.
- StreamBright 7y agohttps://store.google.com/regionpicker https://store.google.com/regionpicker Not sure what you are talking about. If I google buy google pixel outside of the US it takes me to this where I can select my region. I includes many regions/countries outside of the US.
- graycrow 7y agoMany, but not all. Half of Europe is missing, for example.
- mikro2nd 7y agoAnd all of Africa.
- cesarb 7y agoAlso missing is all of the American continent other than North America and Brazil. And selecting Brazil, there's only the Nest Mini and the Chromecast, and nothing else.
- StreamBright 7y agoSorry I did not go through the purchase process, it seems you cannot ship phones outside of the country where it is available.
- SimplyUnknown 7y ago
- josefx 7y agoOn the one hand I agree, on the other why should Google have a monopoly on adding bloatware to my phone. Might as well go the whole nine yards and pre patch the unremovable chrome with an ask toolbar.
- Intermernet 7y agoIt's a bit easier to remove Chrome from a Pixel than it is to remove Safari from an iPhone!
- SpicyLemonZest 7y agoModerate is typically a reasonable severity for, in the article's words, "possible arbitrary code execution". Lots of bugs might allow arbitrary code execution - too many to address them all at the same severity as a vulnerability known for sure to allow it.
- redis_mlc 7y agoThat ship sailed over a decade ago. Arguing that a buffer flow, etc. is only theoretical unless you can show an exploit is nonsense at this point.
- SpicyLemonZest 7y agoIt makes it less likely that an attacker has right this second found and begin using an exploit. As you say, the ship has sailed over a decade ago; your stack will have unpatched CVEs, no matter how cautious you are or how hard you work. The most important parameter that remains available is which patches require which degree of expedited rollout.
- orev 7y agoThe higher levels are used for things like remote code execution, and remote code execution that does not require user interaction. Things that are local only are not as big of an issue, especially on a single user device.
- pjmlp 7y agoEasy, have a look at the quality of Tizen. https://what.thedailywtf.com/topic/15001/enlightened https://what.thedailywtf.com/topic/15001/enlightened
- briandilley 7y agothat guy was the most annoying interview i have seen in a while.
- darkengine 7y agoThe original Project Zero article was discussed here 3 days ago: https://news.ycombinator.com/item?id=22315235 https://news.ycombinator.com/item?id=22315235
- cosmicexplorer 7y agoTelling hardware vendors not to modify kernel code feels grotesquely anti-competitive.
- jimmaswell 7y agoDefinitely a bad look for Google to say they're the only ones allowed to write kernel/driver code.
- cocoa19 7y agoThat's not what the article says.
- qtplatypus 7y agoGoogle doesn't say that at all. What they say to samsung is to push there changes up so that the kernal teams can review them.
- pjmlp 7y agoJust like Google Android team does, oh wait...
- qtplatypus 7y agoCan you clarify that? I did some searches and all I could find was reports that google made large contributions to the Linux kernel.
- qtplatypus 7y agoThis might be helpful https://arstechnica.com/gadgets/2019/11/google-outlines-plans-for-mainline-linux-kernel-support-in-android/ https://arstechnica.com/gadgets/2019/11/google-outlines-plan...
- pjmlp 7y agoAOSP is just a subset of Google's changes made to Linux kernel. Thanks to Project Treble, Linux on Android feels more like a pseudo micro kernel than traditional Linux. Then it is more like Linux + grsecurity than plain Linux, as it has LinuxSE, seccomp, Fortify, hardware pointer validation (on supported devices) and a couple of other security measures enabled by default, constraining what NDK is actually allowed to do. It has its own way of OOM killer daemon, it is compiled with clang. Google is indeed a major Linux kernel contributor, but in the context of Android team, they only contribute a subset of their changes.
- mullingitover 7y agoThis seems like one of those accidents that create valuable backdoors for intelligence agencies with plausible deniability.
- goldenManatee 7y agoHonestly, the truth is probably very mundane. It’s more likely that inter-department political vying for power has created a lot of redundancy, unnecessary work justified, and everything’s just barely being held together by the public’s faith that because they’re big they’ve got it all figured out.
- sdenton4 7y agoOnce, some time ago, I was working on an Interesting Feature for an app using wifi hotspots to connect multiple devices. There were LOTS of problems getting this working properly on arbitrary devices, but I found that Joe-random devices pumped out of a back room in Shenzen... Actually usually weren't bad. The worst were Samsung devices: endless changes deep in the stack for no apparent reason, which created all kinds of funny behavior that had to be discovered the hard way and accounted for. (Also, it turns out there are like twenty different phones called the J2. Nightmare for bug reporting...)
- dehrmann 7y agoI've had surprisingly good luck with generic hardware based on well-known chipsets. Samsung, though. They see themselves more like Apple and want to control more of the ecosystem, but they're not very good at it, and no one wants it. They make decent hardware, but they let their software ambitions get in the way.
- Intermernet 7y agocough ...bixby... cough
- wayneftw 7y agoMan, I hate comments like this. At least leave a link to whatever it is that you’re referencing or say why you think it's relevant.
- core_dumped 7y agoBixby is just Samsungs personal assistant program. Similar to Siri or Alexa.
- CameronNemo 7y agohttps://lmgtfy.com/?q=bixby+samsung&s=d https://lmgtfy.com/?q=bixby+samsung&s=d
- 7y ago
- benbristow 7y agoWhat's with the autoplaying video and prompt for notifications? Annoying.
- sub7 7y agoHurting Android is embedding unremovable Google services all over the place and implementing bullshit defaults like auto turning your wifi on and collecting + storing all available networks silently. Pretty sure they are intentionally slowing down old Pixels as well. /rant
- DagAgren 7y agoHad to fix a Samsung kernel driver once because their temperature sensor driver stored the measured temperature in Celsius in an unsigned char. Meaning, of course, that if the processor was ever below freezing, it would think it was running at over 200 degrees, and turn every clock it could find down as far as possible because it thought it was about to catch on fire.
- pjmlp 7y agoGosling on why Java does not do unsigned arithemtic as primitive type. > In programming language design, one of the standard problems is that the language grows so complex that nobody can understand it. One of the little experiments I tried was asking people about the rules for unsigned arithmetic in C. It turns out nobody understands how unsigned arithmetic in C works. There are a few obvious things that people understand, but many people don't understand it. https://www.artima.com/intv/gosling3.html https://www.artima.com/intv/gosling3.html
- touisteur 7y agoI miss the uint_64 or uint_32 in Java. It's annoying since the world of C talks in unsigned a lot on network protocols.
- pingyong 7y agoHm, I wonder what kind of questions that entailed. Because unsigned arithmetic in C seems very intuitive to me. I have a hard time coming up with a question that would be hard to answer. Certainly, if we're talking about the C standard, unsigned integers are much more intuitive than signed integers. Although even if there somehow are hard questions, I'm not sure understanding unsigned arithmetic would have helped whoever wrote that code. Because I think if you asked that person "what does this unsigned type do with -5 C?" the answer would have been pretty obvious.
- pjmlp 7y agoYou might not have any issue dealing with it, but are you sure that everyone on a given team, specially when scaled into off-shoring teams of various skill levels, all will master it? I have been coding since the mid-80's and I wouldn't definitely assert that I know it well, without having a look into ISO C standard and the semantic expectations of the abstract C machine and implementation specific behaviors.
- FirstLvR 7y agoleave Android alone!! sob ps: seriously, a great OS is chaos because no one respect no one but himself
- wicket 7y agoMe to Google: Stop messing with Linux kernel code. It's hurting Linux. https://leste.maemo.org/Leste_FAQ#What.27s_wrong_with_Android_.28vendor.29_kernels.3F https://leste.maemo.org/Leste_FAQ#What.27s_wrong_with_Androi...
- ebg13 7y agoIt doesn't hurt Linux. It hurts a billion Android users floating in a wasteland of devices that never update. But the only part Google could actually control is if they provided the stable driver interface that the kernel refuses to provide, so it's not like Google is doing anything that the kernel mainlining objective wasn't causing vendors to do anyway in the absence of that stability.
- paulie_a 7y agoSamsung can't stop themselves from making inferior software at every turn.