6 ms·

If arbitrary code execution, according to Samsung, is of "moderate" severity, I'd hate to see what their idea of a real bug is!

gradys 7y ago
The highest level of severity is reserved for anything that allows users to uninstall the crapware they ship with their phones.
- cjbprime 7y ago
  HN snark is doing great recently. See also: https://news.ycombinator.com/item?id=22300333 https://news.ycombinator.com/item?id=22300333
- raverbashing 7y ago
  No kidding It's ridiculous how a brand new phone from Samsung comes with non user-removable Facebook spyware and all their Bixby stuff that all want you to create an account
  - Aweorih 7y ago
    At least can you disable facebook, Bixby sadly not..
  - amphibian87 7y ago
    I broke my phone and bought a cheap burner phone, it was 20 dollars and honestly I'm not sure I'll ever buy a nice phone again. It's 720/1gig of RAM but it's only a mild annoyance, it's just as good as my old expensive one. Anyway it came preinstalled with FB and I'm wondering now if, even though I deactivated it, it spies. That's for sure why the phone was for sale at that price, it's subsidized with lots of bloat ware
  - tbrock 7y ago
    Vote with your wallet and buy pixels or Apple phones.
    - raverbashing 7y ago
      Pixels are not so easy to buy for some reason (outside of the US), only through the web site and some stores. I'm also voting with my wallet against Apple taking out the headphone jack.
      - StreamBright 7y ago
        https://store.google.com/regionpicker https://store.google.com/regionpicker Not sure what you are talking about. If I google buy google pixel outside of the US it takes me to this where I can select my region. I includes many regions/countries outside of the US.
        graycrow 7y ago
        Many, but not all. Half of Europe is missing, for example.
        mikro2nd 7y ago
        And all of Africa.
        cesarb 7y ago
        Also missing is all of the American continent other than North America and Brazil. And selecting Brazil, there's only the Nest Mini and the Chromecast, and nothing else.
        StreamBright 7y ago
        Sorry I did not go through the purchase process, it seems you cannot ship phones outside of the country where it is available.
        SimplyUnknown 7y ago
        Pick the Netherlands, for example. No way to buy any (smart)phone.
      - tialaramex 7y ago
  - josefx 7y ago
    On the one hand I agree, on the other why should Google have a monopoly on adding bloatware to my phone. Might as well go the whole nine yards and pre patch the unremovable chrome with an ask toolbar.
    - Intermernet 7y ago
      It's a bit easier to remove Chrome from a Pixel than it is to remove Safari from an iPhone!
SpicyLemonZest 7y ago
Moderate is typically a reasonable severity for, in the article's words, "possible arbitrary code execution". Lots of bugs might allow arbitrary code execution - too many to address them all at the same severity as a vulnerability known for sure to allow it.
- redis_mlc 7y ago
  That ship sailed over a decade ago. Arguing that a buffer flow, etc. is only theoretical unless you can show an exploit is nonsense at this point.
  - SpicyLemonZest 7y ago
    It makes it less likely that an attacker has right this second found and begin using an exploit. As you say, the ship has sailed over a decade ago; your stack will have unpatched CVEs, no matter how cautious you are or how hard you work. The most important parameter that remains available is which patches require which degree of expedited rollout.
orev 7y ago
The higher levels are used for things like remote code execution, and remote code execution that does not require user interaction. Things that are local only are not as big of an issue, especially on a single user device.
pjmlp 7y ago
Easy, have a look at the quality of Tizen. https://what.thedailywtf.com/topic/15001/enlightened https://what.thedailywtf.com/topic/15001/enlightened

gradys 7y ago

The highest level of severity is reserved for anything that allows users to uninstall the crapware they ship with their phones.

cjbprime 7y ago
HN snark is doing great recently. See also: https://news.ycombinator.com/item?id=22300333 https://news.ycombinator.com/item?id=22300333
raverbashing 7y ago
No kidding It's ridiculous how a brand new phone from Samsung comes with non user-removable Facebook spyware and all their Bixby stuff that all want you to create an account
- Aweorih 7y ago
  At least can you disable facebook, Bixby sadly not..
- amphibian87 7y ago
  I broke my phone and bought a cheap burner phone, it was 20 dollars and honestly I'm not sure I'll ever buy a nice phone again. It's 720/1gig of RAM but it's only a mild annoyance, it's just as good as my old expensive one. Anyway it came preinstalled with FB and I'm wondering now if, even though I deactivated it, it spies. That's for sure why the phone was for sale at that price, it's subsidized with lots of bloat ware
- tbrock 7y ago
  Vote with your wallet and buy pixels or Apple phones.
  - raverbashing 7y ago
    Pixels are not so easy to buy for some reason (outside of the US), only through the web site and some stores. I'm also voting with my wallet against Apple taking out the headphone jack.
    - StreamBright 7y ago
      https://store.google.com/regionpicker https://store.google.com/regionpicker Not sure what you are talking about. If I google buy google pixel outside of the US it takes me to this where I can select my region. I includes many regions/countries outside of the US.
      - graycrow 7y ago
        Many, but not all. Half of Europe is missing, for example.
        mikro2nd 7y ago
        And all of Africa.
        cesarb 7y ago
        Also missing is all of the American continent other than North America and Brazil. And selecting Brazil, there's only the Nest Mini and the Chromecast, and nothing else.
        StreamBright 7y ago
        Sorry I did not go through the purchase process, it seems you cannot ship phones outside of the country where it is available.
      - SimplyUnknown 7y ago
        Pick the Netherlands, for example. No way to buy any (smart)phone.
    - tialaramex 7y ago
- josefx 7y ago
  On the one hand I agree, on the other why should Google have a monopoly on adding bloatware to my phone. Might as well go the whole nine yards and pre patch the unremovable chrome with an ask toolbar.
  - Intermernet 7y ago
    It's a bit easier to remove Chrome from a Pixel than it is to remove Safari from an iPhone!

SpicyLemonZest 7y ago

Moderate is typically a reasonable severity for, in the article's words, "possible arbitrary code execution". Lots of bugs might allow arbitrary code execution - too many to address them all at the same severity as a vulnerability known for sure to allow it.

redis_mlc 7y ago
That ship sailed over a decade ago. Arguing that a buffer flow, etc. is only theoretical unless you can show an exploit is nonsense at this point.
- SpicyLemonZest 7y ago
  It makes it less likely that an attacker has right this second found and begin using an exploit. As you say, the ship has sailed over a decade ago; your stack will have unpatched CVEs, no matter how cautious you are or how hard you work. The most important parameter that remains available is which patches require which degree of expedited rollout.

orev 7y ago

The higher levels are used for things like remote code execution, and remote code execution that does not require user interaction. Things that are local only are not as big of an issue, especially on a single user device.

pjmlp 7y ago

Easy, have a look at the quality of Tizen. https://what.thedailywtf.com/topic/15001/enlightened https://what.thedailywtf.com/topic/15001/enlightened