5 ms·

The point about Android is particularly important. I wouldn't like to estimate the proportion of Android phones that are in regular use that no longer receive s

The point about Android is particularly important. I wouldn't like to estimate the proportion of Android phones that are in regular use that no longer receive security updates.

gjsman-1000 3y ago
I’m surprised, given the history of exploits, Google didn’t decide to start shipping the image decoders as an APEX system component in the Play Store, with the built-in ones serving as a fallback. They just might now.
- tgv 3y ago
  I'm always suspicious of Google's behavior. It might be a good opportunity for them to tell everyone they need the latest version of Chrome because security. Manifest 3.0 and cohorts/FLoC, you can't escape them.
- pja 3y ago
  Having spelunked through some Google announcements on this, it looks like they planned to do so back when Android 11 was in development (https://android-developers.googleblog.com/2020/02/Android-11-developer-preview.html https://android-developers.googleblog.com/2020/02/Android-11... ), but I can’t find any evidence that image decoders are included in the current Android Mainline system updates that ship via Google Play - video codecs are, but not image ones apparently. The image decoders are in android.graphics (https://developer.android.com/reference/android/graphics/package-summary https://developer.android.com/reference/android/graphics/pac... ) & that API subset is not listed in the Android Mainline system modules that are catalogued here: https://source.android.com/docs/core/ota/modular-system https://source.android.com/docs/core/ota/modular-system It looks as if they planned to include image decoders, but that was dropped sometime during the Android 11 development cycle, unless I’ve missed something (which is certainly possible). Edit: the final dev release announcement for Android 11 keeps the same paragraph about the native image decoder. So maybe it is there & I’m just not finding it? https://android-developers.googleblog.com/2020/09/android11-final-release.html https://android-developers.googleblog.com/2020/09/android11-...
londons_explore 3y ago
Android phones don't have an awful lot of attack surface area for typical users though. Messenger apps already will refuse to display arbitrary images - Whatsapp for example will only display jpegs and mp4's sent from other contacts.
- Vt71fcAqt7 3y ago
  True, and most websites will reencode images for compression anyway. But the point still stands this makes "hacked by clicking a link" a reality again for some people which should have ended along with flash and java applets. The current mainstream is that "you won't get hacked if you don't install." (not to say that this is the best security practise..) Since you don't install images most people will just assume they are safe. I hope this whole ordeal doesn't hurt JPEG-XL adoption.
  - mnw21cam 3y ago
    Agreed. Security shouldn't depend on not visiting certain web sites, because if nothing else the ad networks are able to get your browser to load all sorts of content from all sorts of places that you wouldn't deliberately do.
  - Filligree 3y ago
    I hope it does hurt JPEG-XL adoption. The reference implementation is C++, and it’s nearly guaranteed to have equally worrisome bugs in it — every image library has seen those over the years. We live in 2023. We can deal with slightly worse compression until someone rewrites it in a sane language.
    - sambazi 3y ago
      > We live in 2023. We can deal with slightly worse compression until someone rewrites it in a sane language. not just sanity of implementation but also reliability and compatibility {h264,jpg,zip} for life!
      - 3y ago
Pxtl 3y ago
Is there any site that shows what phones are still getting security updates? I'm worried that this will be the thing that makes me retire my son's old Moto G... 5 I think? It's probably out of security updates. Which kills me, he's a careful boy and it's a solid phone, this is unnecessary E-Waste.
- mnw21cam 3y ago
  I'd say a G5 is way out of updates. I have the G8+ and it stopped getting security updates ages ago.
- yjftsjthsd-h 3y ago
  I don't know of a site that tracks it, but in the phone settings you can see when it last got security patches. Also, if you want to get security updates without the e-waste, you could just install LineageOS on it.
  - Pxtl 3y ago
    "just" is definitely a 4-letter word here, but yes, I think I'll be getting him a new one and putting LineageOS on the thing to play with.

The point about Android is particularly important. I wouldn't like to estimate the proportion of Android phones that are in regular use that no longer receive security updates.

gjsman-1000 3y ago

I’m surprised, given the history of exploits, Google didn’t decide to start shipping the image decoders as an APEX system component in the Play Store, with the built-in ones serving as a fallback. They just might now.

tgv 3y ago
I'm always suspicious of Google's behavior. It might be a good opportunity for them to tell everyone they need the latest version of Chrome because security. Manifest 3.0 and cohorts/FLoC, you can't escape them.
pja 3y ago
Having spelunked through some Google announcements on this, it looks like they planned to do so back when Android 11 was in development (https://android-developers.googleblog.com/2020/02/Android-11-developer-preview.html https://android-developers.googleblog.com/2020/02/Android-11... ), but I can’t find any evidence that image decoders are included in the current Android Mainline system updates that ship via Google Play - video codecs are, but not image ones apparently. The image decoders are in android.graphics (https://developer.android.com/reference/android/graphics/package-summary https://developer.android.com/reference/android/graphics/pac... ) & that API subset is not listed in the Android Mainline system modules that are catalogued here: https://source.android.com/docs/core/ota/modular-system https://source.android.com/docs/core/ota/modular-system It looks as if they planned to include image decoders, but that was dropped sometime during the Android 11 development cycle, unless I’ve missed something (which is certainly possible). Edit: the final dev release announcement for Android 11 keeps the same paragraph about the native image decoder. So maybe it is there & I’m just not finding it? https://android-developers.googleblog.com/2020/09/android11-final-release.html https://android-developers.googleblog.com/2020/09/android11-...

londons_explore 3y ago

Android phones don't have an awful lot of attack surface area for typical users though. Messenger apps already will refuse to display arbitrary images - Whatsapp for example will only display jpegs and mp4's sent from other contacts.

Vt71fcAqt7 3y ago
True, and most websites will reencode images for compression anyway. But the point still stands this makes "hacked by clicking a link" a reality again for some people which should have ended along with flash and java applets. The current mainstream is that "you won't get hacked if you don't install." (not to say that this is the best security practise..) Since you don't install images most people will just assume they are safe. I hope this whole ordeal doesn't hurt JPEG-XL adoption.
- mnw21cam 3y ago
  Agreed. Security shouldn't depend on not visiting certain web sites, because if nothing else the ad networks are able to get your browser to load all sorts of content from all sorts of places that you wouldn't deliberately do.
- Filligree 3y ago
  I hope it does hurt JPEG-XL adoption. The reference implementation is C++, and it’s nearly guaranteed to have equally worrisome bugs in it — every image library has seen those over the years. We live in 2023. We can deal with slightly worse compression until someone rewrites it in a sane language.
  - sambazi 3y ago
    > We live in 2023. We can deal with slightly worse compression until someone rewrites it in a sane language. not just sanity of implementation but also reliability and compatibility {h264,jpg,zip} for life!
    - 3y ago

Pxtl 3y ago

Is there any site that shows what phones are still getting security updates? I'm worried that this will be the thing that makes me retire my son's old Moto G... 5 I think? It's probably out of security updates. Which kills me, he's a careful boy and it's a solid phone, this is unnecessary E-Waste.

mnw21cam 3y ago
I'd say a G5 is way out of updates. I have the G8+ and it stopped getting security updates ages ago.
yjftsjthsd-h 3y ago
I don't know of a site that tracks it, but in the phone settings you can see when it last got security patches. Also, if you want to get security updates without the e-waste, you could just install LineageOS on it.
- Pxtl 3y ago
  "just" is definitely a 4-letter word here, but yes, I think I'll be getting him a new one and putting LineageOS on the thing to play with.