5 ms·

Security is the reason I get mad about bank apps detecting custom ROMs on Android. Support is usually shorter, but LineageOS can keep OS and software securities

Security is the reason I get mad about bank apps detecting custom ROMs on Android. Support is usually shorter, but LineageOS can keep OS and software securities rolling past the manufacturers date. There aren’t custom ROMs in the Apple sphere tho since it’s all proprietary.

highwaylights 3y ago
LineageOS probably isn’t a great example. It uses black box firmware blobs that don’t receive updates and essentially just makes the latest Android work with those. It’s certainly better than just running an old Android on an unsupported device, but there are still large parts of the system that can be subject to critical vulnerabilities that can never be patched.
- toastal 3y ago
  Compared to many alternatives, it is better. The devices with longer support don’t have the basic features I need like a headphone jack & too many thing require a mobile device to function anymore, like Signal which doesn’t work without an Android/iOS primary device.
  - fsflover 3y ago
    My Librem 5 with a lifetime support has all that. Signal can run with Waydroid.
- toastal 3y ago
  By coincidence I had to get an old device running last night because current device is broken. I was able to flash 2023-09-05 Android security updates atop a 2014 phone whose last firmware update was 2016-09-01. Is the device not safe? To some extent yes, but I was able to keep an old emergency device running with security patches from last month which is better than having to buy a new temporary device or being stuck on the matching official 2016 ROM.
PaulCarrack 3y ago
> but LineageOS can keep OS and software securities rolling past the manufacturers date. It's unfortunately a false sense of security because you don't get security updates for any proprietary blobs that are needed for your phone. This includes baseband and SoC updates. In security, the chain is only as strong as it's weakest link.
- KennyBlanken 3y ago
  It's also a false sense of security because community roms are maintained by a small group of (often) entirely anonymous people with nearly zero repercussions if they put something in that they shouldn't.
  - toastal 3y ago
    Implying manufacturers aren’t putting stuff in their ROMs they shouldn’t? At least these custom ROMs are built & maintained in the open.
    - phatskat 3y ago
      No, I think the implication is that if a major manufacturer lets something Bad™ slip in, they can be held liable. xXFoneBoi93 could slip in a root kit and the custom ROM they contribute to probably wouldn’t be held accountable in any meaningful way. That’s how I read it at least
      - hurutparittya 3y ago
        Held liable, as in getting a fine that's 0.3℅ of their yearly revenue ?
        phatskat 3y ago
        Well sure, that’s a completely different discussion though.

highwaylights 3y ago

LineageOS probably isn’t a great example. It uses black box firmware blobs that don’t receive updates and essentially just makes the latest Android work with those. It’s certainly better than just running an old Android on an unsupported device, but there are still large parts of the system that can be subject to critical vulnerabilities that can never be patched.

toastal 3y ago
Compared to many alternatives, it is better. The devices with longer support don’t have the basic features I need like a headphone jack & too many thing require a mobile device to function anymore, like Signal which doesn’t work without an Android/iOS primary device.
- fsflover 3y ago
  My Librem 5 with a lifetime support has all that. Signal can run with Waydroid.
toastal 3y ago
By coincidence I had to get an old device running last night because current device is broken. I was able to flash 2023-09-05 Android security updates atop a 2014 phone whose last firmware update was 2016-09-01. Is the device not safe? To some extent yes, but I was able to keep an old emergency device running with security patches from last month which is better than having to buy a new temporary device or being stuck on the matching official 2016 ROM.

PaulCarrack 3y ago

> but LineageOS can keep OS and software securities rolling past the manufacturers date. It's unfortunately a false sense of security because you don't get security updates for any proprietary blobs that are needed for your phone. This includes baseband and SoC updates. In security, the chain is only as strong as it's weakest link.

KennyBlanken 3y ago
It's also a false sense of security because community roms are maintained by a small group of (often) entirely anonymous people with nearly zero repercussions if they put something in that they shouldn't.
- toastal 3y ago
  Implying manufacturers aren’t putting stuff in their ROMs they shouldn’t? At least these custom ROMs are built & maintained in the open.
  - phatskat 3y ago
    No, I think the implication is that if a major manufacturer lets something Bad™ slip in, they can be held liable. xXFoneBoi93 could slip in a root kit and the custom ROM they contribute to probably wouldn’t be held accountable in any meaningful way. That’s how I read it at least
    - hurutparittya 3y ago
      Held liable, as in getting a fine that's 0.3℅ of their yearly revenue ?
      - phatskat 3y ago
        Well sure, that’s a completely different discussion though.