7 ms·

Google made a deliberate decision long ago to detach library and feature support from the operating system due to manufacturer fragmentation. So most of their n

Google made a deliberate decision long ago to detach library and feature support from the operating system due to manufacturer fragmentation. So most of their new stuff automatically works with old versions of android

Rinzler89 2y ago
Same for security updates. A lot of new features and security patches get updated via the Google Play Services to older versions of Android as well.
- _rdvw 2y ago
  Google Play System updates provide very few security patches and this only applies to devices with Android 10 and higher and most APEX modules are only updatable in later versions. I track security patch counts of monthly Android Security Bulletin vs available APEX vs my aftermarket backports for A7 through A13 here: https://divestos.org/pages/patch_counts#aggregatePatchCounts https://divestos.org/pages/patch_counts#aggregatePatchCounts
  - microtonal 2y ago
    And the annoying thing is that on some phones (like Samsung phones recently, twice), the Play System updates get blocked for months on end. Worse, people who buy a new device are often stuck on ancient versions. I recently tried an Android phone again for a few months, and the update/security situation is still a mess. E.g. Samsung does monthly updates on more premium phones. But a former flagship like the S22 would sometimes only get the update near the end of the month, even before the S24 is out. Having a phone with known CVEs for the better part of a month is… meh. For some vendors, like Samsung, things are much better than a decade ago, but it’s still a far cry from Apple rolling out updates to all models simultaneously.
    - Rinzler89 2y ago
      >Having a phone with known CVEs for the better part of a month is… meh. Out of curiosity , have you ever encountered any malware that exploits said CVEs? If a month delay would be so dangerous, Android users, even of new devices would be getting pwned left and right, let alone Android users of device no longer getting patches. Source: Android user of old phone who hasn't been hacked yet so I'm not sure where exactly the dangers are, as the attack surface is mostly the web browser and the apps, both of which are scanned and covered by up-to-date patches from Google Play Store/Services even on my ageing phone. So as long as you don't browse extremely dodgy websites, and don't download shady apps you should be good as nothing else can't get to the Kernel CVEs on your unpatched phone. Yeah, I'm sure some crafty malware dev can whip out a targeted virus that can exploit the chain of open CVEs on my particular phone through a MMS message or something, but I'm not sure targeting the 100 or so users left still using this old OnePlus model that's worth less than 20 Euros used (pointing to a user without much income), is a good use of their skills and time, when they could be frying much bigger fish with that know-how like going after Microsoft's Azure or something. Nor am I being targeted by state actors who have these means. And if you are being targeted by state actors, they have access Zero-Days that even Apple or Google haven't patched yet so you're not safe anyway no matter what phone you have.
      - autoexec 2y ago
        > If a month delay would be so dangerous, Android users, even of new devices would be getting pwned left and right, let alone Android users of device no longer getting patches...Android user of old phone who hasn't been hacked yet so I'm not sure where exactly the dangers are What are the odds that you'd ever know if you were hacked? If you have root access on your device your odds of being able to see something amiss are probably somewhat better than if you don't, but even then I wouldn't count on it. How many people detected Predator/Pegasus? It isn't just state actors taking advantage of zero days. A zero day gets that malware on your system, but once it's infected how would you know? There have been reports that millions of android phones are infected at the factory. (https://www.theregister.com/2023/05/11/bh_asia_mobile_phones/ https://www.theregister.com/2023/05/11/bh_asia_mobile_phones...) We know mass infections happen (see https://www.bleepingcomputer.com/news/security/over-nine-million-android-devices-infected-by-info-stealing-trojan/ https://www.bleepingcomputer.com/news/security/over-nine-mil... and https://www.wired.com/story/android-gooligan-ghost-push-hack/ https://www.wired.com/story/android-gooligan-ghost-push-hack... and there have been some bold (if unverified) claims that most android devices are/were infected with something (https://www.zdnet.com/article/bt-almost-every-android-device-is-infected-with-malware/ https://www.zdnet.com/article/bt-almost-every-android-device...). I don't know how you could possibly be confident that your device isn't infected with something. The devices are designed to keep you from having the ability to poke around too much at their internals and the radios make it difficult to monitor exactly what's being sent/received to the device.
curt15 2y ago
Does this mean system-wide libraries can be shipped via APKs?
- gpm 2y ago
  Yes, that's what google play services is.
  - microtonal 2y ago
    And/or Google Play System updates, which are a separate thing and usually needs to be triggered by hand to get it timely.
  - wolpoli 2y ago
    Is this the reason that my old mid/low end android devices become unusable even through they no longer get updates?
    - darkwater 2y ago
      That's probably more related to storage performance (I guess eMMC) decreasing over time
      - catlikesshrimp 2y ago
        >Is this the reason that my old mid/low end android devices become unusable even through they no longer get updates? More recent versions of apps (like whatsapp, which requires to be updated regularly) are unnecessarily more demanding. Try disabling Play services, all Bloatware, all quasi-bloatware (calendar, contacts), all the way to the default keyboard. (pm disable-user --user 0) Install FOS replacements with no internet connectivity, e.g. from f-droid and such (not affiliated) It is easier to buy a new device, but I get attached to my pal ;)
        fl0ki 2y ago
        > all quasi-bloatware (calendar, contacts) Has Android gotten that bad? I last used it in 2018, and haven't exactly missed it since, but even back then I didn't think of Calendar or Contacts as quasi-bloatware.

Rinzler89 2y ago

Same for security updates. A lot of new features and security patches get updated via the Google Play Services to older versions of Android as well.

_rdvw 2y ago
Google Play System updates provide very few security patches and this only applies to devices with Android 10 and higher and most APEX modules are only updatable in later versions. I track security patch counts of monthly Android Security Bulletin vs available APEX vs my aftermarket backports for A7 through A13 here: https://divestos.org/pages/patch_counts#aggregatePatchCounts https://divestos.org/pages/patch_counts#aggregatePatchCounts
- microtonal 2y ago
  And the annoying thing is that on some phones (like Samsung phones recently, twice), the Play System updates get blocked for months on end. Worse, people who buy a new device are often stuck on ancient versions. I recently tried an Android phone again for a few months, and the update/security situation is still a mess. E.g. Samsung does monthly updates on more premium phones. But a former flagship like the S22 would sometimes only get the update near the end of the month, even before the S24 is out. Having a phone with known CVEs for the better part of a month is… meh. For some vendors, like Samsung, things are much better than a decade ago, but it’s still a far cry from Apple rolling out updates to all models simultaneously.
  - Rinzler89 2y ago
    >Having a phone with known CVEs for the better part of a month is… meh. Out of curiosity , have you ever encountered any malware that exploits said CVEs? If a month delay would be so dangerous, Android users, even of new devices would be getting pwned left and right, let alone Android users of device no longer getting patches. Source: Android user of old phone who hasn't been hacked yet so I'm not sure where exactly the dangers are, as the attack surface is mostly the web browser and the apps, both of which are scanned and covered by up-to-date patches from Google Play Store/Services even on my ageing phone. So as long as you don't browse extremely dodgy websites, and don't download shady apps you should be good as nothing else can't get to the Kernel CVEs on your unpatched phone. Yeah, I'm sure some crafty malware dev can whip out a targeted virus that can exploit the chain of open CVEs on my particular phone through a MMS message or something, but I'm not sure targeting the 100 or so users left still using this old OnePlus model that's worth less than 20 Euros used (pointing to a user without much income), is a good use of their skills and time, when they could be frying much bigger fish with that know-how like going after Microsoft's Azure or something. Nor am I being targeted by state actors who have these means. And if you are being targeted by state actors, they have access Zero-Days that even Apple or Google haven't patched yet so you're not safe anyway no matter what phone you have.
    - autoexec 2y ago
      > If a month delay would be so dangerous, Android users, even of new devices would be getting pwned left and right, let alone Android users of device no longer getting patches...Android user of old phone who hasn't been hacked yet so I'm not sure where exactly the dangers are What are the odds that you'd ever know if you were hacked? If you have root access on your device your odds of being able to see something amiss are probably somewhat better than if you don't, but even then I wouldn't count on it. How many people detected Predator/Pegasus? It isn't just state actors taking advantage of zero days. A zero day gets that malware on your system, but once it's infected how would you know? There have been reports that millions of android phones are infected at the factory. (https://www.theregister.com/2023/05/11/bh_asia_mobile_phones/ https://www.theregister.com/2023/05/11/bh_asia_mobile_phones...) We know mass infections happen (see https://www.bleepingcomputer.com/news/security/over-nine-million-android-devices-infected-by-info-stealing-trojan/ https://www.bleepingcomputer.com/news/security/over-nine-mil... and https://www.wired.com/story/android-gooligan-ghost-push-hack/ https://www.wired.com/story/android-gooligan-ghost-push-hack... and there have been some bold (if unverified) claims that most android devices are/were infected with something (https://www.zdnet.com/article/bt-almost-every-android-device-is-infected-with-malware/ https://www.zdnet.com/article/bt-almost-every-android-device...). I don't know how you could possibly be confident that your device isn't infected with something. The devices are designed to keep you from having the ability to poke around too much at their internals and the radios make it difficult to monitor exactly what's being sent/received to the device.

curt15 2y ago

Does this mean system-wide libraries can be shipped via APKs?

gpm 2y ago
Yes, that's what google play services is.
- microtonal 2y ago
  And/or Google Play System updates, which are a separate thing and usually needs to be triggered by hand to get it timely.
- wolpoli 2y ago
  Is this the reason that my old mid/low end android devices become unusable even through they no longer get updates?
  - darkwater 2y ago
    That's probably more related to storage performance (I guess eMMC) decreasing over time
    - catlikesshrimp 2y ago
      >Is this the reason that my old mid/low end android devices become unusable even through they no longer get updates? More recent versions of apps (like whatsapp, which requires to be updated regularly) are unnecessarily more demanding. Try disabling Play services, all Bloatware, all quasi-bloatware (calendar, contacts), all the way to the default keyboard. (pm disable-user --user 0) Install FOS replacements with no internet connectivity, e.g. from f-droid and such (not affiliated) It is easier to buy a new device, but I get attached to my pal ;)
      - fl0ki 2y ago
        > all quasi-bloatware (calendar, contacts) Has Android gotten that bad? I last used it in 2018, and haven't exactly missed it since, but even back then I didn't think of Calendar or Contacts as quasi-bloatware.