8 ms·

Andy Rubin was the major factor responsible for insecure Android devices. He thought it was impossible to be both secure and 'X' for any 'X'. Meanwhile, Andy Ru

by dguido 14y ago

Andy Rubin was the major factor responsible for insecure Android devices. He thought it was impossible to be both secure and 'X' for any 'X'. Meanwhile, Andy Rubin's replacement is Sundar Pichai, SVP for Chrome and ChromeOS. http://en.wikipedia.org/wiki/Sundar_Pichai http://en.wikipedia.org/wiki/Sundar_Pichai If you care at all about the security of Android mobile devices, this is probably a good sign. EDIT: I wonder if this helped move Andy out the door? http://www.macrumors.com/2013/03/07/phil-schiller-tweets-link-to-mobile-malware-report-that-slams-android/ http://www.macrumors.com/2013/03/07/phil-schiller-tweets-lin...

jmillikin 14y ago
Not to mention that Chrome has figured out how to push updates, while a majority of Androids are still running a version released over two years ago. If Google can start pushing auto-updates to all of its devices, that would be one of the greatest improvements ever made to Android. Also, one of Chrome's most touted features is performance, which has always been Android's weakest point. Hopefully he'll be willing to assign more people to the task of making Androids work as smoothly as iPhones.
- laureny 14y ago
  > Not to mention that Chrome has figured out how to push updates, while a majority of Androids are still running a version released over two years ago. The reason for the hold out is the carriers, not Google. Google is very good at pushing updates to phones when it's not limited by the carriers (and Android implemented over the air updates years before anyone else did. iPhones still require cables to be updated).
  - jojopotato 14y ago
    I haven't required a cable for an iOS update for a while.
  - jhammer 14y ago
    iPhones have not required tethered updating for a year and a half now. OTA updating arrived in iOS 5.
  - chaz 14y ago
    > The reason for the hold out is the carriers, not Google For a Google SVP, much of the role is external. If getting partners on board is important and it hasn't happened, then you're out.
  - deleted 14y ago
    [deleted]
  - jmillikin 14y ago
    > The reason for the hold out is the carriers, not > Google. Google is very good at pushing updates to > phones when it's not limited by the carriers I didn't imply it had to be a technical solution. If users can't update their phones that run Google's operating system because Google isn't leaning hard enough on the carriers, then Google needs to fix that. Apple has managed to strong-arm the carriers into letting it supports its customers, and Google's market position isn't too much weaker than Apple. > iPhones still require cables to be updated). iOS has supported OTA updates since iOS 5, which was released almost two years ago.
    - kronholm 14y ago
      Just to add data to those wondering, iOS 5 released 16 months ago (http://en.wikipedia.org/wiki/IOS_version_history http://en.wikipedia.org/wiki/IOS_version_history)
    - Evbn 14y ago
      Google is responsible for pushing updates to some other company's customers against that company's will? Google's customers get updates just fine.
  - jgeorge 14y ago
    Andy's previous company implemented over the air updates years before anyone had even thought of Android or iOS. :-)
  - lttlrck 14y ago
    "iPhones still require cables to be updated" Only for power and it's just a recommendation...
    - hackmiester 14y ago
      Updating a firmware while on battery is a pretty bad idea, so I can see why it's recommended.
  - seanmcdirmid 14y ago
    >iPhones still require cables to be updated This simply isn't true.
- nollidge 14y ago
  Are you talking updates without prompting the user? My Nexus (original) updates itself every so often with a prompt.
  - ConstantineXVI 14y ago
    I'm led to believe there's some kind of regulation preventing phones from updating without user intervention, given the 'you will not be able to make emergency calls' prompt most phones seem to show on an update.
  - wmf 14y ago
    No, we're talking about any updates, which is more than most Android phones receive.
  - jmillikin 14y ago
    Android ought to update like Chrome: silently downloaded via Wifi (optionally via 3G/4G), installed in the background to whatever extent possible, and then show a reboot prompt only if needed. Android is a Linux distribution, so most updates ought to be possible without having to reboot the device.
    - philsnow 14y ago
      Chrome's auto-updating has broken flash for me several times. The auto-update arrow icon seems to turn from green to red to brown (?), and once it's past green, flash stops working, more or less forcing me to restart it. It's pretty much the equivalent of forcing a reboot of an OS like Android.
- georgemcbay 14y ago
  Much harder for an OS than an app. Phone makers have their own custom set of drivers for driving their unique hardware and these often have to be changed in subsequent releases to deal with changes to the hardware abstraction layer. And even for releases that don't change the exposed hardware abstraction layer it can be really difficult to know if each phone maker's drivers will deal properly with subtle changes to the underlying OS. This is not an impossible problem to mostly-solve, but it is orders of magnitude harder than what Chrome browser has to deal with.
  - ajross 14y ago
    Exactly. I mean, Chrome itself (being an app) is pushing updates on android at a cadence now that almost matches what they are doing on the desktop. Doing hardware integration is a lot harder than writing an app. I wish more app developers recognized this. (That said: I do think Google could have done a much better job at separating out the true kernel/HAL/BSP layer stuff, which needs to be done per-device, from the framework layers that are largely device-independent. There's no reason to force a full hardware test just to push an fix for the Intents framework or whatever).
    - DigitalJack 14y ago
      I can't even run chrome on my android (2.3). I've resorted to Firefox which is actually pretty nice.
      - cpeterso 14y ago
        Firefox for Android supports Froyo (2.2) up the latest Jelly Bean (4.2). Chrome for Android only supports ICS (4.0).
        brian_cloutier 14y ago
        Performance is part of the Chrome brand and supporting 2.3 would only serve to weaken that brand. It would also require a monumental engineering effort.
- benburleson 14y ago
  If OTA updates aren't baked into the existing OS, it's highly unlikely that will be possible.
- marssaxman 14y ago
  The day Google auto-pushes a new OS to my phone is the last day I ever use any Android device. It is my device, not theirs, and I will decide when and if I will change its OS.
guelo 14y ago
Your slander against Rubin, that he was the major factor, is unsubstantiated. And your 'X' sentence makes no sense, it translates to "He thought nothing was secure", huh?
- dguido 14y ago
  His attitude towards security is well known among those attempting to help make Android devices safe for people to use. His refusal to believe that a device could be both safe to use and popular or safe to use and useful has directly led to hundreds of millions of unsafe devices around the world.
  - hhw 14y ago
    He's not wrong. There's always a tradeoff between security and usability. http://www.schneier.com/blog/archives/2009/08/security_vs_usa.html http://www.schneier.com/blog/archives/2009/08/security_vs_us... The key is finding the right balance.
    - duaneb 14y ago
      Surely some security comes for "free". My iPhone has military grade encryption, but all I see is a 4 digit passcode. If I shut it off, however, and have the 10 max attempts, then it's virtually impossible to break in (without other data, e.g. smudges where the passcode numbers are). In any case, it should be a tradeoff the user controls. People have drastically different needs, think OpenBSD versus Windows for a usability/security tradeoff.
      - Evbn 14y ago
        You are aware the jail breaking exists, right? So iPhones aren't so secure.
        duaneb 14y ago
        > So iPhones aren't so secure. What's your benchmark? If you have access to the hardware virtually everything can be jailbroken. With the iPhone, however, you can't do it non-destructively (i.e. you can't get personal information). At least that's my understanding, if I'm wrong please correct me.
Evbn 14y ago
Chrome has the same security issues as Android, but it isn't obvious until Chrome becomes the whole UX. Which it is now.
rdl 14y ago
I think you're probably right, and this was one of my biggest problems with the Android platform. He did a lot of things right, but was completely wrong about security, and from what I've heard, actively stood in the way of the Chrome/ChromeOS people improving Android security.

by dguido 14y ago

jmillikin 14y ago

Not to mention that Chrome has figured out how to push updates, while a majority of Androids are still running a version released over two years ago. If Google can start pushing auto-updates to all of its devices, that would be one of the greatest improvements ever made to Android. Also, one of Chrome's most touted features is performance, which has always been Android's weakest point. Hopefully he'll be willing to assign more people to the task of making Androids work as smoothly as iPhones.

laureny 14y ago
> Not to mention that Chrome has figured out how to push updates, while a majority of Androids are still running a version released over two years ago. The reason for the hold out is the carriers, not Google. Google is very good at pushing updates to phones when it's not limited by the carriers (and Android implemented over the air updates years before anyone else did. iPhones still require cables to be updated).
- jojopotato 14y ago
  I haven't required a cable for an iOS update for a while.
- jhammer 14y ago
  iPhones have not required tethered updating for a year and a half now. OTA updating arrived in iOS 5.
- chaz 14y ago
  > The reason for the hold out is the carriers, not Google For a Google SVP, much of the role is external. If getting partners on board is important and it hasn't happened, then you're out.
- deleted 14y ago
  [deleted]
- jmillikin 14y ago
  > The reason for the hold out is the carriers, not > Google. Google is very good at pushing updates to > phones when it's not limited by the carriers I didn't imply it had to be a technical solution. If users can't update their phones that run Google's operating system because Google isn't leaning hard enough on the carriers, then Google needs to fix that. Apple has managed to strong-arm the carriers into letting it supports its customers, and Google's market position isn't too much weaker than Apple. > iPhones still require cables to be updated). iOS has supported OTA updates since iOS 5, which was released almost two years ago.
  - kronholm 14y ago
    Just to add data to those wondering, iOS 5 released 16 months ago (http://en.wikipedia.org/wiki/IOS_version_history http://en.wikipedia.org/wiki/IOS_version_history)
  - Evbn 14y ago
    Google is responsible for pushing updates to some other company's customers against that company's will? Google's customers get updates just fine.
- jgeorge 14y ago
  Andy's previous company implemented over the air updates years before anyone had even thought of Android or iOS. :-)
- lttlrck 14y ago
  "iPhones still require cables to be updated" Only for power and it's just a recommendation...
  - hackmiester 14y ago
    Updating a firmware while on battery is a pretty bad idea, so I can see why it's recommended.
- seanmcdirmid 14y ago
  >iPhones still require cables to be updated This simply isn't true.
nollidge 14y ago
Are you talking updates without prompting the user? My Nexus (original) updates itself every so often with a prompt.
- ConstantineXVI 14y ago
  I'm led to believe there's some kind of regulation preventing phones from updating without user intervention, given the 'you will not be able to make emergency calls' prompt most phones seem to show on an update.
- wmf 14y ago
  No, we're talking about any updates, which is more than most Android phones receive.
- jmillikin 14y ago
  Android ought to update like Chrome: silently downloaded via Wifi (optionally via 3G/4G), installed in the background to whatever extent possible, and then show a reboot prompt only if needed. Android is a Linux distribution, so most updates ought to be possible without having to reboot the device.
  - philsnow 14y ago
    Chrome's auto-updating has broken flash for me several times. The auto-update arrow icon seems to turn from green to red to brown (?), and once it's past green, flash stops working, more or less forcing me to restart it. It's pretty much the equivalent of forcing a reboot of an OS like Android.
georgemcbay 14y ago
Much harder for an OS than an app. Phone makers have their own custom set of drivers for driving their unique hardware and these often have to be changed in subsequent releases to deal with changes to the hardware abstraction layer. And even for releases that don't change the exposed hardware abstraction layer it can be really difficult to know if each phone maker's drivers will deal properly with subtle changes to the underlying OS. This is not an impossible problem to mostly-solve, but it is orders of magnitude harder than what Chrome browser has to deal with.
- ajross 14y ago
  Exactly. I mean, Chrome itself (being an app) is pushing updates on android at a cadence now that almost matches what they are doing on the desktop. Doing hardware integration is a lot harder than writing an app. I wish more app developers recognized this. (That said: I do think Google could have done a much better job at separating out the true kernel/HAL/BSP layer stuff, which needs to be done per-device, from the framework layers that are largely device-independent. There's no reason to force a full hardware test just to push an fix for the Intents framework or whatever).
  - DigitalJack 14y ago
    I can't even run chrome on my android (2.3). I've resorted to Firefox which is actually pretty nice.
    - cpeterso 14y ago
      Firefox for Android supports Froyo (2.2) up the latest Jelly Bean (4.2). Chrome for Android only supports ICS (4.0).
      - brian_cloutier 14y ago
        Performance is part of the Chrome brand and supporting 2.3 would only serve to weaken that brand. It would also require a monumental engineering effort.
benburleson 14y ago
If OTA updates aren't baked into the existing OS, it's highly unlikely that will be possible.
marssaxman 14y ago
The day Google auto-pushes a new OS to my phone is the last day I ever use any Android device. It is my device, not theirs, and I will decide when and if I will change its OS.

guelo 14y ago

Your slander against Rubin, that he was the major factor, is unsubstantiated. And your 'X' sentence makes no sense, it translates to "He thought nothing was secure", huh?

dguido 14y ago
His attitude towards security is well known among those attempting to help make Android devices safe for people to use. His refusal to believe that a device could be both safe to use and popular or safe to use and useful has directly led to hundreds of millions of unsafe devices around the world.
- hhw 14y ago
  He's not wrong. There's always a tradeoff between security and usability. http://www.schneier.com/blog/archives/2009/08/security_vs_usa.html http://www.schneier.com/blog/archives/2009/08/security_vs_us... The key is finding the right balance.
  - duaneb 14y ago
    Surely some security comes for "free". My iPhone has military grade encryption, but all I see is a 4 digit passcode. If I shut it off, however, and have the 10 max attempts, then it's virtually impossible to break in (without other data, e.g. smudges where the passcode numbers are). In any case, it should be a tradeoff the user controls. People have drastically different needs, think OpenBSD versus Windows for a usability/security tradeoff.
    - Evbn 14y ago
      You are aware the jail breaking exists, right? So iPhones aren't so secure.
      - duaneb 14y ago
        > So iPhones aren't so secure. What's your benchmark? If you have access to the hardware virtually everything can be jailbroken. With the iPhone, however, you can't do it non-destructively (i.e. you can't get personal information). At least that's my understanding, if I'm wrong please correct me.

Evbn 14y ago

Chrome has the same security issues as Android, but it isn't obvious until Chrome becomes the whole UX. Which it is now.

rdl 14y ago

I think you're probably right, and this was one of my biggest problems with the Android platform. He did a lot of things right, but was completely wrong about security, and from what I've heard, actively stood in the way of the Chrome/ChromeOS people improving Android security.