4 ms·

This is a sorta common thing to do when installing complex software; especially hacks like this that could be detected as a rootkit. If during the install, some

by smtddr 13y ago

This is a sorta common thing to do when installing complex software; especially hacks like this that could be detected as a rootkit. If during the install, some anti-virus decidecs to quarantine a file and the updating of hyper-sensitive data locations(firmware/bootloader/etc) fails at some random block I/O .... that device is finished, unless you have the right JTAG unit, have the stock(proprietary) binaries, have the chip-schematics for the pin-outs...

voltagex_ 13y ago
I realise that, but it doesn't sound like the CyanogenMod installer is using Android rootkits or anything like that so wouldn't it be better to test it against a few AVs?
- smtddr 13y ago
  I think Cyanogenmod can be considered dangerous to your device. And to be honest, I actually do think AVs should flag it. It's a good barrier to entry. A user that doesn't trust the developers of Cyanogenmod enough to turn of AV(or add to AV-ignore-list) during install, is a user that shouldn't be using Cyanogenmod to begin with imho.
  - voltagex_ 13y ago
    I'll bite. Where's the install step that asks the user to verify the origin and hash of the installer binary? Why can't I see the source of the installer? Where are the GPG keys? It's not just some game you're downloading, it's a ROM for the device you're (statistically) putting the details of your life into. Trust? Don't get me started. Edit: >beta.download.cyanogenmod.org uses an invalid security certificate. >The certificate is only valid for the following names: > *.cyanogenmod.org , cyanogenmod.org
    - Karunamon 13y ago
      Shouldn't beta.download.cyanogenmod.org be covered under the *.cyanogenmod.org wildcard cert?
      - pplante 13y ago
        wildcard certs only support 1 level of subdomains. they would need to purchase a wildcard for *.download.cyanogenmod.org.
    - danboarder 13y ago
      a fix would be to use betadownload.cyanogenmod.org which is a single level subdomain (rather than beta.download...)
- ploxiln 13y ago
  In my opinion, anti-virus should be turned off and uninstalled. AV software kills performance, and has false positives and false negatives all the time, and just screws up systems all the time. It's really not worth it; you're going to have a bad time unless you take care to not install junk. (junk may include all microsoft and adobe software ...) I suppose I should add the disclaimer that I've used primarily linux for 6 years and rebooted into OS X for gaming for a couple years now. But I've seen it all with Windows + AV, I've serviced computers for common folk, and we still see stories on HN about AV accidentally quarantining a dll needed to boot.
  - mistermann 13y ago
    I've done the opposite of your suggestions going on 10 years now and only ever gotten one virus. AV used to kill performance, but if you have even a mid-range system nowadays its rarely very noticeable, especially if you have an SSD.

by smtddr 13y ago

voltagex_ 13y ago

I realise that, but it doesn't sound like the CyanogenMod installer is using Android rootkits or anything like that so wouldn't it be better to test it against a few AVs?

smtddr 13y ago
I think Cyanogenmod can be considered dangerous to your device. And to be honest, I actually do think AVs should flag it. It's a good barrier to entry. A user that doesn't trust the developers of Cyanogenmod enough to turn of AV(or add to AV-ignore-list) during install, is a user that shouldn't be using Cyanogenmod to begin with imho.
- voltagex_ 13y ago
  I'll bite. Where's the install step that asks the user to verify the origin and hash of the installer binary? Why can't I see the source of the installer? Where are the GPG keys? It's not just some game you're downloading, it's a ROM for the device you're (statistically) putting the details of your life into. Trust? Don't get me started. Edit: >beta.download.cyanogenmod.org uses an invalid security certificate. >The certificate is only valid for the following names: > *.cyanogenmod.org , cyanogenmod.org
  - Karunamon 13y ago
    Shouldn't beta.download.cyanogenmod.org be covered under the *.cyanogenmod.org wildcard cert?
    - pplante 13y ago
      wildcard certs only support 1 level of subdomains. they would need to purchase a wildcard for *.download.cyanogenmod.org.
  - danboarder 13y ago
    a fix would be to use betadownload.cyanogenmod.org which is a single level subdomain (rather than beta.download...)
ploxiln 13y ago
In my opinion, anti-virus should be turned off and uninstalled. AV software kills performance, and has false positives and false negatives all the time, and just screws up systems all the time. It's really not worth it; you're going to have a bad time unless you take care to not install junk. (junk may include all microsoft and adobe software ...) I suppose I should add the disclaimer that I've used primarily linux for 6 years and rebooted into OS X for gaming for a couple years now. But I've seen it all with Windows + AV, I've serviced computers for common folk, and we still see stories on HN about AV accidentally quarantining a dll needed to boot.
- mistermann 13y ago
  I've done the opposite of your suggestions going on 10 years now and only ever gotten one virus. AV used to kill performance, but if you have even a mid-range system nowadays its rarely very noticeable, especially if you have an SSD.