phh

56 ms·

631.
by phh 7y ago
That's still only one source code for all of them. (Nougat never had treble) the difference there between actually one single image and five is build time. There is no additional development needed. And that still means that with five
632.
by phh 7y ago
Well, nowadays, for devices that started from Oreo or later, there is this thing called Project Treble where every device are guaranteed to boot AOSP of the same version. It is possible to use that to create generic lineage image, that ju
633.
by phh 7y ago
Reading from afar, it feels like cloudflare gained a lot financially from this crowdsourcing. But I've already suffered from such patent trolls, and I actually think crowdsourcing is a very nice way to fight them. I think it is very in
634.
by phh 7y ago
Got early access to it as well (not validated yet, Stripe's interface is really not user-friendly and asks for papers I don't usually have handy). And yeah, I totally agree with you. I felt really weird writing the tiers. GitHub&#
635.
by phh 7y ago
Phh-Treble author here. First, to outside looks, your post might be confusing: GrapheneOS and (Phh-)Treble are independent, and complementary. GrapheneOS is focusing on hardening Android (and tbh I'm impressed by Daniel Micay's wo
636.
by phh 7y ago
IMO the whole IBM blog is interesting, your quote isn't just a summary. Basically what IBM is claiming is that Google's circuit doesn't do anything useful really, it is just meant to be very complicated to do in traditional c
637.
by phh 7y ago
Carousel requiring (severely favoring?) AMP, requiring exclusively Google javascript/ads is definitely Googling using their advanced user base on search to favor their ad business. They have already been condemned for their Google Shop
638.
by phh 7y ago
I'm not seeing any iommu referenced in the device-tree, so I'd say you're right, at least in the current software.
639.
by phh 7y ago
To whoever did this: thanks! Such a website can have many uses: - Show the average people why privacy is important with concrete examples - Find previous rulings for people in a specific situation - Stop(reduce.) the "there is
640.
by phh 7y ago
I'd say it's a combination of both. Not having competition means they got a lot of users, but having long-term feature support means people didn't run away.
641.
by phh 8y ago
I've been in commercial contact with FirefoxOS people, and they were definitely targeting phones that are the same specs as what KaiOS currently supports. (512MB RAM, 4GB storage, which is half the RAM and half the storage of Android G
642.
by phh 8y ago
Short answer: no Longer answer: This article mentions how to leak the key, but it assumes that you can generate many signatures successfully. But to successfully use the key (thus sign with the key), you need to provide the password to the
643.
by phh 8y ago
For vendor patches, you really can't trust that value in any way... I'm afraid there is no real way to check, except for trying the attack. Qualcomm patches are not distributed as part of AOSP security patches, and is not tested f
644.
by phh 8y ago
That's assuming Galaxy S8+ is using Qualcomm's keymaster, I'm not too sure. Considering how Samsung is focused on security, I wouldn't be suprised if they'd use external security element like Google does on Pixel 3.
645.
by phh 8y ago
Most chromebooks have that actually. First stage bootloader is shipped read-only (and then there is a secure boot chain), but can be rewritten. It's actually a screw, and it's not totally trivial to access though.
646.
by phh 8y ago
VEVO (the music producer) have most of their free video clips under DRM
647.
by phh 8y ago
As mentioned, there are updates, but then you could have an upgrade-specific permission (there isn't one). But even when simply installing, check the workflow that the play store currently have: When you click "install" in th
648.
by phh 8y ago
Digital Turbine
649.
by phh 8y ago
Please don't assume this is a one-time event, or that it is specific to this brand or even to Chinese manufacturers. Nokia could actually be in the best half on that aspect, just got unlucky. Most of such info leaks are hidden. I'
650.
by phh 8y ago
Well, Android devices do have "Trustzone"s, where keys are bound to the hardware, and user's identification (pin/password) Sadly, Google Authenticator doesn't seem to be using that. AndOTP does have Android KeyStore
651.
by phh 8y ago
Can someone check if I'm understanding the consequences of this correctly? It seems to me there are close to none (it's still very interesting nonetheless. I wasn't aware of DFA): - You still need to have the right to view th
652.
by phh 8y ago
Well everyone there has the same holidays, and yes they mostly assume everyone they work with are well aware of it. So just ask them nicely every three months what are their next holidays
653.
by phh 8y ago
My experience with ODMs at Shenzhen was that it's usually ten days for engineers. Could be down to one week when production was halted. But yeah that means workers only had 7 days. I didn't witness five days though. And they shut
654.
by phh 8y ago
Well, I understand your opinion, though I don't agree with you. > - The chain of trust becomes completely worthless after I decide to put a new operating system on my device. This limits my choice and freedoms as a user of a device.
655.
by phh 8y ago
PC bootloader is totally insecure. And no, full-device encryption doesn't protect you much in my opinion. First, full-device encryption is much weaker if you can do offline bruteforce. With a secure boot trust of chain, it is online, a
656.
Android Pie for any unlockable Oreo Android phone(xda-developers.com)
3 points by phh 8y ago|0 comments
657.
by phh 8y ago
Well, then you'll love Android's Project Treble, and its GSIs. GSI stands for Generic System Image, which means that they separated drivers from Android framework (it is a different partition, and they can communicate only through
658.
by phh 9y ago
There is a security threat for the user, only if the user puts application inside its /system/priv-app folder. If an application is in /system/priv-app, it can do pretty much anything anyway. Worse than that, a threat-mo
659.
by phh 9y ago
Nope, GPLv3 doesn't break any security model other than security by obscurity. Android could very well use GPLv3 and have no consequence on its security model. As long as the bootloader is open-able, the Tivo-ization rule of GPLv3 is r
660.
by phh 9y ago
TL;DR: ChromeOS uses this rfc, Android, dhcpcd, isc-dhcp-client doesn't (Note: I have no clue about systemd-networkd) Ok, so the article covers ARP discover, but actually it's not the only issue. The author mentions a 10s timeout

More ›