Android vulnerabilities

Forums › Android › Android vulnerabilities

1 | 2 | 3 | 4

20591 posts

Uber Geek

Trusted

Lifetime subscriber

#1608512 10-Aug-2016 12:21

NikT:

The average customer does not care about updates, or actively hates them (For which I largely blame legacy versions of Windows)

Good point there. My wife didn't like the update of her Moto G from Android 4.4 to Android 5 (I think it was that one) as it made battery life and user interface quite a bit worse.

gzt

17165 posts

Uber Geek

Lifetime subscriber

#1608519 10-Aug-2016 12:51

Microsoft Windows still has the best same version support life. This might be changing with 10, if things like Anniversary are required to move forward (Enterprise LTSB hopefully excepted).

Ubuntu gives two years on LTS, no idea if that translates over to Ubuntu Phone.

Android at the Google end may be a couple of years but carriers are slack with minor updates. Maybe there is room for carriers to be more friendly to minor Android security updates. Unfortunately, doing nothing is the safest option for carriers.

rmt38

320 posts

Ultimate Geek
Inactive user

#1608576 10-Aug-2016 13:40

NikT:

Look, as an enthusiast who got to see the inner workings of the industry, I feel you. I'm passionate about updates and security, and it bothers me that there's a trade-off between the best network experience and timely feature/bugfix/security patches. But the reality is that an update to the G4 isn't going to come any faster if 2degrees' devices team calls up LG Australia and complains. NZ is too small, the volumes sold here are too low to make a difference, and the solutions have to come from a different place.

Perhaps, Nik, you can comment on the suitability of recommending people buy parallel imported devices whether through somewhere like PBTech where they'll get consumer guarantees protection, or imported themselves.

Can't this bypass the two problems - sku and telco - and result in immediate updates in parallel with the major markets? And it can likely be done with consumer guarantees protection via PBtech or similar outfits?

tripp

3848 posts

Uber Geek

Trusted

Lifetime subscriber

#1608577 10-Aug-2016 13:40

So that asks a question should OEM's have a paid support model in place to supply updates to their devices. I would pay for fast updates however any phone I buy in NZ tend to have telco bloat which then puts another layer in the mix for upgrades.

timmmay

20591 posts

Uber Geek

Trusted

Lifetime subscriber

#1608583 10-Aug-2016 13:43

gzt: Ubuntu gives two years on LTS, no idea if that translates over to Ubuntu Phone.

Ubuntu LTS typically gives 5 years support.

tripp

3848 posts

Uber Geek

Trusted

Lifetime subscriber

#1608587 10-Aug-2016 13:46

rmt38:

NikT:

Look, as an enthusiast who got to see the inner workings of the industry, I feel you. I'm passionate about updates and security, and it bothers me that there's a trade-off between the best network experience and timely feature/bugfix/security patches. But the reality is that an update to the G4 isn't going to come any faster if 2degrees' devices team calls up LG Australia and complains. NZ is too small, the volumes sold here are too low to make a difference, and the solutions have to come from a different place.

Perhaps, Nik, you can comment on the suitability of recommending people buy parallel imported devices whether through somewhere like PBTech where they'll get consumer guarantees protection, or imported themselves.

Can't this bypass the two problems - sku and telco - and result in immediate updates in parallel with the major markets? And it can likely be done with consumer guarantees protection via PBtech or similar outfits?

Parallel imported devices also have issues with updates if they are tied in anyway to a 3rd party. The only way to make sure you get updates directly from the OEM is to get a non branded device. These are not sold in many markets however. I am not sure why but it could be tied to telco's selling the phones.

In NZ for samsung there are no "non branded" devices (even when you purchase from a samsung mall stand). The closes we have is non branded AU firmware which is getting monthly updates.

This is why the nexus range was good, however over the last year or 2 some telco's (looking at 2degrees) could put a stop to updates, you could get around it however by putting in a spark or vodafone sim card into the nexus and rebooting (the update would come up right after reboot).

richms

28218 posts

Uber Geek

Trusted

Lifetime subscriber

#1608605 10-Aug-2016 14:05

Really wish the phone makers would get together and form an alliance that just says no to the relics with the bloat and update approvals.

But while so much of the world is stuck in the subsidized device business model still that's probably not going to happen. I have more faith in updates from random Chinese phones than anything with telco branding on it.

Richard rich.ms

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

NikT

1710 posts

Uber Geek

Trusted

#1608606 10-Aug-2016 14:11

gzt:

Android at the Google end may be a couple of years but carriers are slack with minor updates. Maybe there is room for carriers to be more friendly to minor Android security updates. Unfortunately, doing nothing is the safest option for carriers.

That's the manufacturers, not the telcos. NZ's small market = low priority for global resources. The telcos' only concern is 'Does the update perform as expected on the network?' e.g. emergency calling, which I'm sure (or at least I hope) we can all agree is important.

US telcos, which most publicly available information concerns, are a different story and irrelevant to NZ.

rmt38:

Perhaps, Nik, you can comment on the suitability of recommending people buy parallel imported devices whether through somewhere like PBTech where they'll get consumer guarantees protection, or imported themselves.

Can't this bypass the two problems - sku and telco - and result in immediate updates in parallel with the major markets? And it can likely be done with consumer guarantees protection via PBtech or similar outfits?

Yes and no. If you pick the right one - and there's usually no telling which is the right one at launch - you may get timely updates. If it's the same hardware variant sold in NZ, you're good to go at a base level for network compatibility. But you won't necessarily get local network tuning or optimisation. Always a balancing act.

tripp:

So that asks a question should OEM's have a paid support model in place to supply updates to their devices. I would pay for fast updates however any phone I buy in NZ tend to have telco bloat which then puts another layer in the mix for upgrades.

I'd pay for a faster update track, or at least happily enroll in a local or global beta channel. Running betas on Windows 10, iOS, and Nexus 6P right now.

tripp:

This is why the nexus range was good, however over the last year or 2 some telco's (looking at 2degrees) could put a stop to updates, you could get around it however by putting in a spark or vodafone sim card into the nexus and rebooting (the update would come up right after reboot).

Word through the grapevine was that the Nexus 5 never got proper network certification. Both 2d and Telstra AU had updates blocked at Google's end via detection of the SIM present in the handset until they'd built a new radio image to fix problems with dropouts.

richms: Really wish the phone makers would get together and form an alliance that just says no to the relics with the bloat and update approvals.

Until someone can't make an emergency call, then it's bad times. Testing is important. It takes a week max assuming no major issues are found. Apple builds time for that testing into its rollouts, and the other vendors should too. They just make it harder for themselves than it needs to be.

All of the above speaks volumes about what's happened as phones have evolved into computers. There's a disconnect between the 'phone' component, which interfaces with commercial communications networks and needs to perform as a reliable emergency communication device + support all offered services, and the 'computer' component, which requires regular security patches. Microsoft had it right back in the Windows Phone 8 days when they separated the software layer from the radio layer. Radio layer went through telco testing, software layer could be merrily pushed out to all and sundry. Doesn't solve for Android, mind, since - as mentioned in my last post - manufacturers are not incentivised to spend money upgrading old phones that do not supply them with ongoing revenue.

Product Manager @ PB Tech

Smartphones @ PB Tech | Headphones @ PB Tech

gzt

17165 posts

Uber Geek

Lifetime subscriber

#1608611 10-Aug-2016 14:20

NikT:
gzt:

Android at the Google end may be a couple of years but carriers are slack with minor updates. Maybe there is room for carriers to be more friendly to minor Android security updates. Unfortunately, doing nothing is the safest option for carriers.

That's the manufacturers, not the telcos. NZ's small market = low priority for global resources. The telcos' only concern is 'Does the update perform as expected on the network?' e.g. emergency calling, which I'm sure (or at least I hope) we can all agree is important.

US telcos, which most publicly available information concerns, are a different story and irrelevant to NZ.

If that was the case then NZ telcos would approve things like the Shellshock update almost instantly. Imho they do not.

Overseas there have been cases where minor updates broke telco phone apps (similar to myVodafone) and I would be surprised if NZ telcos did not avoid minor updates for the similar reasons.

richms

28218 posts

Uber Geek

Trusted

Lifetime subscriber

#1608623 10-Aug-2016 14:42

NikT:

richms: Really wish the phone makers would get together and form an alliance that just says no to the relics with the bloat and update approvals.

Until someone can't make an emergency call, then it's bad times. Testing is important. It takes a week max assuming no major issues are found. Apple builds time for that testing into its rollouts, and the other vendors should too. They just make it harder for themselves than it needs to be.

All of the above speaks volumes about what's happened as phones have evolved into computers. There's a disconnect between the 'phone' component, which interfaces with commercial communications networks and needs to perform as a reliable emergency communication device + support all offered services, and the 'computer' component, which requires regular security patches. Microsoft had it right back in the Windows Phone 8 days when they separated the software layer from the radio layer. Radio layer went through telco testing, software layer could be merrily pushed out to all and sundry. Doesn't solve for Android, mind, since - as mentioned in my last post - manufacturers are not incentivised to spend money upgrading old phones that do not supply them with ongoing revenue.

I dont really use the phone component. People have existed for a long time without phones. I feel that the phone in an emergency thing is just a red herring that telcos throw out there to justify stalling on things.

To me, the gains from not getting hacked seriously outweigh the small largly imagined risk that an update will render the ability to do voice calls on the device in case of an emergency. These patches are generally not things in the baseband, they are just fixing holes in the apps and services that come with android. If someone really wants a phone that can work in an emergency and not require updates there are plenty of non smart offerings available still that will never have an update during their much longer lifespan.

Richard rich.ms

olivernz

501 posts

Ultimate Geek

ID Verified

Trusted

Lifetime subscriber

#1608660 10-Aug-2016 15:15

NikT, well said. The LG was only an example. I realise the market here is small (but that also means small risk).

And that's why I bought a One Plus 3 from you guys. Let's see how that goes update wise ;-)
From what I read the OTA there is independant of where the phone is checked in.

The thing is that Google needs to get to a standard OS that is installed with no change just extra drivers. On top of that you have software/bloatware. So that you can install OS fixes without touching drivers or software. Or needs to have an "approved hardware" program that tests in house @ Google that things work.

NikT

1710 posts

Uber Geek

Trusted

#1608664 10-Aug-2016 15:18

gzt:

If that was the case then NZ telcos would approve things like the Shellshock update almost instantly. Imho they do not.

Overseas there have been cases where minor updates broke telco phone apps (similar to myVodafone) and I would be surprised if NZ telcos did not avoid minor updates for the similar reasons.

I do understand why it's easy to come to that conclusion without having seen the inner workings.

The telcos approve updates as soon as the manufacturers send them through for approval. It's the wait to receive the builds that's the trouble - and the wait for the builds to be rolled out by those manufacturers after they're approved. I saw some take months after approval notices were issued. The telcos themselves don't guard the gates to the OTA servers.

I was there when Stagefright fixes were the hot topic, and conducted the testing for several updates myself. NZ telcos don't 'avoid' updates. Certainly not for breaking in-house apps, either - that's the responsibility of the in-house developers to fix. It's a lot easier to walk across a room and ask an internal team to look into something than it is to juggle three time zones and two language barriers to ask a manufacturer's development team. :)

One thing that is worth pointing out: Google security bullitins aside, there are a lot of small updates that don't make it to NZ because they're not relevant to this market. Might be something to the tune of fixing carrier aggregation or VoLTE issues on [insert European network] that goes out to the open-market versions.

richms:

I dont really use the phone component. People have existed for a long time without phones. I feel that the phone in an emergency thing is just a red herring that telcos throw out there to justify stalling on things.

To me, the gains from not getting hacked seriously outweigh the small largly imagined risk that an update will render the ability to do voice calls on the device in case of an emergency. These patches are generally not things in the baseband, they are just fixing holes in the apps and services that come with android. If someone really wants a phone that can work in an emergency and not require updates there are plenty of non smart offerings available still that will never have an update during their much longer lifespan.

It's the law. There are regulations to which mobile phones sold through first-party channels in NZ must comply. Australia's are more restrictive, and for example require emergency calls to be accessible from a secured lockscreen when no SIM is inserted.

I hear what you're saying, and operate much the same myself, but what you (and I) want is a computer with a SIM slot, not a telephone. Physical safety takes priority over digital safety. The solution for Jane and Joe Bloggs who buy a phone and expect it to work as a phone is not 'buy another phone'.

Product Manager @ PB Tech

Smartphones @ PB Tech | Headphones @ PB Tech

olivernz

501 posts

Ultimate Geek

ID Verified

Trusted

Lifetime subscriber

#1608705 10-Aug-2016 15:54

NikT:

Yes but the LG G4 patch is available next to everywhere in the world so it must have been built. It just needs (as you said) minimal testing and rolling out. Or is that really such a naiive view of the world?

But to summarise this thread, so you buy a phone you've just let your pants down and there's no way you going to change that scenario.

rmt38

320 posts

Ultimate Geek
Inactive user

#1608713 10-Aug-2016 16:09

olivernz:

NikT:

Yes but the LG G4 patch is available next to everywhere in the world so it must have been built. It just needs (as you said) minimal testing and rolling out. Or is that really such a naiive view of the world?

But to summarise this thread, so you buy a phone you've just let your pants down and there's no way you going to change that scenario.

My summary would be that the situation is the same as it has been for years, and nothing has changed, or is likely to. Except we now have some insight, thanks to Nik. Also buy chinese self-import like richms says.

gzt

17165 posts

Uber Geek

Lifetime subscriber

#1609870 10-Aug-2016 22:45

Rumor (ars tech) has it that in future versions additional components will be updatable through the app store mechanism. It's a partial solution.

The situation already did improve with lollipop when the Webview component became automatically updatable through the app store.

At least it's progress...

1 | 2 | 3 | 4