Slashdot Mirror
Wireless Carriers Put On Notice About Providing Regular Android Security Updates
msm1267 writes "Activist Chris Soghoian, who in the past has targeted zero-day brokers with his work, has turned his attention toward wireless carriers and their reluctance to provide regular device updates to Android mobile devices. The lack of updates leaves millions of Android users sometimes upwards of two revs behind in not only feature updates, but patches for security vulnerabilities. 'With Android, the situation is worse than a joke, it’s a crisis,' said Soghoian, principal technologies and senior policy analyst with the American Civil Liberties Union. 'With Android, you get updates when the carrier and hardware manufacturers want them to go out. Usually, that’s not often because the hardware vendor has thin [profit] margins. Whenever Google updates Android, engineers have to modify it for each phone, chip, radio card that relies on the OS. Hardware vendors must make a unique version for each device and they have scarce resources. Engineers are usually focused on the current version, and devices that are coming out in the next year.'"
Does Dalvik have the same security problems Oracle Java does? If so this is a serious problem
Some drink at the fountain of knowledge. Others just gargle.
Handset manufacturers should stop screwing with it so much, if they used pure android it wouldnt be so much work to get updates out.
"said Soghoian, principal technologies and senior policy analyst with the American Civil Liberties Union."
Finally, an article about the dangers of Android that quotes someone I'm prepared to listen to. I'm not entirely sure why the ACLU would be involved in this stuff, but I do have some respect for them and believe them to be objective in this matter.
I'm tired of the barrage of articles about the security problems with Android, and the need for anti-virus to resolve them - quoting people paid by the anti-virus companies.
If the carriers were what most of us want, i.e. dumb pipes, then we could possibly own our phones and upgrade them in a much easier fashion (so long as the hardware manufacturer is still providing updates).
Verizon's treatment of the Samsung Galaxy Nexus has been an eye opening experience and I'm still trying to figure out an alternative solution.
What lack of flash support?
Adobe killed flash for all devices post 4.0.
Nonsense. Why would carriers interfere with the current Android upgrade model: Buy a new phone with the current release of Android. And extend your contract at the same time.
The ACLU is complaining that the carriers are allowing the shackles to get all rusty and dangerous and uncomfortable, but they're not arguing for an Emancipation Proclamation: they just want the handcuffs to be adjusted and replaced regularly.
Welcome to the Panopticon. Used to be a prison, now it's your home.
You are running stock on that device?
WHY?
Because they're trying to run the device from the perspective of the average end user. And that perspective has been clad in suckiness since the beginning.
Really?
Because my iPhone 3G didn't get the last few updates. And courtesy of Apple, it no longer streams Netflix. Because crApple is so incompetent, they can't even manage app versions.
Case in point. I have iPhon4 and 3G. iPhone 4s are running iOS5 & 6. Which the new Netflix app requires. However, the 3G model is not able to update to iOS5. But iTunes only allows for one instance of an app. So you'll find that you're old phones are now updated to versions of applications they cannot run.
Get off your high crApple horse. The platform has major suckage. Want to bet $250?
Move a photo you take with your phone into another folder. (No, don't just create a reference. Actually MOVE IT!!!)
If they don't tinker with the OS, how are they supposed to add value?
Why, with what you're suggesting, they would just be commodity dumb pipes. When has a phone company ever admitted that?
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
Whenever Google updates Android, engineers have to modify it for each phone, chip, radio card that relies on the OS. Hardware vendors must make a unique version for each device and they have scarce resources
How come the cyanogenmod people do a better job than everyone else in the industry?
I just upgraded a LS670 last weekend to cyanogenmod. CM9 if I recall. Its faster, looks better, more features, MUCH newer which would imply fewer holes, overall quite a massive improvement over stock. It no longer has cell service, I'm using this phone as a wifi microtablet, quite happily.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Why not just flash a new ROM instead of using the OTA update?
If you wanted to use OTAs, why flash Clockwork at all?
Go re-read why worse is better http://www.dreamsongs.com/RiseOfWorseIsBetter.html and realize any form of micro-architecture has long since been destroyed by the formidable drive of the monolithic design and it's ability to be simultaneously horrible and intractably irremovable from the minds of the vast majority of engineers, along with being faster to get out the door and therefore meeting all requirements of the business people who actually shove all this garbage down our throats.
Wouldn't matter. The problem is more political than technical. Carriers are the ones who push updates, and they don't care especially in the US. Check EU versions of US phones and you'll see many more updates that never make it out here.
Some of that is for a good reason. Carriers put phones through very rigorous acceptance testing that takes weeks to finish. It tests the phone as a whole, not individual modules. Trying to push out partial updates would screw with their process and cost tens of millions. It would also lead to people having versions of modules that were never tested together, an increased possibility of bricking your phone. When your device is seen as a consumer utility that just really isn't an option.
I still have more fans than freaks. WTF is wrong with you people?
Nonsense.
The core problem with Android is a core problem with ARM, namely that all of the nice plug-and-play stuff that lets a single kernel, and thus an Ubuntu live CD, boot on many systems doesn't exist in ARM. So each handset has to have the kernel adapted to it. And since this adaptation has to be done for every kernel Google releases, the handset vendors get lazy particularly as the kernel moves on and leaves their older, out of tree drivers behind.
This has little to nothing to do with regular Linux distros because compatibility across them is actually quite good and as of Jellybean there is nothing other than the kernel in Android that is used by other open source projects.
That they fail to push security fixes, let alone new Android versions, is because they just don't give a fuck.
In previous comments related to carriers and phones, I stated that I am done with carrier games.
I am done with carriers selling me "discounted" phones which are actually far over-priced when required and unwanted data plans are added to the mix. I am done with carriers and their spyware and bloatware. I am done with carriers controlling the obsolesence of my device by providing late updates or failing to update them at all.
Long ago I recognized the potential for security issues which predictably would not be managed by the carriers well or at all.
Apple has it easier and it was by design. There are fewer models of iPhone so everyone is happier. Users know what they've got. The accessory makers are better guaranteed sales of mass produced products. Apple's carriers don't get to corrupt the iPhone and therefore there is more sanity when it comes to user concerns like bugs and security.
I have a Google Nexus. Not quite my ideal phone, but less expensive than unlocked/unbranded Samsung Galaxy S3. It is more likely to get updates and fixes and within my power to install and use custom ROMs.
Carriers care more about themselves than their customers. It is clear and evident. Why keep hoping and demanding that they care? Know them for what they are and respond.
The real problem is that customers in the US get completely and utterly screwed by the carriers. Really, you guys take it hard in the arse and pay though the nose for the privilege.
In the UK you can get a phone on contract from a third party. You get the same contract deal as you would going directly to the carrier, although often for £5/month less. The phone is unlocked and unbranded, you get updates directly from the manufacturer and no pre-installed carrier crapware. There are some good deals on offer too, for example 3 do a really unlimited data plan. A friend of mine runs Android uTorrent on it.
Regulation has delivered this for us. It is really easy to switch provider and take your number with you. Contract terms are heavily regulated to make sure they are fair and reasonable. It isn't perfect by a long way but it saves us from the rip-off hell that the US mobile market suffers from.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Not everyone with a Windows PC has had their identities stolen and bank accounts empties. Oh any by the way, "security" is just a convenient excuse for censoring apps. Look at the big stories of Apple censorship - they have nothing to do with security and everything to do with Apple enforcing their own morals.
Security my ass.
Are you in?
I have an iPod touch, gen 2, which has been stranded. I wish I could get an update on it. but the CPU on it is too old, so they don't support CPU hog IOS5 on it.
I hear people complaining about this, and I don't get it. Maybe they don't remember the 80s and 90s when your computer was out of date within a few months, and it wasn't long before you couldn't run the newest and greatest software. Today, computers have a much longer lifetime than they did back then. I point this out because that's where we are with these portable computers (iPhones, Android phones, tablets, etc.) - we're still in that early and fast update phase. Early on, each new iteration was leaps and bounds ahead of the prior one, and the pace is only starting to slow down now. The pace will speed up again if and when better battery technology shows up.
And, frankly, they pushed out updates for the Touch 2nd Gen for quite some time. Don't act like it was abandoned 3 weeks after they released it, because it wasn't. Updates were available for a long time for it.