Slashdot Mirror
Wireless Carriers Put On Notice About Providing Regular Android Security Updates
msm1267 writes "Activist Chris Soghoian, who in the past has targeted zero-day brokers with his work, has turned his attention toward wireless carriers and their reluctance to provide regular device updates to Android mobile devices. The lack of updates leaves millions of Android users sometimes upwards of two revs behind in not only feature updates, but patches for security vulnerabilities. 'With Android, the situation is worse than a joke, it’s a crisis,' said Soghoian, principal technologies and senior policy analyst with the American Civil Liberties Union. 'With Android, you get updates when the carrier and hardware manufacturers want them to go out. Usually, that’s not often because the hardware vendor has thin [profit] margins. Whenever Google updates Android, engineers have to modify it for each phone, chip, radio card that relies on the OS. Hardware vendors must make a unique version for each device and they have scarce resources. Engineers are usually focused on the current version, and devices that are coming out in the next year.'"
Does Dalvik have the same security problems Oracle Java does? If so this is a serious problem
Some drink at the fountain of knowledge. Others just gargle.
Handset manufacturers should stop screwing with it so much, if they used pure android it wouldnt be so much work to get updates out.
"said Soghoian, principal technologies and senior policy analyst with the American Civil Liberties Union."
Finally, an article about the dangers of Android that quotes someone I'm prepared to listen to. I'm not entirely sure why the ACLU would be involved in this stuff, but I do have some respect for them and believe them to be objective in this matter.
I'm tired of the barrage of articles about the security problems with Android, and the need for anti-virus to resolve them - quoting people paid by the anti-virus companies.
If they don't tinker with the OS, how are they supposed to add value?
Why, with what you're suggesting, they would just be commodity dumb pipes. When has a phone company ever admitted that?
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
Whenever Google updates Android, engineers have to modify it for each phone, chip, radio card that relies on the OS. Hardware vendors must make a unique version for each device and they have scarce resources
How come the cyanogenmod people do a better job than everyone else in the industry?
I just upgraded a LS670 last weekend to cyanogenmod. CM9 if I recall. Its faster, looks better, more features, MUCH newer which would imply fewer holes, overall quite a massive improvement over stock. It no longer has cell service, I'm using this phone as a wifi microtablet, quite happily.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Wouldn't matter. The problem is more political than technical. Carriers are the ones who push updates, and they don't care especially in the US. Check EU versions of US phones and you'll see many more updates that never make it out here.
Some of that is for a good reason. Carriers put phones through very rigorous acceptance testing that takes weeks to finish. It tests the phone as a whole, not individual modules. Trying to push out partial updates would screw with their process and cost tens of millions. It would also lead to people having versions of modules that were never tested together, an increased possibility of bricking your phone. When your device is seen as a consumer utility that just really isn't an option.
I still have more fans than freaks. WTF is wrong with you people?
Nonsense.
The core problem with Android is a core problem with ARM, namely that all of the nice plug-and-play stuff that lets a single kernel, and thus an Ubuntu live CD, boot on many systems doesn't exist in ARM. So each handset has to have the kernel adapted to it. And since this adaptation has to be done for every kernel Google releases, the handset vendors get lazy particularly as the kernel moves on and leaves their older, out of tree drivers behind.
This has little to nothing to do with regular Linux distros because compatibility across them is actually quite good and as of Jellybean there is nothing other than the kernel in Android that is used by other open source projects.
That they fail to push security fixes, let alone new Android versions, is because they just don't give a fuck.
In previous comments related to carriers and phones, I stated that I am done with carrier games.
I am done with carriers selling me "discounted" phones which are actually far over-priced when required and unwanted data plans are added to the mix. I am done with carriers and their spyware and bloatware. I am done with carriers controlling the obsolesence of my device by providing late updates or failing to update them at all.
Long ago I recognized the potential for security issues which predictably would not be managed by the carriers well or at all.
Apple has it easier and it was by design. There are fewer models of iPhone so everyone is happier. Users know what they've got. The accessory makers are better guaranteed sales of mass produced products. Apple's carriers don't get to corrupt the iPhone and therefore there is more sanity when it comes to user concerns like bugs and security.
I have a Google Nexus. Not quite my ideal phone, but less expensive than unlocked/unbranded Samsung Galaxy S3. It is more likely to get updates and fixes and within my power to install and use custom ROMs.
Carriers care more about themselves than their customers. It is clear and evident. Why keep hoping and demanding that they care? Know them for what they are and respond.
The real problem is that customers in the US get completely and utterly screwed by the carriers. Really, you guys take it hard in the arse and pay though the nose for the privilege.
In the UK you can get a phone on contract from a third party. You get the same contract deal as you would going directly to the carrier, although often for £5/month less. The phone is unlocked and unbranded, you get updates directly from the manufacturer and no pre-installed carrier crapware. There are some good deals on offer too, for example 3 do a really unlimited data plan. A friend of mine runs Android uTorrent on it.
Regulation has delivered this for us. It is really easy to switch provider and take your number with you. Contract terms are heavily regulated to make sure they are fair and reasonable. It isn't perfect by a long way but it saves us from the rip-off hell that the US mobile market suffers from.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Not everyone with a Windows PC has had their identities stolen and bank accounts empties. Oh any by the way, "security" is just a convenient excuse for censoring apps. Look at the big stories of Apple censorship - they have nothing to do with security and everything to do with Apple enforcing their own morals.
Security my ass.
I have an iPod touch, gen 2, which has been stranded. I wish I could get an update on it. but the CPU on it is too old, so they don't support CPU hog IOS5 on it.
I hear people complaining about this, and I don't get it. Maybe they don't remember the 80s and 90s when your computer was out of date within a few months, and it wasn't long before you couldn't run the newest and greatest software. Today, computers have a much longer lifetime than they did back then. I point this out because that's where we are with these portable computers (iPhones, Android phones, tablets, etc.) - we're still in that early and fast update phase. Early on, each new iteration was leaps and bounds ahead of the prior one, and the pace is only starting to slow down now. The pace will speed up again if and when better battery technology shows up.
And, frankly, they pushed out updates for the Touch 2nd Gen for quite some time. Don't act like it was abandoned 3 weeks after they released it, because it wasn't. Updates were available for a long time for it.