Slashdot Mirror
Google Pressured 90,000 Android Developers Over Insecure Apps (pcworld.com)
An anonymous reader quotes PCWorld:
Over the past two years, Google has pressured developers to patch security issues in more than 275,000 Android apps hosted on its official app store. In many cases this was done under the threat of blocking future updates to the insecure apps...
In the early days of the App Security Improvement program, developers only received notifications, but were under no pressure to do anything. That changed in 2015 when Google expanded the types of issues it scanned for and also started enforcing deadlines for fixing many of them... Google added checks for six new vulnerabilities in 2015, all of them with a patching deadline, and 17 in 2016, 12 of which had a time limit for fixes. These issues ranged from security flaws in third-party libraries, development frameworks and advertising SDKs to insecure implementations of Android Java classes and interfaces.
100,000 applications had been patched by April of 2016, but that number tripled over the next nine months, with 90,000 developers fixing flaws in over 275,000 apps.
In the early days of the App Security Improvement program, developers only received notifications, but were under no pressure to do anything. That changed in 2015 when Google expanded the types of issues it scanned for and also started enforcing deadlines for fixing many of them... Google added checks for six new vulnerabilities in 2015, all of them with a patching deadline, and 17 in 2016, 12 of which had a time limit for fixes. These issues ranged from security flaws in third-party libraries, development frameworks and advertising SDKs to insecure implementations of Android Java classes and interfaces.
100,000 applications had been patched by April of 2016, but that number tripled over the next nine months, with 90,000 developers fixing flaws in over 275,000 apps.
This write-up sounds awfully negative, but if your software is so bad that it can be auto detected to be insecure, you belong in the penalty box until you make it right. Be respectful of users' data.
Seems like a good idea
How dare Google coerce my apps? My apps can be as insecure as they want to be!
Women who voted Trump have gaping wide meaty pussies.
I've worked at Google and at two security companies and Google is the only company I know that actually takes software security seriously. In the 'security' companies security is pure theater, they do have security teams but their powers are on paper only, in practice they are merely seen as little annoyance by the development teams. The security teams mostly go with whatever you tell them, and even if they know that the reports you are filing are omitting issues they have to take it at face value. It is even worse with external auditors, you simply tell them you will take your business elsewhere and they will keep a blind eye to all the security issues as long as it is not to obvious in published reports. Their main focus is for you to pass the audits, not actually comply with them.
So hats down to Google to actually force developers, their message is clear: No security, no business. As long as other companies are seeing security as less business, they will not take it seriously. Personally I believe government should enforce criminal neglect more. How many bankers, CEOs, VPs went to jail over all the scandals in the past 10 years? Not many.
... which quietly adds more permissions yhat most apps will ever need
> implying android was ever great before
What the Zuck was that?
Oh yeah! So much flesh to grab.
Zuck will save you the trouble of voting because when Zuck runs for prez Zuck will be unopposed. Hawaii now, America soon. All will belong to Zuck.
All the apps require all the rights. If I do not give them the permissions they won't run. So I have no choice, I have no security then and I cannot store any valuable data on the phone.
Why the apps are lying they need global files access to only store their own data? I have found in some Android SDK doc they can store their own data even without global files access.
Other apps could provide functionality without that specific feature but they refuse to run at all unless they get all the permissions they ask for.
Even opening local files could be done safely by an Android-provided dialog box, without giving uncontrolled permissions to the whole disk.
Pressured? Or strongly encouraged? To make their apps more secure. To protect customers, Why is this bad?
trump is making communication laws work
The developers dont care. If 90% will blindly click install -- job done.
So the size of a man's penis is important to you?
Podestas email was chock full of dog whistles, aka code words. The whole DNC strategy involved conveying different messages to the different constituencies.
To be clear about how tinfoil hat this is, the "code word" for the pizza show owner was "pizza" which seems like a word that, I don't know, a pizza shop owner might just want to use for their routine business.
i would like to sandbox every applucation so their camera access only gets an avatar gif loop and the microphone access gets a loop of some shitty elevator music with a chop saw in the background cutting metal and the disk access is a sandboxed default Android image.
where is the application that lets me do this for nagging apps that reqiure all this to run and i dont get benefit from it?
I find this leaves a rather bitter taste in my mouth.. I once found an SQL injection flaw in one of my libraries then spent 30 hours populating the fix to all "infected" libraries....