Android libstagefright still exploitable

Re:Android libstagefright still exploitable by eropple on Thursday August 13, 2015 @02:09PM (#10056109)

I feel for people whose providers won't upgrade them and I think they've got a good complaint, but if you choose to get off the upgrade path I think it's reasonable to assert that you're assuming responsibility for your own choices and security. I expect it can be backported to 4.x via custom ROMs for folks in that spot.

[ Parent | on HN ]

Re:Android libstagefright still exploitable by cwyers on Thursday August 13, 2015 @02:25PM (#10056206)

It's not an apples-to-apples comparison, but Android has been around since 2007, and they're up to API level 22 right now. In that same time period, Microsoft has had the following releases of Windows (excluding Mobile/Phone and Server):

Vista, which actually came out in 2006 in the OEM edition Windows 7 Windows 8 Windows 8.1 Windows 10

Windows has had a much slower release cadence than Android. It's a much, much bigger burden on Google to continue to support older Android versions with bugfixes and security patches than it is Windows. Now, you can counter that Google decided on this release cadence, but still, I don't think it's reasonable to expect Google to support Android versions as long as Microsoft does Windows versions, as some here are stumping for.

(That said, every time I read an article about Android these days I get the urge to buy a Windows Phone.)

[ Parent | on HN ]

Re:Android libstagefright still exploitable by danieldk on Thursday August 13, 2015 @02:41PM (#10056303)

(That said, every time I read an article about Android these days I get the urge to buy a Windows Phone.)

I just did that two days ago, the update situation being one of the reasons (the other that I like a reasonable quality dual SIM phone).

For now, it's just an extra phone to play with (Lumia 640, cheap, great build quality/performance for the price). But who knows ;).

[ Parent | on HN ]

Re:Android libstagefright still exploitable by cwyers on Thursday August 13, 2015 @03:03PM (#10056451)

I have a Lumia 635, which is nice "for the price" I agree but not nice enough to switch to full-time. I'm hopeful that the new high-end phones provide a real choice.

[ Parent | on HN ]

Re:Android libstagefright still exploitable by danieldk on Friday August 14, 2015 @01:15AM (#10058743)

But there is quite a difference between the 635 and the 640: non-HD vs. HD, possibly 512 MB RAM (depending on the version) vs. 1 GB RAM, 5MP vs. 8MP camera.

I agree that new flagships would be nice though. Especially with Continuum.

[ Parent | on HN ]

Re:Android libstagefright still exploitable by ocdtrekkie on Thursday August 13, 2015 @02:28PM (#10056229)

The fact that Google created a huge maintenance burden for themselves shouldn't absolve them of responsibility to provide that maintenance.

Microsoft supports Windows versions for ten years, and I agree that's crazy for Android. However, three years I feel is a bare minimum expectation. Devices tend to remain on the market for about a year, and the standard phone contract is two years. So three years from a version release should cover the vast majority of users for the life of their device, should they choose not to take "system upgrades" which may slow their device or change it in an unwanted manner.

[ Parent | on HN ]

Re:Android libstagefright still exploitable by cwyers on Thursday August 13, 2015 @02:53PM (#10056390)

I agree that DEVICES should be covered for n years, where n is somewhere between 3 and 5 and we can quibble about the specifics later. I don't think that backporting fixes should be the way we gauge this if newer versions are available instead.

[ Parent | on HN ]

Re:Android libstagefright still exploitable by ocdtrekkie on Thursday August 13, 2015 @02:55PM (#10056398)

The problem is that newer and better are not synonymous. And most Android users have probably learned by now that their devices getting slower with each update, not faster.

[ Parent | on HN ]

Re:Android libstagefright still exploitable by eropple on Thursday August 13, 2015 @03:35PM (#10056657)

Mine are getting no slower and often feel snappier. 5.1 was a big improvement over 5.0 on my Z3C.

[ Parent | on HN ]

Re:Android libstagefright still exploitable by ocdtrekkie on Thursday August 13, 2015 @02:19PM (#10056169)

Here's the problem: It's a DROID Turbo. It's locked down by Verizon/Motorola, and neither root nor bootloader unlock has been achieved. So it's not even an option.

The problem is that the "upgrade path" and the "security fix" path need to be separate things. People should not be forced to have their device changed in an unacceptable manner (I did not buy a device with 'material design' for a reason, and being forced to get it to get a security fix is an unacceptable situation.)

[ Parent | on HN ]

Re:Android libstagefright still exploitable by eropple on Thursday August 13, 2015 @03:34PM (#10056651)

I think, honestly, the only real answer is "don't buy locked devices if you want to make those choices." Google doesn't control those devices, and that part of Android is open source. You can make those decisions, but you're earning the consequences with them.

This, as it happens, is why I buy phones with unlockable bootloaders. My current phone uses the OEM build, but I like having that choice.

[ Parent | on HN ]

Re:Android libstagefright still exploitable by ocdtrekkie on Thursday August 13, 2015 @03:48PM (#10056740)

Google :does: control those devices. They're MADA agreement devices, which means Google approves every device that goes to sale, and Google approves every software update they release.

Unfortunately, as a Verizon customer, I don't have a wide variety of options with unlockable bootloaders. And the battery life on the Turbo was simply, the only feature that mattered. Usually there's an unlock within a few months, but there still isn't one at this point for the Turbo, I guess.

[ Parent | on HN ]

Re:Android libstagefright still exploitable by eropple on Thursday August 13, 2015 @04:00PM (#10056830)

Obviously it wasn't the only feature that mattered, though? I mean, you're complaining about another feature right now. =) Like, I'm sympathetic, but this is a solvable problem with the information at hand. Buy phones with unlocked bootloaders. (As it happens, this is why I steer clear of Verizon...)

[ Parent | on HN ]

Re:Android libstagefright still exploitable by ocdtrekkie on Thursday August 13, 2015 @04:27PM (#10056997)

Heh, well, half a year later. I placed more faith in Android security than was warranted. Verizon is non-optional for me.

[ Parent | on HN ]

Re:Android libstagefright still exploitable by beagle3 on Thursday August 13, 2015 @02:21PM (#10056187)

It's not just a providers. I've got a couple of el-cheapo $80 Androids just a month ago to use while traveling. They're running 4.4, Android 5 is not at all being offered for them, and probably never will. I guess I can throw them in the trash if I care about owning them myself.

Being el-cheapos, they aren't even supported by cyanogenmod. Anyone has an idea for how to use them (somewhat) securely?

[ Parent | on HN ]