News for hackers. Stuff that matters.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by komali2 on Thursday July 11, 2019 @10:37AM (#20411817)
> Google already fixed at least one of the Android exploits used by "Agent Smith," nicknamed Janus, in 2017 but the fix hasn't made its way onto every Android phone. It's a potent reminder that millions of phones around the world are being used without the latest security measures.

Because Samsung (or similar) or even more weirdly, Sprint (or similar) just doesn't fucking update our Android versions for months, or ever.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by dan-0 on Thursday July 11, 2019 @01:02PM (#20413223)
This seems to be getting a lot of attention, so as an Android Engineer with some security and framework experience let me try to explain.

This is a side effect of Android's initial approach to it's open nature. Android allows a manufacturer to modify its framework for their own use case. Then the manufacturer can allow a specific carrier to input their own system applications and firmware on to the devices well (your bloatware etc).

This can lead to multiple firmware variants for a specific device. It's not uncommon to see over 20 variants of a firmware for a specific Samsung device for example. This can be broken down by carrier, by region, by OS, etc.. for a number of different reasons.

This becomes a problem when Android needs to post an update. That update has to be pushed first to the Android framework, then to the manufacturer who decides if they are going to make modifications for the update, and if the manufacturer decides to make an update, they push it to the carrier who then has to make an update themselves.

This leads to a web with many broken ends, where a specific phone on one carrier may never see an OS upgrade after purchase, but on another carrier, the same phone might get them regularly.

Additionally some manufacturers take a greater degree of liberty in modifying the Android framework, making updates significantly more expensive to implement, so they don't.

The good news is Google over the past couple of years has been making a great effort under Project Trebel to simplify some of the APIs in the Android framework. What this is leading to is less friction when it comes to implementing core updates. Unfortunately not all manufacturers have opted in to adhering to the standards and Project Trebel yet.

This is all in stark contrast to iOS, which doesn't have the restriction of dealing with multiple manufacturers, and makes it harder for carriers to customize the device for their own business cases. This makes security and updates easier to push, but on the cost to the user of being an expensive single stream walled garden. Nothing against iOS in the statement, as a flagship device they're very nice. However, they don't have the adaptability that Android allows, making them prohibitive in some markets.

Sorry for any grammar issues, I'm on my phone (a regularly updated Pixel 3).

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by cstejerean on Thursday July 11, 2019 @01:09PM (#20413286)
This is what I love about Apple. They gave the carriers a big middle finger when it comes to the usual bullshit of bloatware, sticking their logos on things or getting in the middle of updates. That’s because they cared about the end user experience. Google was happy to just grab market share at the expense of the users by allowing carriers to continue with their usual shenanigans. For this reason Apple will have my eternal gratitude, because I remember what a shitshow smartphones (and deploying apps for them) was before Apple flexed their muscles on this.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by michaelcampbell on Thursday July 11, 2019 @01:16PM (#20413369)
> That’s because they cared about the end user experience.

I'm sure 100% of any revenue going to Apple and not shared with anyone had nothing to do with that.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by enraged_camel on Thursday July 11, 2019 @01:26PM (#20413490)
It may have, but I doubt it was the primary motivation. Steve Jobs famously cared a lot about user experience, security and reliability. Remember that Apple under his leadership took a firm stance and loudly and publicly refused to allow Flash on its devices, despite the fact that many websites back then relied on Flash.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by avtar on Thursday July 11, 2019 @03:17PM (#20414632)
> Steve Jobs famously cared a lot about user experience, security and reliability. Remember that Apple under his leadership took a firm stance and loudly and publicly refused to allow Flash on its devices, despite the fact that many websites back then relied on Flash.

A less generous take on that would be that he/Apple also wanted to push their app store. At the time Flash was popular for publishing apps and games on the web. Yes their decision helped move everyone away from Flash but it also meant they would be getting their 30% cut from iOS apps.

Edit: I stand corrected. "While originally developing iPhone prior to its unveiling in 2007, Apple's then-CEO Steve Jobs did not intend to let third-party developers build native apps for iOS, instead directing them to make web applications for the Safari web browser." -- https://en.wikipedia.org/wiki/App_Store_(iOS)#iOS_SDK

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @05:05PM (#20415835)
You mean the same Flash that Adobe said they could have gotten to work on the original iPhone - with 128MB of RAM and a 400Mhz processor but barely worked on Android with minimum requirements of a 1Ghz processor and 1GB of RAM?
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by avtar on Thursday July 11, 2019 @09:59PM (#20417496)
I wasn't claiming Flash was ideal in any sense -- just that it was popular back then.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by neotek on Thursday July 11, 2019 @11:23PM (#20417844)
>A less generous take on that would be that he/Apple also wanted to push their app store.

The App Store didn't exist at that time.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ninkendo on Thursday July 11, 2019 @03:26PM (#20414764)
The original iPhone didn't even have an app store...
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by Despegar on Thursday July 11, 2019 @03:26PM (#20414758)
This is like saying that Apple can't collect 30% if you make your app in React Native rather than a purely native iOS app. It doesn't matter what technology you use, they're going to get 30% because they control the store.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by z3t4 on Thursday July 11, 2019 @02:25PM (#20414039)
Apple also planned to sandbox all apps. But developers wanted bare metal performance.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @05:07PM (#20415856)
Sandboxes apps has to do with the permissions not having “metal performance”. iOS apps compile down to ARM native code. Unlike most Android apps that run on top of a VM.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by weaksauce on Thursday July 11, 2019 @03:42PM (#20414997)
the anti-flash stance was mainly there because of the abysmal performance a flash app would have on the device and the device's battery life.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by enraged_camel on Thursday July 11, 2019 @04:51PM (#20415704)
Hence, user experience!
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by azernik on Friday July 12, 2019 @12:02AM (#20418023)
Don't make this about moral superiority of Apple over Google.

Apple did it because they could, because when the iPhone came out it owned the smartphone market; any carrier that didn't play ball would be frozen out (as T-Mobile was initially - AT&T's exclusivity on the iPhone really helped their market share among high-end consumers). Google did not have that luxury.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by filmgirlcw on Friday July 12, 2019 @01:15AM (#20418390)
That’s not an accurate representation of what happened.

When Apple/Steve Jobs went into negotiations with Verizon and AT&T (then known as Cingular), it didn’t have any leverage. In fact, Verizon wouldn’t sign the deal in part because of the control Steve Jobs wanted over the devices. AT&T agreed to get the exclusive.

BlackBerry was King when the iPhone launched and BlackBerry bent over backwards to do whatever the carrier wanted (the book Losing the Signal has great details on this).

Google could have depended on similar provisions with Verizon when the Droid launched in 2009 or with T-Mobile when the G1 launched in 2008. Both carriers wanted an iPhone killer.

But Google didn’t do that. It did force Verizon not to put Bing as the default search engine on some of Verizon’s Android phones (like the Droid series), despite an early 2009 agreement Verizon made to make Bing its default search engine — and it also negotiated to NOT force consumers to pay for Android apps using the carrier stores (something many carriers had required for previous non-Apple App Stores), once paid apps launched.

But it didn’t negotiate the update bit, even though the company had the leverage to do it.

I can only speculate the reasons why, but based on the number of books I’ve read, people I’ve talked to, and and other information, it strikes me that Google decided it was more advantageous to let any phone maker or carrier adopt its OS to gain marketshare, rather than worrying about device fragmentation or security update issues.

And that strategy worked beautifully and Android took over the world. The problem is getting carriers or device makers to update, especially when many have spent lots of time customizing Android as a way of differentiating themselves.

But it’s unfair to claim Google didn’t have the opportunity to make the deal Apple did. Google just didn’t want to do that and wasn’t willing to walk away from a partnership to have that level of control.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by davidgl on Friday July 12, 2019 @05:15AM (#20419363)
Is that because Android was a defensive move against ios to protect the search/advertising income, like Chrome, rather than something they make money from do you think ?
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by filmgirlcw on Friday July 12, 2019 @10:51AM (#20421143)
Yes. (Although it was originally a defensive move against Windows Mobile and BlackBerry and Symbian and it then pivoted as soon as they saw the iPhone.)

The big draw for Android for OEMs was that unlike Windows Mobile or Symbian, there was no licensing fee for the devices. HTC, which made the first Android phone, was a Windows Mobile device maker (fun fact, the XDA from XDA Developers, was an OG Windows Mobile forum — XDA was the name of an early series of Windows Mobile devices) — Samsung and LG and Motorola made Windows Mobile phones, Sony used Symbian and so on. Android was free and customizable, which made it enticing for OEMs and carriers to embrace. And unlike BlackBerry, carriers didn’t have to give a portion of the data charge (which was like $20 or $40 a month per BlackBerry device) to BlackBerry, they got to keep all the data fees to themselves.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by codedokode on Thursday July 11, 2019 @03:26PM (#20414762)
But Apple software is proprietary, not friendly to open soure developers and you never know what that software is doing. Maybe they are streaming your data directly to "cloud" operated by NSA. Or iPhone doesn't upload anything to cloud?
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by w1nst0nsm1th on Thursday July 11, 2019 @04:00PM (#20415206)
Most of the function users care about in their phone, if not implemented by third party, are proprietary apps from google.

Without the app store and the google ecosystem, android experience is poor at best.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by darkpuma on Thursday July 11, 2019 @04:15PM (#20415351)
The Google ecosystem can drown in bleach for all I care. F-Droid is not bad at all. Downloading apps from the Google store is an awful experience because on that store it's the norm for damn near every application to spy on you to the fullest extent possible. On f-droid, applications the typical application is a good citizen. It's a lower stress experience and a better appstore than either Google or Apple, unless you desire specific closed source software in which case it's no longer an option.

Try this: On Google's Appstore, find a flashlight app that doesn't upload your contacts. Now on F-droid, try to find one that does. This is not an easy challenge!

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by wildduck on Thursday July 11, 2019 @07:30PM (#20416832)
Or we can also try this: https://www.replicant.us
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @05:02PM (#20415808)
And what makes Android what it is to most consumers - Google Play Services is also proprietary as well as all of the drivers. Not to mention whatever the OEMs and the carriers add.

Even if you have a completely “open” operating system on your phone, your communications is still going through a carrier that could be “operated by the NSA”.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by throwaway2048 on Thursday July 11, 2019 @04:09PM (#20415279)
All of the data collection functionality in Google Apps is closed source too.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by Jerry2 on Thursday July 11, 2019 @07:09PM (#20416724)
Huawei incident has taught that Android is proprietary too. Any country that's at odds with the US will eventually find out that Android will be blocked to their companies too.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by NegativeLatency on Thursday July 11, 2019 @04:45PM (#20415652)
The Google Play Store and related APIs are similarly locked down. Not that you couldn't distribute through something like fdroid.

I take your point but android is similar in some respects (Google probably has less interest in your privacy than Apple does).

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by davidw on Thursday July 11, 2019 @03:28PM (#20414791)
Having a closed ecosystem has costs too, though, especially in terms of user freedom and choice.
[dead]
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by codebje on Thursday July 11, 2019 @06:19PM (#20416418)
I buy unlocked Nexus devices to avoid mftr and carrier bloatware and update delays.

Never again for a Samsung device, they churn through models absurdly quickly, delay updates for months, and shovel tons of crap on.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by navigatesol on Friday July 12, 2019 @06:29AM (#20419598)
>I buy unlocked Nexus devices to avoid mftr and carrier bloatware and update delays.

Exactly. There is a whole series of phones offering bloat-less Android, from a variety of manufacturers:

https://www.android.com/one/

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by snarf21 on Thursday July 11, 2019 @01:16PM (#20413368)
This is also solvable by Android taking a slightly different approach. Isolating the OS and security framework so that it can always just be updated. The carriers and and manufacturers are still free to install whatever bloatware they want and do what ever logo nonsense they want.

We ran into nonsense issues creating a cross platform development toolchain when HTC phones just didn't implement certain functions of the WebView. We were then stuck trying to create workarounds for no reason. Android could have been the best of both worlds but they just punted it and left their users holding the bag.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ansible on Thursday July 11, 2019 @08:54PM (#20417235)
> This is also solvable by Android taking a slightly different approach. Isolating the OS and security framework so that it can always just be updated.

I think that is the plan with Fuchsia.

The core of the OS is small. The drivers can be separated out more easily, and with a (hopefully) stable driver API, they may not need to get updated ever (baring security bugs in the driver code itself).

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by panpanna on Friday July 12, 2019 @03:42AM (#20418998)
Not to sound like a Google apologist, but all you ask is already in there.

And Google's extensive compatibility requirements aside, webview is now directly updated from the store.

Android Q will extend this to most system components via apex.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by dredmorbius on Thursday July 11, 2019 @06:31PM (#20416488)
As I've commented elsewhere on this thread: my 2015 purchased-new Android tablet has never to my knowledge seen a vendor OS update -- it's running 5.0.2, not even the most recent version at the time, as 5.1.1 was released over six months before the unit was sold.

None of this information was available to me at the time, and the 5.1.1 history I've only just learnt whilst composing this comment. I'd purchased the device under sharp time, budget, and information constraints whilst travelling. Budget and other limitations, as well as a market void of credible alternatives (Purism have my eye) have prevented replacement, though I loathe this device.

Google have considerable monopoly leverage, and yet have not used this to require obligations for (and permit forward use of) Android and related ecosystem services in the form of upgrade timeliness SLAs and minimum EoL requirements: this device was obsolete at time of sale, though I was completely unaware of this at the time. Instead Google have sought to perpetuate their own monopoly and interests:

https://www.theverge.com/2018/7/18/17580694/google-android-e...

It is also not capable of being re-ROMed, another fact of which I was unaware.

I'm beyond disgusted and will not and do not recommend Android to anyone.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by alexis_fr on Thursday July 11, 2019 @07:53PM (#20416966)
And up to version 6, Android was not disk-encrypted. If you lose a phone, they don’t need your pw, they can just take the SD card out and read it. All your stored passwords, all your stored cookies, they can read them all...

Never again will I ever trust Android anymore if they can’t even get the basics right.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @01:09PM (#20413293)
Sounds like an excuse for poor engineering on the part of Android. Microsoft also sells Windows to multiple OEMs and has done so for decades. OEMs also are free to add bloatware as well as the retailers (ie Best Buy adds its own bloat), but Microsoft doesn’t have this problem.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by blablabla123 on Thursday July 11, 2019 @03:00PM (#20414391)
Yeah but Windows was created for existing hardware, in fact at first even running on an existing OS. IBM PC compatibles were a thing since the 80s on which DOS flavour from various vendor were running which in turn ran on x86.

Microsoft actually waited really long until they combined normal end user Windows with NT which was it's own OS since early 90s but also had a lot of restrictions when it came to drivers, end user Apps, Games in particular.

Google bootstrapped it all at once, that's quite an effort. That said, some phones like those of OnePlus or FairPhone have really long support times.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @03:12PM (#20414559)
The whole idea behind WinHEC early on was that Microsoft was guiding hardware manufacturers to the plug and play standard.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by blablabla123 on Thursday July 11, 2019 @03:19PM (#20414657)
I guess in that sense Microsoft really did their homework. Apart from niche usage, good Hardware support seems everything for an OS...
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by diroussel on Thursday July 11, 2019 @01:52PM (#20413738)
It’s quite different as windows is closed source. The OEMs don’t build their own flavour of windows from source.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by MiddleEndian on Thursday July 11, 2019 @07:54PM (#20416967)
Seems like the open source-ness of Android is of little use. It helps manufacturers rather than users.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @01:58PM (#20413776)
And almost everything that makes Android what it is outside of China is also closed source - Google Play Services and the drivers.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by rightbyte on Thursday July 11, 2019 @01:39PM (#20413598)
Ye. Patching system libs should be just pulling those as long as they are backwards compatible. Maybe some key parts that the OEMs fiddle with are not behind abstractions properly.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by jamespo on Thursday July 11, 2019 @01:12PM (#20413321)
probably cost you more money than you'd make writing malware for windows phones
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ry4nolson on Thursday July 11, 2019 @03:03PM (#20414441)
no one is talking about windows phones. they're talking about windows.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by nradov on Thursday July 11, 2019 @05:44PM (#20416170)
That's just making excuses for poor software architecture without clearly defined layers and stable, documented APIs between them. MS Windows has a hardware abstraction layer. There's no reason Android couldn't have the same, except that it wasn't a priority.

Some of this is (or was) a fundamental design limitation of the Linux kernel. But there are other kernels.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by zaroth on Thursday July 11, 2019 @04:44PM (#20415648)
Arguably, it should not be legal to sell a device and not provide security updates for some guaranteed period of time, as a violation of the implied warranty for fitness for a particular use, or as an unfair or deceptive trade practice.

I wonder if the FTC has ever pushed this particular angle?

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by Marsymars on Thursday July 11, 2019 @07:31PM (#20416839)
That explains why we ended up in a bad place, but it's still an absurd situation.

From my perspective, Essential pushes a monthly security update for the PH-1 like clockwork. However, my carrier (Telus) delays it for some random (between ~0-90 days since the PH-1 launch, currently on ~70 days) amount of time. In that entire time, there's never once been an update that's been delayed for any actual changes from the stock update. In fact, if I don't want to wait for the update, I can just swap in any random non-Telus SIM, and the update is no longer blocked. The user experience is better with any carrier in the world other than the one I bought the phone from in the first place!

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by mr_toad on Thursday July 11, 2019 @09:24PM (#20417350)
If Google put their foot down the manufacturers and carriers would tow the line.

Trying to sell a (non-Apple) smartphone without Android in 2019 would be like trying to sell a PC without Windows. Your market share could be counted on one hand.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by dredmorbius on Friday July 12, 2019 @03:29PM (#20423645)
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by panpanna on Friday July 12, 2019 @03:37AM (#20418961)
> This can lead to multiple firmware variants for a specific device. It's not uncommon to see over 20 variants of a firmware for a specific Samsung device for example. This can be broken down by carrier, by region, by OS, etc.. for a number of different reasons.

You forgot to mention this was fixed about 2 years ago when Google pushed mandatory changes in the way customisation are added to the firmware image.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by sammorrowdrums on Friday July 12, 2019 @02:10AM (#20418642)
While not a perfect solution, I've been buying phones from manufacturer since my HTC desire was ruined by bloatware (you could put many apps on SD card but not Facebook as it was included bloatware, which got huge over time and literally meant I couldn't install updates or would have to delete other apps etc.)

It has helped the frequency and speed of updates a bit. Not a fan of carrier customisation.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by vinayan3 on Thursday July 11, 2019 @09:39PM (#20417405)
Sounds like getting phones with stock Android is the best option. I rarely see in the stores Android One being a major feature / selling point: https://www.android.com/one/
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by PeterStuer on Friday July 12, 2019 @01:17AM (#20418399)
Thanks for the info. Is there a place where one might find the data on brand/carrier responsiveness to security updates? I'm thinking e.g. Google publishing a dashboard on this might make it to the radar of the marketing departments of the involved partners.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by kilolima on Thursday July 11, 2019 @08:12PM (#20417055)
And yet someone can discover a security vulnerability in a software package and it gets put out to every Linux distro as an update in less than a week, usually by volunteers...
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @11:24AM (#20412242)
That’s the problem. Why should your carrier have any say so in updating your operating system? If I buy a computer from Best Buy, I don’t have to wait for them to push an update to Windows.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ndesaulniers on Thursday July 11, 2019 @12:05PM (#20412636)
Good question. When a phone stops working, people want their money back. Guess where most people in most markets buy their phone from?

Further, who do you think customer's call for support?

Now you know why carriers are hesitant about frequently updating a product they've already made a sale on. If an update breaks something, guess who pays the price?

Not defending them, and it's not the only reason, but it's a big one.

Whether or not they should have a say is a great question. Now that they do, I'm not sure it can be taken away without them simply choosing the next os that they do have more say over.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by hiccuphippo on Thursday July 11, 2019 @12:16PM (#20412766)
Which is why I prefer to buy my phone independently from the carrier service.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by penagwin on Thursday July 11, 2019 @02:38PM (#20414162)
The parent is pointing out one possible motive for a large carrier, who has to deal with what I call the "general public".

> Which is why I prefer to buy my phone independently from the carrier service.

You're clearly a tech literate person, which is great! But I've worked at a phone/computer repair/resell store for 2 years, and let me tell you, the "general public" can be very interesting.

It's common for many people to not know that their "phone runs android". Let alone the which version LOL!

What I'm trying to say is, it's great that you buy your phone that way, and that's the smart way to do it. We've had plenty of customers looking for unlocked phones too, but even then many don't understand how there's different radios in the phones that work with different carriers, some didn't actually know what being "unlocked" means, etc.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @01:10PM (#20413300)
I’m able to buy a Windows computer from third parties and still get an update from Microsoft....
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by bfdm on Thursday July 11, 2019 @05:39PM (#20416134)
Then they should also be held responsible for the fallout (technical or financial) caused by an unpatched security bug.

Then it's just a liability and risk choice for them. If the user is not able to update, then they shouldn't be the ones on the hook if there are problems.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by JustSomeNobody on Thursday July 11, 2019 @11:37AM (#20412358)
Because carriers have a tremendous fear of being simple data pipes.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @12:10PM (#20412687)
Apple pushed the carriers to allow it to update its own operating systems over a decade ago.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by throwaway5752 on Thursday July 11, 2019 @12:41PM (#20413012)
Apple's situation is completely different from Android. Demand for iphone devices was the leverage Apple had over carriers to do this, and it's not a fragmented ecosystem in the first place.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ppseafield on Thursday July 11, 2019 @02:28PM (#20414073)
Apple created that demand. They were exclusively on AT&T at first, and aggressively negotiated that contract so they wouldn't have to have carriers' horrible bloatware. Then the exclusivity made negotiating with other carriers easier.

Google didn't even make any phones until much later. Instead they gave phone manufacturers the green light to do whatever they wanted. They ended up designing phones later because of how crappy the Android phone ecosystem had become. Google could have made Nexuses from the get-go.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @01:13PM (#20413337)
Google had plenty of leverage early on with carriers that didn’t have the iPhone. Google still has leverage by threatening to withhold Google Play Services. The last thing carriers want is not to have an alternative to Apple and no cheap phones to entice customers.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by JustSomeNobody on Thursday July 11, 2019 @01:02PM (#20413221)
Yeah, I know this. I don't think anyone at any of the other phone manufacturers has the weight to throw around that Jobs did, though.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by benburleson on Thursday July 11, 2019 @11:50AM (#20412460)
Is there really some expectation for a carrier to be more than that? I just want a fast, reliable service that connects my phone to the internet. Is there actually profit in providing more than that?
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by wyldfire on Thursday July 11, 2019 @12:04PM (#20412619)
From the carrier: yes.

The phone subsidies (in the US at least) are very reminiscent of the old leased phones of yore.

But if you look at the actions of mobile phone carriers and ISPs they're desperate not to become dumb pipes. They design all kinds of clever mechanisms and marketing strategies to distinguish themselves.

> Is there actually profit in providing more than that?

Well, in a free market, competition is intense. So if they can find ways to distort that, then yes: they will make more money. Many of us don't have much allegiance to particular gas station brands. But they create rewards programs to try and get some of that loyalty. Otherwise you just compete on price.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by bongobongo on Thursday July 11, 2019 @12:56PM (#20413159)
Let's not be silly, there is no market in this case. It's an oligopoly and occasional cartel.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @05:14PM (#20415911)
There is only so much competition you can have in wireless. Different carriers have to have different bands of spectrum and only certain frequencies can be used for cellular.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by bongobongo on Thursday July 11, 2019 @08:11PM (#20417050)
That's why it's not a market. Like I said.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by txcwpalpha on Thursday July 11, 2019 @12:12PM (#20412709)
Being just a dumb data pipe means you aren't differentiated from other dumb data pipes, making it harder to compete with other carriers on anything other than price (reducing revenue) and service reliability/speed (and we all know how awful ISPs are at building out better infrastructure). This does make it much harder to be profitable.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by jethro_tell on Thursday July 11, 2019 @12:00PM (#20412574)
well there's usually a bundle of shit in a carrier OS, it's just not profit from you.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by JustSomeNobody on Thursday July 11, 2019 @01:03PM (#20413237)
From the carrier perspective, sure. Being a dumb pipe is a race to the bottom market-wise.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by codedokode on Thursday July 11, 2019 @03:50PM (#20415106)
Exactly. Contracts, identification, phone numbers are not necessary for this. It could be dead simple: the application on your phone generates a pair of private and public keys. You pay some satoshis to a carrier and get some amount of Internet traffic, using your private key for authentication. If you want to switch to other carrier, you just generate a new key and send some satoshis to its account, and your modem generates a new random IMEI. You generate a new key and new IMEI for every new payment so it becomes difficult to track you and sell data about your location. And you can switch between different providers any time. You can even switch depending on who has a better signal in your current location. No need for identification, making a contract, getting a phone number, selling data about you (because carrier doesn't have it) or reporting your location to the government or courts.

This is ten times better than what any provider offers today. If someone implements this, nobody will want to use old scheme anymore.

Also this should promote competition between carriers.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by dredmorbius on Thursday July 11, 2019 @06:15PM (#20416398)
My (no-carrier) WiFi-only Android tablet ... is also wholly dependent on the hardware vendor for updates, of which to the best of my knowledge has never seen an OS update since date of purchase (though vendor apps, which I've never used and cannot uninstall, have updates pushed, routinely demanding greater permissions).

Of all the monopoly-leverage-based requirements Google could make of Android vendors, demanding update SLA and EOL minima are apparently ones they've never contemplated.

0/10, would not recommend, ever.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by nkozyra on Thursday July 11, 2019 @01:08PM (#20413277)
I don't even buy my phones from the carrier, which makes it even more perplexing.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by brlewis on Thursday July 11, 2019 @01:56PM (#20413762)
This comment and most replies use "carrier" as shorthand for "carrier and/or manufacturer". This looks funny to me because my carrier is T-Mobile and doesn't add bloatware AFAICT. Using "manufacturer" as the shorthand would make more sense to me.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by spiznnx on Thursday July 11, 2019 @02:03PM (#20413830)
T-Mobile does add software to phones. Wi-Fi calling requires T-Mobile-specific OS-level modifications. You won't be able to use it on unbranded unlocked phones. It's definitely not bloatware though.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @03:15PM (#20414601)
WiFi calling is supported on iOS devices across carriers and without T-Mobile making os level modifications.

https://support.apple.com/en-us/HT204039

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by brlewis on Thursday July 11, 2019 @02:11PM (#20413904)
I'm pretty sure the Nexus 5X I got off of craigslist is an unbranded, unlocked phone with an OS from Google, and it makes wifi calls on T-Mobile.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by stevenicr on Thursday July 11, 2019 @09:25PM (#20417354)
It would not surprise me to see kind of an opposite thing - such as other carriers selling phones where they purposefully turned off or hid settings for wi-fi calling, turning on hotspot and similar.. in which case if tmobile sold the same phone, then it would be a matter of them not turning off / hiding.

Would be an interesting chart to show the things the various carriers had turned on / off... added / removed which similar phones.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by pkaye on Thursday July 11, 2019 @05:14PM (#20415916)
I think its already a part of the Android software. I certainly see it enabled on the phone I bought outside of T-Mobile. The only thing I see I need is a the T_Mobile visual mail app but I don't use that much since everything is SMS these days.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by wmf on Thursday July 11, 2019 @03:52PM (#20415129)
This has been somewhat fixed in recent years as my latest unlocked Sony phone has working Wi-Fi calling on T-Mobile.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by bluGill on Thursday July 11, 2019 @12:16PM (#20412765)
The carrier wants your phone to work on their network. A software update could change brick the radio (or just disable the channel they are using) if done wrong.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @12:31PM (#20412916)
Yet Apple has been able to do that for well over a decade and sells phones via carriers. Even if you buy an unlocked Android phone directly you can update it without carrier intervention.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by trevj on Thursday July 11, 2019 @01:44PM (#20413647)
Yes but apple only has ~10 phones that have to be updated at a time, and all share similar hardware with software specifically designed for that hardware. There are so many different hardware setups for android that getting software to work perfectly on all of them is exponentially harder
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by supergeek133 on Thursday July 11, 2019 @12:47PM (#20413078)
Apple has much less risk surface/device variant.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by simonh on Thursday July 11, 2019 @12:55PM (#20413155)
OK, you're a carrier and have millions of Apple and Samsung devices on your network. 0.01% of your users know how to update the OS on their Samsung phones themselves, or jailbreak their iPhones. A software update from the manufacturer could brick millions of those phones on you network.

Which risk keeps you awake at night:

  A few Samsung phone users bricking their phones occasionally
  A few iPhone users bricking their phones occasionally
  50 million Galaxy phones being bricked by Samsung at once
  50 million iPhones being bricked by Apple at once
I'm not saying it's impossible Apple could do it, but in terms of ratios how much more or less likely is it versus Samsung?
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @03:16PM (#20414618)
What does jailbreaking phones have to do with updating them?
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by Shorel on Thursday July 11, 2019 @03:44PM (#20415037)
Could, would, are known as 'weasel words' for a reason.

What the carrier actually wants is to force some applications to always be installed in the customer devices, because of shady business deals, a.k.a. 'partnerships'.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by navigatesol on Thursday July 11, 2019 @03:32PM (#20414850)
>Why should your carrier have any say so in updating your operating system?

You made that choice when you decided you wanted a carrier subsidized phone.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by GeekyBear on Thursday July 11, 2019 @01:38PM (#20413581)
From the start, Google cared enough about device makers potentially shipping a device running a fork of Android that they forbade doing so in their contracts with device makers.

When it came to making sure consumers got timely software updates, Google sided with the device makers and carriers.

Device makers wanted you to buy new hardware every couple of years, and carriers wanted to lock you into an additional two year contract.

Google could have contractually required device makers and carriers to support end user devices after the sale, it just wasn't something they cared enough about.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ApolloFortyNine on Thursday July 11, 2019 @01:40PM (#20413605)
Google never forbid updating phones... They forbid forking Android.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by cma on Thursday July 11, 2019 @01:42PM (#20413623)
That's what he said. They didn't forbid it, but they also didn't mandate it be allowed.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by GeekyBear on Thursday July 11, 2019 @01:57PM (#20413771)
In contrast, Apple did forbid carriers to block software updates in it's contracts with them.

It's a matter of who you think your customers are.

Google sides with advertisers, device makers, and carriers and not it's end users.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ApolloFortyNine on Thursday July 11, 2019 @02:11PM (#20413910)
I fail to see the relevance of Samsung not updating their phones to Google not wanting Android to be forked. If Samsung had forked Android, they still wouldn't update old phones.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by Angostura on Thursday July 11, 2019 @10:41AM (#20411857)
I bought a new Android table from Samsung 3 years ago for more daughter - when bought it had a 2 year old version of Android on and enquiries from Samsung UK said it would not be updated. My daughter is still using it today, unupdated from 5 years ago.

We tend to be an Apple household

Edit - the Device, bought in September 2016 was a Samsung Galaxy TAB E 9.6 SM-T560 WI-FI - I will check the software level tonight.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ajross on Thursday July 11, 2019 @10:53AM (#20411958)
Which device? That doesn't sound right. We're in a more or less identical situation, with Galaxy Tab S2's for the kids that we bought three years ago. And indeed, they're running comparatively ancient Android 7.0 images and will never see a version bump again.

They do, however, continue to see security updates. And in particular they've been patched against the vulnerability in the linked article. I'd be very surprised if yours was any different.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by nolok on Thursday July 11, 2019 @11:07AM (#20412078)
He's probably wrong, but inadvertently so. Most people seem to confuse android version update with security update, which is compounded by the fact that security updates on android are very "discreet" all things considered, and you don't notice it much.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by pmlnr on Thursday July 11, 2019 @11:47AM (#20412437)
> comparatively ancient Android 7.0

7.0 is ancient? 5.1, or rather 4.4 is ancient.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by Santosh83 on Thursday July 11, 2019 @01:27PM (#20413491)
The Android ver on my phone is 4.1. Still runs just fine, but then again all I use it for are calls/SMS, so there's little scope to be exploited.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by CannisterFlux on Thursday July 11, 2019 @02:04PM (#20413836)
It might still be vulnerable to stagefright, exploitable over MMS.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ajross on Thursday July 11, 2019 @06:53PM (#20416632)
Stagefright is the name of the component, not the exploit. And in most cases, devices from major vendors are going to have patched binaries, even on images as old as Jellybean.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by sangnoir on Thursday July 11, 2019 @04:10PM (#20415289)
> ...all I use it for are calls/SMS, so there's little scope to be exploited.

You mean little scope of exfiltration (I'm guessing it's not connected to the internet). There are a lot of vulnerabilities in text rendering that can be exploited via SMS.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by TeMPOraL on Thursday July 11, 2019 @12:25PM (#20412858)
Android with a version number is ancient; current Androids have single letters in their name.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by Angostura on Thursday July 11, 2019 @11:47AM (#20412430)
I'll have a check in a couple of hours and and report back.

The Device, bought in September 2016 was a Samsung Galaxy TAB E 9.6 SM-T560 WI-FI

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by enceladus_ice on Thursday July 11, 2019 @10:50AM (#20411929)
I've had luck with official Google phones the past couple years, and in the past the Moto line of Android phones stayed up to date to a point.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ubercow13 on Friday July 12, 2019 @03:46AM (#20419014)
My Moto phone hasn't had a security update in a year, and sale of the model was stopped 2 years ago, so that's 1 year support. Luckily it was cheap. I'll be ditching Android I think
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by WrtCdEvrydy on Thursday July 11, 2019 @11:23AM (#20412230)
Yeah, I'm doubting that.

Go into settings, about device and check the Security Patch Level.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by jimmaswell on Thursday July 11, 2019 @10:50AM (#20411928)
better than ios updates making the phone unusable. happened to me on old ipod touch models, not even the battery thing.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by thanatos_dem on Thursday July 11, 2019 @11:08AM (#20412088)
> Not even the battery thing.

That was an attempt at graceful degradation that wasn’t communicated well.

The general belief was that having a phone that runs a bit more slowly, but consistently used it’s battery as the battery life naturally degrades is better than a phone suddenly dying with 40% battery remaining if the peak power draw exceeds what a several year old lithium ion battery can produce.

I much prefer the former personally, but I get where the misunderstanding and public outcry came from.

Beyond that, what made your phone unusable? The last 4 or 5 iOS versions have improved performance across the board, even for phones several years old.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by GeekyBear on Thursday July 11, 2019 @12:03PM (#20412603)
In the class action lawsuit against Google, Nexus 6P customers said their devices were shutting off unexpectedly while reporting that the battery still had a 60% charge.

>In April of last year, a class action investigation began concerning Google, Huawei, and the Nexus 6P bootlooping issues. Many users were reporting issues with the Nexus 6P shutting down randomly, even when the battery was showing up to 60% charge.

https://www.xda-developers.com/google-huawei-nexus-6p-class-...

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by JasonFruit on Thursday July 11, 2019 @11:27AM (#20412272)
It's probably true that this was more an image problem than an actual misdeed, but the outcry was symptomatic of consumers' deep mistrust of tech companies' intentions. Some of that is because, to most people, a computing device is a black box, but some of it is because they've been burned before.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by jorvi on Thursday July 11, 2019 @01:18PM (#20413407)
It would have been graceful if the phone gave a pop-up on every boot with 'Your iPhone has a worn-out battery. Have it serviced at your nearest Apple retailer'. Apple was fully aware that people with slowed down phones would buy a newer model iPhone. And besides the free battery replacement for the old model they gave zero recompense if you bought a new phone because your old phone was performing suboptimally.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by jimmaswell on Thursday July 11, 2019 @11:30AM (#20412297)
I had a first or second gen iPod Touch and it became unusably slow right after updating it some time later.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by choward on Thursday July 11, 2019 @12:56PM (#20413166)
Just make it so the batteries are easily replaceable. It's wasteful to buy a brand new phone when all you need is a new battery.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by kube-system on Thursday July 11, 2019 @01:18PM (#20413392)
Ease of maintenance is rarely a marketable feature in mass-market consumer products, and most often is deprioritized.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by jimmaswell on Thursday July 11, 2019 @03:09PM (#20414524)
Replaceable batteries apparently make water resistance a lot harder. I always preferred having an easily replaceable battery but I don't mind the tradeoff on my S10+.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @01:16PM (#20413378)
A battery replacement is $79. No one is forcing you to buy a new phone.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by metildaa on Thursday July 11, 2019 @02:04PM (#20413839)
A lithium ion battery doesn't cost anywhere near that much, its either poor design and/or profiteering on the device manufacturers part to charge that much for a $15 battery to be replaced.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by hombre_fatal on Thursday July 11, 2019 @03:39PM (#20414958)
You could say that about all pricing everywhere. Seems like a waste of breath.

Also doesn't change the upstream clarification that you don't need to buy a new device to get a new battery.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by metildaa on Thursday July 11, 2019 @07:39PM (#20416883)
The battery is a user changeable part on most mid-range and low end phones.

The point of this predatory pricing tactic is to force owners of phones with sub-$200 in value to upgrade, rather than potentially waste half (or more) of the phone's value on replacing the battery.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @07:53PM (#20416962)
Which carrier sold Android phones - where most users by their phones - have user replaceable batteries?

The Moto G is usually cited as one of the best mid range phone and it doesn’t have user replaceable batteries. I don’t think most of the cheap Walmart phones have user replaceable batteries.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by metildaa on Friday July 12, 2019 @01:16PM (#20422362)
The Samsung Galaxy J7 and Moto E5 Play (both free under 24 month commitment on T-Mobile) have removable batteries.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by mensetmanusman on Friday July 12, 2019 @09:11AM (#20420422)
I do about a dozen mobile repairs a year for family, and it really does seem like the new automobile.

Auto’s were not built for ease of repair, the repairs themselves can be quite easy if you know what to do, and often require components that are only 1 or 2 orders of magnitude in price. Paying someone who knows what to do with it, they also add an order (similar to screen repairs).

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by yyyk on Thursday July 11, 2019 @11:49AM (#20412452)
> That was an attempt at graceful degradation that wasn’t communicated well.

That was nearly outright fraud which went swimmingly well. The big issue wasn't so much the unannouced throttling. It was that Apple knew that a lot of customers had battery issues but misled them (by denying the entire issue) so that they'll buy a new device. Instead, the debate turned on slightly more defencible for Apple.

Slightly more defencible, because while Apple _says_ that was done to counteract the battery issues, nobody knows whether iOS really checked battery state and didn't just throttle all older models indiscriminately. The latter would be rather convenient for the bottom line.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by donarb on Thursday July 11, 2019 @12:24PM (#20412853)
Apple has had a battery replacement option for quite a few years. Apple Store employees don't work on commission, so a customer coming in with a battery problem would most likely be offered the battery replacement option before being sold a new phone.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by yyyk on Thursday July 11, 2019 @02:11PM (#20413906)
Employees can only give answers they know about, and a general battery issue was denied by Apple. That they didn't tell their own employees does not clear Apple from misleading their customers.

Aside, I'm pretty sure that Apple Stores do care about margin, and so do employees that identify with their business or are encouraged by their managers, but I am not accusing them (the employees) of anything.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by pier25 on Thursday July 11, 2019 @02:20PM (#20413992)
Which is why Pixel or Android One devices are the way to go.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by paulcarroty on Thursday July 11, 2019 @12:02PM (#20412597)
> Google already fixed at least one of the Android exploits used by "Agent Smith,

Google can't fix it due to Android fragmentation. Millions of devices will never get this update.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by pbhjpbhj on Thursday July 11, 2019 @11:29AM (#20412288)
I've never understood this as a design decision -- why does Google allow companies to block updating of Android?

Presumably the idea is 'block updates to force hardware sales'?

I can't update my Honor, I think it's the service provider (the phone was on contract) who block the update, but it was easy to update (both Android and EMUI) using an app in the Google Play store to a full version higher, but whoever created that update hasn't done further ones. It is a hack though, there should be a way to do it officially.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by tialaramex on Thursday July 11, 2019 @11:47AM (#20412428)
It hasn't made any sense to buy phones from the company that provides your mobile phone service for years, especially now that a "phone" isn't in any meaningful sense a phone at all with many people never making or receiving any calls.

They shouldn't be any more involved in what phone you use than your ISP gets to pick whether you use a Mac or PC.

Sure if you want to use a 15 year old phone you're going to need to find somebody who allows that (my guess: no-one) just like you won't find so many ISPs who offer 1200/75 dial-up mode for your original Apple Macintosh with acoustic coupler. But anybody with normal needs shouldn't need to care, just sell me "phone" (ie mobile Internet) service.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by pbhjpbhj on Thursday July 11, 2019 @02:51PM (#20414296)
Crunching the numbers, it was much much cheaper for me getting this phone on contract then any other route. I did look at buying a phone separately and having SIM-only or PAYGo. (UK, about 3 years ago, low-mid range). With 18 month contract I basically got a 'free' phone with 13MP camera.

I actually use a SIM only by swapping sims with my wife whose phone we bought outright (but it's low end - camera and screen are poor).

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by vetinari on Thursday July 11, 2019 @12:14PM (#20412740)
A cellular phone is also a network terminal.

A misbehaving device can cause unreasonable load on the network, a disruption to other users, or at least interruption of the service on your device.

When Apple does screw up and iOS update will leave you with no data, the operators will attempt to make it work; they won't do that for every random manufacturer though.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by wildduck on Thursday July 11, 2019 @07:30PM (#20416835)
Time to put some effort into this https://www.replicant.us
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by jammygit on Thursday July 11, 2019 @12:50PM (#20413115)
Question: my brother just got a used pixel 1 phone. Will it stop getting security updates soon/already?
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by _underfl0w_ on Thursday July 11, 2019 @01:30PM (#20413521)
FWIW, LineageOS has official nightlies for that phone now (typing this from one of those builds now, actually)
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by jdofaz on Friday July 12, 2019 @11:02AM (#20421203)
If the phone is from Verizon the bootloader is locked
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by cure on Thursday July 11, 2019 @01:13PM (#20413342)
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by jammygit on Thursday July 11, 2019 @01:29PM (#20413506)
What should he do if he finds out about a vulnerability then? Does he need a new phone?
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by brlewis on Thursday July 11, 2019 @01:52PM (#20413736)
Yes, but not necessarily Oct 2019. My Nexus 5X is running Android 8.1.0 with security patch level: December 5, 2018, so it's likely Pixel will also get updates after the guaranteed dates.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by Jonnax on Friday July 12, 2019 @12:13AM (#20418076)
He needs to weigh the risk versus the cost of a new phone.

There is a custom firmware card LineageOS but it's a community effort. It may get up to date security updates merged in but it could be vulnerable in other ways.