News for hackers. Stuff that matters.
Re:Critical Bluetooth vulnerability in Android by madez on Friday February 07, 2020 @06:18AM (#22264941)
The solution is rather simple; buy devices with better documented and open internals rather than what's cheapest, shiniest, and most convenient. There are alternatives, and we all vote with our wallets.
Re:Critical Bluetooth vulnerability in Android by pixl97 on Friday February 07, 2020 @06:23AM (#22264963)
Ah, yes, this is sure to work.

watches the plan fail yet again

This is like saying "we dont need regulations in meat packing, every individual can become educated in butchery cleanliness and track the supply chains for the products they buy and everything will be better!"

Re:Critical Bluetooth vulnerability in Android by madez on Friday February 07, 2020 @06:30AM (#22265008)
We surely need regulation that demands at least delayed publication of firmware source and hardware documentation, I agree. The analogy to regulation in the food industry is enlightening.

It's easier to achieve regulation when people care and show that they care. It seems to me, voting now with your wallet is one of the most direct ways to make a case.

Re:Critical Bluetooth vulnerability in Android by clarry on Friday February 07, 2020 @07:06AM (#22265201)
Voting against the tyranny of the ignorant masses (or just people who also value convenience; or those who can't afford expensive) is a discarded vote. Your pennies are not going to change the world.
Re:Critical Bluetooth vulnerability in Android by madez on Friday February 07, 2020 @07:16AM (#22265254)
Unlike in some political systems, in the market the winner doesn't take all, but rather all receive their votes. Even then, I don't understand the psychology underlying the concept "discarded vote". I vote for what I think is best. To me that is what votes are all about. Is the psychological desire to be part of the winning group responsible?
Re:Critical Bluetooth vulnerability in Android by tripzilch on Saturday February 08, 2020 @07:37AM (#22275433)
I think you're taking the analogy of "vote with your wallet" a bit too far. It's not actual voting, or democratic, it just means that whoever has the most money decides. It's not really comparable to a political system of voting (and if you think it does seem suspiciously similar, that probably means that political system is broken).

> I vote for what I think is best.

Maybe you're an exception, but if you're talking about "vote with your wallet", then the vast majority will actually vote what they think is best for their wallets.

I mean, if you're going to let money decide, then expect the outcome to benefit money.

Re:Critical Bluetooth vulnerability in Android by clarry on Friday February 07, 2020 @10:57AM (#22267197)
If you know you're voting for a niche candidate that cannot win, then that vote achieves nothing. It amounts to as much as not voting at all; voting, then, is an empty ritual, just a rain dance. Psychological desire has nothing to do with it, it's just hard facts.
Re:Critical Bluetooth vulnerability in Android by madez on Friday February 07, 2020 @11:48AM (#22267843)
Even in an archaic the-winner-takes-all vote, the result reveals important information besides determining the winner. That information can influence other voters, vote options, and the winners behavior.
Re:Critical Bluetooth vulnerability in Android by kortilla on Friday February 07, 2020 @05:56PM (#22272041)
We’re talking about voting with your wallet. The vendor you pick doesn’t need to “win”, it just needs to get enough to survive. This is why voting with your wallet is much more powerful than voting for winner-take-all representatives in a political system.
Re:Critical Bluetooth vulnerability in Android by Normal_gaussian on Friday February 07, 2020 @06:45AM (#22265092)
I don't think many people are talking directly to their officials about it. It certainly isn't something my local representatives talk about, and the political consultation groups some of my uni-friends now work in definitely don't have it on their radar.
Re:Critical Bluetooth vulnerability in Android by Mirioron on Friday February 07, 2020 @04:11PM (#22270996)
How do I vote with my wallet though? The only alternative is an iPhone which fulfills a somewhat different role functionally.
Re:Critical Bluetooth vulnerability in Android by dTal on Saturday February 08, 2020 @01:12PM (#22277316)
>This is like saying "we dont need regulations in meat packing, every individual can become educated in butchery cleanliness and track the supply chains for the products they buy and everything will be better!"

People say this kind of thing all the time, even on HN. It's a libertarian saw that the FDA is unneccesary and obstructionist. Personally I think it's deranged, but apparently it's an ideological battle that's still being fought.

Re:Critical Bluetooth vulnerability in Android by taspeotis on Friday February 07, 2020 @06:24AM (#22264973)
Or just buy Apple. The iPhone 5s was released in 2013 and got an update less than a fortnight ago (January 28).
Re:Critical Bluetooth vulnerability in Android by ekianjo on Friday February 07, 2020 @07:55AM (#22265476)
> Or just buy Apple

And get locked in another walled garden? Erm... no thank you.

Re:Critical Bluetooth vulnerability in Android by Humdeee on Friday February 07, 2020 @01:16PM (#22268945)
Meh, I prefer that over a gated patch of dirt
Re:Critical Bluetooth vulnerability in Android by rstupek on Friday February 07, 2020 @01:24PM (#22269031)
gated landfill?
Re:Critical Bluetooth vulnerability in Android by visualphoenix on Friday February 07, 2020 @07:37AM (#22265382)
Did this iOS Bluetooth LE exploit ever get patched? https://github.com/hexway/apple_bleee/blob/master/README.md

Less dangerous, for sure...

Re:Critical Bluetooth vulnerability in Android by eithed on Friday February 07, 2020 @06:35AM (#22265040)
Can you make assurances that iPhone doesn't suffer from similar issues, given it's not open source solution?
Re:Critical Bluetooth vulnerability in Android by objclxt on Friday February 07, 2020 @06:57AM (#22265154)
Depends what you mean by "similar issues"

If you mean "a bunch of relatively new Android phones not getting security updates because their manufacturer doesn't support them", then yes. Apple is actively providing not just security patches but entire feature software updates for the iPhone 6S, which is 4.5 years old at this point.

Re:Critical Bluetooth vulnerability in Android by eithed on Friday February 07, 2020 @09:39AM (#22266346)
Yup, that's what I mean. While I do have an Android phone that is patched (Samsung), I understand that many people will be hmm... irritated that this vulnerability won't be fixed and requires them to upgrade. I'd not treat switching to Apple ecosystem as panacea to everything though and would be more for security through audit, not obscurity.
Re:Critical Bluetooth vulnerability in Android by why_only_15 on Friday February 07, 2020 @02:04PM (#22269486)
Apple's security is heavily audited in a lot of ways. They give special phones to researchers that make it easier to audit them, and there are significant bug bounties.
Re:Critical Bluetooth vulnerability in Android by dewey on Friday February 07, 2020 @06:43PM (#22272394)
> They give special phones to researchers that make it easier to audit them

Did this already happen? I only remember the announcement and then researchers on Twitter complaining that the first one is yet to be seen.

Re:Critical Bluetooth vulnerability in Android by prox on Friday February 07, 2020 @07:36AM (#22265371)
There a couple of alternative solutions, from convenient to effort needed :

iOS ecosystem. Since Apple is a hardware manufacturer foremost, you notice from the start you aren’t the product. Lots of apps, many of high quality.

Librem/Pinephone : Linux phones. While the hardware is still closed source in certain parts, it’s a step up from what we have now. Librem allows you to install any linux variant you choose.

Zerophone : Build your own phone basically, very cheap to build ($50) , and currently in development.

Re:Critical Bluetooth vulnerability in Android by lima on Friday February 07, 2020 @06:46AM (#22265099)
There's tons of security researchers focusing on iOS and the lack of source code access is merely an inconvenience.
Re:Critical Bluetooth vulnerability in Android by janekm on Friday February 07, 2020 @06:46AM (#22265097)
To put that in perspective, as far as I've been able to determine Google provided security updates for the 2013 Nexus 5 until November 2018: https://arstechnica.com/gadgets/2018/03/google-ends-major-os... It's doubtful that any other Android vendor provided updates for longer...
Re:Critical Bluetooth vulnerability in Android by shpx on Friday February 07, 2020 @08:46AM (#22265856)
Another data point: the first Google Pixel, released October 20, 2016, stopped getting security updates in October 2019 https://support.google.com/pixelphone/answer/4457705?hl=en
Re:Critical Bluetooth vulnerability in Android by kllrnohj on Friday February 07, 2020 @12:39PM (#22268512)
It stopped being listed as having guaranteed updates but it already has gotten at least one more update since then. Per https://developers.google.com/android/images#sailfish there's been an update for the Pixel in December 2019.

It is missing the Jan & Feb 2020 updates that the Pixel 2 received, but it's plausible the Pixel 1 could still get a patch for this critical issue.

Re:Critical Bluetooth vulnerability in Android by joshuaissac on Friday February 07, 2020 @07:06AM (#22265202)
While it is not the same as manufacturer support, the latest version of LineageOS is officially supported on the Samsung Galaxy S4 (2013).
Re:Critical Bluetooth vulnerability in Android by myself248 on Friday February 07, 2020 @07:21AM (#22265274)
S4 here too! The last great flagship, as far as I'm concerned. Removable battery (just ordered another!), headphone jack, microSD slot, USB OHG, HDMI/MHL out, glove-compatible touchscreen, and small enough to fit the hand.

I'm gonna keep these things running as long as I can, because the prospect of replacing them with something a decade newer but inferior in every meaningful way is simply sad.

LineageOS is the only reason I don't loathe the whole Android ecosystem, to be honest.

Re:Critical Bluetooth vulnerability in Android by ekianjo on Friday February 07, 2020 @07:59AM (#22265507)
You still have to root your device to install LineageOS right?
Re:Critical Bluetooth vulnerability in Android by myself248 on Friday February 07, 2020 @08:43AM (#22265833)
TBQH I've never been quite clear on what it means to root a device. I just run Heimdall and load the files they specify, plug the device in, and a few minutes later, it reboots into Lineage.
Re:Critical Bluetooth vulnerability in Android by joshuaissac on Friday February 07, 2020 @11:28AM (#22267598)
To install LineageOS, it is enough to unlock the bootloader, which permits the installation of operating system images that have not been signed by the manufacturer (e.g. Samsung).

Rooting permits applications to have more control over the device at runtime. Some devices require the bootloader to be unlocked to enable rooting, and others do not.

Re:Critical Bluetooth vulnerability in Android by ekianjo on Friday February 07, 2020 @07:58AM (#22265503)
> any other Android vendor provided updates for longer...

Nokia is the best though: https://www.counterpointresearch.com/nokia-leads-global-rank...

they support even their very old phones to upgrade up to the latest version of Android.

Re:Critical Bluetooth vulnerability in Android by ChuckNorris89 on Friday February 07, 2020 @08:11AM (#22265599)
Buying iPhone makes sense if you're already invested in the whole ecosystem(owning MacBook, iWatch, AirPods, etc.). If you're not part of the Apple ecosystem the experience is less polished when you need one apple device to play well with the rest of your non apple devices.
Re:Critical Bluetooth vulnerability in Android by tommit on Friday February 07, 2020 @08:49AM (#22265881)
Full disclosure: I'm very locked in the Apple ecosystem. They do play amazingly well with one another, but I feel like that's not at all their main selling point.

You can appreciate the longevity and continued support of an iPhone without having an Apple Watch. You can appreciate a MacBook for its OS (pre Catalina anyway) and build quality (I'm still running a 2014 model -- though I have read about recent models' issues) without having an iPhone to pair it with. To be fair, you cannot appreciate an Apple Watch without an iPhone at all since it won't do anything, and I'm no the fence about AirPods and how well they do outside the Apple world.

My point is, once you're in the ecosystem, you notice a lot of little things that may make your life easier. Are they great? Yeah absolutely. Are they what sells the product? In my opinion, not at all. Unless it happens to pinpoint your exact use case (I need to lock and unlock my MacBook 30 times a day and I'm tired of having to enter a password, I want my Apple Watch to unlock it), it's the product itself that will most likely convince you. The way they neatly play together at times is just the cherry on top, like when you notice your computer and phone now share a clipboard. That's awesome, but not a single selling point for anyone.

Now, I will be the first one to say: iTunes sucks. So, if you do buy an iPhone, it makes sense IMO to shed out the extra 99ct a month for iCloud storage.

Re:Critical Bluetooth vulnerability in Android by davidy123 on Friday February 07, 2020 @12:56PM (#22268716)
While there are cheap computers that don't last well, pretty much any computer at the price point of an Apple computer will last at least five years, in fact they will probably last several times that. Additionally, Thinkpads for example have full user service manuals and often support users repairing or upgrading parts such as RAM and storage that explicitly maintains the warranty.
Re:Critical Bluetooth vulnerability in Android by tommit on Monday February 10, 2020 @06:16AM (#22288118)
That's awesome! I have been using a Linux-running Thinkpad at work for almost three years now and I absolutely love it.

I didn't want my comment to sound like I'm saying Apple does it best. I just wanted to drive the point home that I don't think it's mainly the ecosystem that makes Apple devices fun to use.

As a side note, I wasn't talking hardware that lasts 5 years. We all know most devices on the market now can pull that off, bar one battery-replacement. I was rather talking continued software updates, where iOS is certainly in the lead.

Edit: just re-read your comment and you were talking Apple computers specifically. Oh well :)

Re:Critical Bluetooth vulnerability in Android by vel0city on Friday February 07, 2020 @05:35PM (#22271876)
FWIW, you don't need to be in the Apple ecosystem to have features like having a secondary device auto-unlock your laptop or desktop. Windows has supported a paired device unlocking your user account for a while now, and it does not have to be a manufacturer specific device. Logging in with devices like Yubikeys is also a supported login method.
Re:Critical Bluetooth vulnerability in Android by tommit on Monday February 10, 2020 @06:12AM (#22288090)
That's fair! I guess a side-effect of being locked up in one ecosystem is that you only rarely notice what's happening in others.

I feel like that only furthers my original point though. I didn't want to argue that Apple does it best, only that you can enjoy their devices without being fully bought into the ecosystem.

Re:Critical Bluetooth vulnerability in Android by dana321 on Friday February 07, 2020 @06:36AM (#22265051)
Only because their newer iphone SE is similar enough.
Re:Critical Bluetooth vulnerability in Android by blub on Friday February 07, 2020 @07:12AM (#22265229)
The SE has a similar shape with the 5s, but the internals of a 6s, which is two generations older than the 5s.
Re:Critical Bluetooth vulnerability in Android by dana321 on Saturday February 08, 2020 @09:28AM (#22275856)
I knew it was an updated cpu, but what i meant was they keep it going because it is similar enough looking and probably a lot of the parts are the same like the screen and other associated chips within the device.

There is more to a phone than just the cpu.

Re:Critical Bluetooth vulnerability in Android by munificent on Friday February 07, 2020 @12:48PM (#22268613)
That would work better mobile phones were anywhere in the vicinity of an efficient market. It's not.

* The barrier of entry is very high: You need a top-tier manufacturing system and supply chain. An operating system. An entire suite and market of applications. All of the apps users expect and rely on (mail, navigation, Facebook, chat, Instagram, etc.) must be supported. The hardware is only profitable if you manufacture at very high scale.

* Information asymmetry is very high. Users have almost no insight into how secure one platform is versus another. In fact, they have access to paradoxical information. The most secure platforms are the ones with the most transparent security flaw handling, but those are also the ones that appear the least secure because the vulnerabilities are more widely reported.

* Products are nowhere near commoditized. A phone is a very large constellation of hardware, operating system, and software features. There is no apples to apples comparison between phones. Maybe you like the camera on one but not the screen on the other. One has better apps but the other a more stable OS.

This is not a market where consumer choice will effectively drive solutions to diffuse problems.

Re:Critical Bluetooth vulnerability in Android by zozbot234 on Friday February 07, 2020 @06:32AM (#22265020)
They're all using the same junk SoC's with zero documentation and the crappiest possible level of "board" support anyway. You're actually better off buying a device where that support has been properly reverse-engineered/forward ported and is included in the mainline kernel. (Lots of Allwinner boards are "supported" in that way.) But it's ridiculous that we have to do this.

Also FWIW, the problem has zilch to do with "Android" per se - pre-Android mobile Linux was even worse. It's embedded platforms in general.

Re:Critical Bluetooth vulnerability in Android by kop316 on Friday February 07, 2020 @07:30AM (#22265335)
I hope you realize that with the exception of freescale, there are no phone and tablet devices where the vendor actually cooperate and does that. Many of the devices that are documented are because of the open source community that actually bother to dig in and do this (without any vendor support).

That means there is no Android or Apple device on the market today that accomplishes what you say.

The only phones that are out there that can do that are the Pinephone and Librem 5. I have beta devices of both, and while I am extremely excited to see them mature and turn into daily drivers, the fact is neither can actually be a daily driver today.

Re:Critical Bluetooth vulnerability in Android by nicolaslem on Friday February 07, 2020 @06:36AM (#22265052)
This is why my next phone will be a Librem 5. I know that it will probably suck but at least it's moving things in the right direction.
Re:Critical Bluetooth vulnerability in Android by ekianjo on Friday February 07, 2020 @08:00AM (#22265516)
> my next phone will be a Librem 5.

Better go with a Pinephone if everything that's been written about Librem as a company is even half-true.

Re:Critical Bluetooth vulnerability in Android by madez on Friday February 07, 2020 @06:55AM (#22265144)
I'm in the same boat. If it moves things in the right direction, then it doesn't suck.
Re:Critical Bluetooth vulnerability in Android by prox on Friday February 07, 2020 @07:38AM (#22265387)
Indeed! I usually get “but it’s still a closed source modem” as a counterpoint ... sigh
Re:Critical Bluetooth vulnerability in Android by squarefoot on Friday February 07, 2020 @08:07AM (#22265574)
The closed source modem, or network firmware for that matter, isn't much of a problem if it can't see clear data and/or access to system memory or execute instructions. I'd see it more of a black box not unlike old RS232 connected modems: they could see all data going back and forth, but encrypting that data would be enough since they could never access the system memory to see the data before encryption or after decryption. Librem 5 and Pinephone should work along these lines. Having everything 100% open would be better, but in this case being closed doesn't create security concerns since all personal data is unavailable to these subsystems; only the main system, which is entirely open and where the user is king, can access them.
Re:Critical Bluetooth vulnerability in Android by papermachete on Friday February 07, 2020 @06:57AM (#22265157)
What are some 2018+ sub-$200 smartphones that run first-party LineageOS to no disadvantage over the stock ROM?
Re:Critical Bluetooth vulnerability in Android by pmlnr on Friday February 07, 2020 @07:13AM (#22265233)
There aren't any, unless you go second hand. LOS and nearly all custom ROMs are aiming at widespread, mostly high end devices, which is one of the big problems.
Re:Critical Bluetooth vulnerability in Android by myself248 on Friday February 07, 2020 @07:24AM (#22265293)
I've learned this lesson.

If I have $200 to spend on a phone, I will not buy a low-end 2019 $200 phone.

I will buy a used (or new-old-stock) flagship that was $700 when it came out a few years ago, and is now $200 on the used market.

The older flagship will have similar specs to today's low-end junk, but also all the enthusiast support, better accessory availability, and probably better build quality overall, because it was originally intended to be the highest of the high-end.

Re:Critical Bluetooth vulnerability in Android by steerablesafe on Friday February 07, 2020 @07:39AM (#22265395)
Flagships have the most idiotic designs though, as far as I looked around. Low-end current year $200 phones often have removable batteries, headphone jack and dual sim support. Flagships typically have none of that.
Re:Critical Bluetooth vulnerability in Android by papermachete on Friday February 07, 2020 @08:04AM (#22265548)
I mean if you can go so far as to install or build third party ROMs, it'd be an interesting weekend hobby to repair electronics yourself.

I've saved hundreds of dollars of technology on trivial home repairs instead of buying replacements.

Re:Critical Bluetooth vulnerability in Android by smush on Friday February 07, 2020 @02:53PM (#22270145)
$300 but that got me a Samsung Galaxy Note 9. Headphone jack and all.
Re:Critical Bluetooth vulnerability in Android by mavhc on Friday February 07, 2020 @10:29AM (#22266859)
You'll also have to replace the battery though
Re:Critical Bluetooth vulnerability in Android by myself248 on Tuesday February 11, 2020 @06:50PM (#22304260)
So? I literally just ordered this last thursday. It cost me $4.15: https://www.ebay.com/itm/323865336446
Re:Critical Bluetooth vulnerability in Android by scns on Friday February 07, 2020 @07:40AM (#22265400)
Get a used Galaxy S5, should cost less than $100. Has an oled screen, so switching ui to dark mode saves battery. Has a headphone jack and removable battery. Runs Android 9 via LineageOS
Re:Critical Bluetooth vulnerability in Android by papermachete on Friday February 07, 2020 @08:01AM (#22265521)
Thanks. Is that the original lineageOS or one of those "what works: you tell me ;)" ROMs?
Re:Critical Bluetooth vulnerability in Android by gruez on Friday February 07, 2020 @08:37AM (#22265782)
I'm surprised nobody mentioned xiaomi phones yet.
Re:Critical Bluetooth vulnerability in Android by kees99 on Friday February 07, 2020 @06:34AM (#22265030)
My understanding is that each android phone model is unique and requires unique OS update (unlike, say, BIOS- or UEFI-based x86 PCs, where exact same Windows/Linux/BSD/... image can be installed on any of them).

Having a "standard" OS interface for the phone, where there is just one OS image for a given OS version, and that image could be installed on any phone - now that would be the true alternative, which I would be delighted to vote for with my wallet.

Re:Critical Bluetooth vulnerability in Android by zozbot234 on Friday February 07, 2020 @06:40AM (#22265064)
> Having a "standard" OS interface for the phone, where there is just one OS image for a given OS version, and that image could be installed on any phone

Project Treble is working towards this, in a way. But it's a huge hack that's still dependent on lots of weird AOSP-specific stuff, and doesn't even give you a "single" OS image for every device - the "proper" image for your device varies by baseline AOSP support (7, 8, 9, 10), "A" vs. "A+B" boot and of course 32-bit vs. 64-bit architecture. Nowhere near "UEFI-based PC" territory.

Re:Critical Bluetooth vulnerability in Android by yjftsjthsd-h on Friday February 07, 2020 @09:13AM (#22266066)
Eh... remember 32-bit UEFI? It might be smaller, but there is still room for weirdness.
Re:Critical Bluetooth vulnerability in Android by jacquesm on Friday February 07, 2020 @06:58AM (#22265163)
> My understanding is that each android phone model is unique

Sure, but each PC is also 'unique' in that sense, in fact I'd happily bet that there are more different kinds of hardware combinations for PCs than there are android phone models. And yet, that never was a problem.

Re:Critical Bluetooth vulnerability in Android by cesarb on Friday February 07, 2020 @07:09AM (#22265220)
However, every PC descends from the original IBM 5150 from the 1980s, which gives the PC a common base which phones never had.
Re:Critical Bluetooth vulnerability in Android by zozbot234 on Friday February 07, 2020 @07:03AM (#22265189)
Plug-and-Play and then ACPI have been used to get around this. Hardware discovery just doesn't seem to be a thing on these embedded SoC platforms, and even the hardware support itself (drivers, etc.) is extremely sub-par if you expect to run the ordinary, mainline kernel.
Re:Critical Bluetooth vulnerability in Android by jacquesm on Friday February 07, 2020 @08:22AM (#22265667)
Even before harware discovery and plug-and-play you could do this by simply specifying what hardware you had or by 'probing' the hardware for presence of certain characteristics (this wasn't always fool proof). The hardest parts were when interrupts were still selected with jumpers rather than automatically enumerated.
Re:Critical Bluetooth vulnerability in Android by kees99 on Friday February 07, 2020 @10:54AM (#22267163)
8086 has 256 IO addresses, and hardware of that era had fairly simple initialization, so completely naive way to find peripheral X was to 'probe' each and every possible IO address with something like:

  for i in range(256):
    poke(i,magic1)
    if peek(i) == magic2:
      found!
256 probes in all is not that bad, and real-world probing would only try a handful of commonly used addresses, making it even faster.

Phone SoCs on the other hand have many peripherals memory-mapped, (meaning there are millions/billions addresses to 'probe'), plus there are things like power sequencing, GPIO enable lines that need to be asserted, and clock-sources configured before peripheral would even respond at all. Oh, and that GPIO, or power controller, or clock source themselves might be accessible via an i2c chip speaking its own protocol, so you need to initialize those first, etc, etc.

All of this complexity could be described via linux "devicetree" subsystem, and devicetrees are in a usable state for some hardware (although DT itself is often a labyrinth to navigate). Thing is - factory software for most phones have been extremely slow to adopt DT, and even some that do use DT, don't do it in a particularly portable way.

Re:Critical Bluetooth vulnerability in Android by rjmunro on Friday February 07, 2020 @06:25AM (#22264981)
Looks like I need a new phone because of this. Which phone would you recommend so I don't make the same mistake again?
Re:Critical Bluetooth vulnerability in Android by krn on Friday February 07, 2020 @06:38AM (#22265057)
I would only buy a device running Android One, because they receive monthly security patches and new Android versions for up to 3 years.

The current options include all Nokia smartphones, Motorola One line, and Xiaomi Mi A line.

For the best hardware and 5G support, I would look at Nokia 9.2 (Snapdragon 8--) and Nokia 8.2 (Snapdragon 7--) releases this year.

The best deal is to buy 6 months after the release, when most Android devices become heavily (30-40%) discounted, but are still quite new.

I prefer Android over iOS because of the freedom to install open-source OS-level ad-blockers, such as Blokada[1], which greatly improve privacy and battery life.

[1] https://blokada.org/

Re:Critical Bluetooth vulnerability in Android by zozbot234 on Friday February 07, 2020 @06:46AM (#22265098)
Note that "Xiaomi Mi A" devices are the only ones that are similar to Android One. Most Xiaomi devices have a custom UX and additional weirdness. (Among which is the need to "sign up" online for bootloader unlock and wait for a timeout period. They do this because resellers used to ship bootloader-unlocked versions with "unofficial" mods of sorts, often with customers being none-the-wiser. Not an issue on the 'Mi A' line, for whatever reason.)
Re:Critical Bluetooth vulnerability in Android by krn on Friday February 07, 2020 @07:11AM (#22265226)
> Most Xiaomi devices have a custom UX and additional weirdness.

That's true. Just like Samsung, Huawei, OnePlus, and any other Android manufacturer except Nokia, Xiaomi maintains its own Android ROM, called MIUI[1]. It's not as vanilla as Android One, but at least it also receives monthly security patches.

> Among which is the need to "sign up" online for bootloader unlock and wait for a timeout period. They do this because resellers used to ship bootloader-unlocked versions with "unofficial" mods of sorts, often with customers being none-the-wiser. Not an issue on the 'Mi A' line, for whatever reason.

It's not an issue with Xiaomi Mi A line, because Xiaomi's reputation is not affected as much if there is something wrong with a smartphone that is not running its custom ROM.

Nokia has only recently started allowing to unlock the bootloader of some of the models, and has a similar process[2].

[1] https://en.wikipedia.org/wiki/MIUI

[2] https://www.nokia.com/phones/en_int/bootloader

Re:Critical Bluetooth vulnerability in Android by mavhc on Friday February 07, 2020 @10:31AM (#22266885)
According to Nokia: Unlocking a device means you may lose some of its functionalities, including – but not limit to – telephone, radio, audio, video, payment, encryption and DRM.
Re:Critical Bluetooth vulnerability in Android by krn on Friday February 07, 2020 @11:13AM (#22267396)
As with probably all Android devices, unlocking the bootloader breaks the SafetyNet[1].

And any custom Android ROM requires drivers to be able to completely support the hardware of a particular device.

[1] https://www.howtogeek.com/241012/safetynet-explained-why-and...

Re:Critical Bluetooth vulnerability in Android by mavhc on Sunday February 09, 2020 @01:53PM (#22283632)
Why would that break the ability to make phone calls though? Unless they mean now you have the capability to break it, not that unlocking it may break it
Re:Critical Bluetooth vulnerability in Android by prox on Friday February 07, 2020 @07:39AM (#22265393)
Some options, from less effort to more effort : iOS ecosystem.Since Apple is a hardware manufacturer foremost, you notice from the start you aren’t the product. Lots of apps, many of high quality.

Librem/Pinephone : Linux phones. While the hardware is still closed source in certain parts, it’s a step up from what we have now. Librem allows you to install any linux variant you choose.

Zerophone : Build your own phone basically, very cheap to build ($50) , and currently in development.

Re:Critical Bluetooth vulnerability in Android by vesinisa on Friday February 07, 2020 @07:05AM (#22265198)
I can attest that my Pixel 3a received the February update as soon as it was released directly from Google, and I have been overall very happy with this phone. Pixel 3a is the cheapest yet (IMHO) best Pixel phone on the market. It is guaranteed to receive OTA updates and security fixes until at least May 2022: https://support.google.com/nexus/answer/4457705?hl=en
Re:Critical Bluetooth vulnerability in Android by djxyeush on Friday February 07, 2020 @07:51AM (#22265450)
If you don't expect to lose sleep over third party apps (such as Tachiyomi for comic reading) then iphones are spectacular. You won't have as much customization but the experience overall really does explain why Apple is so profitable. Otherwise, Samsung for MST payments. You'll still want a wallet/clip, but there's been more than a few times I forgot my wallet and MST saved me from a wasted trip to the market.
Re:Critical Bluetooth vulnerability in Android by amanaplanacanal on Friday February 07, 2020 @01:41PM (#22269181)
I switched from Android to iOS when my last phone (samsung) stopped getting updates. I miss a couple things: a good adblocker, and the Swype keyboard. I setup a pi-hole at home to take care of ads when I am there, but the iOS swype-equivalent keyboard is nowhere near as good as the real Swype keyboard on android.
Re:Critical Bluetooth vulnerability in Android by tremon on Friday February 07, 2020 @08:07AM (#22265571)
> There are alternatives

Can you name one smartphone device with open internals? I'd love to buy one, but I don't think they exist. From Replicant's recommendations [1]:

If compromising on privacy/security is not an option, or anything serious is at stake (e.g. political activism or journalism in a sensitive area), it is advised to avoid using a telephony-enabled device at all.

My impression from the smartphone market is that phone platforms have become less open, not more, over the last ten years. The PinePhone isn't generally available yet, and the Librem 5 current iterations don't have working audio calls.

[1] https://www.replicant.us/freedom-privacy-security-issues.php...

Re:Critical Bluetooth vulnerability in Android by madez on Friday February 07, 2020 @12:09PM (#22268142)
Openness isn't binary. One significant step is support for the mainline Linux kernel. Another significant step is free information about the hardware on a high-level, such as PCB schematics and documentation about the used chips. Here are some projects that I'm aware of:

Mainline Linux:

https://pocket.popcorncomputer.com/

https://necunos.com/shop/

Mainline Linux + high-level hardware documentation:

https://puri.sm/products/librem-5/

https://www.pine64.org/pinephone/

Re:Critical Bluetooth vulnerability in Android by tripzilch on Saturday February 08, 2020 @07:27AM (#22275401)
That solution is also rather terrible. We need a better solution than "vote with our wallets", I'm not prepared to give disproportionate voting power to those with disproportionally more money. Because money does not make one more right, more qualified and most definitely not more likely to make a decision that is fair to everybody.

"Voting with your wallet" only leads to good outcomes if the incentives are right. I mean it's money, the VAST majority of it is spent not for the greater good but for small, inefficient egotistical purposes.

Re:Critical Bluetooth vulnerability in Android by toast0 on Friday February 07, 2020 @01:00PM (#22268762)
Do you want two OpenMoko phones sitting in my drawer? They're about as useful now as they were then.