News for hackers. Stuff that matters.
Re:Critical Bluetooth vulnerability in Android by taspeotis on Friday February 07, 2020 @06:24AM (#22264973)
Or just buy Apple. The iPhone 5s was released in 2013 and got an update less than a fortnight ago (January 28).
Re:Critical Bluetooth vulnerability in Android by ekianjo on Friday February 07, 2020 @07:55AM (#22265476)
> Or just buy Apple

And get locked in another walled garden? Erm... no thank you.

Re:Critical Bluetooth vulnerability in Android by Humdeee on Friday February 07, 2020 @01:16PM (#22268945)
Meh, I prefer that over a gated patch of dirt
Re:Critical Bluetooth vulnerability in Android by rstupek on Friday February 07, 2020 @01:24PM (#22269031)
gated landfill?
Re:Critical Bluetooth vulnerability in Android by visualphoenix on Friday February 07, 2020 @07:37AM (#22265382)
Did this iOS Bluetooth LE exploit ever get patched? https://github.com/hexway/apple_bleee/blob/master/README.md

Less dangerous, for sure...

Re:Critical Bluetooth vulnerability in Android by eithed on Friday February 07, 2020 @06:35AM (#22265040)
Can you make assurances that iPhone doesn't suffer from similar issues, given it's not open source solution?
Re:Critical Bluetooth vulnerability in Android by objclxt on Friday February 07, 2020 @06:57AM (#22265154)
Depends what you mean by "similar issues"

If you mean "a bunch of relatively new Android phones not getting security updates because their manufacturer doesn't support them", then yes. Apple is actively providing not just security patches but entire feature software updates for the iPhone 6S, which is 4.5 years old at this point.

Re:Critical Bluetooth vulnerability in Android by eithed on Friday February 07, 2020 @09:39AM (#22266346)
Yup, that's what I mean. While I do have an Android phone that is patched (Samsung), I understand that many people will be hmm... irritated that this vulnerability won't be fixed and requires them to upgrade. I'd not treat switching to Apple ecosystem as panacea to everything though and would be more for security through audit, not obscurity.
Re:Critical Bluetooth vulnerability in Android by why_only_15 on Friday February 07, 2020 @02:04PM (#22269486)
Apple's security is heavily audited in a lot of ways. They give special phones to researchers that make it easier to audit them, and there are significant bug bounties.
Re:Critical Bluetooth vulnerability in Android by dewey on Friday February 07, 2020 @06:43PM (#22272394)
> They give special phones to researchers that make it easier to audit them

Did this already happen? I only remember the announcement and then researchers on Twitter complaining that the first one is yet to be seen.

Re:Critical Bluetooth vulnerability in Android by prox on Friday February 07, 2020 @07:36AM (#22265371)
There a couple of alternative solutions, from convenient to effort needed :

iOS ecosystem. Since Apple is a hardware manufacturer foremost, you notice from the start you aren’t the product. Lots of apps, many of high quality.

Librem/Pinephone : Linux phones. While the hardware is still closed source in certain parts, it’s a step up from what we have now. Librem allows you to install any linux variant you choose.

Zerophone : Build your own phone basically, very cheap to build ($50) , and currently in development.

Re:Critical Bluetooth vulnerability in Android by lima on Friday February 07, 2020 @06:46AM (#22265099)
There's tons of security researchers focusing on iOS and the lack of source code access is merely an inconvenience.
Re:Critical Bluetooth vulnerability in Android by janekm on Friday February 07, 2020 @06:46AM (#22265097)
To put that in perspective, as far as I've been able to determine Google provided security updates for the 2013 Nexus 5 until November 2018: https://arstechnica.com/gadgets/2018/03/google-ends-major-os... It's doubtful that any other Android vendor provided updates for longer...
Re:Critical Bluetooth vulnerability in Android by shpx on Friday February 07, 2020 @08:46AM (#22265856)
Another data point: the first Google Pixel, released October 20, 2016, stopped getting security updates in October 2019 https://support.google.com/pixelphone/answer/4457705?hl=en
Re:Critical Bluetooth vulnerability in Android by kllrnohj on Friday February 07, 2020 @12:39PM (#22268512)
It stopped being listed as having guaranteed updates but it already has gotten at least one more update since then. Per https://developers.google.com/android/images#sailfish there's been an update for the Pixel in December 2019.

It is missing the Jan & Feb 2020 updates that the Pixel 2 received, but it's plausible the Pixel 1 could still get a patch for this critical issue.

Re:Critical Bluetooth vulnerability in Android by joshuaissac on Friday February 07, 2020 @07:06AM (#22265202)
While it is not the same as manufacturer support, the latest version of LineageOS is officially supported on the Samsung Galaxy S4 (2013).
Re:Critical Bluetooth vulnerability in Android by myself248 on Friday February 07, 2020 @07:21AM (#22265274)
S4 here too! The last great flagship, as far as I'm concerned. Removable battery (just ordered another!), headphone jack, microSD slot, USB OHG, HDMI/MHL out, glove-compatible touchscreen, and small enough to fit the hand.

I'm gonna keep these things running as long as I can, because the prospect of replacing them with something a decade newer but inferior in every meaningful way is simply sad.

LineageOS is the only reason I don't loathe the whole Android ecosystem, to be honest.

Re:Critical Bluetooth vulnerability in Android by ekianjo on Friday February 07, 2020 @07:59AM (#22265507)
You still have to root your device to install LineageOS right?
Re:Critical Bluetooth vulnerability in Android by myself248 on Friday February 07, 2020 @08:43AM (#22265833)
TBQH I've never been quite clear on what it means to root a device. I just run Heimdall and load the files they specify, plug the device in, and a few minutes later, it reboots into Lineage.
Re:Critical Bluetooth vulnerability in Android by joshuaissac on Friday February 07, 2020 @11:28AM (#22267598)
To install LineageOS, it is enough to unlock the bootloader, which permits the installation of operating system images that have not been signed by the manufacturer (e.g. Samsung).

Rooting permits applications to have more control over the device at runtime. Some devices require the bootloader to be unlocked to enable rooting, and others do not.

Re:Critical Bluetooth vulnerability in Android by ekianjo on Friday February 07, 2020 @07:58AM (#22265503)
> any other Android vendor provided updates for longer...

Nokia is the best though: https://www.counterpointresearch.com/nokia-leads-global-rank...

they support even their very old phones to upgrade up to the latest version of Android.

Re:Critical Bluetooth vulnerability in Android by ChuckNorris89 on Friday February 07, 2020 @08:11AM (#22265599)
Buying iPhone makes sense if you're already invested in the whole ecosystem(owning MacBook, iWatch, AirPods, etc.). If you're not part of the Apple ecosystem the experience is less polished when you need one apple device to play well with the rest of your non apple devices.
Re:Critical Bluetooth vulnerability in Android by tommit on Friday February 07, 2020 @08:49AM (#22265881)
Full disclosure: I'm very locked in the Apple ecosystem. They do play amazingly well with one another, but I feel like that's not at all their main selling point.

You can appreciate the longevity and continued support of an iPhone without having an Apple Watch. You can appreciate a MacBook for its OS (pre Catalina anyway) and build quality (I'm still running a 2014 model -- though I have read about recent models' issues) without having an iPhone to pair it with. To be fair, you cannot appreciate an Apple Watch without an iPhone at all since it won't do anything, and I'm no the fence about AirPods and how well they do outside the Apple world.

My point is, once you're in the ecosystem, you notice a lot of little things that may make your life easier. Are they great? Yeah absolutely. Are they what sells the product? In my opinion, not at all. Unless it happens to pinpoint your exact use case (I need to lock and unlock my MacBook 30 times a day and I'm tired of having to enter a password, I want my Apple Watch to unlock it), it's the product itself that will most likely convince you. The way they neatly play together at times is just the cherry on top, like when you notice your computer and phone now share a clipboard. That's awesome, but not a single selling point for anyone.

Now, I will be the first one to say: iTunes sucks. So, if you do buy an iPhone, it makes sense IMO to shed out the extra 99ct a month for iCloud storage.

Re:Critical Bluetooth vulnerability in Android by davidy123 on Friday February 07, 2020 @12:56PM (#22268716)
While there are cheap computers that don't last well, pretty much any computer at the price point of an Apple computer will last at least five years, in fact they will probably last several times that. Additionally, Thinkpads for example have full user service manuals and often support users repairing or upgrading parts such as RAM and storage that explicitly maintains the warranty.
Re:Critical Bluetooth vulnerability in Android by tommit on Monday February 10, 2020 @06:16AM (#22288118)
That's awesome! I have been using a Linux-running Thinkpad at work for almost three years now and I absolutely love it.

I didn't want my comment to sound like I'm saying Apple does it best. I just wanted to drive the point home that I don't think it's mainly the ecosystem that makes Apple devices fun to use.

As a side note, I wasn't talking hardware that lasts 5 years. We all know most devices on the market now can pull that off, bar one battery-replacement. I was rather talking continued software updates, where iOS is certainly in the lead.

Edit: just re-read your comment and you were talking Apple computers specifically. Oh well :)

Re:Critical Bluetooth vulnerability in Android by vel0city on Friday February 07, 2020 @05:35PM (#22271876)
FWIW, you don't need to be in the Apple ecosystem to have features like having a secondary device auto-unlock your laptop or desktop. Windows has supported a paired device unlocking your user account for a while now, and it does not have to be a manufacturer specific device. Logging in with devices like Yubikeys is also a supported login method.
Re:Critical Bluetooth vulnerability in Android by tommit on Monday February 10, 2020 @06:12AM (#22288090)
That's fair! I guess a side-effect of being locked up in one ecosystem is that you only rarely notice what's happening in others.

I feel like that only furthers my original point though. I didn't want to argue that Apple does it best, only that you can enjoy their devices without being fully bought into the ecosystem.

Re:Critical Bluetooth vulnerability in Android by dana321 on Friday February 07, 2020 @06:36AM (#22265051)
Only because their newer iphone SE is similar enough.
Re:Critical Bluetooth vulnerability in Android by blub on Friday February 07, 2020 @07:12AM (#22265229)
The SE has a similar shape with the 5s, but the internals of a 6s, which is two generations older than the 5s.
Re:Critical Bluetooth vulnerability in Android by dana321 on Saturday February 08, 2020 @09:28AM (#22275856)
I knew it was an updated cpu, but what i meant was they keep it going because it is similar enough looking and probably a lot of the parts are the same like the screen and other associated chips within the device.

There is more to a phone than just the cpu.