News for hackers. Stuff that matters.
Re:System Hardening in Android 11 by freedomben on Tuesday June 30, 2020 @02:36PM (#23693239)
You're upset about them requiring hardware attestation in SafetyNet (I am too) so you move to a platform that is way less flexible and way more closed?

Not a troll, I'm really curious.

Re:System Hardening in Android 11 by californical on Tuesday June 30, 2020 @03:20PM (#23693762)
I can give an anecdote.

I love most things about iOS design more than Android, and I've used both, but have stuck with Android over the last 7-8ish years. Mainly because of the amount that I could customize things, freely make little app projects, install custom ROMs, etc. Over the last few years, it's gotten inconvenient to tinker, and I just don't find myself bothering with it anymore. I've run into issues where certain apps stop working because of root.

But also both OS's have gotten much better and need fewer (if any) tweaks anyways to be used effectively. Especially with the upcoming change to allow iOS to use a different default browser (finally).

If the main reason I've been drawn to Android is vanishing more every year, I'd rather use the more elegant OS (Apple), regardless of how closed it is. I have a Pixel 2 that's getting near EOL (only 2 years after buying it), and I'll be getting an iPhone SE as soon as I can justify spending the money.

I guess something that helps too is I've been on a de-googling kick these last few months where I've been switching off all their services because of privacy, another benefit of iOS to me

Re:System Hardening in Android 11 by homarp on Tuesday June 30, 2020 @04:23PM (#23694368)
iOS 14 does not let you use a different default browser engine. It's just the skin that change. It's still Webkit under the hood
Re:System Hardening in Android 11 by bad_user on Tuesday June 30, 2020 @05:18PM (#23694900)
This is true and regrettable, but that skin is still important.

I get to use Firefox, it comes with nice tracker blocking out of the box, it keeps my history in sync with my other devices and I find the UI to be a little nicer (personal taste).

Of course I'd like the Firefox that's available on Android, with extensions capabilities and web push support. But having the ability to open links from Mail in iOS Firefox would still be nice and I can't wait for it.

Re:System Hardening in Android 11 by californical on Tuesday June 30, 2020 @04:39PM (#23694520)
Yeah it's not ideal, but it lets me sync with Firefox at least. I really only ever use my phone browser for a few things, anyways.

Neither situation is perfect, but the browser's rendering engine is surpassed by other priorities when choosing a phone.

I do look forward to the day I can use something like Pine as a daily phone though

Re:System Hardening in Android 11 by slipheen on Tuesday June 30, 2020 @04:31PM (#23694435)
As much as you and I may care about that, for many (most?) people the browser chrome is the most important part.

Syncing bookmarks, UI, tab handling etc tend to be bigger pain points for individuals, as opposed to the more dev-focused aspects such as supporting a certain API in Javascript.

Re:System Hardening in Android 11 by bad_user on Tuesday June 30, 2020 @05:22PM (#23694948)
If you're technologically illiterate, this might be true. Witness however Firefox for Android (vs iOS), the most important differences for me being:

- Extensions support, so uBlock Origin, Privacy Badger, the best ad-blocking combination that far surpasses Safari's content blockers, which are pretty shitty; and extensions are useful for more than ad-blocking — e.g. I have another one on my tablet that turns all web pages to dark mode, whether they support it or not

- Web push notifications

- (Up until very recently) webp format support

On Android I wouldn't even install many apps, like Facebook, or Twitter, or Fastmail, I'd simply use them as PWAs (web apps), in Firefox with ads blocking on, because I could.

I still use Firefox on iOS for the history / bookmarks syncing, but it's a shadow of actual Firefox.

Re:System Hardening in Android 11 by izacus on Tuesday June 30, 2020 @04:53PM (#23694656)
> As much as you and I may care about that, for many (most?) people the browser chrome is the most important part.

Except that for many/most people it's equally important to have a market choice which drives product improvements by competition. Not being able to choose a fully opensource browser engine (not even Firefox!) on iOS is a severe blow to opensource as a whole and browser engine competition in general. It's way worse than it ever was in times of IE6 - you never needed Microsoft's private signing keys to switch to Firefox or Chrome.

Re:System Hardening in Android 11 by copp on Wednesday July 01, 2020 @02:36AM (#23698439)
What makes iOS elegant over Android in your opinion ?

You seem to state it as a fact but I believe it is your opinion .

Re:System Hardening in Android 11 by pjmlp on Wednesday July 01, 2020 @03:18AM (#23698694)
Not the OP, but I also share the same opinion.

- OS Frameworks are not designed for the next year's IO, rebooting last years best practices, rather have long term roadmaps.

- The build system has stayed mostly the same, instead of having had multiple reboots

- C and C++ are integrated with the rest of tooling instead of feeling like an burden that has to be supported to keep game devs happy

- Everything that matters on iOS development is available in XCode, instead of being a mix of Studio templates, stuff dropped in Github that we are supposed to build ourselves and apparently official APIs (e.g. Oboe, Vulkan)

- Back to frameworks, while iOS offers high level frameworks for common workflows, Android offers Lego blocks that everyone fits in different ways with lengthy discussions on what is good Android code, MVP and whatever is the fad of the month on /r/androiddev

- When Apple does game development sessions, they actually talk about game development tech and do provide related tooling, Google talks about Play Store console and advertising for gamers. Notice that main GDC 2020 theme for the Google talks was to try to show that they are listing and trying to change, pity it came 10 years later.

- Most APIs in iOS seem to have had some though placed into them, in Android you have stuff like Animations that have had multiple instantiations, or others that have deprecated stuff even before reaching a proper release.

- When Google decided to drop Eclipse they had nothing to offer for NDK devs, almost two years later JetBrains decided to create CLion and then they had a solution. Otherwise most likely there still wouldn't exist an alternative to this day.

Re:System Hardening in Android 11 by copp on Wednesday July 01, 2020 @05:00AM (#23699404)
Thanks for your perspective from a game dev. w.r.t developing apps it has been long argued that iOS is better.
Re:System Hardening in Android 11 by TheSpiceIsLife on Tuesday June 30, 2020 @05:56PM (#23695243)
> Especially with the upcoming change to allow iOS to use a different default (finally).

Did you leave a word out here?

I assume you were going to write default keyboard?

Re:System Hardening in Android 11 by smichel17 on Wednesday July 01, 2020 @08:17AM (#23700548)
It was edited I think, the word is browser.
Re:System Hardening in Android 11 by ocdtrekkie on Tuesday June 30, 2020 @03:48PM (#23694046)
For me, Play Services is a non-starter: It's malware, plain and simple. For a couple years I tried to use Android without Google services, but I found it too restrictive. Most apps I'd want/need to use wouldn't even run without Google Play, even if you got the APK, since there's not really a good app store that has a lot of Android apps without Google Play. (F-Droid's hard-line open source requirement is too restrictive for my daily driver.)

I went to Windows Mobile for a while, it had more apps than a non-Google Android phone as it was, but obviously that's dead now as Microsoft has left the consumer space and literally told everyone to go buy Android phones.

Until antitrust happens, iPhone is really all that's left. I've got a PinePhone too, and I'm pretty excited about it, but it'll probably be a while until it reaches Windows Mobile-level of app availability. I've been pleasantly surprised by Apple's pro-privacy moves since I bought it, and if they're opening up changing default apps this year too, really the most problematic limitation is going to be gone.

Re:System Hardening in Android 11 by andrepd on Tuesday June 30, 2020 @07:54PM (#23696202)
microg is a FOSS implementation of google play services, without the malware part. Apps will still see "google play services" on your phone and mostly will run without problems, but their API calls are actually handled by microg.
Re:System Hardening in Android 11 by user5994461 on Tuesday June 30, 2020 @04:37PM (#23694503)
You could try one of the Chinese android phones, like Xiaomi. Make sure to get an Asian import, because some models have an US/European export edition with the normal Google ecosystem.

This is an interesting experience in what a fully functional phone not from Google/Apple can be like. It may not be able to run the usual apps though, unless you install the playstore manually.

Re:System Hardening in Android 11 by bad_user on Tuesday June 30, 2020 @04:38PM (#23694518)
Why would someone not trusting Google, place their trust in Xiaomi, a Chinese company?
Re:System Hardening in Android 11 by fsflover on Wednesday July 01, 2020 @08:32AM (#23700630)
What if you live in the US? Which government you should fear more, US or Chinese?
Re:System Hardening in Android 11 by bad_user on Wednesday July 01, 2020 @08:55AM (#23700796)
You should fear your local government most, of course, but it does not follow that given the choice you should pick foreign solutions, quite the contrary.

As a citizen you have rights guaranteed by the law in your own country. That's the very definition of citizenship. As a citizen you have leverage over your government, even if small, because you can organize yourself with others, e.g. in class action lawsuits, you can vote, you can convince others to vote, etc. Foreign governments and companies couldn't give a shit about your rights, the only rights you have are those defined weakly by trade agreements.

Not only that but data can be traded or leaked. A foreign company thousands of miles away, collecting data about you, could always leak that data to your local organized crime organizations.

N.B. I know that big companies like Xiaomi also have a presence in the US. With a big enough presence, the US government could coerce them just as easily, so if you fear the US government, it's a double whammy.

---

So this is a non sequitur. Even if you fear the US government, as a US citizen, you should either pick US solutions, or solutions from countries that have a culture and laws for preserving privacy, such as Switzerland or Germany.

Frankly as a US citizen picking products and services from a country with disregard for basic human rights, because you don't trust the US, is just stupid.

Re:System Hardening in Android 11 by fsflover on Thursday July 02, 2020 @04:33AM (#23711171)
> As a citizen you have rights guaranteed by the law in your own country.

True except for some people like protesters or whistleblowers who do not enjoy "rights guaranteed by the law", or at least not reliably.

> Even if you fear the US government, as a US citizen, you should either pick US solutions, or solutions from countries that have a culture and laws for preserving privacy, such as Switzerland or Germany.

Are you aware of any smartphones from those countries without involvement of Apple or Google?

Re:System Hardening in Android 11 by ocdtrekkie on Tuesday June 30, 2020 @04:48PM (#23694595)
The issue is too many Android apps won't even run without Google's malware installed. Even Google's direct competitors' apps depend on it. Skype from Microsoft will not run on Android without Google Play last time I tried it. So I needed to move to a platform where the default assumption is not that users have Google's background malware enabled, and that means anything based on Android is off the table.
Re:System Hardening in Android 11 by viraptor on Tuesday June 30, 2020 @05:24PM (#23694967)
Microsoft phone is dead. They're not competitors. You can also use https://microg.org/ with lots of apps already as an alternative.
Re:System Hardening in Android 11 by ocdtrekkie on Tuesday June 30, 2020 @06:34PM (#23695562)
Are you saying you do not believe Google and Microsoft are competitors? From office suites and chat apps to cloud services and gaming platforms, they have a lot of competing offerings.
Re:System Hardening in Android 11 by bad_user on Tuesday June 30, 2020 @04:38PM (#23694507)
What is wrong with Play Services, why is it malware?
Re:System Hardening in Android 11 by izacus on Tuesday June 30, 2020 @04:55PM (#23694674)
It provides same services as Apple ships with iOS (iCloud, Push messaging services, Find my Friend, AppStore, Location, etc.), except that in Android that's branded "malware that calls home" and in Apple world it's called "integral part of the OS".

The only difference here is that in Android you can actually separate the two.

Re:System Hardening in Android 11 by viraptor on Tuesday June 30, 2020 @05:25PM (#23694978)
The second difference is, you can replace it - https://microg.org/
Re:System Hardening in Android 11 by no_wizard on Tuesday June 30, 2020 @07:05PM (#23695824)
This sounds great, but reading the fine print:

>Although most microG components are far from complete, users are amazed by the results.

What users are amazed by what results? And if you read this carefully, it clearly states its missing swaths of the APIs, so its not 1 to 1 compatible and is very likely out of date in at least one reimplementation, per this [0]:

>This is alpha-grade software and not yet ready for production use. Do not use if you don't know what you're doing.

I don't think this would hold up to being what I'd use as a daily driver. I just want my phone to work not fiddle with troubleshooting weird edge cases for apps I want to use.

I applaud the project, but its hardly a simple as saying 'you can replace it' and that's the last you'll have to think about it.

[0] https://github.com/microg/android_packages_apps_GmsCore/wiki

Re:System Hardening in Android 11 by ocdtrekkie on Tuesday June 30, 2020 @07:36PM (#23696082)
MicroG still talks to Google services. It takes their code off your device but doesn't relieve you of the primary issue, that everything is dependent on Google's cloud services to work, and that they can still track everything you sent to them.
Re:System Hardening in Android 11 by cromwellian on Wednesday July 01, 2020 @01:26AM (#23698033)
As can iCloud, but somehow being tethered to APNS doesn't count. When Apple phone's home, it's like ET and you're supposed to feel all warm and fuzzy.
Re:System Hardening in Android 11 by sitic on Tuesday June 30, 2020 @02:58PM (#23693500)
If my phone has to be a walled garden, Apple's seems more enticing to me for the moment. I would want to give it a try at least. I might very well regret it and switch back to an Android phone which won't get updates after two years.

I also have to say that to me, even if apps that require SafetyNet don't work anymore after unlocking, it certainly doesn't make the phone certainly useless. But I don't want to live with the inconvenience of not being able to use some random apps.

Re:System Hardening in Android 11 by 867-5309 on Tuesday June 30, 2020 @05:27PM (#23694994)
In my case I am stuck with a spare phone on android 8 since they banned wireless scanning from 9 onwards. it's a matter of functionality over perceived security. fed up with google. will check out the PinePhone
Re:System Hardening in Android 11 by WolfRazu on Tuesday June 30, 2020 @08:13PM (#23696333)
No, they just rate limited it and it's toggleable in 10.
Re:System Hardening in Android 11 by 867-5309 on Wednesday July 01, 2020 @11:53AM (#23702837)
appears android 10 has been abandoned by Sony for my main driver (mid 2017). time to try the custom ROMs which are only just appearing..
Re:System Hardening in Android 11 by zimmerfrei on Wednesday July 01, 2020 @04:07AM (#23699075)
Is it clear exactly what SafetyNet does and reports back to Google?

Is its source code available (including for any TrustZone component), maybe as part of AOSP?

I am OK with the concept and I can value it also as a protection against advanced malware, but only if it is totally transparent (to me!) what data it collects and relies upon.

Re:System Hardening in Android 11 by panpanna on Wednesday July 01, 2020 @07:57AM (#23700442)
I think they use industry standard techniques (trust anchroing, attestation, etc) but their implementation is not fully open.

I'm actually fine with that.

Re:System Hardening in Android 11 by notyourday on Tuesday June 30, 2020 @04:39PM (#23694521)
Play Services infuriate me. I have no idea what app is triggering what kind of actions via Play because all of those actions are done by Play on behalf of the app and Play is not showing it to me in enough details
Re:System Hardening in Android 11 by nmfisher on Wednesday July 01, 2020 @07:22AM (#23700240)
As a developer, I apologise for the Play Services requirement. I believe this is a hard dependency for Firebase integration (and at the very least, it's the easiest/fastest way to implement Google Sign-in, though I assume this could be replaced with manual OAuth).

I didn't realize it was such an issue. I'll make a note to investigate how difficult it is to migrate away.

Re:System Hardening in Android 11 by notyourday on Wednesday July 01, 2020 @07:34AM (#23700320)
I do not think there's actually a good way for a developer to avoid Play Services, which in turn leads me to say that you should continue to use it or whatever else lets you get the most functionality out of the Android for the least amount of pain. Objectively, an Android user is not going to disable the Play Services as Google's apps will continue to rely on it so non-Google developers should use it as well.
Re:System Hardening in Android 11 by freedomben on Tuesday June 30, 2020 @05:15PM (#23694872)
I can certainly echo this sentiment. It is maddening to see Play services as the "culprit" for the bad thing I'm investigating. Very frustrating.
Re:System Hardening in Android 11 by kelnos on Tuesday June 30, 2020 @05:24PM (#23694969)
If you're comfortable disclosing, what is this "bad thing"? From my understanding, Play Services provides roughly the same suite of things that are also supplied on iOS, only on iOS, it's built into the OS (location services, cloud messaging, etc.), while on Android it's a modular component that Google can push updates to without a full OS update. Is that not accurate?
Re:System Hardening in Android 11 by scarface74 on Tuesday June 30, 2020 @08:10PM (#23696308)
Everything that Google announced in the submitted article requires an OS update. So being able to push just Play Services updates doesn’t help too much....