News for hackers. Stuff that matters.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by allegory on Monday September 15, 2014 @05:22PM (#8321596)
It's this sort of thing that puts me off Android as a platform. Even my mother got sold a 2.2 handset recently (Samsung Galaxy Ace) that hasn't been patched for the best part of 3 years. You never know when you're going to end up with a lemon on your hands.

Big jump to this conclusion but I'm more inclined to trust Microsoft at the moment as they have a better reputation for lifetime (unlike Android), have a very public security process and good industry comms and the devices are proven usable if not faster after recent updates (unlike iOS which starts to be terribly limiting performance-wise). Plus they're dirt cheap.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by legohead on Monday September 15, 2014 @06:45PM (#8322016)
Yes, this continues to be a problem that I hope Google addresses somehow. I got the Samsung Galaxy Nexus because I assumed it would be kept up to date with the latest Android version, since it's using the Google brand 'Nexus' name.

I even asked the sales representative if it would be kept up to date (knowing I couldn't trust them, but was looking for any extra assurance), and they said yes.

Right now it's at 4.3 and wont upgrade...

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by mbq on Monday September 15, 2014 @07:22PM (#8322157)
Just switch to CyanogenMod or other custom compilation; there is a gain from Nexus brand in the ease of unlocking bootloader (;
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by gsnedders on Monday September 15, 2014 @08:11PM (#8322357)
I'm not convinced CyanogenMod (or any other variant) is actually that great; I have a Samsung Galaxy S2 (i9100 model), the last non-nightly CyanogenMod update was over a year ago now. There have been a number of CVEs issued for Android (and likely numerous others cover Android as a platform, covering OpenSSL for example) over that time period, so there's no way the phone is anywhere near up-to-date with security fixes.

CyanogenMod doesn't have any way to distinguish which phones are currently receiving security fixes in a timely manner and which are not; nor do they have any list of security advisories covering packages they distribute (go look at any notable desktop/server Linux distro — they all have public lists of security advisories and documentation of what release fixes them).

To my knowledge there is no Android distribution that has anywhere near the cohesive security story — and they're all miles behind any desktop OS.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by xorcist on Tuesday September 16, 2014 @02:00AM (#8323243)
CyanogenMod changed their release versioning. There are no more "stable" builds anymore, at all. You're supposed to run "monthly" or "milestone" or whatever they are called. Yes, I think they could have communicated this much better.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by gsnedders on Tuesday September 16, 2014 @02:04AM (#8323252)
And anyone running the stable builds have therefore never been updated to an at all recent build… sighs

And looking at my phone, I have no idea how I'm meant to update to the milestone builds. The updater lets me select "stable" or "all (inc. nightly)", and nowhere do the milestone builds appear…

None of this is helping me believe there's really any decent security story. Abandon all users who don't check the website (or whatever) to find out about releases, trusting the built-in updater to provide updates. Never publish any security advisories that cover your distribution…

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by frankzinger on Tuesday September 16, 2014 @01:51AM (#8323230)
> I have a Samsung Galaxy S2 (i9100 model), the last non-nightly CyanogenMod update was over a year ago now.

Same. The newest version which supports my phone is years old, and there are major usability issues, particularly in the dialler interface. The manufacturer (HTC) UI was miles better (i.e., actually usable).

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by thejdude on Tuesday September 16, 2014 @01:34PM (#8325739)
Are you sure? My Galaxy S 1 (one) still gets updates, as does my S3. They're monthly milestones now.

Maybe you need to install CM 11 first, so the system has a base to work with.

I think you can see if your phone gets updates if it's listed as CM11-supported.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by NickNameNick on Tuesday September 16, 2014 @02:20AM (#8323295)
It looks like there were snapshot builds in august and july. (although how they differ from nightlies, I don't know) I thought I was on a snapshot from April, but it turns out I'm on a nightly.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by thejdude on Tuesday September 16, 2014 @01:36PM (#8325748)
There was a monthly in August something, and I just installed the latest one which is from today. It may not yet be built for all supported devices though.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by jamesisaac on Monday September 15, 2014 @09:09PM (#8322528)
Same situation here. I could put up with outdated Android version, gradually deteriorating performance, and bloating of apps leading to very little free space, but it's very disappointing to find out that even to remain secure, we're expected to shell out at every stage of Google's 12-month release cycle...
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by spb on Wednesday September 17, 2014 @08:23AM (#8329597)
Try ShinyROM, it's an almost-exactly AOSP build of 4.4: http://shinyrom.goofball.org/
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by Zigurd on Monday September 15, 2014 @05:35PM (#8321663)
Android One is meant to make it simple for lo-end OEMs to ship high quality implementations of up-to-date Android and keep up with new releases. It's hard to migrate a huge OEM ecosystem to that kind of program quickly.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by npizzolato on Monday September 15, 2014 @08:03PM (#8322322)
And Nexus was meant to make it simpler for Google to ship updates directly to users, rather than having to go through OEMs. If Google can't keep their own phones up to date, do you expect Android One to be any different?
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by blocke on Monday September 15, 2014 @08:26PM (#8322389)
The only Nexus phones here that don't already have a fix available is the phone they announced as being end of life. 4.4 is not affected and is available for the Nexus 4, 5, both generations of 7 and I believe the 10.

Dear Galaxy Nexus users... It's time to let go.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by jamesisaac on Monday September 15, 2014 @09:24PM (#8322567)
The Galaxy Nexus was released only 3 years ago. Since when was that beyond the expected lifespan of a flagship product from one of the world's largest tech companies?

Don't think I've ever owned anything with such a serious planned obscolence issue. Windows supports its OS releases for 12 years (and doesn't lock you in, so you can usually follow official upgrade procedure anyway). And anything "dumber" than a smartphone doesn't really open itself up to these gaping security flaws, so still operates fine after many years.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by judk on Monday September 15, 2014 @11:15PM (#8322854)
The GN wasn't planned obsolescence so much as "Google doesn't actually own the hardware, so they can't update drivers"
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by allegory on Tuesday September 16, 2014 @02:41AM (#8323340)
Do the drivers need updating? There is a kernel ABI and API that should isolate that from the rest of the OS so the OS should continue to evolve.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by kllrnohj on Monday September 15, 2014 @11:06PM (#8322829)
> The Galaxy Nexus was released only 3 years ago. Since when was that beyond the expected lifespan of a flagship product from one of the world's largest tech companies?

It became beyond the expected lifespan when it became normal to buy a new one every 2 years thanks to contract pricing and carriers pushing people to upgrade.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by allegory on Tuesday September 16, 2014 @02:37AM (#8323334)
That works apart from in Europe. We do a lot of non contract pay as you go stuff where the handset may last 4-5 years. I have a couple of Nokias that are still good after 8 years and Microsoft have a 11-12 year lifecycle for desktop OS for example.

2 years is just a cost cutting exercise and inexcusable.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by wernercd on Monday September 15, 2014 @10:25PM (#8322723)
Since when has anything over 2 years, for a phone, had support? Anything over that is the exception, not the rule.

Apple has better support than most, but even their phones degrade with features missing on older phones AND included new features run like ass (every time my fiance upgrades old phone to new iOS she hate life until upgrade).

A 2 year old phone really is ancient... much less three or four... Who actually supports phones that old CONSISTENTLY?

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by jamesisaac on Monday September 15, 2014 @10:40PM (#8322764)
Well yeah with smartphones really short release cycles are "the rule" - because Google/Apple dominate the industry and set the rules - that's what I'm complaining about.

There's no fundamental reason a 2 year old phone should be seen as ancient. Hardware can last many times longer than that, and software can be updated. Google is just not making the effort to support its older devices.

For people like me who don't want to buy a new phone every 18 months (both a wasteful use of my money, and the earth's natural resources), Android is looking like a pretty bad choice.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by wernercd on Monday September 15, 2014 @11:16PM (#8322861)
Well, honestly, it's not just Android.

iPhones have built in time lines (more or less replaceable anything. Need a new batter? Have fun...).

And then there is the face that if you want ANY kind of app support - not just OS. Facebook, Twitter, etc... - then you can't use old phones. Years old Windows phones. Look at Blackberry phones. Palm OS. No one supports them because well... no one supports them anymore.

I think it's more a function of the rapid change and growth of complexity that makes smartphones obsolete so quick. Screen density, cpu, graphics capabilities, hard drive space, antenna speeds, etc. EVERYTHING is increasing so quick that it's hard to compare a new phone to a 2 year old phone.

It'll most likely be years before it slows down enough that you can treat a smart phone like a PC - keep it for YEARS and expect most stuff to simply run on it.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by allegory on Tuesday September 16, 2014 @02:40AM (#8323338)
My 2 year old Lumia 820 just got Windows Phone 8.1 and is as good as new in every way even though it has been dropped hundreds of times. It's getting the next 8.1 update next month as well.

That's what I expect.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by ClashTheBunny on Tuesday September 16, 2014 @02:03AM (#8323250)
But at least there is the choice with Apple. You don't have to upgrade, but if you want the new security fixes, you have them.

With Android, if you find a beloved phone by many, you will be supported for YEARS. My gTablet was being updated by the community for 4 years after the last official update. My Galaxy Note has nightlies from multiple different projects. My wife's Sony Xperia Arc S has consistent updates still. You find a phone that people fell in love with and you will have your updates until the hardware is dead.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by allegory on Monday September 15, 2014 @06:10PM (#8321836)
I doubt that will happen. At $100 a handset where is the return and motivation for an OEM to bother pushing updates out for firmware/integration testing etc (that the telcos require)? Look at the aforementioned Galaxy Ace in my last comment which is exactly where this will end up, yet again.

Also, they say 2 years' support. If you look at the phone recycling business, there is 4-5 years life in a franken-handset shipped abroad.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by aroch on Monday September 15, 2014 @06:41PM (#8321991)
Google's providing the OS support -- they make money on you using their services. Even if the revenue per user is only ¢10/year, when you get 100's of millions to billions of users that adds up.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by Pxtl on Tuesday September 16, 2014 @07:59AM (#8324031)
And I bet Samsung still won't use it for their terrible low-end phones because of their darned skin.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by ZoFreX on Tuesday September 16, 2014 @07:31AM (#8323950)
The continuing sales of the Galaxy Ace should be criminal. If you buy one and update all apps it comes with, bam: you're out of space. Not to mention even if you apply all updates available you're still a walking target for every Android exploit that's come out in the last 3 years. It is completely unfit for purpose, but even when replacements came out (Y, Ace 2) the shops near me were still pushing the Ace. Why??
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by allegory on Tuesday September 16, 2014 @04:32PM (#8326941)
Probably warehouses full of them still.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by girvo on Monday September 15, 2014 @07:40PM (#8322225)
Microsoft may update their older devices (well, once we moved to WP8 anyway, WP7 can go jump apparently), but my girlfriend's HTC 8X is half broken because her carrier refused to let the update go through. Absolutely frustrating... that's one thing I am happy about with my 4S, for sure. Screw carriers.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by allegory on Tuesday September 16, 2014 @02:35AM (#8323331)
WP7 was a different OS (CE vs NT kernel). The NT kernel wasn't portable to a couple of the SoC's they used on those devices. I suspect that's why it went and jumped.

You're right though about carriers. I always buy non-carrier locked devices here in the UK for that precise reason. Nokia sell "country variant" devices which are usually updated first.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by brudgers on Tuesday September 16, 2014 @06:36AM (#8323818)
Microsoft upgraded WP7 to WP7.8 Mango when WP8 was released. It backported many of the new features to existing devices. including my Dell VenuePro.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by mhurron on Tuesday September 16, 2014 @09:53AM (#8324453)
So Windows Phone is updated at the will of the carriers as well? Basically the only way to get updates to your smart phone is either -

1. iPhone 2. Custom Rom and you're on your own.

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by leen on Friday September 19, 2014 @02:03AM (#8339161)
> So Windows Phone is updated at the will of the carriers as well?

You can register for the Preview for Developers program [1] and get timely OS updates regardless of the carrier.

With the 8x the lack of updates is an HTC issue tho as far as I know. They look to roll out 8.1 on some of the 8Xs in October [2].

[1]: http://www.wpcentral.com/preview-for-developers

[2]: https://twitter.com/htc/status/509409362100879361

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by jayd16 on Monday September 15, 2014 @06:17PM (#8321889)
I don't understand why people are surprised they might be sold an inferior product if they don't do a minimum of research.
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by allegory on Monday September 15, 2014 @06:30PM (#8321935)
That's not how salespeople work...