Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There are over a billion outdated Android devices in use

danluu.com

Post reply on HN
Print view View original

201–210 of 474 posts

Re: There are over a billion outdated Android devices in use

#201

Post by mindslight »

tscs37 wrote: post #196
mindslight wrote: post #192

Earlier quoted context omitted.

Oh no, not a month's allocation of mobile data down the drain! An impersonal passive botnet would likely do less damage than status quo "apps" that are built to siphon as much personal data as possible. Never mind these few Mifi devices that I have - default configs that listen on wan telnet with static passwords! Well known domestic manufacturer, not worth attempting to report - the manufacturer obviously did not ca…

You should install security updates. Period. You don't help anyone by feeling better because instead of having the vendor maybe sniff on you, a hacker can do it instead. I also haven't found any apps yet that intentionally waste my monthly datacap.

Sure, and I didn't advocate doing otherwise. My point is the larger context - there is no "secure" on mobile.

Likewise, my point about losing a datacap was that it was preferable to having more personal info backhauled into commercial surveillance databases. It's not an either-or and I'm not desiring either one - just calling attention to the larger context of user-security versus the myopia of marketing/corporate security.

Re: There are over a billion outdated Android devices in use

#202

Post by mindslight »

Analemma_ wrote: post #198
mindslight wrote: post #190

Earlier quoted context omitted.

Most phones already come with two persistent implants - the user-antagonistic OS, and the baseband processor! I'm all for trusting computing devices to act as one's agents, but attempting to do so with anything resembling a modern mobile phone is barking up the wrong tree. Even though just having one means taking the location-tracking hit from negligently designed cellular protocols, further exposure can be mitigated…

This all might be true, but as a reason to not install patches, it still makes no sense. If you don’t trust the baseband or the OS, why did you buy the phone to begin with? You trust iOS n, but not iOS n+1?

One is forced to buy a phone, as an expectation/requirement of modern society. This does not imply they wish to spend even more money in support of the broken ecosystem every year/six months/etc.

Re: There are over a billion outdated Android devices in use

#203

Post by yegle »

dmitrygr wrote: post #65
yegle wrote: post #60

Earlier quoted context omitted.

The Moto X4 sell at $400 and the Xiaomi A1 is not available in US yet (you can get it ~$220 on some website). Note Xiaomi A1's system update is not handled by Google according to Wiki.

You're right about Moto. Ill fix my post. Can you send me a link to this source for A1? I'll try to check on it.

I just searched Xiaomi A1 on Google Shopping and there are several results and all looks legit.

Re: There are over a billion outdated Android devices in use

#204

Post by guelo »

userbinator wrote: post #63
opportune wrote: post #12

The flipside of this is that developers are forced to support versions of their apps that are compatible with previous operating systems. That's bad for developers, but good for consumers. iPhones shove updates down your throat as a user. They're so persistent that inevitably most people will accept the new update - and even if you're stubborn like me, eventually your apps will no longer be supported under the newer…

That's bad for developers, but good for consumers. Is it? I'm a developer --- and a consumer, as are most --- and have always kept to the principle of as much compatibility as possible, mostly by not gorging on new features for the sake of new features, and a "do what you can with what you have" approach. To me, spending a little extra effort to get much more compatibility is well worth it, since I've been on "the ot…

As a developer of a long-lived popular app I've been pretty agressive at cutting off older OS versions from updates (min sdk 21 right now, considering 23). But the Play Store lets you keep serving up an old version of your app for those older devices. So before I cut off an old OS version I make sure to have a solid bug free release that I can serve them for a few years until eventually my backend API server is forced to break backward compatibility at which point I pull it from the app store and serve up an I'm sorry message for anyone trying to run that old version, about 3 years old at this point.

Re: There are over a billion outdated Android devices in use

#205

Post by sj4nz »

userbinator wrote: post #48

With current and older devices working perfectly well, and new devices being even less serviceable and more user-hostile with greater efforts towards planned obolescence, is it any wonder that people just aren't "upgrading" any more? I don't consider this a problem, but a sign of an ecosystem that is gaining stability. In fact I'd say it's even better, from an e-waste perspective, that the amount of churn has decreas…

I have an old tablet that doesn't seem to "catch" new updates from Samsung anymore. Perhaps it would be worth rooting or something just to get it current? I would "upgrade" the software if it was available. Buying new hardware isn't something I will do in most situations--the device has to become non-functional before I consider it.

Re: There are over a billion outdated Android devices in use

#206

Post by tscs37 »

mindslight wrote: post #201
tscs37 wrote: post #196

Earlier quoted context omitted.

You should install security updates. Period. You don't help anyone by feeling better because instead of having the vendor maybe sniff on you, a hacker can do it instead. I also haven't found any apps yet that intentionally waste my monthly datacap.

Sure, and I didn't advocate doing otherwise. My point is the larger context - there is no "secure" on mobile. Likewise, my point about losing a datacap was that it was preferable to having more personal info backhauled into commercial surveillance databases. It's not an either-or and I'm not desiring either one - just calling attention to the larger context of user-security versus the myopia of marketing/corporate se…

There is secure on mobile. Secure is not a binary property, it's a spectrum of options and possibilities which heavily depend on your environment and your threat model.

You either get security updates at the possible downside of sending more data to some database of a known vendor or you get the very possible risk of being part of a slide on DEFCON Fail Panel by some unknown blackhat.

I choose a known advesary over an unknown any day.

Re: There are over a billion outdated Android devices in use

#207

Post by gnu8 »

Those billion outdated devices are the low hanging fruit screening me and my fully updated iOS device. I can be confident that casual attackers aren't coming after me, only the higher tier ripoff artists gunning for iOS users and the APTs who are attacking my company specifically.

Re: There are over a billion outdated Android devices in use

#208

Post by guelo »

patcheudor wrote: post #45
sizzzzlerz wrote: post #19

I've got a 7 or 8 year old Google Nexus phone. Google stopped updating the OS 5 years ago. The only impact I've noticed is that newer apps won't run on and older OS. For me, however, that really isn't a problem since I use it for making and receiving calls and texts, and checking my email. Right now, I'm in no hurry to lay out hundreds for a new phone, Apple or Android, that will be obsoleted in just a couple years w…

Many Android devices of that age and even newer had flaws resulting in the failure to properly validate HTTPS connections as they would accept invalid certificates. As a result, every time I fire up an off the shelf WiFi Pineapple in public and run SSLSplit (not to be confused with Moxies SSLStrip), I get credential after credential, typically starting with e-mail accounts. This is obviously bad because if someone is…

Most of these "oh no, security!" issues can be mitigated by avoiding public WiFi or using a VPN on them.

Re: There are over a billion outdated Android devices in use

#209

Post by tibu »

userbinator wrote: post #48

With current and older devices working perfectly well, and new devices being even less serviceable and more user-hostile with greater efforts towards planned obolescence, is it any wonder that people just aren't "upgrading" any more? I don't consider this a problem, but a sign of an ecosystem that is gaining stability. In fact I'd say it's even better, from an e-waste perspective, that the amount of churn has decreas…

I had a quite high end Android phone from Sony 3 years ago but because it's dual SIM version I maybe receive only one update. I'm running Android 5.0.2 already for 3 years now. My phone works still well but who can count the vulnerabilities I have now on my device...

Re: There are over a billion outdated Android devices in use

#210

Post by guelo »

kbwt wrote: post #139
flukus wrote: post #23

Earlier quoted context omitted.

Updates for 2 years, security patches for 3: http://www.androidpolice.com/2015/08/05/google-announces-new... That is still way to short, especially if you don't buy it on release day. If you buy a nexus device 12 months after release you've already lost 1/3 of it's effective lifetime.

I bought a Galaxy Nexus for Android app development in September 2012 and it lasted me less than a year before security updates ended. I specifically picked that phone because it was supposed to be the best choice for always receiving the latest Android updates.

5 years ago you unluckily bought a Nexus at the exact point in time where it had the shortest support window in the whole history of the Nexus/Pixel line.
Post reply on HN