Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There are over a billion outdated Android devices in use

danluu.com

Post reply on HN
Print view View original

391–400 of 474 posts

Re: There are over a billion outdated Android devices in use

#391

Post by zingmars »

nowherecat wrote: post #312
amelius wrote: post #284

Earlier quoted context omitted.

That's one reason I'm still hoping for a Linux/Firefox phone.

How about Purism's Librem 5? https://puri.sm/shop/librem-5/ Librem 5, the phone that focuses on security by design and privacy protection by default. Running Free/Libre and Open Source software and a GNU+Linux Operating System designed to create an open development utopia, rather than the walled gardens from all other phone providers.

Isn't out yet and from what I can tell they haven't released much info about it yet. Maybe will be worth revisiting the idea when it's actually released.

Re: There are over a billion outdated Android devices in use

#393

Post by Doctor_Fegg »

pixl97 wrote: post #366
Doctor_Fegg wrote: post #278

Earlier quoted context omitted.

Do you have an actual number for "probably" - assuming normal browsing habits (i.e. not to the sort of porn site with a higher likelihood of installing malware), and an outdated version of iOS or Android? How is that number changed by not using public wifi?

>i.e. not to the sort of porn site with a higher likelihood of installing malware Porn sites are not where most malware comes from. Ad networks are. I've had more attempts at virus and malware installs from 'legitimate' sites that have had poor control of their banner ads. https://www.extremetech.com/internet/220696-forbes-forces-re... >How is that number changed by not using public wifi? You are, quite falsely, assu…

I'm not assuming anything: I asked a question, rather than stating a fact.

"Not significantly" would be a valid answer to the second question. However, you seem to be answering "are home routers entirely secure?", which wasn't my question: my question was about real-world risk levels (i.e. "_are_ public wifi points significantly more likely to deliver threatening payloads", not "_could_ they be").

I'd still be interested in an answer to the main question.

Re: There are over a billion outdated Android devices in use

#394

Post by yaantc »

patcheudor wrote: post #374
guelo wrote: post #208

Earlier quoted context omitted.

Most of these "oh no, security!" issues can be mitigated by avoiding public WiFi or using a VPN on them.

VPN can be a problem, especially on these older devices as those services themselves are vulnerable due to underlying OS issues. In terms of WiFi, keep in mind LTE is effectively broken because of the emergency tower redirection implementation. It's possible for attackers to direct devices to their own OpenLTE tower. https://sourceforge.net/projects/openlte/files/

> keep in mind LTE is effectively broken because of the emergency tower > redirection implementation

And it will fails after only a few message, when the phone modem tries to authenticate the network (MME) and fails. LTE and 3G do have mandatory mutual authentication where the device authenticates the network very early on. It's 2G that's the problem: a 2G network does authenticate the device, but not the other way round, which opens the door to the well known MITM attacks on 2G (stingrays). The worst a LTE/3G rogue cell can do is try to attack the modem during the early non-authenticated messages (send corrupted messages), and waste UE time or jam it. But it can't do MITM.

So if you're paranoid and you can afford it due to good 3G/4G coverage, disable 2G on your handset ;)

Re: There are over a billion outdated Android devices in use

#395

Post by pksadiq »

vetinari wrote: post #376
pksadiq wrote: post #326

Earlier quoted context omitted.

> That's not true, as the Linux kernel is still GPLv2. So while you could swap out the userspace GNU utils, the device manufacturer can still lock the bootloader which is perfectly fine with the GPLv2. Yeah, probably. But the presence of packages like GNU libc can make it harder for the manufacturer to lock the device. > ... kernel version due to proprietary binary blobs which nearly every phone uses. Sadly, binary b…

> this happened because many Linux developers don't care about binary blobs. It is mostly users, not developers, who don't care about binary blobs. The users then take the "pragmatic" approach of using binary blobs, but hey, stuff works for them. See also the Nvidia binary driver. Who is the advocate for that? Users (hey, never had a problem and it runs my apps very well) or developers (whoa, we cannot develop Waylan…

> It is mostly users, not developers, who don't care about binary blobs.

Partly yes, but mostly No.

You are right that most people don't care about binary blobs. But the people who can enforce this are the developers. If all developers agree and enforce this, no on can include binary blobs in Linux kernel.

Also it would be wrong for a mere user to try to enforce it by law, because it might piss off the developers, which is really bad. Also, it might not withstand in court because the developers don't care.

> The users then take the "pragmatic" approach of using binary blobs, but hey, stuff works for them.

"pragmatic"? Most of us are concerned about our immediate problems, and thus we end up with temporary solutions (most of the time), sometimes because we don't have choice, sometimes because that's easier.

I recently got an ASUS eeepc which doesn't have graphics support, because when it was first released, the only support was a binary blob, which is now abandoned.

We will eventually face issues with these binary blobs, for sure. As we know, each day, new vulnerabilities are being surfaced.

But yeah, most of us won't care, until and unless something happen. But by then, it will be too late. Just like how many of us consider the importance of time only when we know we don't have enough.

So I don't think it is "pragmatic" in long term.

Re: There are over a billion outdated Android devices in use

#396

Post by rb808 »

userbinator wrote: post #48

With current and older devices working perfectly well, and new devices being even less serviceable and more user-hostile with greater efforts towards planned obolescence, is it any wonder that people just aren't "upgrading" any more? I don't consider this a problem, but a sign of an ecosystem that is gaining stability. In fact I'd say it's even better, from an e-waste perspective, that the amount of churn has decreas…

See how Windows 95 & XP turned out. Its full of holes and still being used. We still can't get rid of it.

Re: There are over a billion outdated Android devices in use

#397

Post by Tepix »

nowherecat wrote: post #312
amelius wrote: post #284

Earlier quoted context omitted.

That's one reason I'm still hoping for a Linux/Firefox phone.

How about Purism's Librem 5? https://puri.sm/shop/librem-5/ Librem 5, the phone that focuses on security by design and privacy protection by default. Running Free/Libre and Open Source software and a GNU+Linux Operating System designed to create an open development utopia, rather than the walled gardens from all other phone providers.

If they release it with the slow outdated i.MX 6 CPU it will be terrible. Let's hope it will be the i.MX 8.

Re: There are over a billion outdated Android devices in use

#398

Post by gambiting »

uuoc wrote: post #338
CommentCard wrote: post #332

Earlier quoted context omitted.

Back up or sync important contacts and data, and then do a factory reset to restore the original OS. Make sure to turn off auto-updates as it will keep downloading them after the restore. It's a shame that phones keep losing features like micro SD.

> It's a shame that phones keep losing features like micro SD. Phones keep losing features like micro SD (and like end-user replaceable batteries) because too many purchasers do not value those items highly enough to refuse to buy any phone that lacks an SD card slot or a user-replaceable battery. Start refusing to buy any phone which lacks a micro SD slot, and the manufacturers will bring back the micro SD slots (gr…

I don't think that's so clear cut. I'm looking for a new phone now and I refuse to look at anything without a headphone jack. I've been repeatedly told online and by my friends that I'm weird - the headphone jack is dead, the ship has sailed, it's too late now etc etc. But how else can I vote on this if not with my wallet? I want a phone with a headphone jack but the choices are becoming narrower and narrower - and it seems that even picking up something with a jack does not necessarily send a right signal. Look at the original Pixel - it was Google's pride and joy that it still has a headphone jack while the iphone doesn't. Fast forward to today - Pixel 2 doesn't have a jack and no one cares.

Re: There are over a billion outdated Android devices in use

#399

Post by vetinari »

pksadiq wrote: post #395
vetinari wrote: post #376

Earlier quoted context omitted.

> this happened because many Linux developers don't care about binary blobs. It is mostly users, not developers, who don't care about binary blobs. The users then take the "pragmatic" approach of using binary blobs, but hey, stuff works for them. See also the Nvidia binary driver. Who is the advocate for that? Users (hey, never had a problem and it runs my apps very well) or developers (whoa, we cannot develop Waylan…

> It is mostly users, not developers, who don't care about binary blobs. Partly yes, but mostly No. You are right that most people don't care about binary blobs. But the people who can enforce this are the developers. If all developers agree and enforce this, no on can include binary blobs in Linux kernel. Also it would be wrong for a mere user to try to enforce it by law, because it might piss off the developers, wh…

> Also it would be wrong for a mere user to try to enforce it by law, because it might piss off the developers, which is really bad. Also, it might not withstand in court because the developers don't care.

And yet, it is the users who have the ultimate power over developers of such hw/sw. No, not courts, that's the entirely wrong solution.

Their wallets.

Such solutions are being developed only because there's money in it. It is only up to the users, whether this factor is true or not. If they care about sources, they would not purchase hardware that requires blobs. If they don't care, and reward the developers with their money for the blobs, whose fault it is?

Re: There are over a billion outdated Android devices in use

#400

Post by collinmanderson »

rb808 wrote: post #396
userbinator wrote: post #48

With current and older devices working perfectly well, and new devices being even less serviceable and more user-hostile with greater efforts towards planned obolescence, is it any wonder that people just aren't "upgrading" any more? I don't consider this a problem, but a sign of an ecosystem that is gaining stability. In fact I'd say it's even better, from an e-waste perspective, that the amount of churn has decreas…

See how Windows 95 & XP turned out. Its full of holes and still being used. We still can't get rid of it.

Can't get rid of Windows 95?

I see a lot of XP computers around, but it's been years since I've seen a 95/98/ME computer.

(Actually, now that I think about it, I think my dad still had a 98 or ME computer two years ago so he could use an old scanner.)

Post reply on HN