Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

System Hardening in Android 11

security.googleblog.com

Post reply on HN
Print view View original

41–50 of 211 posts

Re: System Hardening in Android 11

#41

Post by pantalaimon »

sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

What about Magisk? When you have full control over the system, you can pretend everything to Userspace Apps.

Re: System Hardening in Android 11

#44

Post by homarp »

californical wrote: post #33
freedomben wrote: post #20

Earlier quoted context omitted.

You're upset about them requiring hardware attestation in SafetyNet (I am too) so you move to a platform that is way less flexible and way more closed? Not a troll, I'm really curious.

I can give an anecdote. I love most things about iOS design more than Android, and I've used both, but have stuck with Android over the last 7-8ish years. Mainly because of the amount that I could customize things, freely make little app projects, install custom ROMs, etc. Over the last few years, it's gotten inconvenient to tinker, and I just don't find myself bothering with it anymore. I've run into issues where ce…

iOS 14 does not let you use a different default browser engine. It's just the skin that change. It's still Webkit under the hood

Re: System Hardening in Android 11

#45

Post by slipheen »

homarp wrote: post #44
californical wrote: post #33

Earlier quoted context omitted.

I can give an anecdote. I love most things about iOS design more than Android, and I've used both, but have stuck with Android over the last 7-8ish years. Mainly because of the amount that I could customize things, freely make little app projects, install custom ROMs, etc. Over the last few years, it's gotten inconvenient to tinker, and I just don't find myself bothering with it anymore. I've run into issues where ce…

iOS 14 does not let you use a different default browser engine. It's just the skin that change. It's still Webkit under the hood

As much as you and I may care about that, for many (most?) people the browser chrome is the most important part.

Syncing bookmarks, UI, tab handling etc tend to be bigger pain points for individuals, as opposed to the more dev-focused aspects such as supporting a certain API in Javascript.

Re: System Hardening in Android 11

#46

Post by stephc_int13 »

pjmlp wrote: post #37
asveikau wrote: post #9

Earlier quoted context omitted.

Most Android apps probably allocate more with the JVM than they do malloc, right? My intuitive guess is that they could regress the performance of libc malloc and many people wouldn't notice.

Yes, the NDK main goal is for writing native libraries, not full blown applications. Although native memory allocations can happen via ByteBuffer, HardwareBuffer, image decoders, or native libraries.

Many games are written in C/C++ with the minimal amount of Java.

Re: System Hardening in Android 11

#47

Post by grishka »

pantalaimon wrote: post #41
sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

What about Magisk? When you have full control over the system, you can pretend everything to Userspace Apps.

If I understand these SafetyNet changes right, it's now relying on TrustZone, where "trust" frankly means distrusting the end user. This runs on a privilege level above the OS kernel, and it isn't possible to modify that firmware or extract data from it even with the unlocked bootloader, by design. It's currently used for media DRM among other things.

Re: System Hardening in Android 11

#48

Post by user5994461 »

ocdtrekkie wrote: post #36
freedomben wrote: post #20

Earlier quoted context omitted.

You're upset about them requiring hardware attestation in SafetyNet (I am too) so you move to a platform that is way less flexible and way more closed? Not a troll, I'm really curious.

For me, Play Services is a non-starter: It's malware, plain and simple. For a couple years I tried to use Android without Google services, but I found it too restrictive. Most apps I'd want/need to use wouldn't even run without Google Play, even if you got the APK, since there's not really a good app store that has a lot of Android apps without Google Play. (F-Droid's hard-line open source requirement is too restrict…

You could try one of the Chinese android phones, like Xiaomi. Make sure to get an Asian import, because some models have an US/European export edition with the normal Google ecosystem.

This is an interesting experience in what a fully functional phone not from Google/Apple can be like. It may not be able to run the usual apps though, unless you install the playstore manually.

Re: System Hardening in Android 11

#49

Post by bad_user »

ocdtrekkie wrote: post #36
freedomben wrote: post #20

Earlier quoted context omitted.

You're upset about them requiring hardware attestation in SafetyNet (I am too) so you move to a platform that is way less flexible and way more closed? Not a troll, I'm really curious.

For me, Play Services is a non-starter: It's malware, plain and simple. For a couple years I tried to use Android without Google services, but I found it too restrictive. Most apps I'd want/need to use wouldn't even run without Google Play, even if you got the APK, since there's not really a good app store that has a lot of Android apps without Google Play. (F-Droid's hard-line open source requirement is too restrict…

What is wrong with Play Services, why is it malware?

Re: System Hardening in Android 11

#50

Post by zozbot234 »

sangfroid_bio wrote: post #40
sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

Another duopoly that needs more competition is push notification infrastructure. Efficient push notification requires OS vendor server support due to radio usage and agreements with telecommunication companies. Everybody is obsessed with closed app stores and completely missing the net neutrality aspect of the iOS/Android duopoly.

It's not clear that push notifications have to be centralised. The OS could coalesce requests for notifications while still querying multiple sources, thus minimizing the time that radios have to be powered on.
Post reply on HN