Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

System Hardening in Android 11

security.googleblog.com

Post reply on HN
Print view View original

61–70 of 211 posts

Re: System Hardening in Android 11

#61

Post by mav3rick »

wvenable wrote: post #55
pjmlp wrote: post #35

Earlier quoted context omitted.

The option is simple although tiresome, reimplement it in Android Java or Kotlin, instead of trying to pretend Android is Linux, given that POSIX or Linux specific calls aren't even part of NDK Stable APIs documentation. Any app that access the Linux features directly just works out of luck, given that there are no compatibility guarantees.

I managed to get VS Code (as code-server) running natively and dotnet running on my Android tablet. It makes it a nice little development machine. Basically anything Android native is horrible for developers; you can't even get a decent IDE or text editor. You still don't have source control, web servers, programming languages, etc. Termux with a few addons gives you all that. I wish Google would recognize the value…

Google is shipping a full Linux VM integrated in the base OS on Chromebooks.

Re: System Hardening in Android 11

#62

Post by zozbot234 »

izacus wrote: post #58
zozbot234 wrote: post #50

Earlier quoted context omitted.

It's not clear that push notifications have to be centralised. The OS could coalesce requests for notifications while still querying multiple sources, thus minimizing the time that radios have to be powered on.

Except that push notifications also require work on telco's side to make sure they don't accidentally cause large battery use. E.g. there was a long time after Apple introduced push messages where iPhone battery would drain pretty fast because many telcos would have very short connection timeouts on their routing equipment. This forced the phone to wakeup the radio a lot to reestablish connection. This was "fixed" by…

> This forced the phone to wakeup the radio a lot to reestablish connection.

Perhaps, but if you can tolerate some latency, you might not have to wake the radio all that much. A huge majority of notification use cases can be delivered "late" (at least if the phone is in sleep mode) and still be useful.

Re: System Hardening in Android 11

#63

Post by izacus »

chaostheory wrote: post #15

This is nice and all, but bigger issue is when will Android phones reach Android 11? Has fragmentation gotten better? Do most phone manufacturers support upgrading to major versions of Android (it does not seem to be in their interest)?

It's really no secret after all these years that you need to buy a Google phone to get best support for their OS, just like you need to buy an Apple hardware to get support for their OS.

Re: System Hardening in Android 11

#64

Post by dredmorbius »

chinhodado wrote: post #23
sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

> apps can't simply access the "external" storage (enforces scoped storage) So how will perfectly valid use cases like file manager or backup manager work now?

Or the One Android App That Does Not Suck: Termux?

Re: System Hardening in Android 11

#65

Post by wvenable »

mav3rick wrote: post #61
wvenable wrote: post #55

Earlier quoted context omitted.

I managed to get VS Code (as code-server) running natively and dotnet running on my Android tablet. It makes it a nice little development machine. Basically anything Android native is horrible for developers; you can't even get a decent IDE or text editor. You still don't have source control, web servers, programming languages, etc. Termux with a few addons gives you all that. I wish Google would recognize the value…

Google is shipping a full Linux VM integrated in the base OS on Chromebooks.

Where's the love for Android, though?

Re: System Hardening in Android 11

#66

Post by zozbot234 »

dcow wrote: post #51
sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

Wouldn't the solution be to allow people who have legitimately unlocked their boot loader to also install a custom attestation root so that safety net can still say “the software running on this phone is the software the user intended and not a malicious 3rd party”? Or maybe safety net is not so much about user safety as it is about platform lockdown and vendor safety. The number of times I’ve been laughed out of a p…

Bootloader unlock is under user control by definition - it won't happen unless you're physically interacting with the device. The legitimate case for safety net is platform lockdown for things like financial apps. Banks and other financial services like to provide some form of insurance to users wrt. losing money in a security breach, and they can't do this unless the app really is being run on a pristine, locked-down platform. Unfortunately it also impacts sillier things like media streaming and online video games. But the best way to cope with that is simply not to use those.

Re: System Hardening in Android 11

#67

Post by antpls »

izacus wrote: post #63
chaostheory wrote: post #15

This is nice and all, but bigger issue is when will Android phones reach Android 11? Has fragmentation gotten better? Do most phone manufacturers support upgrading to major versions of Android (it does not seem to be in their interest)?

It's really no secret after all these years that you need to buy a Google phone to get best support for their OS, just like you need to buy an Apple hardware to get support for their OS.

I bought a Nokia 6.1 around 2 years ago, which is part of the Android One program and it worked well! Had all security monthly updates, the system is clean and stable, updated to major versions of Android smoothly without any issue.

If I can, I will buy another Android One phone. There is an horror story about an Android One Xiaomi phone, but Nokia delivered the promise with the 6.1, according to my experience

Re: System Hardening in Android 11

#68

Post by freedomben »

notyourday wrote: post #54
freedomben wrote: post #20

Earlier quoted context omitted.

You're upset about them requiring hardware attestation in SafetyNet (I am too) so you move to a platform that is way less flexible and way more closed? Not a troll, I'm really curious.

Play Services infuriate me. I have no idea what app is triggering what kind of actions via Play because all of those actions are done by Play on behalf of the app and Play is not showing it to me in enough details

I can certainly echo this sentiment. It is maddening to see Play services as the "culprit" for the bad thing I'm investigating. Very frustrating.

Re: System Hardening in Android 11

#69

Post by corty »

zozbot234 wrote: post #50
sangfroid_bio wrote: post #40

Earlier quoted context omitted.

Another duopoly that needs more competition is push notification infrastructure. Efficient push notification requires OS vendor server support due to radio usage and agreements with telecommunication companies. Everybody is obsessed with closed app stores and completely missing the net neutrality aspect of the iOS/Android duopoly.

It's not clear that push notifications have to be centralised. The OS could coalesce requests for notifications while still querying multiple sources, thus minimizing the time that radios have to be powered on.

The most efficient decentralized way would be direct end-to-end connections. One could assign an IPv6 address to each application and have the notifications just sent there, no middleman necessary. If an application takes up too much battery, just kill it by changing the address.

That would be a killer app for IPv6 if mobile networks were up to it...

Re: System Hardening in Android 11

#70

Post by bad_user »

homarp wrote: post #44
californical wrote: post #33

Earlier quoted context omitted.

I can give an anecdote. I love most things about iOS design more than Android, and I've used both, but have stuck with Android over the last 7-8ish years. Mainly because of the amount that I could customize things, freely make little app projects, install custom ROMs, etc. Over the last few years, it's gotten inconvenient to tinker, and I just don't find myself bothering with it anymore. I've run into issues where ce…

iOS 14 does not let you use a different default browser engine. It's just the skin that change. It's still Webkit under the hood

This is true and regrettable, but that skin is still important.

I get to use Firefox, it comes with nice tracker blocking out of the box, it keeps my history in sync with my other devices and I find the UI to be a little nicer (personal taste).

Of course I'd like the Firefox that's available on Android, with extensions capabilities and web push support. But having the ability to open links from Mail in iOS Firefox would still be nice and I can't wait for it.

Post reply on HN