Termux no longer updated on Google Play • Hacker News Board

Re: Termux no longer updated on Google Play

#221

Post by fsflover » Tue, Jan 05, 2021, 8:11 PM UTC

danShumway wrote: post #210

folkrav wrote: post #171

Earlier quoted context omitted.

> Is that unreasonable? Running another OS on a device with physical hardware switches is a privilege right now, so it costs more. There are essentially two companies doing this, and neither of them are even at the point where they can completely honestly say their products are out of beta. The Librem is expensive in no small part because its feature list is fringe, and even ignoring the inherent hardware challenges…

The ultimate goal of Purism is to expand the market, but (opinion me) when I look at Purism's products in general I don't see them ever themselves moving out of niche categories. If you buy a Purism laptop today, you'll already pay a premium over companies like Dell. I suspect that Purism is happy to see companies like Pine existing, and I know that they want Linux smartphones in general to be a broader market, I don…

> As far as I know, the front camera on the recent Pinephones still doesn't have software support.

It works well since October: https://www.pine64.org/2020/10/15/update-new-hacktober-gear/.

Re: Termux no longer updated on Google Play

#222

Post by joshuamorton » Tue, Jan 05, 2021, 8:12 PM UTC

londons_explore wrote: post #150

shawnz wrote: post #137

Earlier quoted context omitted.

What is so wrong with Android that you trust it 10x less than iOS? What attacks are possible on Android that aren't possible on iOS? There are also trivial ways to root ancient iOS versions with a web browser, too. In fact, I think that technique was more common among iOS devices than it ever was among Android...

A bunch of things that add up...: * Lack of things like w^x enforced across the OS. (the root of this post). * The quality of SoC and OEM provided drivers being very very poor - there are lots of kernel exploits to be found. * Very slow/no updates. Time from an exploit being reported to Google to it being patched by a typical user is usually 6 months or more. That means for any random device you find on the street, t…

It seems like most (all?) of these don't apply to a recent Pixel device. I'd be curious what your bitcoin count would be for a pixel 4 or 5.

Re: Termux no longer updated on Google Play

#223

Post by sneak » Tue, Jan 05, 2021, 8:12 PM UTC

est31 wrote: post #145

sneak wrote: post #104

Earlier quoted context omitted.

I learned recently that having Advanced Protection enabled also rewrites all URLs in your email messages to use the Google URL redirector, even when accessed via IMAP. It breaks PGP signatures, among other things. No way to turn it off without disabling all of Advanced Protection. Sweet, huh?

Which advantages does Advanced Protection give you in particular so that you have enabled it? It seems that things like hardware 2fA should work without it as well? Genuinely curious.

It forbids 2FA with anything other than U2F hardware, which is practically unphishable. I don't really trust the Google auth system without the hard "disallow all non-hardware-based auth" restriction, due to the innumerable stories about sim swapping, et c.

Re: Termux no longer updated on Google Play

#224

Post by angry_octet » Tue, Jan 05, 2021, 8:14 PM UTC

ddevault wrote: post #78

londons_explore wrote: post #64

TL;DR: Android is trying to enforce all data being either writable, or executable, never both. iOS already does this. There are big security benefits (it becomes much harder to exploit an app). A disadvantage is it becomes much harder to make things like terminal emulators and things that want to download random code and run it. But those are by far the minority of apps, and it seems crazy to make a pretty massive se…

This reminds me of the Harvard architecture: https://en.wikipedia.org/wiki/Harvard_architecture Perhaps most familiar to the typical HN reader via Arduinos, and contrasted with von Neumann: https://en.wikipedia.org/wiki/Von_Neumann_architecture And anyone who has tried to make any kind of interesting general-purpose system on a Harvard design will tell you that it's not really practical.

Except for the many CPUs with separate instruction and data caches, i.e. Harvard architecture L1, von Neumann main memory.

https://community.arm.com/developer/ip-products/processors/b...

Re: Termux no longer updated on Google Play

#225

Post by pjmlp » Tue, Jan 05, 2021, 8:15 PM UTC

wvenable wrote: post #200

pjmlp wrote: post #188

Earlier quoted context omitted.

Programming on the go is for toy programs anyway. For real work there are laptops and desktops.

No, I've done real work on the go. The manufacturer of my tablet sells it as a productivity device. My tablet is more powerful than my laptop and I have a portable keyboard and mouse for it. Why have all this power if all I can do is play Candy Crush?

To use it as a Java based platform, not as yet another example of UNIX monoculture stuck in V6 CLI mindset.

Also, plenty of musicians, painters, designers, writers do real work on Android, my previous remark about real work was playing devil's advocate.

Re: Termux no longer updated on Google Play

#226

Post by danShumway » Tue, Jan 05, 2021, 8:15 PM UTC

fsflover wrote: post #221

danShumway wrote: post #210

Earlier quoted context omitted.

The ultimate goal of Purism is to expand the market, but (opinion me) when I look at Purism's products in general I don't see them ever themselves moving out of niche categories. If you buy a Purism laptop today, you'll already pay a premium over companies like Dell. I suspect that Purism is happy to see companies like Pine existing, and I know that they want Linux smartphones in general to be a broader market, I don…

> As far as I know, the front camera on the recent Pinephones still doesn't have software support. It works well since October: https://www.pine64.org/2020/10/15/update-new-hacktober-gear/ .

Nice! I hadn't seen that update.

Regardless, the point still stands that if we've had camera support for ~3 months, we're probably not at the point where we need to seriously worry about whether we're currently offering the highest value-to-money hardware choices to consumer demographics that have never opened up a command line before.

Re: Termux no longer updated on Google Play

#227

Post by shawnz » Tue, Jan 05, 2021, 8:18 PM UTC

user-the-name wrote: post #218

shawnz wrote: post #209

Earlier quoted context omitted.

Sure, but the other poster seemed to be talking about software policy-based security measures with that point (like what Android is adding) and not just app store review restrictions.

iOS enforces this in the memory manager.

This change is regarding the filesystem though, not memory

Re: Termux no longer updated on Google Play

#228

Post by angry_octet » Tue, Jan 05, 2021, 8:21 PM UTC

aviraldg wrote: post #101

slightly offtopic: I am surprised by how much patience thestinger has on the thread replying to people who clearly have no context about the issue - enough to repeatedly explain the tradeoffs and reasons behind the decisions taken.

Absolutely heroic.

Re: Termux no longer updated on Google Play

#229

Post by danShumway » Tue, Jan 05, 2021, 8:29 PM UTC

user-the-name wrote: post #216

forgotmypw17 wrote: post #80

Earlier quoted context omitted.

>But those are by far the minority of apps, and it seems crazy to make a pretty massive security tradeoff for something that 99% of apps don't need to do. It also completely eliminates general purpose computing. >One solution might be a special permission to be allowed to do that, but it seems unlikely a user could really make an informed decision. I think the way "Developer Mode" on Android is implemented is pretty…

General purpose computing is not secure, and can most likely never be made secure.

Why did we move away from flip phones?

Like seriously, what are people even arguing here? General purpose computing was a mistake? Is that seriously an argument that anyone is making in good faith as they type into their web browser on an Internet forum?

Just wait until you find out that app stores are always going to have fundamentally imperfect moderation. Forget running unsigned/unapproved code, we should get rid of 3rd-party code entirely.

General purpose everything is insecure. Self-published books spread lies, open markets have bad products, computers get infected, and people burn and poison themselves cooking their own food in stoves. If your goal is 100% security, then you will very likely never build any platform or product that's worth using.

We have other ways to improve security beyond turning smartphones back into flip phones.

Re: Termux no longer updated on Google Play

#230

Post by mehrdadn » Tue, Jan 05, 2021, 8:32 PM UTC

westurner wrote: post #47

izacus wrote: post #20

The GitHub discussion is significantly more informative and carries a lot of thinking behind the changes: https://github.com/termux/termux-app/issues/1072 IMO a better link than a short paragraph on Wiki.

Note that there are 297 hidden items in that issue so you have to click "Load more..." ceil(297/60) times to read all of the comments about how APK packaging is soon necessary for latest Android devices so the termux package manager can't just dump executable binaries wherever. FWIU: - Android Q+ disallows exec() on anything in $HOME, which is where termux installed binaries that may have been writeable by the execut…

Are there any SELinux + Android experts there? Do you know if there is a way to alter the policy to undo this change with root privileges without disabling SELinux enforcement entirely? It fundamentally seems like it should be possible; I just don't know how. It would get around the issue very nicely if someone can figure out how, since I imagine many people with Termux also have root.