Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

eff.org

Post reply on HN
Print view View original

61–70 of 207 posts

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#61

Post by Nursie »

nileshtrivedi wrote: post #58
Nursie wrote: post #42

Earlier quoted context omitted.

One of the issues with that is that devices on ARM systems are not as discoverable as a lot of other systems. You tend to need a kernel built for a particular processor variant, and it needs a device map of some sort for your specific device or it won't know how to find any of the stuff on the board and may just crash. Without this map you just can't boot. Graphics are also very non-open at the moment, so it can be v…

Linux supports Device Tree mechanism which solves this issue. You would download a kernel for the correct processor and a .dts file that describes the phone's hardware.

Has this made it to mainline/release yet? I've been doing some ARM kernel support stuff for one of my devices, and DeviceTree isn't there even in 3.11.x (AFAICT)

Previously you had a bit of boilerplate code that did much the same. Either way it doesn't actually solve the issue, because you still need the dts file, there's no hardware discovery.

(ok that's a bit of a stretch, some of the busses and things like I2C are discoverable, but you need a map of GPIOs, UARTs etc etc)

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#63

Post by uniray »

biehl wrote: post #57
uniray wrote: post #46

I'm surprised at the EFF. this post seems intended to save face for them rather than anything else. They had a post recently lauding App Ops although it was never officially released, announced nor documented. And it certainly was not accessible to the average user. Also it was obviously not compatible with most apps, as they didn’t fail too gracefully. Again: App Ops Was Never Meant For End Users, Used For Internal…

Because using "beta" features from Google is unthinkable? I think it makes perfect sense to laud even small steps in the right direction (beta-quality features etc.) and comment negatively on steps in the wrong direction (removing privacy options for users).

It was not even a beta feature, it was not exposed to end users at all.

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#64

Post by outworlder »

jackgavigan wrote: post #18

This is one area where iOS stands head and shoulders above Android. I used to run Cyanogenmod and I remember deciding to not upgrade the Facebook app because doing so would have required giving it a slew of permissions, including the ability to "directly call phone numbers". By contrast, in iOS, I can choose which apps have access to my location, contacts, etc. I know that Apple's track record when it comes to privac…

Do not expect Google to implement it anytime soon, due to the massive app breakage potential.

Android's permission system looks good on the surface. However, there are so many required permissons nowadays that many users do not even check them anymore. And you can revoke specific permissions on an app by app basis.

On iOS, developers are told not to rely on certain permissions being available, such as location. Some apps truly can't function without those, but they are supposed to warn the user, not crash.

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#65

Post by nileshtrivedi »

Nursie wrote: post #61
nileshtrivedi wrote: post #58

Earlier quoted context omitted.

Linux supports Device Tree mechanism which solves this issue. You would download a kernel for the correct processor and a .dts file that describes the phone's hardware.

Has this made it to mainline/release yet? I've been doing some ARM kernel support stuff for one of my devices, and DeviceTree isn't there even in 3.11.x (AFAICT) Previously you had a bit of boilerplate code that did much the same. Either way it doesn't actually solve the issue, because you still need the dts file, there's no hardware discovery . (ok that's a bit of a stretch, some of the busses and things like I2C ar…

Here are the LWN articles on Device Tree from June/July. Not sure how things have changed:

https://lwn.net/Articles/560523/ https://lwn.net/Articles/561462/

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#66

Post by ouaibe »

CalRobert wrote: post #24

I'm probably going to turn in to that old guy with tin foil who can't play any games because nobody supports his choice of platform, but I really miss when computers were devices you could buy and then put your choice of OS on. Phones are pretty much just little ARM computers, why the hell don't I just install Ubuntu, Firefox OS, Android, WinPhone, Symbian, whatever? I could format a microSD card to boot from and go…

Because phones inherit from an old business model where they were subsidized by mobile network operators and thus manufactured and sold according to their needs, not to the users need.

This meant you'd have many restrictions and the user was constrained to a tightly-controlled environment that forbode anything the operator deemed unnecessary (and could even contain malware/spyware-like pre-loaded software).

That model gradually evolved into J2ME platforms (and the like), where developers (and sometime users) could make small customizations, until someone decided there was a huge market selling phones designed not for the operators but for their customers (i.e. Apple/Google).

They still built the product partly following the same mindset/model and provided VM-centric phones that still are not designed to give you ring-0 access from the get go and maximize the operator's & manufacturer control on your device, hoping to gain revenues from gated developer communities, reselling applications that are mostly yet another graphical layer on top of code that already exists natively on regular computers since a long time ago.

That model is gradually evolving (hopefully in the right direction) and operators are slowling realizing that they're not device vendors but merely ISPs, which means that the phones are to be sold to customers, centered around their needs and giving them the maximum control (letting them chose the OS and giving them ring0 access).

You still need to get rid of the protected baseband cpu, the SIM, the TEE, the protected bootloaders etc. and eventually might have the device that you speak about.

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#67

Post by The_Double »

josteink wrote: post #47
raverbashing wrote: post #16

Earlier quoted context omitted.

Yeah, because checking return codes and error values is overrated Thanks Google, for making my phone less secure .

Yeah, because checking return codes and error values is overrated Even Google's own non-AOSP camera is guilty of this too. The API docs says an app should check for camera capabilities before using them. Still the PhotoSphere feature in Google's non-AOSP camera attempts to set Flash-settings on devices with no flash-capability. To overcome the issue you have to rewrite the camera-interface code to ignore API calls to…

Google is one of the worse offenders when it comes to not following android guidelines. Their apps consistently break back button behavior, don't follow UI guidelines, etc.

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#68

Post by bjackman »

Nursie wrote: post #61
nileshtrivedi wrote: post #58

Earlier quoted context omitted.

Linux supports Device Tree mechanism which solves this issue. You would download a kernel for the correct processor and a .dts file that describes the phone's hardware.

Has this made it to mainline/release yet? I've been doing some ARM kernel support stuff for one of my devices, and DeviceTree isn't there even in 3.11.x (AFAICT) Previously you had a bit of boilerplate code that did much the same. Either way it doesn't actually solve the issue, because you still need the dts file, there's no hardware discovery . (ok that's a bit of a stretch, some of the busses and things like I2C ar…

http://www.linaro.org/linaro-blog/2011/08/15/enabling-device...

The Linaro kernels ("Linaro Stable Kernel" is the keyphrase) boot from devicetrees (aka FDTs). Not sure how much of that is upstreamed, but devicetrees are pretty standard in the ARM world as far as I can tell. (Also, in general if you're doing Linux stuff on ARM, Linaro is the place to look for everything).

Edit: actually, that link isn't very relevant - I just lazily googled "linaro devicetree". But you should be able to find more info!

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#69

Post by shrikant »

jackgavigan wrote: post #18

This is one area where iOS stands head and shoulders above Android. I used to run Cyanogenmod and I remember deciding to not upgrade the Facebook app because doing so would have required giving it a slew of permissions, including the ability to "directly call phone numbers". By contrast, in iOS, I can choose which apps have access to my location, contacts, etc. I know that Apple's track record when it comes to privac…

CyanogenMod has this killer feature called Privacy Guard which you can enable on a per-app basis. It allows you to use the app and lock it out of unwanted permissions without breaking the app functionality.

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#70

Post by mikecane »

throwwit wrote: post #20

This is a pretty disturbing trend. Just recently I ran into problems with a TV station's app on iOS that refused to play video without Location Services Enabled. I don't mind a general region being disclosed, but the house-level accuracy of the location data definitely creeps me out. I don't think the general public realizes location can be equivalent to a person's id.

>>>Just recently I ran into problems with a TV station's app on iOS that refused to play video without Location Services Enabled.

When it comes to things such as entertainment, regional rights restrictions probably have more to do with that than the app wanting to spy on you. I'm not saying this is right. Just saying how the lawyers have sliced things into pieces like that.

Post reply on HN