131–140 of 232 posts
>While the AOSP has "been killed off" by Google, it... I do not follow android closely, but this refers to the browser only, right?
Earlier quoted context omitted.
The only Nexus phones here that don't already have a fix available is the phone they announced as being end of life. 4.4 is not affected and is available for the Nexus 4, 5, both generations of 7 and I believe the 10. Dear Galaxy Nexus users... It's time to let go.
The Galaxy Nexus was released only 3 years ago. Since when was that beyond the expected lifespan of a flagship product from one of the world's largest tech companies? Don't think I've ever owned anything with such a serious planned obscolence issue. Windows supports its OS releases for 12 years (and doesn't lock you in, so you can usually follow official upgrade procedure anyway). And anything "dumber" than a smartph…
It became beyond the expected lifespan when it became normal to buy a new one every 2 years thanks to contract pricing and carriers pushing people to upgrade.
Use Chrome.
Won't protect you from apps embedding WebView.
And if your banking app with its embedded webview has its site compromised, you're already fucked without even opening the app.
Earlier quoted context omitted.
The only Nexus phones here that don't already have a fix available is the phone they announced as being end of life. 4.4 is not affected and is available for the Nexus 4, 5, both generations of 7 and I believe the 10. Dear Galaxy Nexus users... It's time to let go.
The Galaxy Nexus was released only 3 years ago. Since when was that beyond the expected lifespan of a flagship product from one of the world's largest tech companies? Don't think I've ever owned anything with such a serious planned obscolence issue. Windows supports its OS releases for 12 years (and doesn't lock you in, so you can usually follow official upgrade procedure anyway). And anything "dumber" than a smartph…
Earlier quoted context omitted.
Since when has anything over 2 years, for a phone, had support? Anything over that is the exception, not the rule. Apple has better support than most, but even their phones degrade with features missing on older phones AND included new features run like ass (every time my fiance upgrades old phone to new iOS she hate life until upgrade). A 2 year old phone really is ancient... much less three or four... Who actually…
Well yeah with smartphones really short release cycles are "the rule" - because Google/Apple dominate the industry and set the rules - that's what I'm complaining about. There's no fundamental reason a 2 year old phone should be seen as ancient. Hardware can last many times longer than that, and software can be updated. Google is just not making the effort to support its older devices. For people like me who don't wa…
iPhones have built in time lines (more or less replaceable anything. Need a new batter? Have fun...).
And then there is the face that if you want ANY kind of app support - not just OS. Facebook, Twitter, etc... - then you can't use old phones. Years old Windows phones. Look at Blackberry phones. Palm OS. No one supports them because well... no one supports them anymore.
I think it's more a function of the rapid change and growth of complexity that makes smartphones obsolete so quick. Screen density, cpu, graphics capabilities, hard drive space, antenna speeds, etc. EVERYTHING is increasing so quick that it's hard to compare a new phone to a 2 year old phone.
It'll most likely be years before it slows down enough that you can treat a smart phone like a PC - keep it for YEARS and expect most stuff to simply run on it.
Earlier quoted context omitted.
My grandmother managed to switch entirely to Chrome on her PC without the help of anyone in our family. Anecdotal evidence works both ways. It isn't 1998. Most people know what a browser is and which one they are using on their desktop. Making the leap to a second browser on a phone (where they can easily get it from Google Play) isn't that ridiculous.
Chrome on Desktop has adapted several malware techniques to get installed without the user noticing. Bundled by default in many installers, including Flash, installs with user permissions only.
I am a big Linux fan and appreciate the openness and control that I can get with Android as opposed to Apple and Microsoft products, but... My Android experience has been shit, and I'm really getting sick of it. Admittedly, much or even most of the problem for me is the OEMs screwing things up and not sending out updates.
What does Android has to do with Linux? Do you also praise TiVo for the "openness and control" by using the Linux kernel?
Can I do that with an iPhone? Maybe, but probably have to put up with a lot of Apple garbage, trying to make things "easy" for non-technical people and/or keep you in their ecosystem.
I also like that Android uses Linux because I think the proliferation of Linux is good for me. (For various reasons, not that I have a financial stake in it, although I do indirectly due to my technical areas of competence.)
In that sense, I prefer that it uses Linux marginally over, say, using FreeBSD, which I would still prefer infinitely more than a proprietary OS.
Earlier quoted context omitted.
While good advice, I suspect that isn't what's going on. My guess would be that the URL is being validated with code which relies on null-terminated strings, and it's being processed/executed with code that uses a separate length value. The empty string "" will pass a same-origin check as it refers to the current page. "\0javascript:alert()" looks like the empty string to validation code expecting null-terminated str…
However, it's a valid URL I doubt "\0javascript" is a valid URI scheme since they must begin with a letter, and any code that uses 0-terminated strings would just see it as an empty string. The fact that the \0 somehow seems to be ignored completely is most disturbing. Edit: I double-checked the spec ( http://www.w3.org/TR/html5/browsers.html#dom-open ) just to make sure there's no weird "skip nulls" behaviour, and t…
It really depends on the browser. Here are a few test cases to consider. http://jsfiddle.net/8e525ne9/
Leading nulls used to work in common browsers. Most recent browsers don't support it. However, most do continue to support fun things like newlines and tabs in the middle of URL schemes.
This is nuts. On a sidenote, any suggestions for an equivalently fast, secure browser for Android 4.2 on a relatively old phone? Not gonna use AOSP anymore!
Opera Classic OK
Opera Mini OK
Tint Vulnerable
Default Vulnerable
Earlier quoted context omitted.
Chrome on Desktop has adapted several malware techniques to get installed without the user noticing. Bundled by default in many installers, including Flash, installs with user permissions only.
Example? I worked quite hard to get my grandma to install Chrome.
Not saying I agree with the Malware comment, though the bundling is annoying.