LineageOS will be a continuation of what CyanogenMod was • Hacker News Board

Re: LineageOS will be a continuation of what CyanogenMod was

#101

Post by em3rgent0rdr » Mon, Dec 26, 2016, 3:06 PM UTC

jimmies wrote: post #96

TheAceOfHearts wrote: post #75

Earlier quoted context omitted.

Something I've wondered about: why does Android require you flash a ROM to update the system? When you buy a windows laptop you'll usually get a bunch of vendor-specific crap, but after doing a clean install you can just pick up the drivers on their website and it'll all work fine. Why isn't this an option with Android?

As I have been involved with OpenWRT/LEDE and how they make builds to different devices recently, I realized that making unified builds are actually possible. OpenWRT has the same kernel and root image for many different devices that use the same SoC. So once you have OpenWRT flashed on, the content of every OpenWRT update (for every device of the same SOC) is by and large the same. The only check in place is the art…

Thanks for your work on OpenWRT...I'm a happy user! I would hope for any expertise on unified builds could be transferred over to android. I'm wondering if android could run on top of OpenWRT, then could use the same system to update the android layer without having to update the lower levels.

Would think one of the whole points of having the many layers in the android software stack is that one layer can be modified without having to reload everything in the lower levels.

Re: LineageOS will be a continuation of what CyanogenMod was

#102

Post by chei0iaV » Mon, Dec 26, 2016, 3:33 PM UTC

LordWinstanley wrote: post #100

I'm getting really confused here. I thought CyanogenOS was a commercial venture that arose out of CyanogenMod. But that they were essentially separate protects. I'd read about CyanogenOS coming a cropper, but understood this wouldn't affect CyanogenMod. Now, these linked articles seem to be treating -OS and -Mod as the same project/same organisation. Can anyone explain?

Cyanogen Inc (the commercial venture) owns the infrastructure and trademarks of CyanogenMod (community project). So now that they've been ditched, the CyanogenMod community has to change the name and find new infrastructure.

Re: LineageOS will be a continuation of what CyanogenMod was

#103

Post by josteink » Mon, Dec 26, 2016, 3:38 PM UTC

TheAceOfHearts wrote: post #75

gsnedders wrote: post #3

Who's going to make sure LineageOS users get security updates in a timely manner? Is anyone going to be paid to work on it? Any large OSS distribution is going to have a fairly continuous stream of security fixes to ship to their users, and that takes a fair amount of time, and I'm always concerned about whether any new project (okay—it's not quite new, but they have a fraction of the number of developers they did tw…

Something I've wondered about: why does Android require you flash a ROM to update the system? When you buy a windows laptop you'll usually get a bunch of vendor-specific crap, but after doing a clean install you can just pick up the drivers on their website and it'll all work fine. Why isn't this an option with Android?

> Something I've wondered about: why does Android require you flash a ROM to update the system?

Let me answer that by picking the question apart:

1. To update the system, you need access to write actual system-files. You need system-level access.

2. Android is built entirely up on a "user-space" model where permissions are granted to apps, and almost no apps have system-level access.

3. On rooted phones you can allow system-level access to specific apps, which in theory could install the latest OS version and binaries. In theory that sounds like 1 app which you can use to update the OS, everywhere, right?

4. Except you would need a different installation-strategy for unrooted phones anyway for the installation anyway.

5. To compound the problem the ARM platform has no standardized BIOS/UEFI layer to handle generic booting, so the kernel being booted must be device-specific in order to gain access to the rest of the phone: It can't rely on generic "BIOS"-drivers to load modules on demand from flash storage. And the boot-partition is almost always too small to have a kernel with enough drivers for "everyone" embedded.

6. So you cant make a standard phone-agnostic flashing-app, nor install medium. You do have to build a custom phone-specific initial flash-package for every model you want to support as a bare minimum.

And when you've already put in all that effort, what do you gain by creating an "app" which does this inside a pretty GUI, instead of just rebooting back to recovery to (auto) flash the latest image? Practically nothing.

"Flashing" may sound scary, but in reality it just means installing. There's no technical difference between that and just copying files to a usually write-protected partition.

AFAIK: Apple officially does exactly the same, they just don't call it by that name.

Re: LineageOS will be a continuation of what CyanogenMod was

#104

Post by gurkendoktor » Mon, Dec 26, 2016, 3:46 PM UTC

givinguflac wrote: post #85

Thrillington wrote: post #21

Earlier quoted context omitted.

That's not going to fix the problem. Installing updates on an iPhone older than a couple years bogs performance down to unusable levels.

While I agree that's been the case in the past, supported devices are fast enough now that it really doesn't slow them down anymore. Even the lowest supported device runs well on iOS 10, and it has gotten official updates years longer than all android devices I know of. Sure, one could install an updated and more secure rom (assuming it exists for your device). But, the vast majority of users don't care or won't both…

> supported devices are fast enough now that it really doesn't slow them down anymore

That happens to be true now because Apple has dropped support for many iPad models with iOS 10, accounting for up to a third of all iPads in use.

Running iOS 9 on the iPad 2, 3, and iPad mini was frustrating. This was only three months ago, so I wouldn't rule it out for the future yet.

Re: LineageOS will be a continuation of what CyanogenMod was

#105

Post by gsnedders » Mon, Dec 26, 2016, 4:16 PM UTC

g_p wrote: post #35

gsnedders wrote: post #31

Earlier quoted context omitted.

Oh, that's totally true—though for many having some secure updates would be better than none, especially given the number of kernel bugs that are only locally exploitable (i.e., if the rest of the system is up-to-date, locally exploitable issues are less, but not none, of a concern). One thing I wish there was more visibility of is "is this device still getting security updates", because there's often almost no visib…

Absolutely - userland is the easiest to exploit, as it's fairly common across all devices (thanks to CTS and standardisation of the runtime) - that's why stagefright was such a big deal! Definitely agreed - I've thought about making such a list to give visibility of this before, but it would be more of a user-submitted list (perhaps with link-up to screen scraping of OEM web pages for the ones that list the latest ve…

I presume the OS can at least tell what exact model it's on, which means we could potentially at least have something (an app, given I guess Google will never ship such a thing) that says, "hey, this device isn't secure any more".

Now, obviously there's the problem with the time taken to ship fixes (do you say the device is insecure for the two-to-three months before a patch is shipped? do you say the device is insecure only six months after the exploit becomes public? etc.), so even this isn't that simple.

I still wonder about how well the "Android security patch level" will cope with OEMs and their often slow kernel updates (i.e., the fact there are OEMs that quickly release userland fixes, and very slowly release kernel updates).

Re: LineageOS will be a continuation of what CyanogenMod was

#106

Post by gsnedders » Mon, Dec 26, 2016, 4:18 PM UTC

BuuQu9hu wrote: post #48

g_p wrote: post #25

Earlier quoted context omitted.

Not directly an answer, but one of the big issues with security patches for custom ROMs is the amount of patches they don't (read can't) ship. The proprietary blobs are very often not patched when the device is vendor-supported, and once it reaches end of life from the vendor (but the community ROMs give devices significantly extended longevity), there's no more patches to these blobs. Blobs incorporate the modem, ba…

The only solution seems to be reverse engineering the blobs and mainlining Linux kernel drivers, without both of those security updates get much much harder to impossible. I've no idea how to achieve that on volunteer time, maybe a crowdfunded reverse engineering and mainlining org could work?

I wouldn't be surprised if it were easier to backport kernel security fixes to the version the blob depended on than reverse engineer the blob, given the relatively short life of devices in general.

That said, neither of those two options is easy!

Re: LineageOS will be a continuation of what CyanogenMod was

#107

Post by gsnedders » Mon, Dec 26, 2016, 4:19 PM UTC

em3rgent0rdr wrote: post #41

realstuff wrote: post #29

Earlier quoted context omitted.

I am aware but at least I won't get hacked which is more important than performance.

But even if Apple may be better than most android manufacturers, Apple still doesn't support devices it considers "Obsolete"...and there is nothing you can do about it other than buy a new phone since the bootloader is locked down. According to https://en.wikipedia.org/wiki/List_of_iOS_devices anything before iPhone 5 is considered "Oboslete" and they don't seem to be releasing updates. On the other hand, I've been h…

Does the S3 get security updates to all the kernel-level vendor-provided blobs?

Re: LineageOS will be a continuation of what CyanogenMod was

#108

Post by codedokode » Mon, Dec 26, 2016, 5:56 PM UTC

josteink wrote: post #103

TheAceOfHearts wrote: post #75

Earlier quoted context omitted.

Something I've wondered about: why does Android require you flash a ROM to update the system? When you buy a windows laptop you'll usually get a bunch of vendor-specific crap, but after doing a clean install you can just pick up the drivers on their website and it'll all work fine. Why isn't this an option with Android?

> Something I've wondered about: why does Android require you flash a ROM to update the system? Let me answer that by picking the question apart: 1. To update the system, you need access to write actual system-files. You need system-level access. 2. Android is built entirely up on a "user-space" model where permissions are granted to apps, and almost no apps have system-level access. 3. On rooted phones you can allow…

There is a "fastboot" [1] tool from Google that interacts with phone bootloaders that support it and can be used to flash the ROM.

> There's no technical difference between that and just copying files to a usually write-protected partition.

"Flashing" usually means "uploading" a filesystem image onto a partition, not copying single files.

[1] https://source.android.com/source/running.html#booting-into-...

Re: LineageOS will be a continuation of what CyanogenMod was

#109

Post by codedokode » Mon, Dec 26, 2016, 6:08 PM UTC

g_p wrote: post #87

djsumdog wrote: post #71

Earlier quoted context omitted.

It'd be nice if you could just customize Android on ARM and have lots of different spin-offs in the same way you have various x86/64 and PPC Linux distros. I wrote about this: http://penguindreams.org/blog/android-fragmentation/ The problem is with all these ARM boards. As other comments have pointed out, vendors have tons of binary blobs and shim layers that link them to the kernel. Nvidia/AMD do this too with their…

You're spot on here. To also add, some (most!) vendors make dirty hacks to the kernel source, as they maintain it as a standalone tree for the most-part. Wired the headphone jack the wrong way around? Don't bother with a new PCB revision, as deadlines are too tight, and getting things perfect seems to have no place; just hack at the driver code in a messy way and change the outputs! It's not like you're ever going to…

If the vendor is patching kernel they probably must release their patches and proprietary drivers as GPL requires (regarding drivers they could avoid this by moving important parts into userspace).

Re: LineageOS will be a continuation of what CyanogenMod was

#110

Post by gsnedders » Mon, Dec 26, 2016, 8:22 PM UTC

m45t3r wrote: post #90

unethical_ban wrote: post #68

Earlier quoted context omitted.

I can't fathom why Google would buy them. Why not make a version of AOSP that people can actually use, like Cyanogenmod?

What you mean by "usable"? Vanilla Android is really usable nowadays (I have a Nexus 6P with Android 7.1.1, non-rooted with locked bootloader since I don't really root nowadays). CyanogenMod nowadays is more important for their support to multiple hardware then the customization from AOSP per see. This is especially true since for those who really want mods, things like Xposed Framework offers much more customization…

"Vanilla Android" (from the AOSP) doesn't pass the Compatibility Test Suite (CTS) nowadays, so according to Google's Android trademark rules shouldn't be called Android. Some of the "Core" apps simply don't work at all.

Don't confuse what Google publish at the AOSP with what they ship on the Nexus/Pixel devices: they're increasingly different, with AOSP increasingly dysfunctional. Heck, the initial release of Android 7 for the 5X/6P at the AOSP wouldn't even compile because it had closed source compile-time dependencies.