Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Virtual Machine as a core Android Primitive

android-developers.googleblog.com

Post reply on HN
Print view View original

131–140 of 177 posts

Re: Virtual Machine as a core Android Primitive

#131

Post by i5-2520M »

3abiton wrote: post #105
rstat1 wrote: post #51

Its annoying that I can't use this without greater-than-normal-user access.

It is still baffling that root is so shunned upon in the Android communities. Imagine not having root access to your linux laptop. Magisk users are persecuted and punished by Google for getting root access, which is the bare minimun for a device you own.

As a big root user, I don't lay the blame on Google. They don't prevent much on rooted devices, mostly just gpay, but they do provide the tools for other apps to do detection. Google devices are also the best for modding from a technical standpoint.

Re: Virtual Machine as a core Android Primitive

#132

Post by fragmede »

glacia01 wrote: post #122
omeid2 wrote: post #82

Earlier quoted context omitted.

Android apps are already running on top of a Virtualisation Technology", both current ART (Android Runtime) and the previous one, Delvik, runtimes are virtual machines, process level virtual machines, but they do bytecode translation/JIT nonetheless. If AVF allows running native code, it might actually be cheaper than the current arrangement.

I'm not Android expert in any way, but VM have nothing to do with virtualization. I think you're confusing something.

what does VM stand for?

Re: Virtual Machine as a core Android Primitive

#133

Post by usrusr »

walteweiss wrote: post #113
VierScar wrote: post #110

Earlier quoted context omitted.

I think that's saying they're surprised. The saying in other contexts: "I can't say I'm not impressed" -> I'm impressed. "I can't say you didn't try" -> you tried. I think you mean "I can't say I'm surprised" -> this is not at all surprising. But that's just one negative.

And what about ‘I’m not telling nobody’ which means ‘I won’t tell anyone’?

That's an ironic mistake playing with the idea of negation being additive instead of multiplicative that is enabled by the subtle redundancy encoded in no/any/some.

Makes me wonder if it might be a linguistic eddy echoing from the clash of Germanic and Latin-based French, where negation contracted with the word is also very common (no idea if n'est and friends had been a thing in French at the time that clash happened)

Re: Virtual Machine as a core Android Primitive

#134

Post by eptcyka »

codedokode wrote: post #114

Looks like something absolutely overengineered and unnecessary. Why do you need a virtual machine with a separate kernel? Why do you need to protect it from kernel? I guess, it is made mostly for playing DRM content?

I'd love to be able to use a Qubes like OS on my phones. There's so much vile garbage I need to run on my phone yet at the same time, I want my phone to have access to my passwords and email. Segregating apps is long overdue.

Re: Virtual Machine as a core Android Primitive

#135

Post by lozf »

walteweiss wrote: post #113
VierScar wrote: post #110

Earlier quoted context omitted.

I think that's saying they're surprised. The saying in other contexts: "I can't say I'm not impressed" -> I'm impressed. "I can't say you didn't try" -> you tried. I think you mean "I can't say I'm surprised" -> this is not at all surprising. But that's just one negative.

And what about ‘I’m not telling nobody’ which means ‘I won’t tell anyone’?

This isn't the first time I've seen a discussion about "double negatives" still being having negative meaning in English.

Last time, someone described how this is quite common, but that the opposite - "double positives" were always positive as there's no negation.

Then someone else replied: "Yeah, right!"

Re: Virtual Machine as a core Android Primitive

#136

Post by IAmLiterallyAB »

omeid2 wrote: post #82
robertwt7 wrote: post #77

Although this is very exciting. Surely performance is not the benefit here? It won’t perform better than android app built not on top of the virtualisation tdchnology?

Android apps are already running on top of a Virtualisation Technology", both current ART (Android Runtime) and the previous one, Delvik, runtimes are virtual machines, process level virtual machines, but they do bytecode translation/JIT nonetheless. If AVF allows running native code, it might actually be cheaper than the current arrangement.

Android apps can already run native code, so there's no performance benefit.

Also, Java "virtual machines" and native virtual machines are two very different things, they shouldn't be equated.

Re: Virtual Machine as a core Android Primitive

#137

Post by jonathanlydall »

berkes wrote: post #121
codedokode wrote: post #114

Looks like something absolutely overengineered and unnecessary. Why do you need a virtual machine with a separate kernel? Why do you need to protect it from kernel? I guess, it is made mostly for playing DRM content?

A use-case I can imagine is e.g. a password vault, a banking app, or a secure messaging app that you want isolated from everything. Even when running. And where "everything" includes infected apps, an infected host or even physical access. Not sure if this architecture can handle that, nor of it's the best architecture to solve this problem, though.

Yes, yes, yes... those are all "legitimate" and likely good uses of this technology, but they're most likely just additional/bonus tertiary use cases to the main use case which motivated Google to expend effort on this feature: DRM.

It's much like how web browsers' incognito/private mode is really useful for web developers and certain kinds of troubleshooting, but those are tertiary uses to the primary consumer use case for which it was originally built: browsing porn without leaving history behind.

Re: Virtual Machine as a core Android Primitive

#138

Post by anthk »

eptcyka wrote: post #134
codedokode wrote: post #114

Looks like something absolutely overengineered and unnecessary. Why do you need a virtual machine with a separate kernel? Why do you need to protect it from kernel? I guess, it is made mostly for playing DRM content?

I'd love to be able to use a Qubes like OS on my phones. There's so much vile garbage I need to run on my phone yet at the same time, I want my phone to have access to my passwords and email. Segregating apps is long overdue.

Not Qubes, mayube something like Unikernels from NetBSD.

Re: Virtual Machine as a core Android Primitive

#139

Post by keepamovin »

codedokode wrote: post #115
keepamovin wrote: post #96

Earlier quoted context omitted.

Possibly one cybersecurity-related thing you could do is run a headless browser inside this VM, and bridge the network requests to the host network (a little bit like Docker). Using my open-source BrowserBox^0 project then you could have a "bit more isolated" Browser running on your Android device that would add "VM escape" to any zero-day exploit chain that might be a risk. This is speculation tho, I don't know if i…

Why do you need VM for isolation? ARM architecture already provides tools for isolation, like MMU and privilege levels. Why do you need another kernel, emulation of hardware devices? It is completely wrong method.

For sure, ARM's MMU and privilege levels are solid for base isolation. But consider the VM for a headless browser as an extra layer of defense, especially in the wild and crazy web threat landscape. Yes, it involves another kernel and some hardware emulation, but modern VMs, particularly with Android's AVF, are designed to be lightweight and efficient.

With AVF, we're looking at tailored isolation, where a VM can be as minimal or as comprehensive as needed. This flexibility means we can create a highly controlled environment for the browser, enhancing security against web-specific exploits. It's about using ARM's strengths and adding a VM where it makes sense for focused, web-centric security. The idea's to mix and match security layers for the best defense, especially with Android's new AVF making VMs more streamlined.

I guess you could say the goal here is to tailor the security approach to the specific risks associated with web browsing, making the system resilient against a broader range of exploits.

Re: Virtual Machine as a core Android Primitive

#140

Post by anthk »

angm128 wrote: post #130
heavyset_go wrote: post #15

Earlier quoted context omitted.

This is already possible if your phones ship with the KVM kernel module, like on some Pixel devices, but reading the article suggests that KVM will become standard on all Android devices to enable this. edit: according to this[1], yes, the pKVM functionality that's standard in Android exposes KVM functionality so that you can run VMs on Android. [1] https://www.xda-developers.com/android-13-dp1-google-pixel-6...

A full linux environment (with external monitor support) sounds awesome. I hope that enabled KVM becomes standard Would graphics acceleration work properly?

You can already to that with termux, XSDL and some scripts. No virtualization needed.
Post reply on HN