Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

community.rapid7.com

Post reply on HN
Print view View original

211–220 of 232 posts

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#211

Post by thejdude »

NickNameNick wrote: post #153
gsnedders wrote: post #89

Earlier quoted context omitted.

I'm not convinced CyanogenMod (or any other variant) is actually that great; I have a Samsung Galaxy S2 (i9100 model), the last non-nightly CyanogenMod update was over a year ago now. There have been a number of CVEs issued for Android (and likely numerous others cover Android as a platform, covering OpenSSL for example) over that time period, so there's no way the phone is anywhere near up-to-date with security fixe…

It looks like there were snapshot builds in august and july. (although how they differ from nightlies, I don't know) I thought I was on a snapshot from April, but it turns out I'm on a nightly.

There was a monthly in August something, and I just installed the latest one which is from today. It may not yet be built for all supported devices though.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#212

Post by autism_hurts »

_pmf_ wrote: post #171
autism_hurts wrote: post #51

Earlier quoted context omitted.

You're not the only one. I'm sorry, but the Android issue has devolved into a holy war but... .. support is terrible on the Android side. Really terrible.

> .. support is terrible on the Android side. Really terrible. Buy a Windows Phone, then.

I've got an iPhone 5.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#213

Post by thejdude »

EpicEng wrote: post #34
kb120 wrote: post #21

Earlier quoted context omitted.

Very few people explore other browsers? Alt browsers are often the first app that people download. Chrome is included in gapps.

Who, engineers? Certainly not my wife or anyone else I have ever met who isn't technical.

Isn't that what you are for, if you're computer-literate?

The first thing I install on my gf's computer or phone is Firefox and configure it to sensible settings (turn off third-party cookies, install ABP and Ghostery and stuff like that).

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#214

Post by thejdude »

lucb1e wrote: post #19
helpbygrace wrote: post #13

Use Chrome.

Use Firefox. Why? Chrome isn't open source, if you care about that kind of thing. And personal preference also.

That, and you can actually turn off third-party cookies.

There's absolutely NO reason you should have them on, and I've been surfing the web just fine this way for 15 years.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#215

Post by paulirish »

Just an update from the Google side: As discussed below, any Android users on 4.4+ or running Chrome are not affected. For earlier versions of Android, we've shipped patches for AOSP:

https://android.googlesource.com/platform/external/webkit/+/... https://android.googlesource.com/platform/external/webkit/+/...

These are in the AOSP branches for jb-dev, jb-mr1-dev, jb-mr1.1-dev, and jb-mr2-dev.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#216

Post by junktest »

paulirish wrote: post #215

Just an update from the Google side: As discussed below, any Android users on 4.4+ or running Chrome are not affected. For earlier versions of Android, we've shipped patches for AOSP: https://android.googlesource.com/platform/external/webkit/+/... https://android.googlesource.com/platform/external/webkit/+/... These are in the AOSP branches for jb-dev, jb-mr1-dev, jb-mr1.1-dev, and jb-mr2-dev.

is android kitkat 4.4.x safe from this bug regardless of whether chrome browser exists (not installed or uninstalled) in the phone or not? please enlighten. thanks.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#217

Post by anonbanker »

ck2 wrote: post #67

If you haven't tried Firefox Fennec (android mobile) it is actually pretty good now. https://play.google.com/store/apps/details?id=org.mozilla.fi... https://www.mozilla.org/en-US/firefox/partners/#android They make it for arm and x86 android. They used to make a windows version but sadly stopped that build.

Been using Firefox mobile for four months now, and forcefully removed both chrome and the vulnerable browser from my device about one month in. Slight battery drain issues, but those are almost all solved in recent releases. Definitely give it a try.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#218

Post by TheGrassyKnoll »

niyazpk wrote: post #201
acdha wrote: post #193

Earlier quoted context omitted.

> Google can do better, but for whatever reason they aren't. s/aren't/choose not to/ This is simply bad management – we're talking, what, a single engineer to backport critical fixes and some testing support. Contrast that against the damage this has done to Android's competitiveness – even the non-nerds I know talk about how they bought an iOS device because Android never gets updates – and increases the likelihood…

>> we're talking, what, a single engineer to backport critical fixes and some testing support. Understatement of the day? :) There is absolutely no way a single developer will be able to support huge/complex codebases like web-browsers across platform versions. Also keep in mind that most of the original developers would have moved on from the project - due to lack of interest, greener pastures etc. I am wondering wh…

> "...what kind of engineer would be willing..." The kind that ends up on a layoff list when the inevitable slowdown occurs. This is a zero-glory, zero-thanks task, with plenty of risk.

> "...support huge/complex codebases like web-browsers > across platform versions..." What could go wrong ?

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#219

Post by Consultant32452 »

downandout wrote: post #183
Pxtl wrote: post #181

Earlier quoted context omitted.

Even if they do fast vuln updates, what about older devices? Even Google only offers 2y of support.

I think Google needs to change that as well. Android is seen as a second class OS by a large percentage of people, and these kinds of revelations only increase that percentage. Google can do better, but for whatever reason they aren't.

I think the large percentage of people that see Android as 2nd class don't know what an OS is, nor are they likely to become aware of this issue.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#220

Post by acdha »

niyazpk wrote: post #201
acdha wrote: post #193

Earlier quoted context omitted.

> Google can do better, but for whatever reason they aren't. s/aren't/choose not to/ This is simply bad management – we're talking, what, a single engineer to backport critical fixes and some testing support. Contrast that against the damage this has done to Android's competitiveness – even the non-nerds I know talk about how they bought an iOS device because Android never gets updates – and increases the likelihood…

>> we're talking, what, a single engineer to backport critical fixes and some testing support. Understatement of the day? :) There is absolutely no way a single developer will be able to support huge/complex codebases like web-browsers across platform versions. Also keep in mind that most of the original developers would have moved on from the project - due to lack of interest, greener pastures etc. I am wondering wh…

> Understatement of the day? :) There is absolutely no way a single developer will be able to support huge/complex codebases like web-browsers across platform versions.

Possibly but I wasn't talking about upgrading to the latest WebKit or the actual patch development – only the work required to backport a critical fix which has already been identified and fixed upstream. That's a fairly normal part of the support process at most places so I wouldn't expect it to be a huge amount of work unless you hit something which required an architectural change to fix.

Edit to add a link to the diffs which were posted earlier today:

https://android.googlesource.com/platform/external/webkit/+/...

https://android.googlesource.com/platform/external/webkit/+/...

Obviously not every patch is like that but there also aren't that many critical bugs – I'd be surprised if the engineer:tester ratio was anywhere near even on this kind of work.

Post reply on HN