What Determines Custom ROM data security? - T-Mobile HTC One (M9)

I'm writing from the perspective of a retailer who has recently adopted NFC payments at our business but am also writing from the perspective of a custom ROM user. One thing I noticed is the general policy from payment providers that NFC payments will not work on custom ROM/rooted devices or jailbroken devices. I can understand that there are some safety concerns regarding how financial data, especially, get bounced around inside a device before ultimately being launched out into a pinpad and through the Internet to a transaction processor. But it just occurred to me - is there anything in the android platform itself in relation to custom ROM's that prevents developers from sticking a nasty backdoor into rooted/custom phones? This applies to my beautiful new M9, but I suppose to android devices in general. Thoughts?

htc4668 said:
I'm writing from the perspective of a retailer who has recently adopted NFC payments at our business but am also writing from the perspective of a custom ROM user. One thing I noticed is the general policy from payment providers that NFC payments will not work on custom ROM/rooted devices or jailbroken devices. I can understand that there are some safety concerns regarding how financial data, especially, get bounced around inside a device before ultimately being launched out into a pinpad and through the Internet to a transaction processor. But it just occurred to me - is there anything in the android platform itself in relation to custom ROM's that prevents developers from sticking a nasty backdoor into rooted/custom phones? This applies to my beautiful new M9, but I suppose to android devices in general. Thoughts?
Click to expand...
Click to collapse
I'd also love to see a developer answer this. :good:
The Google dev team seems to think it's impossible to keep a rooted / dev / custom device secure, based on this thread, but that engineer's points also had a lot of comments and counterpoints that show a lot of people are actively thinking about the problem.

I don't know much about the Linux security platform, but from what I can tell, if an Android device were to have some form of sand boxing, similar to something like Docker, there should be a way to secure the API handling transmission of financial data between the hardware/OS/kernel to the NFC, no? But anyway, it seems kind of moot to me. Until the 16 digit code is no longer used and cards are actually swiped, or read, for online transactions, there's always going to be some kind of security gap.
My advice for those in the family at least, who do not have a lot of tech savvy, is to invest in a good Chromebook of some sort strictly used for financial stuff and nothing else. I had an uncle who just didn't care much and lost much of his finances to a hacker who had probably keylogged everything on his machine.
But yes, I did see the thread posted above. I would love to see this discussion continued further. I love my M9, rooted, with a custom ROM, but would love to be able to use NFC payments on it as well.

Related

Costs involved developing Android App vs iPhone apps

I realise that this is very much a "how-long-is-a-piece-of-string" type question, but I'd really like to get some idea of the costs and time involved in developing an app for the Android market compared to the iPhone.
My understanding is that it doesn't cost developers to submit apps to the Android Marketplace (as opposed to the iPhone Developer’s Program which costs $99 a year). So there's a saving there.
But in terms of development costs, would you suggest that hiring a developer to create an Android app would be cheaper because the market's smaller? Would it make no difference at all? Would it be harder to find a developer to code for Android?
Basically, any thoughts anyone has on this would be really appreciated.
Cheers,
Why don't you try and find out? Ask some (android)developers what app x would cost and ask some (iphone)developers the same
for most applications it should be cheaper to hire an Android programmer because you develop in standard Java and this is the most widely used language in computer science education. Eclipse is also a standard development environment many young programmers are familiar with. Even I was able to code my first Android application in a matter of minutes.
Objective-C on the other side is a nieche language. Of course, every good progammer can learn that language in a couple of hours or at least days but there are definitly more experienced Java programmers out there and they can reuse code (snippets). Java code is so ubiqitous you can find for a lot of problems coded and tested solutions. So two reasons: there are much more Java programmers out there and they can develop faster. Specific Android experience is not needed as long as you don't want to program kernel extensions or things like that.
But I guess the Apple-market is still more profitable because Apple users are trained to spend money. So even as it may cost more to develop it also brings in more revenue. I hope the sheer amount of Android handsets out there will outweigh this advantage soon.
Humm .. i think this is a tricky question.
While it will definitely be cheaper to develop an application for android, the question you might want to ask (depending on what you want to do) is what is the ROI of an Android application versus and IOS application.
And even then, depending on the type of application & the demographic your app will be targeting (not to mention usability, design, general app quality) the response will likely vary quite a bit too.
But globally yeah, it's cheaper and less a hassle to make an android app i'd say. ..then again, i have an allergy to apples, and this is an android forum after all
robert_tlse said:
Humm .. i think this is a tricky question.
While it will definitely be cheaper to develop an application for android, the question you might want to ask (depending on what you want to do) is what is the ROI of an Android application versus and IOS application.
And even then, depending on the type of application & the demographic your app will be targeting (not to mention usability, design, general app quality) the response will likely vary quite a bit too.
But globally yeah, it's cheaper and less a hassle to make an android app i'd say. ..then again, i have an allergy to apples, and this is an android forum after all
Click to expand...
Click to collapse
Hehe, I agree on that Robert.
ten chars!!!
You can also spend many months developing an iPhone app, only to have it rejected by Apple for no good reason. That's quite expensive.
It is, however, unescapable that there are a lot of iOS users who buy a lot of apps from the App Store, so the potential ROI is higher. There's also only a few platforms to develop for (although this is becoming increasingly less the case).
Would like for Android to have more focus though; it's getting there!
(The diminutive term "app" does irk me slightly - Apple have popularised it in relation to phones when they convinced everyone that the iPhone was the first phone to support third-party software. Guess it's stuck now though.)
then why are Android apps more expensive??
Android apps aren't more expensive. They have by far the largest proportion of free apps on any mobile platform and even those that do cost are comparatively cheap.
Android will probably be easier and cheaper to develop for..the only concern people have with Android is fragmentation...aka when developing you gotta decide which versions and up to develop for and choose the appropriate functions for the documentation. Of course in the end all the old devices will upgrade eventually and be compatible anyways..
My hope is though Apple lets 3rd party development tools back in...cause that way you can use Adobe AIR and make an App for both Android and iPhone at the same time....How I wish for cross platform app development...but Apple will fight it till the and cause if they don't they will loose one of their biggest advantages...
In my opinion Android is just now getting to the average joe especially in the United States. Older people are even trying the droid line of devices since there are so many to choose from now on all carriers (vs 1 iphone on AT&T forever just revised of course) So yeah, even people here in hicksville, MO USA are even trying it out go figure. If everyone hasn't heard of HTC or Android, they're definitely being introduced to it now through the Galaxy S series since it's on almost all carriers and has some snazzy media buzz.
With all these new cells and tablets coming out I give it a mere 2-3years and everyone will know our lil green droid dude globally, and use it on multiple devices around the house. Just my theory. I'm sure the Marketplace will grow 10/fold in that time, peace!
I guess there are a few things to keep in mind:
Politics:
1) Apple tries to regulate what is permitted to be installed on their phones. They don't provide any real guidelines, nor do they tell you in advance if your application will be accepted. You'll only discover after submitting your app that it isn't permitted. So they waste your time, and numerous high end projects have developed their application only to discover Apple blocks them because "they are duplicating functionality" *cough competing*. Yes, lots of money has been lost.
2) Apple is Non-Disclosure Agreement overload. Send an email to apple and it always says "this information is confidential". Basically, Apple's agreement is so bad (unless it's changed recently) that they can cancel the account/sue you any time they wish. That increases your risk further.
3) iPhone's can be jail-broken to install 3rd party apps, but many people wont. Even if the Google store wont accept your app, they can manually install it, or you can use another store... Without jailbreaking.
4) Many developers often complain of long delays getting their apps approved, and when removed from the store by Apple, they have to flood Apple with emails for reason's why. On android, you don't even need to use the App store, in fact, Android has the benefit of allowing paid apps to be sold in countries with export restrictions (because they can sell it via other means).
5) Piracy is possibly more rife on Android, however, Google are apparently implementing an API which allows apps to check if they were purchased for that phone, which should strongly reduce piracy once available (because it means that dodgy stores will need to actually crack the programs). Once this is implemented, hopefully it will stop the jackass spammers from selling pirated stuff.
Development Process:
1) iPhones use objective C, Android uses Dalvik. Dalvik is VERY similar to java, one simply needs to learn the differences. Objective C is also quite easy to learn though, but it probably takes more experience to do well (because c++ doesn't have the idea of selectors). If you try creating apps on the iPhones without using objective C originally though, your app might be removed. On android, frankly, Google doesn't give a damn provided, it works.
2) Big win for Android here, the Android SDK works on Linux,Windows AND OSX. It integrates with eclipse which already has a large user-base. Whereas, you need to buy a mac for code for the iPhone, and the SDK is OSX only.
3) That being said, you can make a cross-platform webapp that can be sold for both, but the user needs to be online.
4) Objective C is compiled code, whilst Java is bytecode. Bytecode can run as fast as compiled (with some initial overhead). Native sounds great, but if Apple ever does a processor change for their phones, it might be a world of hurt. If massively-multicore mobile processors are released, Android is probably better suited. That being said, by then, you'll probably need to fix some things in your app anyway because of API changes.
Actual sales:
1) Apparently in the past, you would have sold more in the Apple market. However, in the past, Android mobiles were actually quite rare because Android stunk. Froyo is probably the first Android OS that can compete against iOS effectively because it now supports JIT. There is also a much greater emphasis on Android these days in advertising, and I see more Android advertising than iPhone. Possibly inaccurate predictions suggest they will overtake the iPhone in 2012 too.
2) Sales figures don't represent profit though (so whilst iOS may generate more still, it's less than Apple claims). A google market account costs $25, whereas an Apple iPhone development account costs $99. Furthermore, you need Apple equipment to code for the Apple market (which can be significantly more expensive than PC's), and there is no estimates done to determine profits lost by being rejected from the Apple app store (there have been major projects which cost thousands to develop which have been rejected). So greater overheads on the Apple store, which means for cheap/quick apps, you are probably safer developing for Android (especially if you don't already own a mac).
My opinion:
For me, developing major apps is too high risk for iPhones. Although, if your app is approved, there are potentially bigger payoffs than Android. For small apps which don't have a predictable further, you may earn more on Android because of lower overheads. If you app is rejected for iPhone though for competing, you wasted weeks/months of your life, and need to use a 3rd party store (since only hacked phones can use them though, you dramatically decrease your sales instantly).
Anyway, my thoughts are that by the end of the year, everyone will know what Android is, and you may start to see manufacturers getting together to launch MAJOR campaigns to promote Android, especially since they now all have a common enemy (Apple basically took a cheapshot at other major manufacturers to justify their design flaw). Apple is only a small guy when it comes to manufacturing phones, and so it's as though they threw a few tiny pebbles at a team of football players to show off. Of course, some of those football players have already started retaliating, and it just depends on how annoyed they got.
Personally, I think iPhone would be great if they didn't do the "anti-competitive" thing they always do, but as it stands, I am now doing my Oracle/Sun SCJP, and hope to get into Android coding soon. If Apple starts acting less evil though, I will take another look in their direction, but they are mistreating the users they need the most, the developers. It's a pity, because Apple really has potential.
Source: I haven't sold any apps on either market yet, but I have mostly decided on developing for Android.
Developing new iPhone app looking for developer
I have a cool iPhone app idea it's a very simple game that I could like to create I am looking for a developer in the Los angeles area I am new here so please if your interested or can redirect me to the right person I would appreciate it thank you...email me with any info

Root and OTA

This might be a silly question, I've not used Samsung in a long time, last one was the S2 haha.....but is it ever going to be possible to root and/or install TWRP on this device without breaking OTA updates? I love rooting my devices and using custom ROMs, I still have need for root access, but to be honest this phone I would be happy keeping as close to stock as possible, I could live without TWRP, but will we ever get root without losing the ability to OTA update? If not then I'll just go custom when the urge becomes too strong haha.
Oh and I have the exynos version.
beta546 said:
This might be a silly question, I've not used Samsung in a long time, last one was the S2 haha.....but is it ever going to be possible to root and/or install TWRP on this device without breaking OTA updates? I love rooting my devices and using custom ROMs, I still have need for root access, but to be honest this phone I would be happy keeping as close to stock as possible, I could live without TWRP, but will we ever get root without losing the ability to OTA update? If not then I'll just go custom when the urge becomes too strong haha.
Oh and I have the exynos version.
Click to expand...
Click to collapse
+1
I too see a growing need for root elevation without destroying core security patch options. Either from stock, or with an aptitude like package management used by ROM creators, so you can even patch android files sooner than Samsung normally would. Because as it stands, the way we root now makes android a security disaster.
In essence this is a design failure by google and android. How could they expect users to be happy with non-configurable systems? That's why we don't have Apple devices, so we can config and alter whenever we would want to. Sigh.. Closed source for android is such a PITA. And so slow with patches..
?
jult said:
+1
I too see a growing need for root elevation without destroying core security patch options. Either from stock, or with an aptitude like package management used by ROM creators, so you can even patch android files sooner than Samsung normally would. Because as it stands, the way we root now makes android a security disaster.
In essence this is a design failure by google and android. How could they expect users to be happy with non-configurable systems? That's why we don't have Apple devices, so we can config and alter whenever we would want to. Sigh.. Closed source for android is such a PITA. And so slow with patches..
Click to expand...
Click to collapse
I agree, people like Samsung who just want to lock down their devices for whatever reason is just getting a bit extreme now. I don't think it's Google to blame though as android is easily rooted in general, it's manufacturers like Samsung that make you jump through hoops to do it. And yes it's exactly why we don't have iPhones haha. I believe every android device should come with a setting in developer options that just activates root with a disclaimer.....take my warranty, I don't care in the slightest, but don't cripple my device that I payed £720 for that is now my property, just because I want to use some of the most useful features and app designed to work with root. After reading through these forums I see Samsung seem more like apple than ever. I mean God the guide to install a custom ROM is crazy haha, perfectly doable, but compared to my le max 2 which was just, plug your phone in, push this through ADB, then flash this zip and you're done, so simple.
beta546 said:
I agree, people like Samsung who just want to lock down their devices for whatever reason is just getting a bit extreme now. I don't think it's Google to blame though as android is easily rooted in general, it's manufacturers like Samsung that make you jump through hoops to do it. And yes it's exactly why we don't have iPhones haha. I believe every android device should come with a setting in developer options that just activates root with a disclaimer.....take my warranty, I don't care in the slightest, but don't cripple my device that I payed £720 for that is now my property, just because I want to use some of the most useful features and app designed to work with root. After reading through these forums I see Samsung seem more like apple than ever. I mean God the guide to install a custom ROM is crazy haha, perfectly doable, but compared to my le max 2 which was just, plug your phone in, push this through ADB, then flash this zip and you're done, so simple.
Click to expand...
Click to collapse
The most important part of your post is often missed by a lot of people.
"lock down their devices for whatever reason..."
No one thinks about the reason it seems. As much as it sucks for folks on XDA, the folks that come to XDA don't think about all of the people that DO NOT come to XDA, or why a device manufacturer that makes their devices primarily for the Corporate world, wouldn't want to let their devices be unlocked by the small amount of XDA folks that buy them.
And before anyone says "the exynos is unlockable!" Remember the Exynos version is international, not USA. There's are so much more benefits to Samsung keeping the USA devices locked than there are downsides. I work for a small corporate company of about 300 employees and I am not allowed to have a device with the bootloader unlocked, period. Why? I don't even know, and I am in the tech field. Each company has their rules and such. Imagine how much contracts Samsung could have with corporations out there for their devices. We used to have one, and look at how small we are. We don't have one anymore because it's cheaper to just have employees front the device cost instead of the company paying for devices! Lame I know. I fought against it but lost.
As far as the original question goes, no, you will not be able to keep OTA and root at the same time. Not for the way OTA are setup, and rooting works.
Jammol said:
As far as the original question goes, no, you will not be able to keep OTA and root at the same time. Not for the way OTA are setup, and rooting works.
Click to expand...
Click to collapse
Now. You mean. It can (and should) change. The way the android permission model is designed, is totally corporate-based, not user-friendly at all. And if Samsung would stay on top of security-patches and push updates (like you have with Win10 now, which are still totally under the user's control without having to 'root' anything), that would be fine, but time and again these smartphone manufacturers have proven to stop giving a hoot after they've released a new model, if they even cared at all about security patching in time, because they apparently really don't. Not enough anyway. If they would, we'd already be running Android 9 on our Notes by now.
Jammol said:
The most important part of your post is often missed by a lot of people.
"lock down their devices for whatever reason..."
No one thinks about the reason it seems. As much as it sucks for folks on XDA, the folks that come to XDA don't think about all of the people that DO NOT come to XDA, or why a device manufacturer that makes their devices primarily for the Corporate world, wouldn't want to let their devices be unlocked by the small amount of XDA folks that buy them.
And before anyone says "the exynos is unlockable!" Remember the Exynos version is international, not USA. There's are so much more benefits to Samsung keeping the USA devices locked than there are downsides. I work for a small corporate company of about 300 employees and I am not allowed to have a device with the bootloader unlocked, period. Why? I don't even know, and I am in the tech field. Each company has their rules and such. Imagine how much contracts Samsung could have with corporations out there for their devices. We used to have one, and look at how small we are. We don't have one anymore because it's cheaper to just have employees front the device cost instead of the company paying for devices! Lame I know. I fought against it but lost.
As far as the original question goes, no, you will not be able to keep OTA and root at the same time. Not for the way OTA are setup, and rooting works.
Click to expand...
Click to collapse
That makes a lot of sense really, obviously there are going to be businesses and companies and such that wpild rely on their workers devices being as secure as possible, for multiple reasons. But again that's not really up to Samsung to decide really, now I agree that although there are a huge number of people that want to modify their devices in various ways, but on the grand scale it's a relatively low percentage of the market. Which is why I think it should always be an option, that way they cater to everyone. If a company has a requirement that all their employees devices stay locked down, they simply don't allow it, and if an employee does it regardless then the consequences would be their own. I guess Samsung could bake in the setting, but with an option at first boot as to leave the ability to unlock intact, or to choose to permanently remove any option of ever being able to do it. That way when a company bought the phones they could lock them all down before handing them out. But in the scenario where people must purchase their own device, they then would have to decide whether to follow company policy, or unlock the phone and risk potentially losing their job at worst because of it....that's just what I think really, but I'm in no way some business or manufacturing giant haha, there will be multiple arguments for and against this entire scenario.
And also thanks for the answer ? It was as I suspected, but always worth an ask.
Voiding the Warranty for unrelated modifications is illegal and there is a better way
It seems we are all getting used to the arrogance and impertinence ...
... with which manufacturers and telephone service operators want to dictate what we do with our property. Let us not forget that «this will void your warranty», though common practice, is not in accordance with current legislation.
Modifications to devices should be protected under the Magnuson-Moss Warranty Act, unless the modification caused the damage you're asking the manufacturer to repair. Manufacturers threatening to void warranties for rooting, even when they have no legal right to do so, is nothing but bullying, banking on the fact that most people are not feeling confident about legal battles with corporations for which time and money are of no consequence. It is about time that reviews took the aspect of rooting/customization friendliness into consideration, so that manufacturers like OnePlus and HTC receive the credit they deserve for being more lenient toward rooting and still receiving updates. If technology journalists pointed this aspect out in their reviews, companies might come to their senses. Being able to use some apps that can do what they do only with Root access is more important than yet another MegaPixel on the camera -- if the other manufacturers do not drop the ball yet again, by dumbing down their phone instead of building the best device they possibly can, this year's phone purchase will be from a brand that is user friendly and provides OTA updates even on customised devices.
As for the «security» fairytale, that's often the last aspect that manufacturers care about, skipping security patches even after exploits have been detected. By the way: if some guy with a mobile phone could really bring down or disturb an operator's network, the operator doesn't deserve better. Most people do not root because they are devious masterminds from a Bond movie who try to mess up their kernels or bring down the global communication networks, but because they want to customize the looks of devices to their liking, fix some flaws or get some software to work. Very few people would keep rooting if manufacturers only guarded their kernels against overclocking beyond what the phone can endure and operators blocked what could disrupt the network -- if they did that and only that, hardly anyone would complain or root.
Security is obviously not what it's really all about. On my SAMSUNG GALAXY NOTE 9, Amazon Shopping, Fakecrook, LinkedIn and a whole bunch of other garbage came pre-installed as system apps that can be disabled but not uninstalled. Like everything imposed on us by Google, these companies have no interest in enhancing their customers' security and privacy, but exactly the opposite, grab as much sensitive information about us as they possibly can and sell it to whoever is interested and willing to pay for it.
On a Windows PC, I can do most things I want to do if I really have to, via editing the Windows Registry if need be and turning off User Access Control (UAC) when the unnecessary extra-click got on my nerves. Millions of people are and have been doing the same without upsetting the space-time-continuum, and corporations can restrict whatever they want to restrict if there is an administrator to do it. In most cases, however, there is not, because after all, it's a Personal Computer (PC), managed by the user at home. If we pay for something -- and quite handsomely so -- we own it, consequently it should be us who, after a warning that can be turned off with a checkmark, have the final say. So far, the corporate world seems to thrive quite nicely with the kind of approach to security that MS Windows is taking, despite surely being the first and loudest ones to complain if there were any real and relevant problems that seriously threaten their dayly operations.
Mobile phone manufacturers and operators use «security» as an excuse to restrict what the owners of those expensive little toys can do, just like governments proclaim «terrorism» as the excuse for spying on and controlling their own populations by grabbing ever more power with authorizing laws that undermine constitutional civil liberties. In our societies, it is to keep track on any possible threats to the Status Quo that might be caused by a shift of public opinion if the media -- these days large corporations themselves -- did not distract us with polemics, sports and celebrity BS, but reported on and kept in focus issues such as ecology, human overpopulation, inequality, tax evasion, poverty, injustice, corruption, lobbyism and so on. In the mobile phone world, they do it to milk us for banalities like boot animations, wallpapers, type fonts, themes, icons and whatever we would like to do to make our phones look nicer. Under Windows, buy a shareware CD with 10,000 fonts, copy the 20 or 30 you like into the respective system folder -- done. On Android, they want to milk us for every bit they can and that's the real motivation for all the bull****, harassment, hoops and loops they make us jump through.
If companies were really interested in user privacy rights and security, the first thing that would be forbidden were advertisements, because a lot of sh.t can come in through those backdoors. Second, why does Apple not allow antivirii and firewalls if security is such a concern? Why are owners of devices with a custom recovery or root being punished by exclusion from OTA updates, given that these updates are supposed to improve stability and security? That's just bollocks and distraction to ram as much advertising down our throat, rip us off for every boot animation, wallpaper, theme, icon or type font that we have tons of lying around on our hard drive, and to obtain as much data from us as possible, in order to know and track what we buy, think, believe, suffer from, like, dislike or do in any place at any at any time.
Apart from a couple of absolute geeks and nerds, nobody would root their phones if adaptation and customization of our phones was easily possible, i.e. if everything except things that could irrevocably damage hardware or networks could be easily modified as we please. The introduction of a/b partition slots for Seamless Updates paved the way for preventing irreparable accidents and could easily be expanded and improved, together with a better design of the user interface and user experience to make the process more comprehensible for average users. Yet, most companies did not even implement a/b partitions, although this approach makes accidents and mistakes when playing around with the device «non-lethal» and saves the Customer Service costs that companies so often cite as the second excuse and pretext for the arrogance with which they keep and exert control over other people's property. With each new generation of phones and every new version of operating systems, the restrictions are getting worse, the options for access and harmless modification less, and that unacceptable trend needs to stop.
If companies want to disencourage people from rooting their phones, they need to stop bombarding us with intrusive ads, stop spying and imposing bloatware and replace it with useful tool bundles (Titanium Backup, decent file managers, cleaners, system tools and the like). It is okay to guard and firewall the indispensable and risky parts (hardware overclocking, network integrity), but only block those irreparable areas while opening up the rest for users to customise to their hearts content, making it as comfortable, easy and intuitive as possible to copy, paste, move and configure everything else between phone and PC. If something goes wrong while doing so, make sure that a system restore point and booting into the alternative partition means that there's no harm, no foul and therefore no problem and no service cost.
Instead of wasting our time hunting for patched partiton files, info on how to get out of bootloops, etc., users could then enjoy and be happier with our phone instead of fixing its shortcomings or, dare I say it, do something fun and entertaining outside while the snow is fresh or the sun is shining.
.
Qui Peccavit said:
It seems we are all getting used to the arrogance and impertinence ...
... with which manufacturers and telephone service operators want to dictate what we do with our property. Let us not forget that «this will void your warranty», though common practice, is not in accordance with current legislation.
Modifications to devices should be protected under the Magnuson-Moss Warranty Act, unless the modification caused the damage you're asking the manufacturer to repair. Manufacturers threatening to void warranties for rooting, even when they have no legal right to do so, is nothing but bullying, banking on the fact that most people are not feeling confident about legal battles with corporations for which time and money are of no consequence. It is about time that reviews took the aspect of rooting/customization friendliness into consideration, so that manufacturers like OnePlus and HTC receive the credit they deserve for being more lenient toward rooting and still receiving updates. If technology journalists pointed this aspect out in their reviews, companies might come to their senses. Being able to use some apps that can do what they do only with Root access is more important than yet another MegaPixel on the camera -- if the other manufacturers do not drop the ball yet again, by dumbing down their phone instead of building the best device they possibly can, this year's phone purchase will be from a brand that is user friendly and provides OTA updates even on customised devices.
As for the «security» fairytale, that's often the last aspect that manufacturers care about, skipping security patches even after exploits have been detected. By the way: if some guy with a mobile phone could really bring down or disturb an operator's network, the operator doesn't deserve better. Most people do not root because they are devious masterminds from a Bond movie who try to mess up their kernels or bring down the global communication networks, but because they want to customize the looks of devices to their liking, fix some flaws or get some software to work. Very few people would keep rooting if manufacturers only guarded their kernels against overclocking beyond what the phone can endure and operators blocked what could disrupt the network -- if they did that and only that, hardly anyone would complain or root.
Security is obviously not what it's really all about. On my SAMSUNG GALAXY NOTE 9, Amazon Shopping, Fakecrook, LinkedIn and a whole bunch of other garbage came pre-installed as system apps that can be disabled but not uninstalled. Like everything imposed on us by Google, these companies have no interest in enhancing their customers' security and privacy, but exactly the opposite, grab as much sensitive information about us as they possibly can and sell it to whoever is interested and willing to pay for it.
On a Windows PC, I can do most things I want to do if I really have to, via editing the Windows Registry if need be and turning off User Access Control (UAC) when the unnecessary extra-click got on my nerves. Millions of people are and have been doing the same without upsetting the space-time-continuum, and corporations can restrict whatever they want to restrict if there is an administrator to do it. In most cases, however, there is not, because after all, it's a Personal Computer (PC), managed by the user at home. If we pay for something -- and quite handsomely so -- we own it, consequently it should be us who, after a warning that can be turned off with a checkmark, have the final say. So far, the corporate world seems to thrive quite nicely with the kind of approach to security that MS Windows is taking, despite surely being the first and loudest ones to complain if there were any real and relevant problems that seriously threaten their dayly operations.
Mobile phone manufacturers and operators use «security» as an excuse to restrict what the owners of those expensive little toys can do, just like governments proclaim «terrorism» as the excuse for spying on and controlling their own populations by grabbing ever more power with authorizing laws that undermine constitutional civil liberties. In our societies, it is to keep track on any possible threats to the Status Quo that might be caused by a shift of public opinion if the media -- these days large corporations themselves -- did not distract us with polemics, sports and celebrity BS, but reported on and kept in focus issues such as ecology, human overpopulation, inequality, tax evasion, poverty, injustice, corruption, lobbyism and so on. In the mobile phone world, they do it to milk us for banalities like boot animations, wallpapers, type fonts, themes, icons and whatever we would like to do to make our phones look nicer. Under Windows, buy a shareware CD with 10,000 fonts, copy the 20 or 30 you like into the respective system folder -- done. On Android, they want to milk us for every bit they can and that's the real motivation for all the bull****, harassment, hoops and loops they make us jump through.
If companies were really interested in user privacy rights and security, the first thing that would be forbidden were advertisements, because a lot of sh.t can come in through those backdoors. Second, why does Apple not allow antivirii and firewalls if security is such a concern? Why are owners of devices with a custom recovery or root being punished by exclusion from OTA updates, given that these updates are supposed to improve stability and security? That's just bollocks and distraction to ram as much advertising down our throat, rip us off for every boot animation, wallpaper, theme, icon or type font that we have tons of lying around on our hard drive, and to obtain as much data from us as possible, in order to know and track what we buy, think, believe, suffer from, like, dislike or do in any place at any at any time.
Apart from a couple of absolute geeks and nerds, nobody would root their phones if adaptation and customization of our phones was easily possible, i.e. if everything except things that could irrevocably damage hardware or networks could be easily modified as we please. The introduction of a/b partition slots for Seamless Updates paved the way for preventing irreparable accidents and could easily be expanded and improved, together with a better design of the user interface and user experience to make the process more comprehensible for average users. Yet, most companies did not even implement a/b partitions, although this approach makes accidents and mistakes when playing around with the device «non-lethal» and saves the Customer Service costs that companies so often cite as the second excuse and pretext for the arrogance with which they keep and exert control over other people's property. With each new generation of phones and every new version of operating systems, the restrictions are getting worse, the options for access and harmless modification less, and that unacceptable trend needs to stop.
If companies want to disencourage people from rooting their phones, they need to stop bombarding us with intrusive ads, stop spying and imposing bloatware and replace it with useful tool bundles (Titanium Backup, decent file managers, cleaners, system tools and the like). It is okay to guard and firewall the indispensable and risky parts (hardware overclocking, network integrity), but only block those irreparable areas while opening up the rest for users to customise to their hearts content, making it as comfortable, easy and intuitive as possible to copy, paste, move and configure everything else between phone and PC. If something goes wrong while doing so, make sure that a system restore point and booting into the alternative partition means that there's no harm, no foul and therefore no problem and no service cost.
Instead of wasting our time hunting for patched partiton files, info on how to get out of bootloops, etc., users could then enjoy and be happier with our phone instead of fixing its shortcomings or, dare I say it, do something fun and entertaining outside while the snow is fresh or the sun is shining.
.
Click to expand...
Click to collapse
Best post I've read in the recent years. Well done!
PS: Love the Angola flag.

XDA ToS designed to shield Motorola's poor security patch cycle?

Information available on Reddit seem to show that several of Motorola's phones have not had any security patch levels applied since after January. It also seems like as long as the known security issues are just documented as theoretically possible that Lenovo/Motorola seem happy to keep reiterating the same lie that they make security a "top priority" while not actually addressing these problems. It is also frustrating that Motorola seems unwilling to release a version of the Motorola One that is intended to be used in the USA.
It would be nice to have a proof of concept repository similar to Rapid7's metasploit but for the Motorola G-series. Please keep in mind, I am *NOT* talking about violating responsible disclosure. This would not include any unpatched vulnerabilities. Instead, this would be known issues were AOSP has provided fixes to Motorola for over a month and Motorola has selected to still notify it's customers that their device is "up to date" without having addressed the known issues.
I believe only by showing customers what is possible with this exploits can enough pressure be put on Lenovo/Motorola to make "top priority" mean actual action instead of empty posturing.
However, based on my careful reading of the XDA ToS, it seems anything that facilitate the creation of malicious content is not allowed. This seems vaguely worded enough to exclude all proof of concept exploit discussion. But several of the issues left unaddressed by Motorola seem to be fairly easy to exploit. So, is XDA really improving the situation or avoiding transparency in favor of shielding Motorola's poor behavior?
It would be really nice if someone could provide some clarification behind the wording of this ToS and XDA's position on vendors that make security a "top priority" leaving months of patches outside of the scope available to customers if the device is to remain under warranty.
This is what I already said.
Motorola is just a retarded company.
I don't know in which universe this is acceptable.
Someone needs to sh*t in a bag and address it at Motorola, so they see what they sell.
The G6 was my last Motof**k phone.
F**k Motorola. F**k Lenovo and f**k all the retards which work in this companies.
I hope the company dies and never sells a f**kphone again.
I completely understand your level of frustration ThisIsRussia but please don't get the thread locked.
If I were to mail something to Motorola to make a statement, it would probably be a finger-print reader attached to swiss cheese. They keep using user facing features to give the illusion of security while leaving the rest of the product full of security holes.
Yeah, sorry I was a little upset because they are always responding with phrases like "soon it will be updated" etc.
Since February. Its May now.
I just don't use Motorola phones anymore and if someone asked me for opinion I didn't recommend Motorola/Lenovo.
They are a bunch of liars. period.
I picked up the g6 on Fi just to have a cheap phone. I thought it was just the Fi version not getting security updates.. luckily I don't keep financials, etc on. Only good as a glorified phone and music streaming device, but for $99?
Not many budget phones get monthly patches on time. None that are under$150 anyways.
$99 or $150 isn't what I was charged for the Moto G6. It was released for a price of $200.
The Federal Trade Commission has fined D-Link, TP-Link and ASUS for marketing *BUDGET* wireless routers that sold for much less than $200 or $150 or $99 for misrepresenting their products as providing security while "failing to take reasonable steps to secure."
According to David Kleidermacher, Google's head of security for Android, ""Android security made a significant leap forward in 2017 and many of our protections now lead the industry" and also "as Android security has matured, it has become more difficult and expensive for attackers to find high severity exploits."
Google owned Motorola, they should have been able to established policies and procedures for Motorola to make good on David Kleidermacher's statements. Or they should have made establishing those part of terms of the sale to Lenovo.
Lenovo and Motorola also market themselves as providing security even for budget devices with statements as:
* "Prevent unauthorized access with secure biometrics"
* "keeping your devices and systems secure and your digital privacy intact is a top priority"
At no point do they put any exclusionary statement such as "but only if it is not a budget device."
Also, while Motorola One is also a budget device, it does get more frequent updates. However, the Moto One is clearly not intended for purchase in the USA market and is missing support for several LTE bands.
And the Moto G6 is supposed to be a Treble/GSI device were any effort Motorola put into providing updates to flagship GSI devices should also apply to being able to also update the G6 for almost no additional effort.
So, I reject the claim no one should expect Feb 2019 security updates by May 2019 because it is simply a budget device.
Then let's also look at the claim that if financials or similar are not stored directly on the phone then it is not really a big issue.
To respond to that I am going to focus on just one Feb 2019 patch. There have been plenty of other security issues in Jan 2019 to now but for purposes of this discussion, I will just focus on one. The CVE-2019-1988 seems to still apply to still apply to any Motorola phone that is "up-to-date" but has a Jan 2019 security level. This vulnerability as a high impact score of 10 out of 10 and an easy exploitability score of 8.6 out of 10. The attack complexity is low and "could lead to remote code execution in system_server with no additional execution privileges needed."
What would need to result from this for it to be considered a violation of Lenovo and Motorola's marketing of making security a top priority?
What if an email or MMS ("text message") or instant message could do any of the following:
* Open and stream the microphone while the phone is locked
* Take and transmit pictures from either the front or rear camera while the phone is locked
* Send and receive text messages while the phone is locked
* Transmit phone location while the phone is locked
* Access and transmit email and files/documents on Google Drive and Google Docs while the phone is locked
Would any of this be disturbing? Is Lenovo/Motorola really delivering on "[preventing] unauthorized access with secure biometrics" if this is possible while the phone is locked?
I get this is all theoretical and I sound like I have been wearing a tin foil hat (maybe I am ). Anyone want to find out? Anyone want to give me the phone number to a Moto G6? Anyone want to give me the email address that they use with their Moto G6? How confident are people that not having financials stored directly on the phone means CVE-2019-1988 is not a major issue?
So far, people's reactions have been similar to this forum that there is still things people can do to maintain their privacy while using a device in this state. No one wants to believe that a major company would leave them so exposed. Lenovo/Motorola seems to be banking on no one understand the full scope of the problem. But what if a Proof of Concept of a Remote Access Trojan launched not via installing an application but simply from viewing a PNG really happened, would anyone be interested that? Would being able to actually demonstrate a PoC RAT have any positive value in holding Motorola accountable to their marketing claims or simply feed "hackers" with an exploit? If it is already known to be easily exploitable, shouldn't it be safe to assume any criminal that wanted it already has created their own implementation?
What exactly is XDA's stand on a real PoC RAT full disclosure? Is XDA taking on the stance that a RAT disclosure is always only harmful? Or is it that Motorola's actions are harmful?
@chilinux
Relax, you don't need to attack me. I can see you're feeling very hostile.
I didn't say you or anyone should accept it. I said it's common on low end devices. Even low to midrange devices.
I don't care what you paid for it. I have the g6 play and paid $99 for it. And it has been updated to pie with March security patch.
Moto is not great at supplying updates the way they were when they were under Google. Not many companies in China that are shopping phones to other countries are good at it.
It sucks, I was agreeing with you.
So rant at someone else. Geez
madbat99 said:
@chilinux
Relax, you don't need to attack me. I can see you're feeling very hostile.
Click to expand...
Click to collapse
I am very sorry you feel personally attacked. I do admit that I have taken a hostile stance but I wasn't trying to attack you.
My point is that I have already heard from users that the issue is not really that bad. It really seems like a demonstration is the only way to change the Lenovo/Motorola business model of leveraging customer misconception. At the same time, the XDA ToS seems to be at odds with using this forum as the method of giving such a demonstration. To me, this means XDA is passively contributing to Motorola's clearly invalid marketing of using product security to protect against unauthorized access.
Allowing remote unauthorized access is very much part of how the Moto G6 functions.
chilinux said:
I am very sorry you feel personally attacked. I do admit that I have taken a hostile stance but I wasn't trying to attack you.
My point is that I have already heard from users that the issue is not really that bad. It really seems like a demonstration is the only way to change the Lenovo/Motorola business model of leveraging customer misconception. At the same time, the XDA ToS seems to be at odds with using this forum as the method of giving such a demonstration. To me, this means XDA is passively contributing to Motorola's clearly invalid marketing of using product security to protect against unauthorized access.
Allowing remote unauthorized access is very much part of how the Moto G6 functions.
Click to expand...
Click to collapse
XDA needs to cover their butts. They walk a fine line on many things.
To provide members the most information, useful guides, and general Android knowledge; they do have to remain, for lack of a better term, "neutral".
They allow us access to guides, knowledge, and even files, that allow us to take back some semblance of "ownership" of our devices. And that is despite many OEM, and country, restrictions, regulations, and "ownership", be it proprietary or what have you, that threaten their voice.
We, in turn, try to adhere to their rules to maintain an even keel, so to speak. So as not to make it harder, or impossible, to do the good work they are doing.
That said, this may not be the platform to achieve the ends you seek. Even if others share your view, in part, or otherwise.
Make sense?
madbat99 said:
XDA needs to cover their butts. They walk a fine line on many things.
To provide members the most information, useful guides, and general Android knowledge; they do have to remain, for lack of a better term, "neutral".
They allow us access to guides, knowledge, and even files, that allow us to take back some semblance of "ownership" of our devices. And that is despite many OEM, and country, restrictions, regulations, and "ownership", be it proprietary or what have you, that threaten their voice.
We, in turn, try to adhere to their rules to maintain an even keel, so to speak. So as not to make it harder, or impossible, to do the good work they are doing.
That said, this may not be the platform to achieve the ends you seek. Even if others share your view, in part, or otherwise.
Make sense?
Click to expand...
Click to collapse
I understand what it is you are trying to saying that XDA sees it to their advantage to not rock the boat too much. That doesn't mean it makes sense to me.
Here is how I view how the world works when people don't speak out:
https://www.cnn.com/2019/01/12/middleeast/khashoggi-phone-malware-intl/index.html
If Motorola wants to specify that security and safety simply is not part of this product, then I can understand them making that part of their *stated* business model. But Lenovo/Motorola has decided they can market a product as preventing authorized access without doing the work required to actually provide that feature. There should be moral and ethical issues raised when knowingly letting a company mislead their customers to that extent.
There should be room someplace on the XDA forum to create a penetration/vulnerability to put customers of Motorola in a better position for informed consent. The idea that the average person can take the April and May 2019 security bulletins and understand what that really means just doesn't work out. They know what the word "critical" means but usually don't know what RCE is and largely take it as being someone else's problem. The level of conflict of interest on the part of Motorola is not made clear.
Instead, the average person still focuses on if when they are going to see the latest Avengers movie. "CVE-2019-2027" means nothing but if you show them April/May gives criminals all of the infinity gems such that at a click of their fingers half of customers of Motorola have their privacy turn to dust, then that is something they can at least understand. Then they can more meaningfully decide if it is reasonable/safe to use that device without leaving airplane mode permanently on.
chilinux said:
I understand what it is you are trying to saying that XDA sees it to their advantage to not rock the boat too much. That doesn't mean it makes sense to me.
Here is how I view how the world works when people don't speak out:
https://www.cnn.com/2019/01/12/middleeast/khashoggi-phone-malware-intl/index.html
If Motorola wants to specify that security and safety simply is not part of this product, then I can understand them making that part of their *stated* business model. But Lenovo/Motorola has decided they can market a product as preventing authorized access without doing the work required to actually provide that feature. There should be moral and ethical issues raised when knowingly letting a company mislead their customers to that extent.
There should be room someplace on the XDA forum to create a penetration/vulnerability to put customers of Motorola in a better position for informed consent. The idea that the average person can take the April and May 2019 security bulletins and understand what that really means just doesn't work out. They know what the word "critical" means but usually don't know what RCE is and largely take it as being someone else's problem. The level of conflict of interest on the part of Motorola is not made clear.
Instead, the average person still focuses on if when they are going to see the latest Avengers movie. "CVE-2019-2027" means nothing but if you show them April/May gives criminals all of the infinity gems such that at a click of their fingers half of customers of Motorola have their privacy turn to dust, then that is something they can at least understand. Then they can more meaningfully decide if it is reasonable/safe to use that device without leaving airplane mode permanently on.
Click to expand...
Click to collapse
Nope. Nobody is "honest" in marketing. They would sell nothing. Is it right....? No. Is it going to continue? Of course.
There are places to speak out. This isn't IT. Period.
You want a Google device that updates with every patch, you're gonna have to get a Pixel. Flat out. No company truly cares about you're security. They start companies to make money. The end. Right or wrong. Sorry bro. It is what it is.
Unless a company specifically spelled it out in the laws of the country their marketing in they don't have to do it. They can skirt rules and regulations anyway they possibly can. And they have lawyers to make sure they get around that crap. Marketing gimmicks do not equal legal regulation obedience.
if you have a medium to carry out the plan you intend to, find it and do it. just make sure no consumers are harmed in the process. because then the line has been crossed where you're not helping anyone but hurting people.
companies are going to sell their products at the greatest profitt imaginable and that's just the way things are going to be until some company proves that profits lie somewhere else. There isn't much you or I can do about it.
Again, this is not the medium for you to carry out such a vision. the most we hope to do here is to give users the keys to find a way to pick the lock for themselves. Not a way to circumvent the rules, punish the guilty, or vindicate innocence. There are places for that.
I'm going to bed now because I get up for work early. Good luck dude. hope you feel better in the morning.
how many people in the budget phone range are still using phones that haven't even been updated past kit Kat. Just a bit of a reality check. Up-to-the-minute security patches don't mean much to those who are struggling just to have a device to communicate with.
Infinity gems be damned, level-headed decisions with your device make all the difference in the world
madbat99 said:
just make sure no consumers are harmed in the process. because then the line has been crossed where you're not helping anyone but hurting people.
Click to expand...
Click to collapse
I can not no consumers would ever be harmed by anything I ever released. TeamViewer has been weaponized to performing scams. UPX was weaponized to help hide malware from detection. Cerberus antitheft app for Android has the potential to be weaponized. Magisk can be weaponized for malware to avoid detection on Android. To claim any of those projects is "not helping anyone" is really a stretch.
The security audit PoC suite would be similar to previously publicly released project. It would have a method of install via exploit similar to JailbreakMe and it would provide demonstration on what privileged level access provides similar to Back Orifice 2000. Both of those previous project had the potential to weaponize but also helped customers make a better informed decisions about the products they use.
madbat99 said:
how many people in the budget phone range are still using phones that haven't even been updated past kit Kat. Just a bit of a reality check. Up-to-the-minute security patches don't mean much to those who are struggling just to have a device to communicate with.
Click to expand...
Click to collapse
Just a bit of a reality check, I know a medical doctor that discusses information that should be legally protected under HIPAA in the same room as a Moto G6. When a vendor misrepresents the degree to which unauthorized access to a device's microphone is prevented, then more than just people struggling to communicate are impacted. That level of misplaced trust also means the privacy impact extends beyond just owners of the phone.
It is also a level of mistaken trust that was contributed to by people like Ronald Comstock with the XDA Developers sponsorship team which recommended this phone. It might be possible to make an excuse that at the time the recommendation was made it wasn't known how far behind security updates for the product would go. However, the XDA sponsorship team never posted a retraction and the XDA ToS makes it hard to effectively counter the vendor's misrepresentations of the XDA recommended product.
chilinux said:
I can not no consumers would ever be harmed by anything I ever released. TeamViewer has been weaponized to performing scams. UPX was weaponized to help hide malware from detection. Cerberus antitheft app for Android has the potential to be weaponized. Magisk can be weaponized for malware to avoid detection on Android. To claim any of those projects is "not helping anyone" is really a stretch.
Just a bit of a reality check, I know a medical doctor that discusses information that should be legally protected under HIPAA in the same room as a Moto G6. When a vendor misrepresents the degree to which unauthorized access to a device's microphone is prevented, then more than just people struggling to communicate are impacted. That level of misplaced trust also means the privacy impact extends beyond just owners of the phone.
.
Click to expand...
Click to collapse
It can be said that security and privacy are separate issues.
But your insights are well stated.
I remember when a "researcher" seemingly died right before demonstrating how security flaws in insulin pumps could kill a man. (We know who did it Jack) so security is a real concern. And big money will always try to silence what is too expensive to fix. So I get your point. Just goes a little beyond XDA is all I meant. No hard feelings intended, so I hope you didn't take it that way.
madbat99 said:
And big money will always try to silence what is too expensive to fix. So I get your point. Just goes a little beyond XDA is all I meant. No hard feelings intended, so I hope you didn't take it that way.
Click to expand...
Click to collapse
I have hard feeling about this issue but not about what you have said.
I also have a much less issue with "big money" not spending money were it does not need to. But they need to be transparent about that.
What I have hard feelings about is this:
https://androidenterprisepartners.withgoogle.com/device/#!/5659118702428160
And statements from Google related to that page such as:
"Organizations can then select devices from the curated list with confidence that they meet a common set of criteria, required for inclusion in the Android Enterprise
Recommended program ... Mandatory delivery of Android security updates within 90 days of release from Google (30 days recommended), for a minimum of three years"
As appears in this document:
https://static.googleusercontent.co...droid_Enterprise_Security_Whitepaper_2018.pdf
Ninety days from the February 5, 2019 security update bulletin was May 6, 2019. Choosing from that list does not result in mandatory delivery of security updates within 90 days. Google and David Kleidermacher are drowning consumers with willfully misleading information to put trust into devices that aren't held to the criteria they claim they are.
am i the only one who doesn't give a crap about security patches? i just want my phone to work, which my G6 does, just fine.
Dadud said:
am i the only one who doesn't give a crap about security patches? i just want my phone to work, which my G6 does, just fine.
Click to expand...
Click to collapse
You are far from the only one who doesn't care about security patches. I would agree with you that you should not have to care. Addressing problems that are over 90 days old are stated to be the responsibility of Google and Motorola to have taken care of.
In terms of it working just fine, my point is while it appears to normally be fine there is known ways that unapproved behavior can be applied to the product without the owners being aware of them. To me that is not working as advertised and is also not really working fine.

[DISCUSSION] Or more like a manifest...

Hello boys and gurls, this is just a way from me to "scream" one frustration I've got since I've started to try custom ROMs on my OP 6T device I own since February this year.
I'm an Android fan and user since back in the 2.3 era, you know, the days when Android names had a "tasty" name that could made you "swallow" one way or another. I remember that on my 1st device, Galaxy one plus, I've encountered 1st time this frustration I'm trying to point now, and that was a semi-bricked device camed from a "bad flash"... Those days are long gone and isn't good to live nostalgic way, because that will stop progress, they say...
About progress, here is where I really wanted to get... In my opinion, with this A/B partition system, Google messed up things so bad that could even get to the point that developing will go down so bad that even "he" will feel it. Sorry to say this Google, but this ain't really a progress regarding development of an Open Source you actually benefit from... I'm a bit frustrated regarding of what this system brings when flashing/testing ROMs for the fine people developers are. Because I can imagine this messed up way of do things by bringing up A/B up in development will lower the testers and beta testers to a point where only a few users will have the guts and most important time to actually test a custom ROM... And that's just because of this "idiotic" thing you bought up with latest Android versions...
Like I've said in title, this manifest is made for all the ones who feel the same about wasted time testing and failing when comes about something that you, Google, benefit.
Regarding anyone who wants to add anything about this or maybe just to make the required number of posts so he can use the forum as he wants (hello to all this new Android newcomers BTW), feel free to discuss the subject, or point finger at me, at me a person who thinks that this new system (not a flawless one as Google intended to be) is pure crap that will make lots of devs or testers to just quit be part of this awesome life that Android brings ...
I agree and disagree. I think the A/B partitions are good for non-root users and those are the 99.5% of people with a smart phone.
For root users it is a pain in the ass however, I never really had any major problems with A/B layout because you can always flash back to stock.
I dont like it but not enough to make a big deal over.
Scott said:
I agree and disagree. I think the A/B partitions are good for non-root users and those are the 99.5% of people with a smart phone.
For root users it is a pain in the ass however, I never really had any major problems with A/B layout because you can always flash back to stock.
I dont like it but not enough to make a big deal over.
Click to expand...
Click to collapse
Well as I've said, it kills the mood to test/use/flash customs because you can end up with a soft brick (or worse) more easily than before.
chasemyass said:
Well as I've said, it kills the mood to test/use/flash customs because you can end up with a soft brick (or worse) more easily than before.
Click to expand...
Click to collapse
Yes, this is true but if you are careful you can avoid 99% of the issues. Im not saying your point is not valid but I am asking that you look at it from OEM / GOOGLE side.
They used to have updates, if bad, brick phones. Now the phone can roll back to the last known good operating system without issue if OTA corrupts boot.
Its a tough pill to swallow because it benefits and hurts different people in different ways.
Scott said:
Yes, this is true but if you are careful you can avoid 99% of the issues. Im not saying your point is not valid but I am asking that you look at it from OEM / GOOGLE side.
They used to have updates, if bad, brick phones. Now the phone can roll back to the last known good operating system without issue if OTA corrupts boot.
Its a tough pill to swallow because it benefits and hurts different people in different ways.
Click to expand...
Click to collapse
Well maybe you can get to a back point where all was good during a flash, but not if you are rooted. At least I never managed to do it and ended up with using msm, unlocking bl, flash twrp, etc. That's a waste of time tbh beside the fact that if you want to actually test ROMs is better (safer) to play on a smartphone you don't use day by day... This is where it hurts on some "flash'ohoolics" that wants to test more than one cooked ROM to see what's best for him, like I always did.
Google doesn't care of custom roms. Even if Android is allegedly open source, the reality is that the Android environment (certification process, filesystem design, even bootloader security and access) is meant to make custom roms and above all root access more and more difficult to implement.
That explain all changes made to Android and future ones. Google stated several times that simple root access is not legit and is dangerous for the user. Especially now that phones are more and more used for very critical usage as banking, payment, car opening and starting and so on. The chain of identification and legal responsibility will lead more and more to tight closed phones even on Android.
Striatum_bdr said:
Google doesn't care of custom roms. Even if Android is allegedly open source
Click to expand...
Click to collapse
Android isn't open source, AOSP is. Android = AOSP + proprietary closed source blobs.
grt67DFqyu said:
Android isn't open source, AOSP is. Android = AOSP + proprietary closed source blobs.
Click to expand...
Click to collapse
That only proves my point, proprietary is badly compatible with custom rom, and needs many Dev effort... Until time when those efforts won't be enough or too heavy to be done.
This belongs in some Google Android dev forum regarding the architecture. Or, feel free to get hired by them and influence them anyway you please.
Striatum_bdr said:
Google doesn't care of custom roms.....The chain of identification and legal responsibility will lead more and more to tight closed phones even on Android.
Click to expand...
Click to collapse
I can partially agree with you about Google, because the good thing about an open source is that you can "borrow" some modifications made by others, so closing up or limiting the development isn't such a bright ideea, but that is just my humble opinion.
Regarding the closed phones you mention, well that brings me back to the point where jailbreak was an intense way to do things and I did once on one of my old iPhone 4, and that just because I wanted to customize it a bit more, as I was getting bored of it.
Beside that, I really think that if we manage to read, pay attention to details and act like a conscious person, we all know what unlocking BL and rooting can do regarding our precious smartphones. But if you know that and still use your rooted smartphone to save delicate things and/or credentials regarding your bank account and so on, can't really blame anyone else for it... This ain't about security, because I can think that we most users agree that's something beyond us, but more like annoying adds, customize more the look of your gadged and last, but not least, trying to squeeze as much as it can be done from it when comes to whatever you do with it...
I still stick with the point I've started this discussion thread, that A/B partition sucks, even if Google hides it behind a safer window towards using the gadget... Sometime I think that all this pushing forward with all modifications made by Google, behind any reason, is just a road to make it difficult to use it without a ROM agreed by them...

Do you like the challenge?

Huawei still firmly rejects requests to allow bootloader access and I'm wondering if this is more intriguing to those who like hacking and modifying their phones?
It's not a challenge if you can unlock the bootloader and if you can't it throws up numerous hurdles to overcome.
With Emui being awarded BSI privacy protection certificate and the first mobile OS to do so, do you instead enjoy the device as is and feel happy feeling secure and Google tracking free?
You trade Google tracking for Huawei tracking. If you install a firewall you'll see how often the device phones back to Chinese servers. A locked bootloader isn't intriguing, it turns people away. Just look at the Snapdragon Samsung Galaxy forums, full of complaints, bounties etc.
Yes I'm happy that the phone is Google free as much as possible being Android, it's a step in the right direction.
I truly believe Huawei needs to unlock bootloader if they want to maintain smartphone dominance. People who unlock are aware of the issues and should be free to do so. If they are not developer friendly, soon they will be running out of options.
I absolutely love huawei hardware, if due to some restrictions they can't deliver software experience, they should empower developers to do so.

Categories

Resources