Hacker News Reader

This seems noteworthy:

> Any scenario still requires the user to install the malicious update from a source outside the Google Play store.

Agreed. Also this "The ... vulnerability affects ... Android 5.0 and newer... Applications that have been signed with APK signature scheme v2 and that are running on devices supporting the latest signature scheme (Android 7.0 and newer) are protected against the vulnerability."

Reply on news.ycombinator.com