Hacker News Reader

Comment by _sdegutis | Hacker News Reader

> "when each and every single device is stuck on an old kernel often with a bunch of important CVEs unpatched"

As an iPhone user, I've heard about how one of the benefits of Android is that it's built on OSS, so that if you wanted to have a fully secure phone, you could just download the latest kernel and patches and software and install it yourself. Is this actually possible for Android users?

View on HN

Phone manufacturers always buy the drivers from chip manufacturers, and under closed licenses. The source is rarely ever published, you can't download the kernel patches and do anything. Often you'll wait months or years to get the kernel the manufacturer used, and it will have been so old that none of the drivers will work on a recent linux kernel anymore at all.

The situation isn't exactly great. And torvalds believes it to be more important to talk nice to these companies than to enforce the GPL, so nothing's been moving in the past decade at all.

Yeah, the only hope we've got is to move to a more Windows-style driver model, which is what Treble attempts to do, abstracting the HAL from the kernel and application software. This is already shipping in Android O and new devices on O or P must be Treble certified to ship Play Store, so we should see this improved greatly in upcoming devices.

If only OEMs weren't the ones expected to do Treble updates....

If they are fully compatible it means community updates can work better too - not needing to worry about the HAL as much.

Yes, Google might need to take one more step of saying "and we ship the security updates" before the average user benefits - but that can be done down the line if the situation merits it. Developers and power users will be able to take advantage of it even sooner. A single codebase for LineageOS? Yes please!

Community updates don't count for regular users, nor does LinageOS.

To an extent. You'd have to be pretty tech savvy and fairly involved in both ecosystems to actually run your own android builds and stay on top of security.

I know of one example of an Android OS which is focused on security and privacy. Check out CopperheadOS [0]. Their technical overview [1] details some of the improvements.

* Possible disclaimer? I run CopperheadOS on my old Nexus 5X.

[0] https://copperhead.co/android/

[1] https://copperhead.co/android/docs/technical_overview

> Is this actually possible for Android users?

Not even close. Android security is a joke. I don't even like to login to my email from it.

Are you sure it isn't iOS security that's the real joke? I mean, just do a search on YouTube for all of the lock screen bypasses. And then there's Cellebrite and their ability to unlock any iOS device for the relatively paltry sum of $1500 or you could just wait for a 2 for 1 special and do 2 for $750. The Pixel phones are virtually unhackable and not one has ever fallen at a PwnToOwn event. iOS devices, on the other hand, always fall at these events.

Reply on news.ycombinator.com