Google's Android Update Alliance Is Already Dead

Yeah, I picked up an iPhone 4 eventually, and I absolutely love it.

What annoys me, though, is that had I waited another month or two instead of buying the Galaxy S, the Nexus S came out and by most accounts was a really nice phone.

Instead, I returned the Galaxy S, and put my SIM card back into an old Nokia N73 (which despite being old and Symbian, I vastly preferred to the Galaxy S).

It's been a while, but here are the issues I remember:

* GPS was completely broken (a known and admitted issue with the T-Mobile variant of the Galaxy). If you disabled it, you could use tower triangulation to get a rough position, but that made it unusable for things like driving directions.

* Battery life was terrible (probably not specific to that model, but it didn't get through a day the whole time I had it).

* The camera was awful (not unusual for smartphones at the time, but my old crappy N73 had a camera that was easily 10x better).

* If you unplugged the headset, the phone would automatically launch the music player and start playing music through the speaker, even if the music player wasn't running.

* USB mass storage mode didn't work, so you couldn't move files to it. The only workaround was to turn on debugging on the phone, which would then let it show up in as a USB device, but you'd have to enable/disable debug every time you plugged it in, as leaving it in debug made the screen not turn off.

* Lots of crap applications that you couldn't remove.

* Most of the menus had misspellings or bizarre word choices, like it had been passed through Google Translate (a nitpick concern, I realize, but it didn't give me a lot of faith in the quality control of Samsung).

Then there were all the issues with Android itself, which aren't specific to the phone, and I really don't want to hash out here, as some of them have been fixed by now, and I really have no desire to get into a debate about the merits of the platform.

I spent the next six months or so after returning the phone to see if the issues ever got addressed, just to see what would have happened if I kept it, and it seemed like most of them were still known issues. That made me feel better about my decision to return the phone.

Android OS upgrades almost always come with fixes for security flaws. You wouldn't be OK running your desktop with software that hadn't gotten updates for a year, right?

Yeah, as I said in a reply below, if I'd have waited another couple months, the Nexus S would have been announced, which probably would have changed my opinion completely.

As to your option 2, that's the type of option "the old me" would have considered; which is "ok, so maybe this thing I bought sucks, but I can root it and replace the software to do the things it should have done out of the box".

I've found that avoiding that line of reasoning has made my life much better. That's not meant to disparage people who do mess around with stuff like that, I think it's awesome that you can even replace the ROMs. I just hope that people who replace the ROMS on their phones are doing it because they derive enjoyment from hacking, and not because it's necessary to make their phone actually usable.

I'm not sure there are any Google Experience phones for sale.

The Verizon Galaxy Nexus does not appear to be a pure Google phone -- it comes preloaded with Verizon software and I have seen no statements from either Verizon, Samsung, or Google regarding when updates will be released, or who will publish them, or if they will first have to go to Verizon. (Here's one article discussing the issue: http://www.pcmag.com/article2/0,2817,2397377,00.asp - How CDMA is killing the Galaxy Nexus)

Even the imported GSM Galaxy Nexus is being questioned as perhaps not a google phone as it seems to have shipped with substantially different roms that may have different update policies. (http://www.xda-developers.com/android/is-the-galaxy-nexus-st... https://news.ycombinator.com/item?id=3341959 )

I am very interested in this question of when/where/who will publish the Galaxy Nexus updates -- I want to replace my Nexus One with a Galaxy Nexus. But much of the value I perceived of the Nexus One is that the updates came frequently and came directly from Google.

The Nexus S 4g (sprint) was the worst phone I ever owned. Terrible reception meant calls dropped constantly and therefore the battery never lasted a whole workday. On the flipside, my Motorola Photon has great reception and battery life, but is encrusted with Motororola customizations, and apparently unlocking the bootloader disables 4g. While I love the open nature of Android and I've enjoyed CyanogenMod immensely in the past, the fact is that right now I have a fairly locked-down phone which -- though powerful --is nowhere near as fun to use as ones I've had before.

1. The Nexus One is not 2 years old yet and will not be getting ICS. So getting a Google phone is not a guarantee.

2. Having control over your phone is great. But that is not really what you paid for. So not really a solution unless you always intended to use a custom ROM in the first place.

I have to admit though, I don't think I have ever seen anything that says any smart phone, iPhone, Android or otherwise, will have software updates for at least the contract life (2yrs) of the phone. So maybe my argument has no feet to stand on and you are getting what you paid for.

So I agree with the OP. Checkout what you will actually get and look at the manufacturers track record of actually following through.

I guess it depends on what you mean by 'launch'. There was an ICS image released like a month ago, and a friend was running a CyanogenMod 9 alpha build shortly after.

They do not[1] treat all their vendors the same way. It has been documented that Google provides early access to particular vendors, in order to suit their own desires for the launch of each version of Android. It has been going on at least since the original Droid launch on Verizon.

[1] http://www.bbc.co.uk/news/technology-14836102

That's confusing two issues. You're talking about a corporation "blessing" the use of some software on some device. I'm talking about people actually doing the work to make the software work on the device.

We currently lack the latter because the former is perceived as "expensive" by the companies who need to provide the support. That equation changes rapidly if the product starts out as a blessed version of an active community project.

That could be the case, I'll don't really know. All I know is that nothing came through Kies for me.

The CTR mode in bouncy castle does not allow one to do partial block encryption. So if you want to encrypt 4 bytes you need to pad it to the full 16 bytes. It will always want to do a full block.

This also means that you can't do a partial offset into the CTR. You can increment the counter correctly, but you can't start encrypting from within a partial block.

Lets say you need to encrypt 17 bytes and write them to a file, which later can be opened in append mode to append more data to it using AES-128/CTR-BE mode:

  1234567890ABCDEF\0

C-style terminated string.

That is 2 blocks in CTR mode (1 full block used, 1 partial block (1 byte out of a 16 byte block)).

The next time you open the file you want to append data to it, what you would do is this:

  1. Load your previous key, and counter into AES-128/CTR
  2. Increment the counter by the full blocks already used
  3. Update the location into the current block by encrypting a random byte
  4. Provide the rest of your plaintext which will now be correctly encrypted for appending to an already encrypted segment

Now you can read your file back using the following:

  1. the AES key, counter for the start of the file
  2. Use CTR to "decrypt" the content from start to finish

So that would look something like this in Java code with JCE:

  Cipher c = Cipher.getInstance("AES/CTR/NoPadding");
  SecretKeySpec keySpec = new SecretKeySpec(aeskey, "AES");
  IvParameterSpec ivSpec = new IvParameterSpec(iv);
  c.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);

I've left out some stuff like creating the iv (really the counter), so now if we wanted to advance into the first block what we could do (and this works with JCE) is this:

  c.update(new byte[count]);

Where count contains the amount we want to offset into the next block.

On JCE this does exactly what I described above, it moves forward "count" characters into the next block and then you can do:

  CipherOutputStream cipher_out = new CipherOutputStream(output, c);

where "output" is DataOutputStream(new FileOutputStream("filename", true)) which is a file opened in append mode. Now you can write stuff to the file using the normal functions used by an OutputStream. This will then correctly append your new data to the end of the file so that if you start reading at the beginning of the file you can read through the end and get valid data. (We are using this to encrypt log files that are opened in Append only mode).

Where BouncyCastle breaks down is that you can not use c.update() to move forward into the block, thus appending is not possible because if you don't end on a block boundary your next write is going to have overlap. The only thing you can do in c.update() is provide it the amount of bytes that is the same as the block size. So you have to pad all input into c.update() to 16 bytes. Basically instead of being a stream cipher that allows seeking it has become yet another block cipher.

How many real PC end-users upgrade their operating systems? In the long run, this matters even less for Android than it does now.

That's exactly what I'm saying. With Windows, you could follow as close to the cutting edge as you wanted. With Android, your hands are tied unless you want to hack your phone. For the hacker types that have so far pushed Android adoption, this is a big deal.

The development part of upgrades is not a problem, neither resources or time-wise. The real problem are certifications. Alternative firmware developers like Cyanogen or MIUI do not have bother with this, they are not selling products based on their software, but phone vendors have to go through them. This is the big sink of money and time.

Recently, there were articles by Motorola and Sony Ericcson, that shed a little bit of light on this topic.