Hacker News Reader

Comment by toastal | Hacker News Reader

Security is the reason I get mad about bank apps detecting custom ROMs on Android. Support is usually shorter, but LineageOS can keep OS and software securities rolling past the manufacturers date. There aren’t custom ROMs in the Apple sphere tho since it’s all proprietary.

View on HN

> but LineageOS can keep OS and software securities rolling past the manufacturers date.

It's unfortunately a false sense of security because you don't get security updates for any proprietary blobs that are needed for your phone. This includes baseband and SoC updates. In security, the chain is only as strong as it's weakest link.

It's also a false sense of security because community roms are maintained by a small group of (often) entirely anonymous people with nearly zero repercussions if they put something in that they shouldn't.

Implying manufacturers aren’t putting stuff in their ROMs they shouldn’t? At least these custom ROMs are built & maintained in the open.

No, I think the implication is that if a major manufacturer lets something Bad™ slip in, they can be held liable. xXFoneBoi93 could slip in a root kit and the custom ROM they contribute to probably wouldn’t be held accountable in any meaningful way.

That’s how I read it at least

Held liable, as in getting a fine that's 0.3℅ of their yearly revenue ?

Well sure, that’s a completely different discussion though.

LineageOS probably isn’t a great example. It uses black box firmware blobs that don’t receive updates and essentially just makes the latest Android work with those.

It’s certainly better than just running an old Android on an unsupported device, but there are still large parts of the system that can be subject to critical vulnerabilities that can never be patched.

Compared to many alternatives, it is better. The devices with longer support don’t have the basic features I need like a headphone jack & too many thing require a mobile device to function anymore, like Signal which doesn’t work without an Android/iOS primary device.

My Librem 5 with a lifetime support has all that. Signal can run with Waydroid.

By coincidence I had to get an old device running last night because current device is broken. I was able to flash 2023-09-05 Android security updates atop a 2014 phone whose last firmware update was 2016-09-01. Is the device not safe? To some extent yes, but I was able to keep an old emergency device running with security patches from last month which is better than having to buy a new temporary device or being stuck on the matching official 2016 ROM.

Reply on news.ycombinator.com