Hacker News Reader

Comment by kb120 | Hacker News Reader

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

View on HN

"a browser that isn't supported by Google"

But still a browser that was created by Google and was bundled with the OS until 12 months ago, never mind how long it takes OEMs to roll it out. Android <=4.3 accounts for 75% of Android users:

https://developer.android.com/about/dashboards/index.html?ut...

Just because Google decided not to support it any more doesn't mean they shouldn't. Pointing out Firefox and Opera is all very well, but this is the default browser on Android <=4.3, and very few users explore alternative browsers (Chrome being the exception, to a point).

It's also the browser engine used in embedded webviews, don't forget.

Could they update it, though? I thought part of the reason they went to Chrome is that the AOSP browser is baked into the OS and so not updateable without updating the whole OS. So to patch it, they'd have to update the OS, but if you're doing that, then why not just move to the latest OS, which is already fixed?

Chrome only supports Android 4.0+ (Ice Cream Sandwich), so people with older Android devices don't have that choice. OTOH, Firefox supports Android 2.3+ (Gingerbread). Mozilla only recently dropped Froyo support.

Yes they can update it. Android provides an update mechanism for system apps.

They can update the "Android Browser" app, but the flaw is in a system level component (the Android WebView). They might be able to mitigate the flaw with an update to the app, but all other applications (including any OEM shipped browser that utilises the system web view) would still be vulnerable.

I imagine this would be fixable with an Android OS patch, no? I think this is critical enough to warrant that.

Very few people explore other browsers? Alt browsers are often the first app that people download. Chrome is included in gapps.

Alt browsers are often the first app the people download.

Which people? I'll grant that Chrome is an exception, given that it's bundled, but I've never seen usage number of other alternative Android browsers hit any meaningful numbers.

Who, engineers? Certainly not my wife or anyone else I have ever met who isn't technical.

My grandmother managed to switch entirely to Chrome on her PC without the help of anyone in our family. Anecdotal evidence works both ways. It isn't 1998. Most people know what a browser is and which one they are using on their desktop. Making the leap to a second browser on a phone (where they can easily get it from Google Play) isn't that ridiculous.

Who's talking about PC? We're talking about phones here, and it is different. Also, it's not anecdotal; we have data. The only reason that IE still has such a large share of the browser market is because people are unaware of and/or don't care about other (better) options.

Not sure what fantasy land you're living in. But most people are not downloading alternate browsers en masse for their phone. Especially not when there isn't a compelling reason to do so.

Chrome on Desktop has adapted several malware techniques to get installed without the user noticing. Bundled by default in many installers, including Flash, installs with user permissions only.

Example? I worked quite hard to get my grandma to install Chrome.

>Bundled by default in many installers, including Flash, installs with user permissions only

Not saying I agree with the Malware comment, though the bundling is annoying.

Isn't that what you are for, if you're computer-literate?

The first thing I install on my gf's computer or phone is Firefox and configure it to sensible settings (turn off third-party cookies, install ABP and Ghostery and stuff like that).

Haha, I'm sure we've all had tunnel vision moments at one point or another.

I've played tech support to many people in my circle of friends and family who have no idea that alternate browsers even exist. The vast majority of users use what comes on the phone by default.

Most "normal" people assume whatever browser comes with Android is "Google's Browser" (right or wrong), so this could be a very big deal to A LOT of people. How many Android handset manufactures have shipped units with the AOSP browser as the default?

So on 90% of phones when someone opens "the web" using the browser installed on their device, they are using an unsupported browser. How would they know this?

Only 20% of mobile web traffic comes from ASOP browser.

According to these people, Chrome and Safari also have ~20% each.

http://gs.statcounter.com/#mobile_browser-ww-monthly-201308-...

That's 1 in 5 mobile users! How can you argue that 20% is small?

> How can you argue that 20% is small?

where did they argue that? They were just correcting the 90% claim above.

"90% of phones" and "20% of Web traffic" are two different claims; there is no correction.

This just keeps getting better. "Only 20% of mobile web traffic", wow.

Back in my times browsers would kill for a 20% market share...

both are chrome. just different versions.

google ridicules microsoft with IE6, and the first offline platform they release they made the exact same mistake!

bundle a integrated browser just so the use cant uninstall... and decide to not patch it.

not the exact same mistake, as you can install chrome...and now those can at least be disabled. Un-installable system apps...another place where the microsoft and apple default is a mistake.

I fail to understand your point. you can also install browsers on windows that ship with IE6.

your other arguments, maybe on your fancy phone. 99% of the phones still stuck on 2.3.3 or older, you

- can't disable system apps

- can't uninstall system apps

- usually have 60mb or less for apps.

- can use the SD card for apps.

that leaves ANY browser out of the option. chrome and firefox, both install on around 20 to 40mb... and then consumes an additional (non-configurable) 100+mb of cache on the app data partition. leaving any older phone crippled (you can't fetch background data when the low storage space warning is showing).

That's because most web traffic comes from iOS. AOSP Browser represents about half of the Android traffic.

Well, not everywhere. Here in Brazil, Androids have the (by a huge margin) biggest share of the market and of the mobile traffic.

They are clearly talking about normalized global metrics.

Obviously things aren't the same everywhere...

Pretty much the tone-deaf reaction I was expecting. Thanks!

(Of course, these devices will still be counted by those touting Android's market share. Surprise surprise)

And this is where platform evangelism/favortism morphs from the merely annoying to the (potentially) dangerous.

Even if we accept your dismissal of this issue, and I sure don't, this is indicative of Android's issues as a platform. Massive vulnerability affecting huge proportion of installed base is ignored by vendor.

"So the bug is only for a browser that isn't supported by Google?"

Wait, what ? I'm not an android user, but I am a chrome user on all of my desktops ... can someone enlighten me ? How is chrome not a browser supported by google ?

This is not a bug in Chrome, but a bug in AOSP which was the browser shipped with android before Chrome became the default.

AOSP Browser is the unsupported one. Google deprecated it in favor of Chrome.

But AOSP is still a core part of the android OS because it's used by every app that wishes to render a page.

In 4.4, WebView is backed by Chromium.

"deprecated" while there are still millions of consumers whose products only run 2.3.3 with enough memory for aosp browser (which they cant even uninstall)

google logic. ...or better yet, san francisco dev logic

>. If security is such a big deal to a user they should use a browser that is supported by a strong development team.

Recalls happen in older cars still. Maybe since it is 2014, we think about a similar idea with software involving millions of users.

Reply on news.ycombinator.com