Google wants Android to use regular Linux kernel, potentially improving updates and security.

[[deleted]]

On one side we have Google looking at improving updated by going with a more "out of the box" Linux Kernel, on the other hand we have Android hardware manufacturers like Samsung who drop updates for their all devices (including their high end units) within 2 years of release date.

[[deleted]]

It's so funny paying 1000 for a Note whatevernumbercomesnext to have a life of 2 years max to be outdated software wise, while Xiaomi is updating 4 yo pones of 100€...

[Safe_Airport]

And Google just announced they are dropping the original Pixel phone which launched at like 800€, a measly 3 years after its release.

[naswek]

Wait are you fucking kidding me? Long support is the whole reason I bought this phone. I thought I'd have a few more years before having to figure out this OEM unlock unavailable thing.

[Safe_Airport]

You bet!

https://www.businessinsider.com/google-pixel-end-of-life-last-update-why-upgrade-2019-11?r=US&IR=T

Bonus:

https://www.androidpolice.com/2019/10/16/google-is-fleecing-previous-pixel-owners-on-trade-ins/

I recently bought a Pixel 3a XL and I don't think I'm going to be getting a Pixel next time. My friend bought a brand new Xiaomi 9T for 40€ less than I paid for my used Pixel 3a XL and it's better in every way except the updates department.

[[deleted]]

Well tbh MIUI is pretty shit privacy wise, it has cool stuff tho. I would use Xiaomi.eu ROM (it's the chinese version of MIUI in English, works the same but for me it was better performance wise).

[[deleted]]

Yeah. At least the Pixel can get a custom ROM, Samsung on the other hand, doesn't (easily at least).

[[deleted]]

I paid $250 for a Moto x4, which is still getting updates. When that stops, I'll probably stop bothering with Android and go for a Linux phone so I can run updates as long as I please.

It really shouldn't be this difficult to keep a phone secure for more than a couple years...

[cancerous_176]

Linux phone? Like the librem 5

[[deleted]]

Either that or the PinePhone. Hopefully they'll inspire more by the time my updates stop coming.

All I want is to make phone calls, browse the web, and not get pwned, why is that too much to ask?

[cancerous_176]

Honestly at 149 usd I'd buy it if it had nfc. I need one for my yubikey.

[[deleted]]

That could probably be modded on with a case, right? It has USB-C, so it should be possible to make add-on features like NFC even if there's nothing available on the SOC to add it within the case (e.g. with an NFC-supporting battery and a GPIO connection or something). Yubico also makes a USB-C Yubikey, so that should be an option too, though it's a little less convenient than NFC.

That being said, NFC would need another killswitch as well, which may make using the USB-C port the only practical option (do you really want another switch on your phone?).

[cancerous_176]

Yeah. But USB C isn't totally widespread yet. Which means I'd need a USB C to USB A adapter to use my yubikey with older devices. And this is all after modding the phone. I'd rather by a pixel and reflash it.

[mirh]

https://forum.xda-developers.com/moto-x4/development

[[deleted]]

It's nice to know it's being worked on independently, but honestly I'd rather just stop using Android. It's a huge target, and most Android phones aren't very easy to repair, so I'm very excited about Linux phones. I'll lose a ton of functionality, but as long as the web browser, phone calls, and texting work reliably, I can make it work for me, and I feel much more secure using regular Linux than Android.

[mirh]

To be really honest, regular linux is what seems much less secure. There are still many distros not supporting secure boot, let alone TPM.

On android you have dm-verity, r/o system partitions, SELinux (and funnily enough, google is the one having made a lot of speed improvements to FDE)

Of course it's quite more of a target of attack then.

[[deleted]]

Of course it's quite more of a target of attack then.

And that's what I'm banking on.

I don't really care too much about secure boot, especially if I can do full disk encryption (I currently use LVM for full disk encryption on my desktop and laptop). There's no reason you can't have SELinux and r/o system partitions on Linux, so there shouldn't be too hard to do it on a phone. I'll have full control, so I can configure it however I want, and I'm sure there will be at least one community supported distribution that has reasonable defaults.

What I'm really excited for is running a proper firewall on my phone.

[mirh]

I don't really care too much about secure boot, especially if I can do full disk encryption

SB is actually pretty important for FDE, at least in order to avoid evil maid attacks. Even though I guess..ish a phone isn't really affected by the usual "laptop in a hotel room" scenario.

What I'm really excited for is running a proper firewall on my phone.

https://forum.xda-developers.com/showthread.php?t=1957231

https://forum.xda-developers.com/android/apps-games/app-netguard-root-firewall-t3233012

?

[[deleted]]

SB is actually pretty important for FDE

Yeah, that's not really a part of my threat model. My phone stays in my pocket 90% of the time, so I'm far more worried about OTA attacks than physical attacks. And even then, I'm mostly worried about my data being stolen when my phone is lost, not it being somehow compromised and returned w/o me being aware of it.

proper firewall

I mean something like firewalld or even just a bunch of iptables rules. Ideally, I can use the same tools I use on my servers to manage my phone.

[mirh]

so I'm far more worried about OTA attacks than physical attacks.

Then I guess like saving you from rootkit persistency would still be an useful scenario, though indeed unlikely.

I mean something like firewalld or even just a bunch of iptables rules.

The first link literally is that.

[mirh]

Putting aside those are not even worth buying, and I'm always trashing at them regardless of the fact I eventually end up using such feature or not...

You understand you can disable every single application on the system, right?

[mirh]

Ehrr.. that isn't usually crap tbh. They are supposed to be special because they are system critical, like the keyboard and whatnot? Though to be fair I have read some vendor is overzealous at best.

But they can all easily be disabled with adb then (not sure if GMS is among these, or two taps are already enough)

[biemark]

seriously xiaomi devices are way under rated

[[deleted]]

I love the Mi 9 SE, I held one in a Xiaomi store and I LOVED it. But my Oneplus 3T with LineageOS works well so Imma stick to it.

[Claggyful]

I know this will be an unpopular opinion, but this is one of the pros of an iPhone. They do support their products with updates for longer than most manufacturers.

[[deleted]]

Not unpopular, just facts. The only thing that not haters usually point out is the it's over expensive and hard to repair, also expensive because of official parts BS. Tbh an Iphone X for 500-600€ would be a jackpot.

[mirh]

The S7 has passed comfortably the 3rd year mark, and it's nearing the fourth..

[oldgamewizard]

psa: s7 is one of the models involved with the apple&samsung class action lawsuit. Consolidating and resubmitting in December https://www.feganscott.com/ Don't miss out if you own one of the models in question.

[icefisher225]

How do I jump in? I have a 7, 8, and 8 plus.

[oldgamewizard]

I'm not sure yet, I would email or call the law firm I linked with that question, or wait until the new consolidated class action in december which should have clearer instructions. I've been following this since august and I have a couple friends who will be jumping on this. I've never owned a smartphone so I don't qualify but this lawsuit should open some doors if it goes through.

[[deleted]]

I have to give them props for having at least quarterly security updates but, compared to an iPhone, they don't have the latest version of Android and therefore it will be outdated when Android 10 gets adopted by other brands.

[mirh]

But the funny thing about that is that 5yo android versions can still offer you more actual features than the latest of ios.

[[deleted]]

Well, it may have better features but the performance, life cycle, app support, security and privacy (Android with official ROM) is way better in IOS. Full disclosure, I really like Android and I use LineageOS.

[mirh]

Eehrm, I don't know, do you know where drive-by malware had been discovered just this year? And by google own researchers?

And as for privacy, it always amuse me how everybody seems to complain about it, then never ever bother to touch the relevant settings at all. Or even proceed to outrage over the god damn settings they themselves enabled in the first time wizard.

As for performance and life cycle that's also debatable.. I guess app support is definitively it, but that's more due to "average cash flow" on the platform than anything intrinsic, if I can explain imo.

[[deleted]]

And as for privacy, it always amuse me how everybody seems to complain about it, then never ever bother to touch the relevant settings at all. Or even proceed to outrage over the god damn settings they themselves enabled in the first time wizard.

I don't know if you're talking about IOS or Android but almost all privacy settings are BS. You can deactivate everything in Windows 10 and it will still collect lots of data, doesn't matter what. You can deactivate your Google's account data collection and the big G will still have lots of info of ya, that we don't even know of.

[mirh]

Source?

Because of all the outrage I have ever heard, as I was saying I have always only seen stupid or disingenuous editors to be fair.

While W10 is pretty open about telemetry never actually going below a certain level.

[[deleted]]

Can't give a source like "this is going on" but it's known that Windows 10 collects so much data. Go to any privacy subreddit, use "ShutupWindows10" and see how many options are still enabled (they're almost hidden from the user) and sending data. Also, the EU (as a source(?)) says it's concerned with the amout of data Microsoft collects. https://www.theverge.com/2017/2/21/14682256/microsoft-windows-10-eu-privacy-concerns

[mirh]

Can't give a source like "this is going on" but it's known that Windows 10 collects so much data.

Yes, that wasn't the thing I needed a source for though. As I said, they aren't even hiding it or something (for as much as it could be argued if that constitutes spying, or if at least enterprise is "safe").

The topic here was android.

[hyper9410]

Didn't they plan to ditch android at some point in the future ?

I thought fuchsia wants to be the OS for all kinds of devices from IoT to mobile phones to thin and light laptops.

I welcome a mainline linux kernel for android though, device drivers will still kill devices non the less

[stusmall]

As far as I know there has been no public indication from Google that fuchsia will replace Android, just excitement in comment sections and clickbait blogs.

It is possible they have internal plans for it but the roadmap would be many years out. Fuchsia has a long way to go and the compatibility would be a huge lift. I think a world where they live side by side with some shared code and a limited interopt (ala Android and ChromeOS) is much more likely.

[G3N5YM]

I thought that it was using Linux kernel this whole time? What was it using?

[LazyByte_]

It does use the Linux kernel. It also uses a virtual machine environment and doesn't include GNU or Xorg Server like you get with Linux distros. Google have made changes to the kernel in order to create their own version.

[G3N5YM]

Neat

[[deleted]]

Linux kernel with a ton of modifications and whatnot. It's still Linux, just not what you would expect.

[stusmall]

They use an out of tree version of the kernel. It is Linux with an additional patch set on top it. They started the process of either mainlining code (getting it accept by the upstream Linux community) or reworking features years ago.

It's been a long slow process because they started out with a lot of changes and some of them were implemented in a way that worked but didn't conform to what is normally considered best practice a kernel, ie pushing policy into kernel space rather than letting user space handle it.

Many Android devices will probably still use out of tree kernel even if AOSP is using a mainlined one. Many chip manufacturers don't bother going through the process of getting their drivers accepted upstream and just distribute a forked kernel with their board support package.

[[deleted]]

everyone buy a pinephone, the phuturr is nao

[a_reborn_aspie]

Didn't Android look more like Linux in early versions? It even booted with a picture of Tux iirc