Hacker News Reader

Comment by digi_owl | Hacker News Reader

> android.permission.WRITE_MEDIA_STORAGE

Oh how what a mess the intro of this one was.

Over night Android went from a potential production platform to a straight media consumption platform, as now only system apps could write to removable storage.

View on HN

Since nobody pointed it out yet: that change was done for security reasons, not due to a political conspiracy. Media access was a big hole in the otherwise fine-grained permission model.

Your camera app used to be able to access your WhatsApp backup folder and your documents. It was just a flat file system. Developers would request the permission even though all they needed was a caching folder or something, but they could read and upload all of your documents, too.

This change, while breaking a bunch of applications until they migrate to the new fine-grained API, was a necessary one.

Unix 40 year old permission system is enough to deal with this, this is no excuse.

The hard part is the user interface, not the backend. The application needs to invoke a privileged UI where the user can choose which files or directories the application may access.

(many storage media are formatted using FAT, so the media API is probably not implemented using Unix permissions)

I'm talking of allowing apps to mark things (like the WhatsApp data previously mentioned) to only be accessible by itself or some other app(s).

As for FAT, I said in another comment that Google has already imposed MTP on us and Android's adoptable storage uses ext4 anyway, so they could easily require it on all removable storage where application data is stored.

As far as I understand, media was (is?) stored on sdcards, which uses (can use) FAT, which has no permissions support.

It uses ext4 on the mixed mode (which incorporates it as system memory), but it should require ext4 for sd cards as well. They cut off USB mass storage support so they have already crossed that line.

That was about whatsapp doing a major goof and putting private files in a "public" area (every app already had a private area for file storage) and failing to secure them properly (encryption is hard, apparently).

WhatsApp messed it up particularly bad, but it's not the only example. The point is that there was no private access to the SD card. If you had large files that did not fit on the internal storage, using the shared external storage was the only alternative. Developers abused that and ended up putting all sorts of private data on the SD card.

Lets try to not confuse "external storage" (effectively a partition on the emmc, but mounted under /sdcard for legacy reasons) and an actual SD card.

Removable storage, SD, USB, etc, was moved from external_storage to media_storage with Android 3.1.

Note that external_storage was still about putting files in an area readable by any and all apps that had read_external_storage permission.

In other words, the change would do jack all to safeguard against idiots like the whatsapp app devs.

> The point is that there was no private access to the SD card.

Sure there was! Simply generate a random key, store it in the (small) private storage area, and use it to encrypt whatever you want to write. Instant private area!

What about using the post-kitkat Storage Access Framework and adopting the user-granted permission to access removable storage? That is, once your user manually grants access to a file or directory (in android 7) using the file/directory picker built into Android, your app can keep that permission for later and use it whenever it wants.

http://developer.android.com/guide/topics/providers/document...

They also made a video explaining how it works:

https://www.youtube.com/watch?v=C28pvd2plBA

Info about scoped directory access in Android 7.0:

https://developer.android.com/training/articles/scoped-direc...

Incidentally I didn't see READ_EXTERNAL_STORAGE or WRITE_EXTERNAL_STORAGE in the list.

I have some bad experiences with mediastorage (the core of SAF) getting the state of the FS royally confused. Various apps used that path even before SAF, because it is also the backend for the Media Transfer Protocol support.

Thing is that SAF only arrived with 4.4, and didn't properly handle anything more than single file access until 5.0. The the write_media_storage permission was introduced in 3.1. Thats some 5 releases and 2 years of goofing around before they sorted their own mess.

Oh and the external_storage permissions where there initially, but they seem to have edited it since in an effort to clear out some non-Android stuff.

Yep.

This is why I absolutely won't consider any Android devices in future. The hardware's been admirable, particularly with a folio-style case and bluetooth keyboard. Great battery life. The display is limited, but the best as can be hoped for.

But the limitations on what I as a user can do drive me bloody bananas.

It's a very short drive, and an entirely uninteresting challenge.

Google, Samsung, and Logitech specifically have fucked this up hard and irretrievably.

Android is still the (mainstream) mobile operating system which gives you the most freedom. What are you going to use instead? iOS?

This is not a hostile limitation - it's a backwards-incompatible API change that the ecosystem hasn't fully adapted to.

Quite honestly: nothing within the "mobile" ecosystem.

A laptop running Linux. The mobile world isn't ready for non-trivial use. May never be, though I'm watching Ubuntu's progress.

Agreed then. I'm a developer and I can't see myself developing on a mobile phone operating system anytime soon. But I still like my Android phone for taking notes, pictures, syncing PDFs and reading my mails.

It's just two different use cases and different security/freedom tradeoffs. Not sure if I'd call Android a general purpose operating system.

I learned programming with JRuby SL4A on my smartphone. I can't imagine anyone doing this today. Gingerbread is without a doubt my favorite Android version. You had so much freedom back then!

https://github.com/damonkohler/sl4a

That's a great point. Thinking back to the introduction of iOS and Android, iOS was appliance-like in that it was tailored to one use case (phone), while Android felt like a general-purpose OS that just happened to run on a phone.

As you point out, the benefit of Android was never quite taken advantage of.

However, Google's upcoming Android laptops will hopefully push the issue to the fore. It would be amazing to have a more powerful alternative to iOS on the iPad Pro, more powerful in ways we notice everyday, rather than just being more powerful on paper.

The sad thing is that back when 3.0 (Honeycomb) shipped, most of the 10" or so Android tablets included a full size USB-A port. But then came 3.1, and the introduction of the above permission, and basically the major selling point of said port evaporated (i have a Toshiba Thrive sitting here that i basically shelved after said change).

If we observe Windows tablets, with the MS Surface at the forefront, many of them come with a easily accessible USB-A port (I recall Gigabyte tried to sell a tablet that came complete with a ethernet port even, but i think that series has since been discontinued).

What worries me is that Google introduced this change to placate big media. Because around the same time they made the big announcement that people could now buy movies and music via the Android Marketplace (later renamed Google Play).

What advantage does a A-port have over the current micro ports in a tablet? And now the new C port is slowly gaining more support, I bet the A-port will slowly vanish completely, or am I missing something here?

USB-A port = no fiddly adapters etc.

Counter-intuitively, those big fat USB-A sockets have a much lower minimum-cycle specification compared to Micro-B or USB-C ( 1500, 5000 and 10000 respectively ).

So the tiny, fiddly ports are more robust.

Don't worry, i'm sure folks would have also complained had they stuck with those ports and they broke.

> Toshiba Thrive sitting here that i basically shelved after said change

You can access your media if you use a file explorer and media player which support the new API.

> If we observe Windows tablets, with the MS Surface at the forefront, many of them come with a easily accessible USB-A port

And all of the applications running on it can access all of your media. Life is easy when there's only one single flat security domain.

https://xkcd.com/1200/

It's not to placate big media, but to increase security, as others have pointed out.

But the bigger point is that I don't think it's just the USB port that limited Android's flexibility. Android was supposed to be a more flexible, more powerful iOS. That didn't play out in ways the average end user cares about.

> Android felt like a general-purpose OS that just happened to run on a phone.

And that was its big issue. They used the firmware model for a general purpose OS. This keeps Android from having the simple install models we've come to expect with Windows/some Linux distros/MacOS. I wrote a thing on this a while back:

http://penguindreams.org/blog/android-fragmentation/

Note that Chromebooks are similar (and Android 7 adopts the update strategy of ChromeOS). There you have two system partitions, one in use and one on standby. A system update gets applied to the partition on standby, and on next reboot it becomes the used partition (unless the boot is deemed faulty).

BTW, event thought Chromebooks gets updates all the time the kernel and drivers are the same one as when they originally shipped. This means that older Chromebooks will not be able to run Android apps, as it is done using kernel provided containerization.

Does every vendor have their own image, or is there one universal image for chrome laptops? If it's the former, can you just put a stock image on it, or does each vendor embed their drivers?

Dunno. I guess you could look through the project site and see if they have more details.

https://www.chromium.org/chromium-os

Every device has its own kernel and drivers, which is signed and verified. See:

https://www.chromium.org/chromium-os/chromiumos-design-docs/...

If you can unlock your bootloader, you can build your own version of chromeos and the kernel, but trust me, it's not as good. You'll have a chromium-based OS, not chrome based-- it's a lot like the difference between Chromium vs. Chrome in Linux, only affecting the whole OS.

I haven't done it in a few years, but I imagine that with the Android integration, even if it builds, you'll have more of a stock AOSP experience sans any Google cloud features. Good for freedom and privacy, but if you're bothering to replace the OS like that actual Linux may be a better call.

But if you go for standard Linux, you may run into issues with hardware support, especially graphics acceleration... just sayin'. The closed-source graphics drivers written for ChromeOS may not play friendly with Xorg or whatever.

Aside from potential issues w such blobs, I don't see any reason you couldn't unlock the bootloader and try updating your own kernel...

Yea I know a few people who attempted open-source (mostly; drivers are still usually closed) phones sans Google/Amazon stores and services. They'd use F-droid/K9-mail/OpenStreepMaps/OwnCloud, etc. They mostly work, but you do lose a lot of the android ecosystem. One of my friends gave up after a year and went back to the Play Store/Gapps because she started writing her own Android apps to make up for what she was missing and just didn't have the time for it.

I didn't realize ChromOS was in the same boat. That's really shit. In traditional Linux, a lot of drivers get merged right into the tree. Even for proprietary drivers/blobs, we have linux-firmware. For the most part, the initrd files on Arch/Debian/Ubuntu can load a lot of modern hardware.

I wish Google Android/Chrome devs would get their shit together and stop this individual build madness. An initrd full of drivers and linux-firmware do not take up that much space, and many phones now have the footprint of tiny laptops vs the old <8GB tiny flash roms.

Google wields a heavy hand with their (no-so-)open handset alliance (OHA). They can get manufactures to at least commit their blobs to a standard google-firmware package and keep a fork of their Kernel that builds all major drivers into a standard initrd package. Manufactures could always strip out all the crap for their custom ROMS, but this would allow AOSP to just run, out of the box, like Windows 10 or Ubuntu, on a large chunk of hardware.

Google's decisions in Android structure feel asinine.

I think it's not so much as the vendors of the graphics card and such that only released closed blobs to go with the open drivers in the kernel. And while they may work with say, ChromeOS, getting them to work on Linux isn't as straightforward. Android has a similar issue, though most of the time people aren't jumping from Android to another OS..

Are you sure about that? I've got a Samsung chromebook (Snow) from about 3 years ago, and yet...

     localhost / # uname -a
     Linux localhost 3.8.11 #1 SMP Mon Sep 26 02:48:53 PDT 2016 armv7l ARMv7 Processor rev 4 (v7l)
     SAMSUNG EXYNOS5 (Flattened Device Tree) GNU/Linux

Recently built kernel. Unless things have changed from a few years back (when I last played with it), there are multiple (3) kernel partitions in ChromeOS:

https://www.chromium.org/chromium-os/chromiumos-design-docs/...

...and you can manually select between them by using the "cgpt" command from the shell:

So on an ARM device, you could say:

     sudo cgpt add -i 6 -P 5 -S 1 /dev/mmcblk0

If I'm not mistaken, this would mean to set partition 6 (a kernel) with a priority of 5 (compared to other partitions at boot), successful flag set to 1 on mmc block device 0-- (the internal mmc, where mmcblk1 is the external sdcard). I think if that kernel fails, that flips the successful flag to 0 and it falls back to the next priority kernel on the reboot. But like I said, it's been a while so don't quote me.

See more here: https://www.chromium.org/chromium-os/chromiumos-design-docs/...

Also, if you weren't aware, to get into the shell:

     ctrl-alt-T
     shell
     sudo bash
     cgpt --help

if you play with cgpt, be VERY careful. Also, if you're thinking of replacing kernels or whatnot, be aware that on most (all?) devices, the partitions are signed, so you'll have to turn off any checks first.

Well it was Google's excuse for how only certain Chromebooks of a recent vintage would be getting Android app support.

Maybe they meant the major version number of the kernel wouldn't get an upgrade, though I suspect maybe performance/memory limitations are the real issue. It may be possible to backport whatever features are missing to an older machine's kernel and see...

Agreed, but my point was intended more in terms of what apps can do. Full access to USB, multitasking, users can install apps outside Google Play, a variety of hardware rather than just one or two models Apple deems good -- all these are advantages of Android when it comes to tablets, laptops or other devices to get work done. But the ecosystem hasn't evolved to take advantage of these, so the benefits are lost.

Reply on news.ycombinator.com