Hacker News Reader

Comment by kllrnohj | Hacker News Reader

It's worth keeping in mind which vendors are being talked about here.

Treble fixes the problem of "manufacturer who didn't do any customization can't update because Qualcomm never updated their drivers & friends" by ensuring that the level that the Qualcomms, Nvidias, etc... build against is forwards-compatible. So small manufacturer can just take a new android source drop from google and plop it on top of the binaries they originally got from qualcomm or whoever and tada! done.

It doesn't help with the "OEM injected so much 'customization' that it's a disaster to move forward and will forever be abandonware"

View on HN

If only a project existed to support devices beyond what the original manufacturers were willing to put out with singular consistent releases across all hardware.

Oh yeah, Lineage.

If only the company that made the OS actually supported the effort to perpetually support devices with a single OS the way Android should have been from day 1.

The problem is that you have to trust Lineage's (just an example) developers and release process. If you want Google Apps installed you need to trust another 3rd party like http://opengapps.org or https://microg.org/.

At this point I'm not so sure what's better: an updated OS or one full of known exploits.

Why wouldn't they be trustable? You always have the option of building it yourself. (disclaimer, I'm one of the leads & run their infrastructure)

Like I said, it was just an example. I don't have the time or knowledge to review an entire custom ISO and after that another ISO from the Gapps provider that I choose. I'm sure there are some tricks to cut down the review process time but anyway.

It's a trade-off. I'm installing custom software to improve security, but at the same time, can I trust that this solution won't be a source of malware?

I hope this didn't came out as accusatory, I was just trying to show another aspect of using custom ROMs.

It didn't - I'm mostly curious what people's thoughts are on things.

For what its worth, the mirror selection software we're using [1] won't send you to a mirror that has a modified file. If a mirror is doing something malicious (and that doesn't catch it), builds are signed and can be verified [2]. Obviously there's some level of trust involved (build infrastructure isn't auditable, android builds aren't reproducible).

[1] https://github.com/etix/mirrorbits [2] https://wiki.lineageos.org/verifying-builds

I think you're the only one that got it. If the goal is to be able to update the Android OS without the carrier or device manufacturer having to do any work, the CTS would no longer be necessary because Google would control everything that the CTS tests.

Reply on news.ycombinator.com