Hacker News Reader

Comment by flakiness | Hacker News Reader

Huawei has "OS Kernel Lab" in their research division [1] and seems to do real research, including building an OS kernel. I guess they at least tried to ditch Android at a point.

I'm not supporting their PR strategy. Just interesting to see where a corporate research goes.

[1] https://www.google.com/search?q=huawei+OS+Kernel+Lab

View on HN

The Linux kernel is the singular decent component of Android.

On the contrary, the way Android forces security best practices, by allowing native code only to be used for implementing native methods, enabling all security mechanisms by default, use containerized applications and moving away from ossified POSIX APIs (except for what ISO C and ISO C++ require) are Android's best features.

Oh yeah, I forgot about how that fixed the malware problems on the platform.

Indeeed, it is wonderful when people install outside Play Store and keep giving permissions for everything on flashlight apps.

It doesn't matter where the users are getting the software when the threat model implicitly trusts the OS vendor and makes it difficult for users to install the OS themselves.

Android phones ship with malware installed as root often with no methods for removing it.

I don't consider OEM bundles malware, a practice that goes all the way back the early days of home computing.

https://www.mi6-hq.com/sections/games/james-bond-007-action-...

http://www.bambi-amiga.co.uk/amigahistory/bundles.html

So malware magically ceases to be malware as soon as it’s preinstalled by the vendor?

It wasn't malware to start it.

> computer software that is designed to damage the way a computer works

https://dictionary.cambridge.org/dictionary/english/malware

"damage the way the computer works" IMO that includes abusing or denying resources or services on the machine which is very common with preloaded stuff.

Also your definition doesn't capture spyware.

Congrats on reverting home computing back to the amiga days then.

I have walked into target, bought androids, pulled them out of the box and connected them to the network over which they would immediately proceed to download gigabytes of malware from the play store.

That is not malware.

> computer software that is designed to damage the way a computer works

https://dictionary.cambridge.org/dictionary/english/malware

As home computing being reverted back to the Amiga days, I really look forward to it.

PC, macOS, iOS, Android are devices with a soul, where hardware and software is designed in alongside each other.

Whereas GNU/Linux folks keep trying to put a PDP-11 sh into a mobile phone.

Meh, at this point I'll take a pdp-11 sh on my phone (I use ash actually.) At least it does what I tell it to do unlike most of Android.

Let's not pretend that the Play Store is malware-free. Or that the Android permissions model is flawless.

It is definitely better than default GNU/Linux installations.

It's definitely not. I'm certain I can install and use tools like git on a fresh GNU/Linux install. I can't say the same about Android.

That is completly unrelated to security.

But just to tease your goal post move action, 99.9% of people using Android don't care about using git on their phones, and even if they would.

https://play.google.com/store/apps/details?id=com.aor.pocket...

If you only bother with what software people care about why allow installing code outside of the browser? That would much more effectively eliminate security vulnerabilities.

Indeed, https://www.google.com/chromebook/chrome-os/

Ok, well now I can't do most of the stuff I was doing on GNU/Linux without doing it on a machine that someone else is hosting. So that's still a step backward.

https://play.google.com/store/apps/details?id=com.aide.ui&hl...

Want a GNU/Linux phone? Buy Openmoko, or any other commercial failures that followed them.

Is that an admission that it makes sense?

No and is completly irrelevant for the subject of security being discussed.

It's relevant because when I go to use git on android and iOS I go hunting through the play store and download some closed source wrapper around it, often with libraries that the developer pulled in that they don't fully understand the behavior of.

By dramatically raising the cost of software maintenance (by decreasing interoperability and because of the heavy API churn) these systems make community maintained software rare which forces users to turn to organizations that are unwilling (and sometimes unable) to share information with their users.

The resulting security situation is dire.

What? Point me to a single piece of malware in any major distro's repositories; I'll wait.

I'm certain stuff slips through occasionally, there's the random number generator "bug" that made it into debian a decade or so ago. The rate is fantastically lower than pretty much anything else though.

Software most humans care to use on GNU/Linux isn't part of distro repositories.

curl | sudo sh rulez!

Most of it really is.

When you need software that isn't well supported by your OS you're always going to have to apply some degree of care and research. Thinking that any degree of sandboxing or API re-arranging will ever make flinging binaries around safe is extremely naive and counter productive.

Was. https://news.ycombinator.com/item?id=27280567

Technically, “was” is wrong because the new Nest Hub doesn’t run any part of Android. These are Flutter apps targeted specifically for Fuschia. There’s no evidence yet that they will run Android on top of Fuschia.

They are actually working on porting the Android Runtime (ART) to Fuchsia. [1]

[1] https://android.googlesource.com/device/google/fuchsia/

Thanks for the link.

Nah, it’s the greatest security vulnerability of the platform.

Reply on news.ycombinator.com