Conversation

This Tweet was deleted by the Tweet author. Learn more
Daniel Micay
@DanielMicay
Non-Pixel devices also don't have comparable security at a firmware and hardware level. It can't be addressed with another OS. Also, only Pixels (and the Nexus 5X / 6P before them) support all the hardware security features like verified boot with alternate operating systems.
1
This Tweet was deleted by the Tweet author. Learn more
Daniel Micay
@DanielMicay
You should be avoiding Android as a whole if you think they deliberately put in backdoors, because backdoors can be hidden in open source code as bugs. The same applies to other software where Google plays a substantial role including the Linux kernel and many other projects.
1
This Tweet was deleted by the Tweet author. Learn more
Daniel Micay
@DanielMicay
It's worth keeping in mind that desktops and laptops have similar issues. They have huge numbers of components, many with their own complex firmware like HDDs/SSDs, Wi-Fi, etc. It's even rarer to have proper firmware updates on those than phones.
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
AOSP offers much better privacy and security than a traditional operating system without a strong security model and strong exploit mitigations too. LineageOS hinders some of that, but most is still intact. Most devices not having full security updates is a huge issue though.
1
This Tweet was deleted by the Tweet author. Learn more
Daniel Micay
@DanielMicay
Having the AOSP security updates doesn't mean you're receiving most of the critical security vulnerability fixes. A disproportionately large number of the security issues are in device-specific code, lots of it closed source. Having most fixed wouldn't really help much anyway.
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
An attacker doesn't need hundreds of vulnerabilities available, although there are hundreds of serious unfixed vulnerabilities after a year of not receiving updates from the vendors and only applying AOSP security fixes and upstream kernel fixes (and the latter is not a given).
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
For example, vulnerabilities in the GPU driver can often be exploited from a web browser. A vulnerability in audio / video handling can be even more exposed. These areas involve huge amounts of closed source vendor code in driver libraries / firmware requiring updates from them.
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
There's a lot of open source code that's device-specific and needs security updates. Lots of it isn't included in AOSP. Devices also use a specific kernel branch to implement drivers and it requires proper maintenance. However, upstream (kernel.org) drops support.
1
Show replies
This Tweet was deleted by the Tweet author. Learn more
Daniel Micay
@DanielMicay
I find it a bit frustrating that many people are misled into thinking the problem is solved for them because they have security updates for one part of the system (AOSP components) via a custom ROM. I wish LineageOS and others would set the security patch level accurately.
1
Show replies