Nexus devices will receive regular OTA updates each month focused on security

[scary alien]

Don't think I've seen this posted here yet (lemme know if so)...

"From this week on, Nexus devices will receive regular OTA updates each month focused on security, in addition to the usual platform updates."

From http://officialandroid.blogspot.com/2015/08/an-update-to-nexus-devices.html:

Spoiler: Full article text

Posted: Wednesday, August 5, 2015

Security has always been a major focus for Android and Google Play: Android was built from day one with security in mind.

For example, the “Application Sandbox” model keeps applications running separately from other apps and the rest of the device to keep your data safe. With Verify Apps, over 1 billion devices are protected via Google Play, which conducts hundreds of millions of antivirus-like security scans of devices per day seamlessly in the background. Also, Android is open source so that anyone can comb through the code to identify and address potential security risks, which makes the platform stronger. In fact, the Android Security Rewards Program financially rewards security researchers who invest their time and effort in helping make Android more secure.

We believe the combination of these approaches has led to there being fewer than 0.15% of devices with any kind of potentially harmful app installed, as long as apps were installed from Google Play. (See more of our research.)

An additional approach to further increase the security of Android users involves updates to the device software. For the past three years, we have been notifying Android manufacturers every month through bulletins of security issues so that they can keep their users secure.

Nexus devices have always been among the first Android devices to receive platform and security updates. From this week on, Nexus devices will receive regular OTA updates each month focused on security, in addition to the usual platform updates. The first security update of this kind began rolling out today, Wednesday August 5th, to Nexus 4, Nexus 5, Nexus 6, Nexus 7, Nexus 9, Nexus 10, and Nexus Player. This security update contains fixes for issues in bulletins provided to partners through July 2015, including fixes for the libStageFright issues. At the same time, the fixes will be released to the public via the Android Open Source Project. Nexus devices will continue to receive major updates for at least two years and security patches for the longer of three years from initial availability or 18 months from last sale of the device via the Google Store.

Security continues to be a top priority and monthly device updates are yet another tool to make and keep Android users safe.

I like this other than it will be more difficult to take the monthly OTA whilst rooted...

 

[EarlyMon]

Yeah, Nexus, Samsung and LG have chimed in on that so far.

http://androidforums.com/threads/stagefright-vulnerability-disable-mms-auto-download.932588/

 

[scary alien]

Ah, thanks, EM...EP's post was too new for a Google search to have revealed that .

Any merit to keeping this discussion here / separate?

 

[EarlyMon]

Not sure.

Google has not been as focused on Stagefright per se in this because most of blogosphere has the issue wrong but is making the opportunity to upgrade security protocols and thereby influencing others to do the same.

Sounds like a separate topic in its own right yeah?

 

[scary alien]

Not sure.

Google has not been as focused on Stagefright per se in this because most of blogosphere has the issue wrong but is making the opportunity to upgrade security protocols and thereby influencing others to do the same.

Sounds like a separate topic in its own right yeah?

Yeah, maybe they've (Google) simply chose the "Stagefright vulnerability" as a kicker to roll-out what they might have had in the works (or at least on the shelf)...dunno.

To me, a monthly OTA will make keeping root almost impossible (or at least a real pain in the butt)--depending on the makeup of the things done in the updater-script, of course.

Re. keeping this as a separate thread: we can always merge / move later, of course .

 

[iowabowtech]

To me, a monthly OTA will make keeping root almost impossible (or at least a real pain in the butt)--depending on the makeup of the things done in the updater-script, of course.

Imagine being the su binary maintainer. Keep up the good work Chainfire old pal?

 

[SavageRobot]

Do you think if they are clamping down on security, and obviously rooting may be a security risk, we might see Android going more "closed source", or is that, as I hope, just a wild stretch and they will see that is one of the many reasons people choose android?

 

[EarlyMon]

Do you think if they are clamping down on security, and obviously rooting may be a security risk, we might see Android going more "closed source", or is that, as I hope, just a wild stretch and they will see that is one of the many reasons people choose android?

Anything is possible.

There's rooting and then there's rooting.

I don't find that a proper root is a security risk - although I recognize that is a popular meme thanks in no small part to irresponsible users.

 

[SavageRobot]

Well no, rooting, as far as my limited technical knowledge goes, isn't really a security risk in itself, just dependant on what the user does with said rooted phone. And being rooted you can become more of a security risk to others if you were that way inclined, being able to hack other people using WiFi to take passwords etc for one and spoofing IP whereabouts etc and ability to bypass payments and the like on markets. I just worry we could be heading down the road to iPhone...

 

[Crashdamage]

Android cannot go closed source. It was issued as open source from the beginning. Once opened, you can't put open source back in a closed source bottle. So let's just put that away.

As for rooting and security, I'm one of those who considers rooting to have fairly serious security problems. Some even consider just unlocking the bootloader a security problem. Agreed the clueless, irresponsible rooters are the real risk in rooting. Rooting by competent, careful users certainly carries much less risk. Like I always say, the biggest threat to Android is Android users.

IMHO the biggest advantage to doing monthly security updates won't be an actual increase in security. It will be the public's *perception* of increased security and attention being paid to it. An general palcebo effect.

 

[EarlyMon]

IMHO the biggest advantage to doing monthly security updates won't be an actual increase in security. It will be the public's *perception* of increased security and attention being paid to it. An general palcebo effect.

Lmao!

I said that exact same thing on Discus in a Phandroid article - and was basically told that I must be new here and didn't understand maintenance.

http://phandroid.com/2015/08/05/lik...-security-updates-for-select-android-devices/

 

[scary alien]

Android cannot go closed source. It was issued as open source from the beginning. Once opened, you can't put open source back in a closed source bottle. So let's just put that away.

Amazing article on Android Fragmentation Visualized.

Basically there are currently 24,000+ unique ("distinct") Android devices out there and only a tiny portion of those will see regular updates (i.e., they're not "current" or Nexus devices that are likely to have security (or any) OTAs pushed out to them).

At the very least, maybe we'll start to see a paradigm change in how the manufacturers / carriers "maintain" their devices going forward...(maybe...).

 

[EarlyMon]

I think that already started long ago with system apps getting fixed with Play Store updates. Correct me if I'm wrong but I believe that the original Moto X lit the way on that.

The great WebView Scare of 2014 led to Lollipop decoupling it from the core and updating it via the Play Store as well.

During that scare, the blogosphere was all over how the only possible solution moving forward would be monolithic manufacturer updates.

Also during that scare, initial reports said it covered all Android going back to Froyo - by analysis and deduction. And we proved right here in the forums with crowd testing that wasn't true.

The blogosphere was wrong then on all counts.

See where I'm going with this?

I'm all for the utopia of critical security updates in a timely manner.

I think that it can be achieved.

I don't think that placebos are the answer.

I'll be back.

 

[Crashdamage]

Just to be clear, I wasn't saying I'm against monthly security patches. I'm all for it, I think it's way overdue. I'm just saying that from a public relations point of view, the placebo effect of getting a monthly dose of security pills is more important than the actual increase in security. The monthly dose of security will change public opinion of Android and security.

The blogosphere, spewing the latest "news" as usual to gullible readers, will gush over the monumental security improvement and how they were right all along and it's about time manufacturers listened to them and how important they were in forcing manufacturers into doing something about it.

Oh well. Let them have a moment. If it increases the placebo effect on the public that's good for Android.

IMHO, Android was always a secure OS. It's nice that there's gonna be more attention paid to security, but not a big deal.

 

[EarlyMon]

No, I know that on the surface that may have appeared that I put that on you - but it's more like we're saying the same thing two different ways.

We both want regular security updates.

We both have doubts over whether a system designed due to a press reaction, rather than a proactive, fully engineered approach, will be free of placebos and full of security.

On that basis, I claimed that we both said the same exact thing on placebos and what the caution ought to be on expectations right now.

 

[Crashdamage]

Agreed. We should hum 'We Are the World' in harmony...

 

[scary alien]

Just to be clear, I wasn't saying I'm against monthly security patches. I'm all for it, I think it's way overdue.

No, I know that on the surface that may have appeared that I put that on you - but it's more like we're saying the same thing two different ways.

(LOL, I love that commercial )

 

[EarlyMon]

Lmao I've never seen that before!

 

[EarlyMon]

We need to put this somewhere -

http://phandroid.com/2015/08/07/certifi-gate-mobile-security-threat/

Check out "Certifi-gate Scanner"

https://play.google.com/store/apps/details?id=com.checkpoint.capsulescanner

I've never seen that much eye candy before.

After it tells you that you MAY be vulnerable, you can get more information - by requesting the report after giving your personal details.

Today's story includes no threat details -

- no scope of users affected
- no details on what can go wrong
- no details on how it works
- no opportunity for independent analysis
- no details about risk mitigation

I for one hope to see this fixed in the next 30 days.

CBS said it's news.

 

[zuben el genub]

I'd say I'd want security only updates without any other "it's good for you, it's good for us, " or trial anything added.

 

[scary alien]

I'd say I'd want security only updates without any other "it's good for you, it's good for us, " or trial anything added.

^^^ +1!

Yeah, kind of like the optional updates you get in Windows--you CAN install them, but you're not forced to...

 

[zuben el genub]

Apparently on 10 you get them whether you want them or not. The business software (Enterprise) can delay. Whole load of complaints.
I'm sticking with Mint, 7Pro and OFFLINE XP. All Windows has to do is run legacy and craft software plus older Adobe products. Windows 10 is also getting pounded over privacy. Wifi sharing with your contacts is drawing a lot of ire. All this will be fixed or someone will find a workaround eventually

With MS wanting or allowing access to android:
http://www.digitaltrends.com/mobile/windows-10-can-almost-run-android-apps/
Nonsense or whatever, I don't want any part of stuff to accommodate Windows on my Android if I can help it.

 

[Slug]

I'd say I'd want security only updates without any other "it's good for you, it's good for us, " or trial anything added.

As the quoted blog release states,

Nexus devices will receive regular OTA updates each month focused on security, in addition to the usual platform updates

 

[EarlyMon]

From the Placebo Department -

http://blog.exodusintel.com/2015/08/13/stagefright-mission-accomplished/

How soon will the media run this when there's a new Samsung to talk about?

I'm tipping Android Police and Phandroid, let's find out.

 

[Crashdamage]

You're new here aren't you? You just don't understand maintenance.