Monthly Archive:: July 2014

Dan Goodin, at Ars Technica, is writing about a security flaw in Android. It's got all the usual scary-scary language about doom and gloom, quotes from antivirus peddlers, and it wasn't long until sensationalist Apple site AppleInsider took it all one step further (relevant). So, is this a real security threat, or are we looking at sensationalism run amok?

This is the issue in a nutshell.

Sounds serious! Should you be worried? Is it time to stock up on canned beans and switch to a Nokia 3310? Of course, it's always time to switch to a Nokia 3310, but not really because of this "issue". Buried deep within the Ars Technica article is Google's response to the issue.

First, a patch been sent to OEMs and AOSP, but with Android's abysmal update situation, this is a moot point. The crux, however, lies with Google Play and Verify Apps. These have already been updated to detect this issue, and prevent applications that try to abuse this flaw from being installed. This means two things.

First, that there are no applications in Google Play that exploit this issue. If you stick to Google Play, you're safe from this issue, period. No ifs and buts. Second, even if you install applications from outside of Google Play, you are still safe from this issue. Verify Apps is part of Play Services, and runs on every Android device from 2.3 and up. It scans every application at install and continuously during use for suspect behaviour. In this case, an application that tries to exploit this flaw will simply be blocked from installing or running.

As a sidenote, you can actually disable Verify Apps, but unlike what some people seem to think, the dialog you get about sending data to Google when trying to sideload an application has nothing to do with this (that dialog just covers sending data about the application to Google, which is not required for Verify Apps to work). To actually completely disable Verify Apps, you need to go into the Google Settings application (or the Android settings application in 4.2 and up), navigate to Security, and disable it from there.

To get back to the matter at hand: this means that every Android user with Google Play Services is 100% protected from this issue. The only way an Android user can potentially be affected by this issue is if she, one specifically allows installation from unknown sources, and two, specifically disables Verify Apps - all accompanied by several warnings. Luckily, not a single application in or outside of Google Play is currently trying to exploit this issue.

While one can expect sensationalist nonsense from a site like AppleInsider - you don't blame TMZ for reporting on a fart by Miley Cyrus; you don't blame AppleInsider for spreading sensationalist nonsense - I'm very disappointed that a respected site like Ars Technica resorts to spreading this kind of fear, uncertainty, and doubt, especially since this isn't the first time the site has done so.

Recently, it has become very clear that the security industry - antivirus peddlers and similar companies - have focussed all their attention on Android, resorting to all sorts of dirty tactics to scare unsuspecting users into buying their useless software. Since I can't stress this often enough: do not install antivirus on Android (or iOS, for that matter). It is not needed in any way, shape, or form.

This is not the first time they have tried to spread and exploit fear, uncertainty, and doubt. Back when Windows started properly shoring up its security, Microsoft released MSE, and the mass infections of the early XP days became a thing of the past, they tried to use the exact same tactics to try and scare the rapidly growing number of OS X users into buying their junk.

I advocated against this practice then (more here), and I will advocate against it now. When you come across stories like this, you can almost always assume it's FUD, whether it covers Android, OS X, or iOS. They almost always originate from antivirus peddlers, who know full well that operating system security - on both desktop and mobile - has increased so much these past decade or so that their core business model is at stake, and as such, they have to drum up the FUD. I just wish respected websites would not dance to their tunes for clicks.

And yes, you should totally get a 3310.

The technology press and bloggers really seem to have no idea what to make of Tizen. First, it was a huge, credible threat to Android (*), but now that even people who really, really, really want to see Android in trouble can no longer maintain that Tizen is a serious threat, it's now apparently magically a sign of Samsung's weakness. Or, if you believe Reuters, it's a sign of... Both? Or something?

Of course, those of us who have even a minute understanding of what it takes to create a successful and viable operating system and platform know full well just how unrealistic it is to see Tizen as anything but a fringe experiment that will, in all likelihood, never bear any fruit. You can ask BlackBerry and Microsoft just how hard it is to create, introduce, maintain, and grow a mobile platform in the current Android-iOS duopoly.

I would love for Tizen to be a success, but the cold and harsh truth of this world is that all evidence - both historical and current - points towards it not making any headway whatsoever in smartphones and tablets. Tizen may very well play a role in Samsung's more embedded efforts - like TVs - but don't expect it on any serious phone any time soon, let alone it being a threat to iOS, Android, Windows Phone or even BB10.

However, I want Tizen to be a success not because of some hand-wringing desire to see iOS or Android or Google or Samsung stumble and fall. No, I want it to be a success because the market - and thus consumers - always benefit from choice. The more platforms compete for that precious space in your pockets, the better all of them will become. Without Android, iOS would still be stuck at the level of version 2. Without Windows Phone, Android would still look like a cartoon. Potential other platforms would push the big three to even greater heights.

I've made my desire to buy a Tizen device very clear. Not because I believe it will change the world or because I consider it an "Android killer", but because I believe diversity in the marketplace benefits us all - whether we're an iOS, Android, or BeOS user.

Antivirus peddler Trend Micro recently issued a "report", in which it states that "Google Play populated with fake apps, with more than half carrying malware". Sounds scary, right?

Well, reality is a little different, as TechRepulic and Android Police found out.

As I've been saying for years and years now, antivirus peddlers are the scum of the technology industry. These people actively lie and spread FUD about popular platforms just to scare people into buying their crappy, bloated, unnecessary software. They tried these scummy scare tactics for OS X, iOS, and recently it's been Android's turn. Of course, it doesn't help that people like Tim Cook actively join in on the lying and FUD.

You can spot the FUD from miles away. It usually contains something like "99% of all mobile malware targets Android", which may technically be true, but is actually entirely meaningless without the figure that actually matters: infection rates to determine just how successful this malware actually is. The actual infection rate figures make it very clear that they are, in fact, not successful at all. Another dead giveaway that you're dealing with antivirus FUD is " is insecure. Buy our software to make it secure".

Android is just as secure as iOS. The figures are out there for all to see. Any time you see articles about reports regarding Android's security, you can be 100% sure it's coming from antivirus peddlers, meaning the figures will be contorted, false, manipulated, or just downright made up. These people are not to be trusted. If you still haven't learned that lesson, you are either stupid, or you have an agenda to push.

I'm lucky. My financial situation allows me to buy several phones and tablets every year to keep up with the goings-on of all the major - and some of the minor - platforms currently competing for prime real estate in your precious pockets. It also means that I am lucky from a psychological point of view - by being able to buy several devices every year, I never fall into the all-too-common trap of choice-supportive bias. I don't have to rationalise my device purchases after the fact, so I won't have to employ all sorts of mental gymnastics to solve any states of cognitive dissonance caused by hardware and software flaws - the number one cause of irrational fanboyism.

And so, I try to rotate my phone of choice around as much as possible. I enjoy jumping from Android to my N9, then onwards to Sailfish, back to Android, and then have some fun with Symbian on my E7 - and beyond. I've got a long list of platforms I want to add to the collection - one white BlackBerry Passport please - but in general, I'm pretty well-rounded.

Yesterday, former Google-executive Hugo Barra, now Xiaomi's global vice president, had a talk with The Verge.

This morning, John Gruber:

Hilarious.

Advertising companies will become increasingly... 'Creative' to find some way of tracking us that circumvents known laws and technological barriers. However, I doubt you have to worry about the small fish - worry about what the biggest internet advertising company in the world has cooking in its labs.