Monthly Archive:: November 2017

More than 1 billion Android devices run outdated software

This is horrifying:

But even with the data we have, we can take a guess at how many outdated devices are in use. In May 2017, Google announced that there are over two billion active Android devices. If we look at the latest stats (the far right edge), we can see that nearly half of these devices are two years out of date. At this point, we should expect that there are more than one billion devices that are two years out of date! Given Android's update model, we should expect approximately 0% of those devices to ever get updated to a modern version of Android.

Whenever I bring up just how humongous of an issue this is, and just how dangerously irresponsible it is to let average consumers use this platform, apologists come out of the woodwork with two arguments as to why I'm an Apple shill or anti-Google: Google Play Services and Project Treble.

Google Play Services indeed ensures that a number of parts of your entire Android operating system and stack are updated through Google Play. This is a good move, and in fact, Android is ahead of iOS in this respect, where things like Safari and the browser engine are updated through operating system updates instead of through the App Store - and operating systems updates present a far bigger barrier to updating than mere app updates do. However, vast parts of Android are not updated through the Play Store at all, and pose a serious security threat to users of the platform. Google Play Services are anything but a silver bullet for Android's appalling update situation.

Project Treble is the second term people throw around whenever we talk about Android's lack of updates, but I don't think people really understand what Project Treble is, and what problems it does and does not solve. As Ron Amadeo explains in his excellent Android 8.0 review:

Project Treble introduces a "Vendor Interface" - a standardized interface that sits between the OS and the hardware. As long as the SoC vendor plugs into the Vendor Interface and the OS plugs into the Vendor Interface, an upgrade to a new version of Android should "just work." OEMs and carriers will still need to be involved in customizing the OS and rolling it out to users, but now the parties involved in an update can "parallelize" the work needed to get an update running. SoC code is no longer the "first" step that everyone else needs to wait on.

Treble addresses an important technical aspect of the Android update process by ensuring OEMs have to spend less time tailoring each Android update to every specific SoC and every specific smartphone. However, it doesn't mean OEMs can now just push a button and have the next Google Android code drop ready to go for all of their phones; they still have to port their modifications and other parts of Android, test everything, have it approved by carriers, and push them out to devices worldwide.

Project Treble addresses part of the technical aspect of Android updates, but not nearly all of it. While Treble is a huge improvement and clearly repays a huge technical debt of the Android platform, it doesn't actually address the real reason why OEMs are so lax at updating their phones: the political reason. Even in the entirely unrealistic, unlikely, and honestly impossible event Treble solves all technical barriers to updating Android phones, OEMs still have to, you know, actually choose to do so.

Even the most expensive and brand-defining Android flagships - the Note, Galaxy S, LG V, and so on - are updated at best only six months after the release of a new version of Android, and even then, the rollout usually takes months, with some countries, regions, carriers, or phones not getting the update until much, much later.

This isn't because it really is that hard to update Android phones - it's because OEMs don't care. Samsung doesn't care. LG doesn't care. HTC doesn't care. They'd much rather spend time and resources on selling you the next flagship than updating the one you already paid for.

Treble will do nothing to address that.

But let's assume that not only will Treble address all technical barriers, but also all political barriers. Entirely unlikely and impossible, I know, but for the sake of argument, let's assume that it does. Even then, it will be at best four to five years before we experience these benefits from Treble, because while Treble is a requirement for new devices shipping with Android 8.0 out of the box, it's entirely optional for existing devices being updated to 8.0. With the current pace of Android updates, that means it will be no earlier than four to five years from now before we truly start enjoying the fruits of the Treble team's labour.

At that point, it will have been twelve to thirteen years of accumulating unupdateable, insecure Android devices.

The cold and harsh truth is that as a platform, Android is a mess. It was quickly cobbled together in a rushed response to the original iPhone, and ever since, Google has been trying to repay the technical debt resulting from that rushed response, sucking time and resources away from advancing the state of the art in mobile operating systems.

As an aside, I have the suspicion Google has already set an internal timeline to move away from Android as we know it today, and move towards a new operating system altogether. I have the suspicion that Treble isn't so much about Android updates as it is about further containerising the Android runtime to make it as easy as possible to run Android applications as-is on a new platform that avoids and learns from the mistakes made by Android.

Each and every one of you knows I'm an Android user. I prefer Android over the competition because it allows me to use my phone the way I want to better than the competition. Up until recently, I would choose Android on Apple hardware over iOS on Android hardware - to use that macOS-vs-Windows meme - any day of the week.

These days - I'm not so sure I would. Your options as an Android user today? A Pixel phone you probably can't buy anyway because it's only available in three countries, and even if you can buy it, it falls apart at the seams. You can buy a Samsung or HTC or whatever and perpetually run outdated, insecure software. Or you can buy something from a smaller OEM, and suffer through shady nonsense.

You have to be deeply enveloped in the Android bubble to not see the dire situation this platform is in.

OnePlus left a backdoor in its devices with root access

Just a month ago, OnePlus was caught collecting personally identifiable data from phone owners through incredibly detailed analytics. While the company eventually reversed course on the data collection, another discovery has been made in the software of OnePlus phones. One developer found an application intended for factory testing, and through some investigation and reverse-engineering, was able to obtain root access using it.

People often tout OnePlus phones as an alternative to the Pixel line now that Google abandoned the Nexus concept of affordable, high-quality phones. Recent events, however, have made it very clear that you should really steer clear of phones like this, unless you know very well what you're doing.

Google to remove Accessibility Services apps from the Play Store

Some of the most innovative applications on the Play Store are built on using APIs in ways that Google never intended. There are apps that can remap your volume keys to skip music tracks, record and play back touch inputs on webpages or games, and even provide alternative navigation keys so you can use your device’s entire screen. All of these examples that I’ve just mention rely on Android’s Accessibility APIs. But that may soon change, as the Google Play Store team is sending out emails to developers telling them that they can no longer implement Accessibility Services unless they follow Google’s guidelines.

Accessibility Services is an attack vector for malicious software, so in that light it makes sense. Of course, that doesn't make it any less frustrating that good, innovative software gets smothered like this. Luckily, this is Android, so the developers can always just distribute their applications outside of the Play Store through sideloading, but that's not exactly a secure solution for most people - and let's be honest, not being in the Play Store will be the death knell for most developers.

The real solution would be to provide APIs for things like this, but I doubt Google is going to invest any time, effort, and money into creating such APIs, since they seem more concerned with shoving useless digital assistants down our throats.

How Firefox got fast again

People have noticed that Firefox is fast again.

Over the past seven months, we’ve been rapidly replacing major parts of the engine, introducing Rust and parts of Servo to Firefox. Plus, we’ve had a browser performance strike force scouring the codebase for performance issues, both obvious and non-obvious.

We call this Project Quantum, and the first general release of the reborn Firefox Quantum comes out tomorrow.

orthographic drawing of jet engine

But this doesn’t mean that our work is done. It doesn’t mean that today’s Firefox is as fast and responsive as it’s going to be.

So, let’s look at how Firefox got fast again and where it’s going to get faster.

I should definitely give Firefox another try - I've tried it over the years but it always felt a little sluggish compared to the competition. Chrome's gotten way too fat over the years, so I've resorted to using Edge on my main computer lately - it isn't perfect, but it it sure is fast, and places very little strain on my machine. I want my browser to get out of my way, and gobbling up processor cycles is exactly not that.

A history of the Amiga, part 11: between an Escom and a Gateway

Ars Technica has released another excellent article in their series on the Amiga. This article covers the beginning of the post-Commodore world, starting with Escom and ending with the beginning of Amiga Inc.

Commodore International declared itself insolvent on April 29, 1994 under Chapter 7 of US bankruptcy law. Ordinarily, this would have been followed immediately by an auction of all the company’s assets. However, Commodore’s Byzantine organizational structure - designed to serve as a tax shelter for financier Irving Gould - made this process far more lengthy and complicated than it should have been.

Sailfish 2.1.3 released

Another point release of one of the few - maybe even only - alternative mobile operating systems still being actively updated.

This update, 2.1.3 alias Kymijoki brings Sailfish X for Sony Xperia X. All Sailfish devices get fixes for some recent well-known security vulnerabilities, including WPA issues and Bluetooth Blueborne. Kymijoki contains connectivity improvements made for Qt and Android apps and fixes dozens of other issues, too.

It's a relatively minor update, but still - it's good to see Sailfish progressing.

Fused video stabilization on Pixel 2 and Pixel 2 XL

One of the most important aspects of current smartphones is easily capturing and sharing videos. With the Pixel 2 and Pixel 2 XL smartphones, the videos you capture are smoother and clearer than ever before, thanks to our Fused Video Stabilization technique based on both optical image stabilization (OIS) and electronic image stabilization (EIS). Fused Video Stabilization delivers highly stable footage with minimal artifacts, and the Pixel 2 is currently rated as the leader in DxO's video ranking (also earning the highest overall rating for a smartphone camera). But how does it work?

An interesting technical look at how Google achieves these results on their Pixel 2 phones, with the obvious caveat that we're looking at story written by Google here, so take that into account as you're reading this.

On a related note, overall DxO ratings are dumb.

The rise and fall of LiMux

The LiMux (or Limux) initiative in Munich has been heralded as an example of both the good and bad in moving a public administration away from proprietary systems. Free Software Foundation Europe (FSFE) President Matthias Kirschner reviewed the history of the initiative - and its recent apparent downfall - in a talk at Open Source Summit Europe in Prague. He also looked at the broader implications of the project as well as asking some questions that free-software advocates should consider moving forward.

The LiMux initiative is one of the longest-running story 'streams' on OSNews. The oldest item I could find is from 2003.

Modern tech product reviews are flawed

Khoi Vinh on why 24 hour or even weeklong reviews are dumb:

However I've come to believe that there's at least one thing wrong with this whole notion of product reviews - and with smartphone revirews in particular - and that's that by and large they’re only ever interested in these phones when they're brand new.

When an iPhone debuts it's literally at the very peak of its powers. All the software that it runs has been optimized for that particular model, and as a result everything seems to run incredibly smoothly.

As time goes on though, as newer versions of the operating system roll out, as there are more and more demands put on the phone, it inevitably gets slower and less performant. A case in point: I'm upgrading to this iPhone X from a three-year old iPhone 6 Plus and for at least the last year, and especially over the last three months, it has struggled mightily to perform simple tasks like launching the camera, fetching email, even basic typing. People who have recently had the misfortune of having to use my phone tell me almost instantly, "Your phone sucks."

You could argue that three years is an unrealistically long time to expect a smartphone to be able to keep up with the rapidly changing - and almost exponentially increasing - demands that we as users put on these devices. Personally, I would argue the opposite, that these things should be built to last at least three years, if for no other reason than as a society we shouldn't be throwing these devices away so quickly.

This is, of course, the reason behind the odd embargo strategy Apple employed regarding the iPhone X - if you only give people an hour or at best, 24 hours, to review a device, people will still be in the honeymoon phase of owning a product, where you're still rationalising spending €1200 for a phone (or any other high price for any other product, for that matter). Choice-supportive bias is a real thing, and each and every one of us experiences it. During this period, initial flaws aren't as apparent, and long-term flaws or flaws that only pop up in specific situations aren't yet taken into account. It makes the product appear better than it really is.

This is why, back when I still did reviews for OSNews, I had my own rule of using a product for at least four weeks before publishing a review. This gave me enough time to get over this initial phase, and made sure I had a more levelheaded look at the whole thing. We don't do many reviews anymore - I have to buy everything myself, and I'm not rich - so it's not an issue at this point, but even if companies were to approach us today for reviews, I would still ask for that four week period, and if they were to object - sorry, but no review.

This is, of course, what the major publications should've done. Nobody forced The Verge or whomever else to publish a review within 24 hours. The initial embargo rush is important for the bottom-line, I get that, but it still feels rather suspicious. What can you really learn about a product in just 24 hours? Can you really declare something "the best damn product Apple ever made" after using it for less than a day? At what point does writing most of the review in advance before you even receive the product in the first place, peppering it with a few paragraphs inspired by the 24 hours, cross into utter dishonesty?

By reviewing products in a day or less, popular tech media is really doing readers and consumers a huge disservice, only further strengthening the idea that the tech press is often nothing but an extension of a company's PR department. This erodes credibility, and in turn hurts those among the media who do take their time to properly review a product.

It's okay to not rush writing a review to meet some asinine embargo. It's okay to not ask "how high?" when a company tells you to jump. It's okay to publish a review a week or even a month after an embargo has been lifted. It's okay to not post unboxing videos of non-retail boxes.

It's okay to, sometimes, just say no.

Tock: a secure embedded operating system

Tock is an embedded operating system designed for running multiple concurrent, mutually distrustful applications on Cortex-M based embedded platforms. Tock's design centers around protection, both from potentially malicious applications and from device drivers. Tock uses two mechanisms to protect different components of the operating system. First, the kernel and device drivers are written in Rust, a systems programming language that provides compile-time memory safety, type safety and strict aliasing. Tock uses Rust to protect the kernel (e.g. the scheduler and hardware abstraction layer) from platform specific device drivers as well as isolate device drivers from each other. Second, Tock uses memory protection units to isolate applications from each other and the kernel.

Visit the official site and the github repository for more information.

Waymo’s self-driving cars on public roads – without a driver

Waymo recently hosted a number of journalists at its private Castle testing compound, and treated us to rides with no safety driver behind the wheel - now, the former Google self-driving car company is going farther still, however, launching public road tests of its autonomous Chrysler Pacifica minivans with no safety driver on board.

The tests aren't limited to one or two routes, either; the test area where the truly driverless trials are being conducted is in Chandler, Arizona (part of the greater Phoenix metro area), and the cars are able to go anywhere within this defined space. It’s hard to understate the importance of this milestone: Waymo is operating at full Level 4 autonomy, sharing public roads with human-driven cars and pedestrians, with no one at the wheel able to take over in case things don't go as planned.

All my friends live at least an hour's drive away from where I live (assuming no traffic, which is a big assumption in The Netherlands). That's not a long drive by standards of large countries, but for us, it is, and since it basically comes down to a boring drive over a few boring highways in a boring part of the country, it's mind-numbingly tedious.

I can't wait until I can just sit down on the backseat of my car, tell it to drive to Amsterdam or wherever else my friends live, and just chill for an hour with some YouTube or webbrowsing. I know we're not there yet, but I hope I can at least experience that at one point in my life.

An open letter to Intel

Andrew S. Tanenbaum, creator of MINIX, has published an open letter to Intel regarding Intel's use of MINIX in the IME:

The only thing that would have been nice is that after the project had been finished and the chip deployed, that someone from Intel would have told me, just as a courtesy, that MINIX 3 was now probably the most widely used operating system in the world on x86 computers. That certainly wasn't required in any way, but I think it would have been polite to give me a heads up, that's all.

If nothing else, this bit of news reaffirms my view that the Berkeley license provides the maximum amount of freedom to potential users. If they want to publicize what they have done, fine. By all means, do so. If there are good reasons not to release the modified code, that's fine with me, too.

I can still barely believe this whole story.

After a tax crackdown, Apple found a new shelter for its profits

Five months after Mr. Cook's testimony, Irish officials began to crack down on the tax structure Apple had exploited. So the iPhone maker went hunting for another place to park its profits, newly leaked records show. With help from law firms that specialize in offshore tax shelters, the company canvassed multiple jurisdictions before settling on the small island of Jersey, which typically does not tax corporate income.

Apple has accumulated more than $128 billion in profits offshore, and probably much more, that is untaxed by the United States and hardly touched by any other country. Nearly all of that was made over the past decade.

Apple is the largest company in the world, so they're the big target - but tons of other companies engage in the same shady activities.

Every euro or dollar Apple, Google, and Facebook dodge in taxes is a euro or dollar regular folk like you and I have to pay instead. These companies make use of all the facilities and infrastructure paid for by our tax euros and dollars, but then turn around and stab society in the back by extracting vast sums of wealth from it without paying their fair share of taxes. It's exactly this reason why the divide between rich and poor is growing exponentially, which in turn is destabilising our communities because it becomes ever clearer that the Tim Cooks and Mark Zuckerbergs of this world get to live under a different set of rules than you and I.

I am lucky to live in an incredibly solid welfare state, where, while exceptions exist, we take care of each other (interestingly enough, The Netherlands is also one of the biggest shady tax havens in the world). A welfare state is built upon the concept of the strongest shoulders carrying the heaviest burdens, and the knowledge that Joe Billionaire is capable of paying more into the system than Jane Minimum Wage. When this system of trust breaks down - as it clearly is at risk of - our society breaks down. The fact that Tim Cook et al. have the gall to claim their 0.0002% tax rate is "fair" just rubs more salt in the wounds of any regular person who dutifully pays her or his 20-40% taxes every year.

Sadly, any meaningful change to the tax codes of the US and the EU will be blocked through the corruption and bribery Apple, Google, Facebook, and so on engage in on a daily basis. Unless we break these giants up into small companies that aren't 'too big to fail', our societies will grow ever more at their mercy.

Intel, AMD co-develop new processor with Intel CPU and AMD GPU

Well, this is the kind of news you don't hear every day: Intel and AMD are teaming up to develop a processor that combines an Intel CPU with an AMD GPU. From Intel's press release:

The new product, which will be part of our 8th Gen Intel Core family, brings together our high-performing Intel Core H-series processor, second generation High Bandwidth Memory (HBM2) and a custom-to-Intel third-party discrete graphics chip from AMD's Radeon Technologies Group* - all in a single processor package.

It’s a prime example of hardware and software innovations intersecting to create something amazing that fills a unique market gap. Helping to deliver on our vision for this new class of product, we worked with the team at AMD’s Radeon Technologies Group. In close collaboration, we designed a new semi-custom graphics chip, which means this is also a great example of how we can compete and work together, ultimately delivering innovation that is good for consumers.

This is the first partnership between these two sworn rivals in several decades, and that alone makes it quite notable. I didn't really know whether to put this in the Intel or AMD category, but I chose Intel because it appears above AMD in our list (which isn't alphabetical because reasons).

Restoring a 1998 Packard Bell multimedia PC

There really is no rational reason to restore a late 90s NEC-manufactured Packard Bell computer. Which is exactly why I'm doing it. Join me in getting this unloved machine back to factory fresh condition!

LGR is one of the best and most entertaining technology channels on YouTube, and his latest video from today hits home particularly hard, since these kinds of crappy, low-budget late '90s PCs defined my early teens. Nobody in my family, town, or school had Macs or other types of computers - it was all PC, as cheap as possible, fully embracing the race to the bottom which for many people still defines the PC today.

It's good to see that there are people willing to preserve these otherwise forgettable machines for posterity. They may objectively suck, but they did make computing accessible to an incredibly wide audience, and they served an important role in the history of computing.

The Amazing $1 Microcontroller

As an embedded design consultant, the diverse collection of projects on my desk need an equally-diverse collection of microcontroller architectures that have the performance, peripheral selection, and power numbers to be the backbone of successful projects. At the same time, we all have our go-to chips - those parts that linger in our toolkit after being picked up in school, through forum posts, or from previous projects.

In 2017, we saw several new MCUs hit the market, as well as general trends continuing in the industry: the migration to open-source, cross-platform development environments and toolchains; new code-generator tools that integrate seamlessly (or not so seamlessly...) into IDEs; and, most notably, the continued invasion of ARM Cortex-M0+ parts into the 8-bit space.

I wanted to take a quick pulse of the industry to see where everything is - and what I've been missing while backed into my corner of DigiKey’s web site.

It's time for a good ol' microcontroller shoot-out.

An amazingly detailed and well-organised resource.

ARM GCC cross compilation in Visual Studio

In Visual Studio 2017 15.5 Preview 2 we are introducing support for cross compilation targeting ARM microcontrollers. To enable this in the installation choose the Linux development with C++ workload and select the option for Embedded and IoT Development. This adds the ARM GCC cross compilation tools and Make to your installation.

Our cross compilation support uses our Open Folder capabilities so there is no project system involved. We are using the same JSON configuration files from other Open Folder scenarios and have added additional options to support the toolchains introduced here. We hope that this provides flexibility for many styles of embedded development. The best way to get started with this and understand the capabilities is with a project exported from the ARM mbed online compiler. We'll cover the basics here, to learn more about the online compiler see ARM’s tutorials, and you can sign up for an account here.

Here are the Russia-linked Facebook ads released by Congress

As part of this week's hearings into how Russia has used social media to influence American opinion, House lawmakers released several Facebook and Instagram ads linked to Kremlin meddling online. Although lawmakers have not yet released the full cache of ads, which includes about 3,000 examples provided to Congress by Facebook, the so-far disclosed ads offer one of the closest looks yet at the Russian operation.

Some of these ads and fake accounts are quite fascinating - they're clearly designed not just to promote Trump, but also to rile up different groups - from the LGBT community to proponents of the US 2nd amendment - against each other. Oh, and also to pitch a fight between Clinton and Jesus.

The Improbable Origins of PowerPoint

PowerPoint is so ingrained in modern life that the notion of it having a history at all may seem odd. But it does have a very definite lifetime as a commercial product that came onto the scene 30 years ago, in 1987. Remarkably, the founders of the Silicon Valley firm that created PowerPoint did not set out to make presentation software, let alone build a tool that would transform group communication throughout the world. Rather, PowerPoint was a recovery from dashed hopes that pulled a struggling startup back from the brink of failure - and succeeded beyond anything its creators could have imagined.

Fascinating story. I despise PowerPoint because PowerPoint presentations are difficult to translate (my actual job), but there's no denying it's used in meeting rooms all over the world - for better or worse.

Russia’s meddling could spell the end of online anonymity

This week, representatives from Google, Facebook, and Twitter are appearing before House and Senate subcommittees to answer for their role in Russian manipulation during the 2016 election, and so far, the questioning has been brutal. Facebook has taken the bulk of the heat, being publicly called out by members of Congress for missing a wave of Russian activity until months after the election.

But one of the most interesting parts of yesterday's proceedings actually came after the big companies had left the room, and a national security researcher named Clint Watts took the floor. Watts is one of the most respected figures in the nascent field of social media manipulation - and when it came time to diagnose root of Russia's platform meddling, he put much of the blame on the decision to allow anonymous accounts. As long as Russian operatives can get on Twitter and Facebook without identifying themselves, Watts diagnosed, foreign actors will be able to quietly influence our politics.

I decided to keep this particular part of the hearings currently underway out of the previous item I posted because I feel it's too important not to be discussed on its own merit. The concept of anonymity online is a complex issue, and instinctively, I want to say it's one of the greatest things about the internet. What part of it are we willing to give up - assuming we still have it or parts of it to begin with - to prevent dictators like Putin from meddling with our elections?