Android Archive

Liberating MediaTek bootloaders and modem firmware

On the right you can see photos of a Coolpad Modena 2, which was built around MediaTek's MT6735P SoC (System on a chip). In case you are wondering why we're not showing a picture with postmarketOS running on it: we can't! This is because the vendor decided to ship it with a closed down bootloader, which prevents users from running custom kernels.

The postmarketOS team details how they are cracking open the bootloader and the cellular modem firmware on MediaTek-based devices.

How Android phones hide missed security updates

Google has long struggled with how best to get dozens of Android smartphone manufacturers - and hundreds of carriers - to regularly push out security-focused software updates. But when one German security firm looked under the hood of hundreds of Android phones, it found a troubling new wrinkle: Not only do many Android phone vendors fail to make patches available to their users, or delay their release for months; they sometimes also tell users their phone's firmware is fully up to date, even while they've secretly skipped patches.

On Friday at the Hack in the Box security conference in Amsterdam, researchers Karsten Nohl and Jakob Lell of the firm Security Research Labs plan to present the results of two years of reverse-engineering hundreds of Android phones' operating system code, painstakingly checking if each device actually contained the security patches indicated in its settings. They found what they call a "patch gap": In many cases, certain vendors' phones would tell users that they had all of Android's security patches up to a certain date, while in reality missing as many as a dozen patches from that period - leaving phones vulnerable to a broad collection of known hacking techniques.

Android is a mess.

Android Studio 3.1 released

New to Android Studio 3.1 is a C++ performance profiler to help troubleshoot performance bottlenecks in your app code. For those of you with a Room or SQLite database in their your app, we added better code editor support to aid in your SQL table and query creation statements. We also added better lint support for your Kotlin code, and accelerated your testing with an updated Android Emulator with Quick Boot.

Google blocks GApps from running on uncertified devices

Even though Android is open source, virtually every Android device sold outside of China contains a chunk of closed code from Google in the form of Google Play Services and the GApps. These two deeply related software packages turn a rather stale mobile operating system into the full-on Google Android most of us know. There aren't a whole lot of Android users (again, outside of China) who aren't using these.

Since these packages aren't open source, custom Android ROMs ship without them; you have to sideload them manually after installing your ROM image. Luckily for us, Google has always allowed this, but it's always been a bit tenuous. It's about to get a whole lot more tenuous, since Google appears to be blocking GApps from running on uncertified Android devices - but thankfully, they're allowing custom ROM users to register their Android device to get an exception.

Earlier this week, we received an anonymous tip from a person claiming to be within the industry. This person, who said they worked for an OEM/ODM, notified us that Google has started entirely locking out newly built firmware from accessing Gapps. This change apparently went into effect March 16th and affects any software builds made after this date (Google Play Services checks ro.build.fingerprint for the build date apparently).

You can register your device to get an exception, and you can register up to 100 devices per user - which should be enough for virtually everyone, I assume.

Introducing the LineageSDK for developers

LineageOS is an operating system for everyone: from the average user to the advanced developer. While users have a giant playground in their hands with many customization options, we also want to make LineageOS a fun place for developers. The standards for official builds help ensure developers that their app will not end up in a bad state because of inappropriate Android API changes or broken hardware support, but this is not enough for us; we're announcing some new APIs that will allow your apps to do more when they're running on a LineageOS-powered device.

The Lineage platform SDK (LineageSDK for short) is a powerful resource that allows us to both keep our features out of the core Android frameworks (for better security and easier bringup processes) and expose some extra functionality to app developers.

We'll have to wait and see if developers are willing to add some code to their Android applications for the features in this SDK.

Google renames Android Wear to Wear OS

As our technology and partnerships have evolved, so have our users. In 2017, one out of three new Android Wear watch owners also used an iPhone. So as the watch industry gears up for another Baselworld next week, we’re announcing a new name that better reflects our technology, vision, and most important of all - the people who wear our watches. We’re now Wear OS by Google, a wearables operating system for everyone.

If a company changes the name of one of its operating system, but nobody cares - has the name really been changed?

Google releases first Android P preview

Google has released the first preview for Android P - again, apologies for the late coverage - and it contains some interesting improvements. Here's a few things that jumped out at me:

To better ensure privacy, Android P restricts access to mic, camera, and all SensorManager sensors from apps that are idle. While your app's UID is idle, the mic reports empty audio and sensors stop reporting events. Cameras used by your app are disconnected and will generate an error if the app tries to use them. In most cases, these restrictions should not introduce new issues for existing apps, but we recommend removing these requests from your apps.

This is a very good move, and I doubt anyone will have any objections.

In line with these changes, Android P will warn users with a dialog when they install an app that targets a platform earlier than Android 4.2 (targetSdkVersion less than 17), and future platform versions will continue to increment that lower bound.

Expect scary warning dialogs when installing older applications. This should encourage developers to update their applications as users complain in the review sections of the Play Store. Hopefully.

You can now access streams simultaneously from two or more physical cameras on devices running Android P. On devices with either dual-front or dual-back cameras, you can create innovative features not possible with just a single camera, such as seamless zoom, bokeh, and stereo vision. The API also lets you call a logical or fused camera stream that automatically switches between two or more cameras.

Definitely neat.

There's a lot more stuff in this preview release, and more features will certainly follow over the coming months.

Bad iPhone notches are happening to good Android phones

I’ve been coming to Mobile World Congress for close to a decade now, and I’ve never seen the iPhone copied quite so blatantly and cynically as I witnessed during this year’s show. MWC 2018 will go down in history as the launch platform for a mass of iPhone X notch copycats, each of them more hastily and sloppily assembled than the next.

No effort is being made to emulate the complex Face ID system that resides inside Apple’s notch; companies like Noa and Ulefone are in such a hurry to get their iPhone lookalike on the market that they haven’t even customized their software to account for the new shape of the screen. More than one of these notched handsets at MWC had the clock occluded by the curved corner of the display.

I have an iPhone X, and the notch doesn't bother me at all. Face ID works reasonably well - not as good as Touch ID, but good enough - and thus, gives the notch a reason to exist in the first place. I don't feel particularly strongly towards either Samsung's small chin/forehead solution, or Essential's/Apple's notch solution, and I'm glad it at least creates some visual difference between phones. However, if you decide to go with a notch, don't just copy Apple's shape while not actually putting anything underneath it.

I can't believe this is truly going to be a thing.

Android Go phones show how much you can get for $100

Mobile World Congress is happening this week, and we're slowly getting a better picture of what Google's new "Android Go" initiative will look like. Android Go is a special configuration of Android 8.1 (with a selection of special "Go" apps) that targets low-end devices with 1GB of RAM or less.

MWC has seen a ton of manufacturers sign up for the program and announce phones shipping with the Go config, so it's time for a hardware roundup.

We often tend to get tunnel vision and focus on expensive flagships, so here's a roundup of upcoming 100 dollar Android Go phones. These are neat little phones for a decent price.

Android One becomes the new Google Play Edition

If I look back through all of the years we have covered Android, it’s hard to argue that the introduction of Google Play Edition phones wasn’t one of the biggest moments. In those early years, the Android skin situation was bad. Those early versions of TouchWiz, MotoBlur, and even HTC Sense, weren’t what many of us wanted, to say the least. We wanted Google’s version of Android, as well as their Nexus update schedules, yet that was tough to get because Google was making average hardware at the time.

While Google Play Edition may have failed as a program, I get the feeling that Android One will now act as a proper replacement to it.

Stop trying to make timely Android updates happen. It's not going to happen.

Google’s next Android overhaul said to embrace ‘notch’

Google is working on an overhaul of its Android mobile software for a new generation of smartphones mimicking Apple Inc.'s controversial new "notch" at the top of the iPhone X, according to people familiar with the situation.

The Android update, due later in the year, will also more tightly integrate Google’s digital assistant, improve battery life on phones and support new designs, like multiple screens and foldable displays, the people added.

A key goal of this year’s update to the Google mobile operating system is to persuade more iPhone users to switch to Android devices by improving the look of the software, the people said. They asked not to be identified discussing the private plans. A Google spokesman declined to comment.

A bit short on actual details, but what's there is mostly the kind of stuff you'd expect Android to be preparing for. We're going to need to be closer to Google I/O for more concrete information.

Essential to skip 8.0 Oreo release, goes straight to 8.1

Essential - the phone company led by Android co-founder Andy Rubin - has had some difficulty in getting a stable 8.0 Oreo update released. After three beta releases, the company is not quite satisfied that the update is ready for general release. Because of these protracted issues, Essential has announced plans to skip the 8.0 release entirely in favor of 8.1, which will "push the public release back a couple weeks," according to the company.

Not even a phone with close to stock Android, built by the very same person who developed Android in the first place, can be updated to a newer Android release without delays, stability issues, and general problems - to the point where they're skipping a version altogether.

Android is a mess.

Gemini is a tiny Android laptop with the spirit of Psion

The Gemini is a clamshell Android device with an 18:9 ultrawide 1080p screen and a compact but more-or-less full physical keyboard. It runs on a 10-core MediaTek Helio X27 processor and has 4GB of RAM, a 4,220mAh battery, and two USB-C ports. It’s 15.1mm thick when closed and weighs 308g. There are both Wi-Fi-only and LTE-capable models. The software is pretty much stock Android with a useful customized dock that can be brought up anywhere, and you can also dual-boot into Linux for more customization.

This is exactly what I've always wanted. A tiny Psion Series 5-like computer running a modern operating system. This machine can run Android and regular Linux, and seems quite similar in concept to the GPD Pocket 7, which sadly seems to be hard to come by here in The Netherlands (I'd want to run Haiku on the GPD Pocket 7). To be honest, I'm not entirely sure what's I'd use such a tiny laptop for, but they're tiny enough they're not really taking up space.

Android Emulator gets Quick Boot

Today, we are excited to announce Quick Boot for the Android Emulator. With Quick Boot, you can launch the Android Emulator in under 6 seconds. Quick Boot works by snapshotting an emulator session so you can reload in seconds. Quick Boot was first released with Android Studio 3.0 in the canary update channel and we are excited to release the feature as a stable update today.

There's a quite a few other improvements and new features, as well.

Android Wear gets updated to Android 8.0 Oreo

Remember Android Wear? Google's struggling smartwatch OS is getting updated to Android 8.0 Oreo, just like the rest of the Android lineup. Google announced the update on the "Android Wear Developers" Google Plus group. It seems like the only supported watch right now is the flagship LG Watch Sport, which makes sense since that was the only watch to get an Android O beta in the beginning of October.

Wear's last big update was Android Wear 2.0, which was released with the LG Watch Sport the beginning of the year. Most users won't notice the move to Oreo. Like Android TV, Android Wear has its own interface and set of features that are developed separately from the base OS version. This update to Oreo changes the under-the-hood OS, but the user-facing features will mostly remain unchanged.

It feels like Android Wear is stuck in limbo - not exactly dead, but it doesn't seem like there's much activity or forward momentum either. Also I keep forgetting Google Plus is even a thing.

“Google’s Pixel 2 XL is absurdly close to being perfect”

With me being so down on Android, it's only fair to also offer insight into the other side of the coin - a longtime iPhone user making the switch to the new Pixel 2 XL, and loving it:

This phone is extremely my shit. Google has taken the original Pixel, which was interesting but not enough to tempt me into switching, and made it into something that's near perfect.

In a year where the iPhone X, which Apple touts as the future phone, only has a single interesting feature (Face ID) Google has embraced the opportunity to show a different future with arms wide open. It's the first time I can confidently say an Android device is great coming from the iPhone without constantly saying but there's this one thing.

Different strokes for different folks, but that's why we're all here debating things that are, in the grand scheme of things, irrelevant.

Android collects locations when location services are disabled

Since the beginning of 2017, Android phones have been collecting the addresses of nearby cellular towers - even when location services are disabled - and sending that data back to Google. The result is that Google, the unit of Alphabet behind Android, has access to data about individuals' locations and their movements that go far beyond a reasonable consumer expectation of privacy.

Quartz observed the data collection occur and contacted Google, which confirmed the practice.

The cell tower addresses have been included in information sent to the system Google uses to manage push notifications and messages on Android phones for the past 11 months, according to a Google spokesperson. The were never used or stored, the spokesperson said, and the company is now taking steps to end the practice after being contacted by Quartz. By the end of November, the company said, Android phones will no longer send cell-tower location data to Google, at least as part of this particular service, which consumers cannot disable.

Raise your hand if you're surprised.

More than 1 billion Android devices run outdated software

This is horrifying:

But even with the data we have, we can take a guess at how many outdated devices are in use. In May 2017, Google announced that there are over two billion active Android devices. If we look at the latest stats (the far right edge), we can see that nearly half of these devices are two years out of date. At this point, we should expect that there are more than one billion devices that are two years out of date! Given Android's update model, we should expect approximately 0% of those devices to ever get updated to a modern version of Android.

Whenever I bring up just how humongous of an issue this is, and just how dangerously irresponsible it is to let average consumers use this platform, apologists come out of the woodwork with two arguments as to why I'm an Apple shill or anti-Google: Google Play Services and Project Treble.

Google Play Services indeed ensures that a number of parts of your entire Android operating system and stack are updated through Google Play. This is a good move, and in fact, Android is ahead of iOS in this respect, where things like Safari and the browser engine are updated through operating system updates instead of through the App Store - and operating systems updates present a far bigger barrier to updating than mere app updates do. However, vast parts of Android are not updated through the Play Store at all, and pose a serious security threat to users of the platform. Google Play Services are anything but a silver bullet for Android's appalling update situation.

Project Treble is the second term people throw around whenever we talk about Android's lack of updates, but I don't think people really understand what Project Treble is, and what problems it does and does not solve. As Ron Amadeo explains in his excellent Android 8.0 review:

Project Treble introduces a "Vendor Interface" - a standardized interface that sits between the OS and the hardware. As long as the SoC vendor plugs into the Vendor Interface and the OS plugs into the Vendor Interface, an upgrade to a new version of Android should "just work." OEMs and carriers will still need to be involved in customizing the OS and rolling it out to users, but now the parties involved in an update can "parallelize" the work needed to get an update running. SoC code is no longer the "first" step that everyone else needs to wait on.

Treble addresses an important technical aspect of the Android update process by ensuring OEMs have to spend less time tailoring each Android update to every specific SoC and every specific smartphone. However, it doesn't mean OEMs can now just push a button and have the next Google Android code drop ready to go for all of their phones; they still have to port their modifications and other parts of Android, test everything, have it approved by carriers, and push them out to devices worldwide.

Project Treble addresses part of the technical aspect of Android updates, but not nearly all of it. While Treble is a huge improvement and clearly repays a huge technical debt of the Android platform, it doesn't actually address the real reason why OEMs are so lax at updating their phones: the political reason. Even in the entirely unrealistic, unlikely, and honestly impossible event Treble solves all technical barriers to updating Android phones, OEMs still have to, you know, actually choose to do so.

Even the most expensive and brand-defining Android flagships - the Note, Galaxy S, LG V, and so on - are updated at best only six months after the release of a new version of Android, and even then, the rollout usually takes months, with some countries, regions, carriers, or phones not getting the update until much, much later.

This isn't because it really is that hard to update Android phones - it's because OEMs don't care. Samsung doesn't care. LG doesn't care. HTC doesn't care. They'd much rather spend time and resources on selling you the next flagship than updating the one you already paid for.

Treble will do nothing to address that.

But let's assume that not only will Treble address all technical barriers, but also all political barriers. Entirely unlikely and impossible, I know, but for the sake of argument, let's assume that it does. Even then, it will be at best four to five years before we experience these benefits from Treble, because while Treble is a requirement for new devices shipping with Android 8.0 out of the box, it's entirely optional for existing devices being updated to 8.0. With the current pace of Android updates, that means it will be no earlier than four to five years from now before we truly start enjoying the fruits of the Treble team's labour.

At that point, it will have been twelve to thirteen years of accumulating unupdateable, insecure Android devices.

The cold and harsh truth is that as a platform, Android is a mess. It was quickly cobbled together in a rushed response to the original iPhone, and ever since, Google has been trying to repay the technical debt resulting from that rushed response, sucking time and resources away from advancing the state of the art in mobile operating systems.

As an aside, I have the suspicion Google has already set an internal timeline to move away from Android as we know it today, and move towards a new operating system altogether. I have the suspicion that Treble isn't so much about Android updates as it is about further containerising the Android runtime to make it as easy as possible to run Android applications as-is on a new platform that avoids and learns from the mistakes made by Android.

Each and every one of you knows I'm an Android user. I prefer Android over the competition because it allows me to use my phone the way I want to better than the competition. Up until recently, I would choose Android on Apple hardware over iOS on Android hardware - to use that macOS-vs-Windows meme - any day of the week.

These days - I'm not so sure I would. Your options as an Android user today? A Pixel phone you probably can't buy anyway because it's only available in three countries, and even if you can buy it, it falls apart at the seams. You can buy a Samsung or HTC or whatever and perpetually run outdated, insecure software. Or you can buy something from a smaller OEM, and suffer through shady nonsense.

You have to be deeply enveloped in the Android bubble to not see the dire situation this platform is in.

OnePlus left a backdoor in its devices with root access

Just a month ago, OnePlus was caught collecting personally identifiable data from phone owners through incredibly detailed analytics. While the company eventually reversed course on the data collection, another discovery has been made in the software of OnePlus phones. One developer found an application intended for factory testing, and through some investigation and reverse-engineering, was able to obtain root access using it.

People often tout OnePlus phones as an alternative to the Pixel line now that Google abandoned the Nexus concept of affordable, high-quality phones. Recent events, however, have made it very clear that you should really steer clear of phones like this, unless you know very well what you're doing.

Google to remove Accessibility Services apps from the Play Store

Some of the most innovative applications on the Play Store are built on using APIs in ways that Google never intended. There are apps that can remap your volume keys to skip music tracks, record and play back touch inputs on webpages or games, and even provide alternative navigation keys so you can use your device’s entire screen. All of these examples that I’ve just mention rely on Android’s Accessibility APIs. But that may soon change, as the Google Play Store team is sending out emails to developers telling them that they can no longer implement Accessibility Services unless they follow Google’s guidelines.

Accessibility Services is an attack vector for malicious software, so in that light it makes sense. Of course, that doesn't make it any less frustrating that good, innovative software gets smothered like this. Luckily, this is Android, so the developers can always just distribute their applications outside of the Play Store through sideloading, but that's not exactly a secure solution for most people - and let's be honest, not being in the Play Store will be the death knell for most developers.

The real solution would be to provide APIs for things like this, but I doubt Google is going to invest any time, effort, and money into creating such APIs, since they seem more concerned with shoving useless digital assistants down our throats.