Android Archive

Android collects locations when location services are disabled

Since the beginning of 2017, Android phones have been collecting the addresses of nearby cellular towers - even when location services are disabled - and sending that data back to Google. The result is that Google, the unit of Alphabet behind Android, has access to data about individuals' locations and their movements that go far beyond a reasonable consumer expectation of privacy.

Quartz observed the data collection occur and contacted Google, which confirmed the practice.

The cell tower addresses have been included in information sent to the system Google uses to manage push notifications and messages on Android phones for the past 11 months, according to a Google spokesperson. The were never used or stored, the spokesperson said, and the company is now taking steps to end the practice after being contacted by Quartz. By the end of November, the company said, Android phones will no longer send cell-tower location data to Google, at least as part of this particular service, which consumers cannot disable.

Raise your hand if you're surprised.

More than 1 billion Android devices run outdated software

This is horrifying:

But even with the data we have, we can take a guess at how many outdated devices are in use. In May 2017, Google announced that there are over two billion active Android devices. If we look at the latest stats (the far right edge), we can see that nearly half of these devices are two years out of date. At this point, we should expect that there are more than one billion devices that are two years out of date! Given Android's update model, we should expect approximately 0% of those devices to ever get updated to a modern version of Android.

Whenever I bring up just how humongous of an issue this is, and just how dangerously irresponsible it is to let average consumers use this platform, apologists come out of the woodwork with two arguments as to why I'm an Apple shill or anti-Google: Google Play Services and Project Treble.

Google Play Services indeed ensures that a number of parts of your entire Android operating system and stack are updated through Google Play. This is a good move, and in fact, Android is ahead of iOS in this respect, where things like Safari and the browser engine are updated through operating system updates instead of through the App Store - and operating systems updates present a far bigger barrier to updating than mere app updates do. However, vast parts of Android are not updated through the Play Store at all, and pose a serious security threat to users of the platform. Google Play Services are anything but a silver bullet for Android's appalling update situation.

Project Treble is the second term people throw around whenever we talk about Android's lack of updates, but I don't think people really understand what Project Treble is, and what problems it does and does not solve. As Ron Amadeo explains in his excellent Android 8.0 review:

Project Treble introduces a "Vendor Interface" - a standardized interface that sits between the OS and the hardware. As long as the SoC vendor plugs into the Vendor Interface and the OS plugs into the Vendor Interface, an upgrade to a new version of Android should "just work." OEMs and carriers will still need to be involved in customizing the OS and rolling it out to users, but now the parties involved in an update can "parallelize" the work needed to get an update running. SoC code is no longer the "first" step that everyone else needs to wait on.

Treble addresses an important technical aspect of the Android update process by ensuring OEMs have to spend less time tailoring each Android update to every specific SoC and every specific smartphone. However, it doesn't mean OEMs can now just push a button and have the next Google Android code drop ready to go for all of their phones; they still have to port their modifications and other parts of Android, test everything, have it approved by carriers, and push them out to devices worldwide.

Project Treble addresses part of the technical aspect of Android updates, but not nearly all of it. While Treble is a huge improvement and clearly repays a huge technical debt of the Android platform, it doesn't actually address the real reason why OEMs are so lax at updating their phones: the political reason. Even in the entirely unrealistic, unlikely, and honestly impossible event Treble solves all technical barriers to updating Android phones, OEMs still have to, you know, actually choose to do so.

Even the most expensive and brand-defining Android flagships - the Note, Galaxy S, LG V, and so on - are updated at best only six months after the release of a new version of Android, and even then, the rollout usually takes months, with some countries, regions, carriers, or phones not getting the update until much, much later.

This isn't because it really is that hard to update Android phones - it's because OEMs don't care. Samsung doesn't care. LG doesn't care. HTC doesn't care. They'd much rather spend time and resources on selling you the next flagship than updating the one you already paid for.

Treble will do nothing to address that.

But let's assume that not only will Treble address all technical barriers, but also all political barriers. Entirely unlikely and impossible, I know, but for the sake of argument, let's assume that it does. Even then, it will be at best four to five years before we experience these benefits from Treble, because while Treble is a requirement for new devices shipping with Android 8.0 out of the box, it's entirely optional for existing devices being updated to 8.0. With the current pace of Android updates, that means it will be no earlier than four to five years from now before we truly start enjoying the fruits of the Treble team's labour.

At that point, it will have been twelve to thirteen years of accumulating unupdateable, insecure Android devices.

The cold and harsh truth is that as a platform, Android is a mess. It was quickly cobbled together in a rushed response to the original iPhone, and ever since, Google has been trying to repay the technical debt resulting from that rushed response, sucking time and resources away from advancing the state of the art in mobile operating systems.

As an aside, I have the suspicion Google has already set an internal timeline to move away from Android as we know it today, and move towards a new operating system altogether. I have the suspicion that Treble isn't so much about Android updates as it is about further containerising the Android runtime to make it as easy as possible to run Android applications as-is on a new platform that avoids and learns from the mistakes made by Android.

Each and every one of you knows I'm an Android user. I prefer Android over the competition because it allows me to use my phone the way I want to better than the competition. Up until recently, I would choose Android on Apple hardware over iOS on Android hardware - to use that macOS-vs-Windows meme - any day of the week.

These days - I'm not so sure I would. Your options as an Android user today? A Pixel phone you probably can't buy anyway because it's only available in three countries, and even if you can buy it, it falls apart at the seams. You can buy a Samsung or HTC or whatever and perpetually run outdated, insecure software. Or you can buy something from a smaller OEM, and suffer through shady nonsense.

You have to be deeply enveloped in the Android bubble to not see the dire situation this platform is in.

OnePlus left a backdoor in its devices with root access

Just a month ago, OnePlus was caught collecting personally identifiable data from phone owners through incredibly detailed analytics. While the company eventually reversed course on the data collection, another discovery has been made in the software of OnePlus phones. One developer found an application intended for factory testing, and through some investigation and reverse-engineering, was able to obtain root access using it.

People often tout OnePlus phones as an alternative to the Pixel line now that Google abandoned the Nexus concept of affordable, high-quality phones. Recent events, however, have made it very clear that you should really steer clear of phones like this, unless you know very well what you're doing.

Google to remove Accessibility Services apps from the Play Store

Some of the most innovative applications on the Play Store are built on using APIs in ways that Google never intended. There are apps that can remap your volume keys to skip music tracks, record and play back touch inputs on webpages or games, and even provide alternative navigation keys so you can use your device’s entire screen. All of these examples that I’ve just mention rely on Android’s Accessibility APIs. But that may soon change, as the Google Play Store team is sending out emails to developers telling them that they can no longer implement Accessibility Services unless they follow Google’s guidelines.

Accessibility Services is an attack vector for malicious software, so in that light it makes sense. Of course, that doesn't make it any less frustrating that good, innovative software gets smothered like this. Luckily, this is Android, so the developers can always just distribute their applications outside of the Play Store through sideloading, but that's not exactly a secure solution for most people - and let's be honest, not being in the Play Store will be the death knell for most developers.

The real solution would be to provide APIs for things like this, but I doubt Google is going to invest any time, effort, and money into creating such APIs, since they seem more concerned with shoving useless digital assistants down our throats.

Fused video stabilization on Pixel 2 and Pixel 2 XL

One of the most important aspects of current smartphones is easily capturing and sharing videos. With the Pixel 2 and Pixel 2 XL smartphones, the videos you capture are smoother and clearer than ever before, thanks to our Fused Video Stabilization technique based on both optical image stabilization (OIS) and electronic image stabilization (EIS). Fused Video Stabilization delivers highly stable footage with minimal artifacts, and the Pixel 2 is currently rated as the leader in DxO's video ranking (also earning the highest overall rating for a smartphone camera). But how does it work?

An interesting technical look at how Google achieves these results on their Pixel 2 phones, with the obvious caveat that we're looking at story written by Google here, so take that into account as you're reading this.

On a related note, overall DxO ratings are dumb.

Google releases Android 8.1 preview, Android Studio 3.0

Today we're giving you an early look at Android 8.1. This update to Android Oreo includes a set of targeted enhancements including optimizations for Android Go (for devices with 1GB or less of memory) and a new Neural Networks API to accelerate on-device machine intelligence. We've also included a few smaller enhancements to Oreo in response to user and developer feedback.

Android 8.1 while literally nobody is even using Android 8.0 yet. OK Google, OK.

Coinciding with the Android 8.1 developer preview, Google also released Android Studio 3.0.

This release of Android Studio is packed with many new updates, but there are three major feature areas you do not want to miss, including: a new suite of app profiling tools to quickly diagnose performance issues, support for the Kotlin programming language, and a new set of tools and wizards to accelerate your development on the latest Android Oreo APIs.

Ars Technica’s Android 8.0 review

Ars has a very detailed review - more of an in-depth deconstruction, to be honest, and that's a good thing - of Android 8.0 Oreo.

Take a closer look at Oreo and you really can see the focus on fundamentals. Google is revamping the notification system with a new layout, new controls, and a new color scheme. It's taking responsibility for Android security with a Google-branded security solution. App background processing has been reined in, hopefully providing better battery life and more consistent performance. There's even been some work done on Android's perpetual update problem, with Project Treble allowing for easier update development and streaming updates allowing for easier installation by users. And, as with every release, more parts of Android get more modularized, with emojis and GPU driver updates now available without an OS update.

Saving this one for tomorrow.

Hardening the kernel in Android Oreo

The hardening of Android's userspace has increasingly made the underlying Linux kernel a more attractive target to attackers. As a result, more than a third of Android security bugs were found in the kernel last year. In Android 8.0 (Oreo), significant effort has gone into hardening the kernel to reduce the number and impact of security bugs.

Android Nougat worked to protect the kernel by isolating it from userspace processes with the addition of SELinux ioctl filtering and requiring seccomp-bpf support, which allows apps to filter access to available system calls when processing untrusted input. Android 8.0 focuses on kernel self-protection with four security-hardening features backported from upstream Linux to all Android kernels supported in devices that first ship with this release.

Is it common to have to backport security features of newer Linux versions to older ones? Or is this just a peculiarity of Android's Linux kernel being so far behind the times?

Google announces ARCore, its answer to Apple’s ARKit

With more than two billion active devices, Android is the largest mobile platform in the world. And for the past nine years, we've worked to create a rich set of tools, frameworks and APIs that deliver developers' creations to people everywhere. Today, we're releasing a preview of a new software development kit (SDK) called ARCore. It brings augmented reality capabilities to existing and future Android phones. Developers can start experimenting with it right now.

We've been developing the fundamental technologies that power mobile AR over the last three years with Tango, and ARCore is built on that work. But, it works without any additional hardware, which means it can scale across the Android ecosystem. ARCore will run on millions of devices, starting today with the Pixel and Samsung's S8, running 7.0 Nougat and above. We're targeting 100 million devices at the end of the preview. We're working with manufacturers like Samsung, Huawei, LG, ASUS and others to make this possible with a consistent bar for quality and high performance.

Essentially Google's answer to Apple's ARKit, and definitely a rebranding (at least partially) of Project Tango.

Android 8.0 overhauls installing apps from unknown sources

This is a pretty big change, detailed only a few days ago.

Eagle-eyed users of Android O will have noticed the absence of the 'Allow unknown sources' setting, which has existed since the earliest days of Android to facilitate the installation of apps from outside of Google Play and other preloaded stores. In this post we'll talk about the new Install unknown apps permission and the security benefits it brings for both Android users and developers.

Google goes into more detail a few paragraphs down:

In Android O, the Install unknown apps permission makes it safer to install apps from unknown sources. This permission is tied to the app that prompts the install - just like other runtime permissions - and ensures that the user grants permission to use the install source before it can prompt the user to install an app. When used on a device running Android O and higher, hostile downloaders cannot trick the user into installing an app without having first been given the go-ahead.

This new permission provides users with transparency, control, and a streamlined process to enable installs from trusted sources. The Settings app shows the list of apps that the user has approved for installing unknown apps. Users can revoke the permission for a particular app at any time.

Good move.

Samsung unveils Galaxy Note 8

Samsung has finally unveiled the Galaxy Note8, revealing the (rather heavily-leaked) device at its Unpacked event in New York City today. You won't be surprised to know that it comes with little in the way of surprises. It's basically a bigger Galaxy S8+ with a stylus and dual cameras.

The Note8 is something of a chance for Samsung to make things up to fans of the Note series, after the Note7 was forced off shelves because of defective batteries that led to the smartphone catching fire. Knowing that Note fans were deprived of a generation of hardware, Samsung is likely eager to capitalize on the eagerness of said fanatics to finally upgrade.

I'm not the target market for a Note, but you have to admit - these recent Samsung flagships are a far, far cry from the ugly, plasticky crap they used to make. There's no accounting for tastes - or practicality - but this Note 8 is a beautiful piece of engineering.

Google officially releases Android 8.0 Oreo

Today, we are officially introducing Android 8.0 Oreo, the latest release of the platform - and it's smarter, faster and more powerful than ever. It comes with new features like picture-in-picture and Autofill to help you navigate tasks seamlessly. Plus, it's got stronger security protections and speed improvements that keep you safe and moving at lightspeed. When you're on your next adventure, Android Oreo is the superhero to have by your side (or in your pocket!).

Coming to a device near you. Eventually. Maybe. But probably not.

Google to release Android O on 21 August

On August 21st, a solar eclipse will sweep across the entire United States for the first time since 1918. Android is helping you experience this historic natural phenomenon so you can learn more about the eclipse and count down to the big day - when you’ll meet the next release of Android and all of its super (sweet) new powers, revealed via livestream from New York City at 2:40PM ET.

If a new operating system version is released, but nobody's able to use it, has it really been released?

Amazon invests in Andy Rubin’s Essential

It's being reported by the Wall Street Journal that Amazon is among the companies which contributed to Essentials $300 million coffers. They also reveal that Best Buy and Amazon will be retail partners for the upcoming phone launch. The best bit of news, though, comes in the form of a set of dates. Although we still have no idea when the phone will launch (Essential has now very much overshot its 'end of the month' June prediction), Essential president Niccolo de Masi says, "I will give you an exact date in a week."

Those are some serious investors for Andy Rubin's new devices company.

Android 8.0 gets “streaming OS updates”

When you get that "out of space" error message during an update, you're only "out of space" on the user storage partition, which is just being used as a temporary download spot before the update is applied to the system partition. Starting with Android 8.0, the A/B system partition setup is being upgraded with a "streaming updates" feature. Update data will arrive from the Internet directly to the offline system partition, written block by block, in a ready-to-boot state. Instead of needing ~1GB of free space, Google will be bypassing user storage almost entirely, needing only ~100KB worth of free space for some metadata.

I promise not to make some snide remark about Android's update mess.

Jide discontinues Remix OS

We'll be restructuring our approach to Remix OS and transitioning away from the consumer space. As a result, development on all existing products such as Remix OS for PC as well as products in our pipeline such as Remix IO and IO+ will be discontinued. Full refunds will be issued to ALL BACKERS via Kickstarter for both Remix IO and Remix IO+. In addition any purchases made via our online store that has remained unfulfilled will also be fully refunded. This requires no action from you as we will begin issuing refunds starting August 15th.

I'm shocked.

Android is a dead end

Dieter Bohn at The Verge:

So while Microsoft didn't do itself any favors, I'd argue strongly that all these machinations and flailings weren't a response (or weren't only a response) to the iPhone. The real enemy was the company that had set its sights on Microsoft's phone ambitions since before the iPhone was released.

That company was Google, of course, and it only tangentially wanted to take on the iPhone. Google's real target was always Microsoft, and it hit the bullseye.

This article looks at the past, so let me take this opportunity to posit something that might come as a surprise to some.

Android is a dead end.

I really want to write a far more detailed and in-depth article explaining why I think Android is a dead end, but I can't yet fully articulate my thoughts or pinpoint why, exactly, I've felt like this for months now. All this doesn't mean Google is going to get out of mobile operating systems, and it doesn't even mean that the name "Android" is going away. All it means is that what we think of today as "Android" - a Linux kernel with libraries, the Android Runtime, and so on on top - has served its hackjob, we-need-to-compete purpose and is going to go away.

Android in its current form suffers from several key architectural problems - it's not nearly as resource-efficient as, say, iOS, has consistent update problems, and despite hefty hardware, still suffers from the occasional performance problems, among other things - that Google clearly hasn't been able to solve. It feels like Android is in limbo, waiting for something, as if Google is working on something else that will eventually succeed Android.

Is that something Fuchsia? Is Project Treble part of the plan, to make it easier for Google to eventually replace Android's Linux base with something else? If Android as it exists today was salvageable, why are some of the world's greatest operating systems engineers employed by Google not working on Android, but on Fuchsia? If Fuchsia is just a research operating system, why did its developers recently add actual wallpapers to the repository? Why does every design choice for Fuchsia seem specifically designed for and targeted at solving Android's core problems?

I don't like making broad predictions based on gut feelings and spidey senses, since they can be incredibly misleading and hard to read, but I'm still pretty confident on this one: over the coming two to three years, Android will undergo a radical transformation. This transformation will be mostly transparent to users - their next Android phone won't actually be "Android" anymore, but still run the same applications, and they literally won't care - but it won't be a Linux device, and it won't suffer from Android's core problems.

In a few years, Google's Pixel phone will have a fully custom, Google-designed SoC, and run an operating system that is Android in brand name only.

Bookmark this.

Android execs talk updates, Project Treble, Linux, more

Google I/O doesn't need skydivers or LCD Soundsystem to keep us interested year to year - we'll happily settle for what is becoming an annual chat with members of the Android team. Heading into this year's conference, the group was fresh off the release of the second Android O Developer Preview and the announcement of Project Treble, a massive modularization of Android's hardware dependencies that should make updates a little easier on everyone involved with the OS. So as usual, there was plenty to talk about.

Dave Burke, VP of engineering for Android, has made time for us at several recent conferences, but this year we also had Stephanie Saad Cuthbertson, PM director for Android, in on the conversation. Given the opportunity, we tried to keep these questions pretty technical.

Ars does a duo-interview with two Android execs at Google.

Android developers can now block rooted devices, Netflix bites

Over the weekend, it was discovered that the Android Netflix application could no longer be installed on rooted Android devices - in fact, it vanished from the Play Store on rooted devices completely. Netflix then confirmed it started blocking rooted devices from installing the Netflix application.

Well, it turns out we'll only be going downhill from here, as Google explained at I/O that from now on, developers will be able to block their applications from being installed on rooted Android devices.

Developers will be able to choose from 3 states shown in the top image: not excluding devices based on SafetyNet, excluding those that don't pass integrity, or excluding the latter plus those that aren't certified by Google. That means any dev could potentially block their apps from showing and being directly installable in the Play Store on devices that are rooted and/or running a custom ROM, as well as on emulators and uncertified devices (think Meizu and its not-so-legal way of getting Play Services and the Play Store on its phones). This is exactly what many of you were afraid would happen after the Play Store app started surfacing a Device certification status.

This is bad news for the custom ROM community. If I can no longer install Netflix (and possibly more applications) on custom ROMs, there's no way I'll be using custom ROMs on my devices. For now, this is a Play function and we can still sideload the applications in question, but with Google Play Services installed on virtually every Android device, one has to wonder - and worry - how long it'll be before such checks happen on-device instead of in-Play.