Database Info

How safe are custom roms to use?

I was wondering if anyone knows a real answer for this. How easy would it be to cook in something that would send back your email login and password? Or other logins to stuff like banking sites. The people who make the roms seem to be hard working enthusiasts, but it still makes me nervous.
The reason I am asking this is because WM6.1 seems pretty buggy and slow and I was hoping that maybe updating to 6.5 would help, however Sprint is being super slow and vague (as usual) about if they will ever release an official rom.
And please no "then just don't use custom roms" replies. I am just hoping someone has some way to show that they are safe and then I will happily use it!

I was wondering the same thing. I don't use any cooked rom for anything banking related for this possible risk.

I know there are other threads that have the answer but can't find them maybe someone hid them?
Anyway what would the average chef gain, second of all how do you know a member of Opera or IE is not taking down your details or even Bill? "by that i mean there is more to worry about"
My point being chefs cook ROMs to give users better phones than stocks... Also the world of WM isn't laden with virus's/spyware so even doing so would be hard and no one would be bothered to spend there time considering how much time cooking consumes.
Just Hard-SPL your device and start flashing

I find cooked roms are the best! They are tweeked, customized, optimized, flexable, etc. Happy Flashing

Im still leary. Im going to wait until you all flash...then i will know its safe

If any chef here did anything as dumb as that, I guarantee you everyone would know in VERY short order what was done, and that chef would be hung up by his ankles and verbally flogged by everyone here.
Trust me, it's never happened here, and it's not GOING to happen; because we have a great community here with great chefs who do nothing but make life better for everyone else. Choose a ROM, flash it, and quit being so paranoid.

FloatingFatMan said:
If any chef here did anything as dumb as that, I guarantee you everyone would know in VERY short order what was done, and that chef would be hung up by his ankles and verbally flogged by everyone here.
Trust me, it's never happened here, and it's not GOING to happen; because we have a great community here with great chefs who do nothing but make life better for everyone else. Choose a ROM, flash it, and quit being so paranoid.
Click to expand...
Click to collapse
That is a very argumentative answer to a very simple and valid concern that allwires has regarding the security of using cooked rom's. Some people that use these rom's like to use their device's web capabilities for banking and for storing personal information and he brings up a very valid question regarding the safety of using these rom's for these purposes. Then you insult the poster by saying he or she is being paranoid when we all know that the capabilities for wrong doing via viruses and other malicious software are very valid concerns in this day and age. I would like to hear an intelligent and informative answer to this question since I'm sure as this sort of thing becomes more mainstream as it is bound through time to become there will be many more inquiries made as to the safety of their usage.

I'm with FloatingFatMan here, any cook daft enough to do such a thing to a ROM would very quickly be found by his peers, tried, convicted and summarily thrown to the lions.
For all that how do we know Messrs Gates, Jobs, well their minions anyway , and other sundry "professional" ROM cooks are not hiding sneaky payloads in?

deedee said:
I'm with FloatingFatMan here, any cook daft enough to do such a thing to a ROM would very quickly be found by his peers, tried, convicted and summarily thrown to the lions.
For all that how do we know Messrs Gates, Jobs, well their minions anyway , and other sundry "professional" ROM cooks are not hiding sneaky payloads in?
Click to expand...
Click to collapse
Well, but you see that is my point exactly. Whether it is the big guy or the small guy doing it history has shown that where there is a will there is a way, especially when there is a profit to be made. Its like when Norton got busted for spyware found in their AV software in the early 2000's, remember that? I just wonder if such an attempt will be made with this newly emerging technology that is similar to the PC of the late 90's and the early 2000's, vulnerable. No one is offering (at least no one that I'm aware of) AV or firewall software for these various mobile OS's and I think that it is only a matter of time before the bad guys find a way to take advantage of these opportunities the same way they did the PC. Al least over time there became ways to detect these types of illegal practices with firewall software and packet capture software that made the average user capable of some control over his or her personal data.

qqa92 said:
Well, but you see that is my point exactly. Whether it is the big guy or the small guy doing it history has shown that where there is a will there is a way, especially when there is a profit to be made. Its like when Norton got busted for spyware found in their AV software in the early 2000's, remember that? I just wonder if such an attempt will be made with this newly emerging technology that is similar to the PC of the late 90's and the early 2000's, vulnerable. No one is offering (at least no one that I'm aware of) AV or firewall software for these various mobile OS's and I think that it is only a matter of time before the bad guys find a way to take advantage of these opportunities the same way they did the PC. Al least over time there became ways to detect these types of illegal practices with firewall software and packet capture software that made the average user capable of some control over his or her personal data.
Click to expand...
Click to collapse
Hey There,
Not wanting to be unkind but i think you are being very paranoid here and btw, you can indeed purchase AV software for mobile devices; youve only gotta google AV software for windows mobile to see that
The limited OS and how its written means the "baddies" would have nothing to gain/find it difficult to exploit so whats the point.
The only "virus" (and i use the term loosely) i ever came across actually asked you "do you want to install blah blah blah" to which the obvious answer was no.............oooo that was dangerous
To summerise, dont get your knickers in a twist about it and enjoy!

^^ And to add to Tim's comments. Just make sure you get your cooked ROM from an established chef if you're worried, and there won't be any problems.
Now, if the ROM was from someone with a tiny postcount and wasn't known, then you might have cause to think twice; but that's not going to happen here...

timmymarsh said:
Hey There,
Not wanting to be unkind but i think you are being very paranoid here and btw, you can indeed purchase AV software for mobile devices; youve only gotta google AV software for windows mobile to see that
The limited OS and how its written means the "baddies" would have nothing to gain/find it difficult to exploit so whats the point.
The only "virus" (and i use the term loosely) i ever came across actually asked you "do you want to install blah blah blah" to which the obvious answer was no.............oooo that was dangerous
To summerise, dont get your knickers in a twist about it and enjoy!
Click to expand...
Click to collapse
Well then why not let the cat out of the bag. I'm just in here to see if I can get a large portion of the members in here's knickers in a twist so that they will all go out and buy my mobile AV since mine is the biggest one out there currently. Lots of potential there, in terms of cha-ching you have to agree. LOL!

There's also the option of downloading a kitchen and cooking your own ROM ... this method permits you to look at each package in detail.
Cheers,

I once opened my yahoo on a cooked room, later on I was trying to log on on my laptop and password was rejected. I freaked out and kept trying, later that day I was able to log in after few hours for some unknown reason...
I stopped using my HTC fuze for emails since.
The myth that ALL cooked ROMs in here are completely clean sounds like an old familiar story of when the young man said to the girl "don't worry it will not hurt a bit" lol
I wish there was a tool that scans for such security gaps in a ROM

I'm not sure what your reasoningn was to stop using email on the phone because of a failure to login to yahoo from a laptop. Did you notice any malicious activity on your yahoo account? Have you since? Have you changed that password? Just seems strange.
As for the security of cooked ROMS, I've never used one but I have a new phone coming and I'm going to try one from a reputable party here. I'm not nervous about it and I use online banking all the time. Here is why I am not concerned:
1.) As several people pointed out already, your PC is more vulnerable just because of sheer numbers. WinMo has a small market share and cooked ROMs would represent an even smaller market share. Even then, there are many custom ROMs to choose from. Then if EVERY user of a specific tainted ROM used their online banking on their phones, there is still little they could actually do with that information. For example, chase uses text messaging which means yes, someone could get my balance and stuff, but I actually have to login to the site to authorize my phone rather than login through the phone. So the information itself may or may not be useful. At the end of the day, it just wouldn't make the chef much money since there would simply be too few potential victims.
2.) The liklihood is very high that the perp would be caught by their peers and exposed in order to 1 - protect their own integrity, and 2 - get bonus points for being the one who exposed the bad guy (or girl). When you add this level of risk to the low reward, it just doesn't make sense. High risk, lots of work, little reward.
3.) Then of course, if someone fraudulently accesses your account, you can usually get that money back.
So I'm perfectly comfortable froma security standpoint. It's the stability standpoint I'm a bit concerned about but that's why I'm waiting till I get my new phone to try one out so I can go back to my old phone if it all craps out.

RedScorpion78 said:
I once opened my yahoo on a cooked room, later on I was trying to log on on my laptop and password was rejected. I freaked out and kept trying, later that day I was able to log in after few hours for some unknown reason...
I stopped using my HTC fuze for emails since.
The myth that ALL cooked ROMs in here are completely clean sounds like an old familiar story of when the young man said to the girl "don't worry it will not hurt a bit" lol
I wish there was a tool that scans for such security gaps in a ROM
Click to expand...
Click to collapse
I was thinking the same thing and how much it would cost to have Lavasoft or AVG or Symantec evaluate ROMs as an impartial third party.
If anybody is thinking peer review would snuff out cheaters there are plenty cases where Ebay and Craigslist deals go bad and everybody is in on it - even (inadvertently) the local police authority that doesn't have the technical knowhow to deal with a cyber-based threat.

startluvova said:
I was thinking the same thing and how much it would cost to have Lavasoft or AVG or Symantec evaluate ROMs as an impartial third party.
If anybody is thinking peer review would snuff out cheaters there are plenty cases where Ebay and Craigslist deals go bad and everybody is in on it - even (inadvertently) the local police authority that doesn't have the technical knowhow to deal with a cyber-based threat.
Click to expand...
Click to collapse
Hey there,
Way to go to ressurect an old thread
Nothing has changed, i have never heard of seen of a custom rom that has a virus cooked in, or one that has been intentionally created to spy on the user.
That said, i guess you have to make your own decision after reading the comments from some experienced chefs/flashers here
CHeers.

[Q] Paying Developers to customize your phone !

Am a Non-conformist, I don't try to follow the herd's travels in getting the Best looking customizing on my phone. I became really frustrated with my G2 over the past few days and I'll tell you why .
The G2 is the only phone that I have to go through different hoops in order to hack it to be able to install a custom ROM on it ! After all, the whole idea is to be able to customize it to begin with with some fancy screens and new apps. Every time a new ROM comes out, were all racing to get it installed and working on our devices and were left with a huge mess. Can you honestly remember what ROM you installed last week and have you forgotten what procedures to take before installing your New fancy Rom over it ?
Every time I come here and look at the ROMS being worked on, it seems that you have to follow that developers procedures in order to get it working and guess what, if you BRICK it, it's your own damn fault ! Ain't no one here to blame you for trying out that new fancy Rom, right !
What got me worked up was this, I received a picture from someone via mms and after previewing it on my G2, it closed the thread and took me to my list of sms threads and I still can't figure out how to save the damn picture to my phone !
Maybe, I just overlooked something and maybe I installed an app from the market that changed some small aspect regarding sms and mss messaging, I don't know and frankly, I dislike coming to any forum and having my intelligence questioned by some smart ass nerd who knows more then I do, only because he has the information to fix my problem but is not willing to share the solution until he makes himself Glorified.
Developers are indeed SMART and very SKILLED at what they do but it just seems to me that all it takes is just 1 individual to bring down the Fame and Glory because this 1 individual fails to follow instructions.
How about let's change all this to an idea I have.
An individual comes here with a NEW factory carrier phone, he wants to have it customized his way, He's willing to pay a certain developer to cook a BASE ROM, let's say $25.00 dollars and he likes it, Now he wants certain apps that make it work, let's say he's willing to pay $ 5.00 to 10.00 at the very least, depending on the apps usage. NOW, this NEW owner has his own phone customized to his liking, He's happy as a clam, right ? Maybe and maybe not.
Does anyone have any suggestions or ideas like this? Is it worth trying here ?

If developers had the time to handle your phone the amount of money you are suggesting would probably not buy that time. Also I think it is customary here to take donations and not payment for services. Sorry about your bad experience. Not all of the smart people here are so unrefined as the ones you encountered. Try to keep a cool head. Everything that happens to your phone after the instant it is rooted is ultimately YOUR PROBLEM, like it or not, and that goes for everybody, including smarty pants geeks! If your not a paid member you might want to consider becoming one. If you're new around here it probably couldn't help to have something going for you. If you think you got off on the wrong foot with somebody, PM them a well thought out apology, you might make a friend and get the help you need. Just a thought.

The Market Incompatibility Final Solution

The short version:
Let's get Google to change the market incompatibility from "You can't have this," to "Are you sure...?" Because quite honestly why waste precious minutes downloading an APK from some unknown source that for all you know could be tempered with and wind up ****ing up your device.
The teal deer version:
There are now numerous threads regarding this issue and I think it's time we had one that was the central place for us to discuss this issue as it's too scattered about and so far all attempts at remedying the issue have been either in vain or temporary. We shouldn't have to suffer so much over something so unnecessary.
The idea is sound, sure, but its ways of going about doing so are very wrong. In the event that an app doesn't work as expected, or at least in suspicion of such, it need only be noted as a warning to the user. So instead of seeing that black bar stating that we can't have app X and have the install button disabled, we should see that same black bar but with a warning and the install button enabled irregardless.
If big brother is worried that because the app is known to have issues on our devices then they need only to disable the ability to rate the app for that specific user. But that's about it, as it's fairer to both parties involved. We shouldn't have to go through the hassle of having to have to keep looking for ways around something that only goes to further slow down progress, or downloading and installing APK files every time there's an update to our apps (some of which were paid for)!
We need to attack the disease at its source rather than treat the symptoms.
What the issue is basically is that "power" users prefer to use tweaked settings that the market doesn't like despite the fact that those same apps Google deems incompatible, when installed as APKs, actually work flawlessly.
I figured we should have this thread focus on the following issues:
---------------------------------------
1. Have something of a Database (or at least a simple list for now) of all the apps that El Goog doesn't want us to install. Just to emphasize the issue as there are quite a bit of apps that work flawlessly and appear in the market, while others aren't (in some cases without the developer's own wishes or knowledge for that matter). And we then label them as working 100% perfectly well or buggy under conditions Y and Z.
We make the list of all apps that are known to be incompatible and actually are! So far I've not encountered a single one. And I've been using my freak device with its freaky settings for a year+ now.
2. This is something I'm still thinking about and am not 100% sure if should be done. Start a petition on Change.org and bring this to big brother's attention as he tends to ignore the little guy. In numbers there's strength.
3. Get a list of app developers who are aware of the issue and support our cause. The reason for three is because I've been in contact with one app developer who was turned down by big brother after pursuing help with this issue because they "don't provide support for custom roms." And it's OK that they don't, as it's reasonable enough. But give us the option of opting out if you think it's wise to, and opt in even if it might cause issue. We're adults for god's sake.
4. Make a list of currently available solutions to fix the so-called 'feature' while we're waiting for an actual fix.
I'll keep this post as updated as I can with the latest known and consistently updated fixes for this 'bug'. Yeah, I said it.
---------------------------------------
So far every single app I used worked flawlessly on my I9100 running CM10 with DorimanX custom kernel. I've set the DPI to 160 and I can't imagine myself going back to anything above that. And to emphasize, I've had these setting (or at least the DPI and CM) for so long now (about a year) that I forget sometimes that I'm using something that isn't exactly 'standard', per se.
I mean, if you can live with the default dpi then that's cool, good for you. But I've had a taste of the forbidden fruit, and now I can't go back. . . .
I'm not going to start crusading just yet. First I'd like your, the community of XDA, input on this issue before we do anything. If you have any suggestions or criticism you'd like to share with us, I'd like to hear it, personally. For I may be wrong about the whole thing. Call it, lacking in confidence.
Thank you.

Reserved, just in case.

Also reserved, just in case.

Well this is fantastic. Congrats on the nerve for writing this freakishly long post. That's what I was thinking since the moment I encountered "I'm sorry, but we think this won't work as planned on your device and we deem you stupid enough to make wrong choices, so we'll just put this install button on this shelf right here, where you can't reach it" error.
However, I just said screw it, there's tons of sites where I can just download what I want without anyone questioning my motives and whether it will work or not. Never thought of it as a big deal, just as a tougher way of doing stuff, but not much I can do about it.
To get to the point, I support this cause, will sign whatever I need to sign, but am to lazy to start it myself Just wanted to give you some support. If you're willing to put some more time into this, maybe this is the beggining of a revolution! Revolution of geeks with custom DPIs! But it's still something damn it!
Cheers mate!
Sent from my Desire HD using xda app-developers app

Thank you, Uros. I was happy to read your reply.
It seems that there is no interest in this, however. Very unfortunate, but I suppose if this is what the people want. . . . It was worth a try.

Thanks for your effort.

I am rather curious to know if this is because people were going "tl;dr" or they're genuinely not interested in having this issue fixed. I just need to know so that I could make the proper adjustments.
Granted, it would take a bit longer, but as Goethe said, "I apologize in advance, had I had more time, this letter would be shorter."
Or is it that most people believe that the odds of getting Google to listen to us are too small?

There's a reason why Google won't give us the option to install anyway, just as there's a reason as to why this probably hasn't been noticed by as many people as preferred.
It all comes down to noobs.
Regarding this thread, the noobs are probably coming across this thread and click because they're interested by the title. They see all the text and think "F&#k that!". Unfortunately, that is generally the noob mentality.
Maybe colouring some of the text and spacing it out a little bit more could help the cause, but only time would tell.
Now onto the matter at hand.
I personally don't think Google will allow us to install apps anyway (even though I think they should) because noobs are super dangerous to themselves. In general, noobs won't read which then means that if they go to install an app which isn't compatible and install it anyway, they won't read that it could potentially harm their device.
The other type of user to make a mistake when it comes to installing such apps, would be the general android population. After all, us here on XDA are but a small proportion of Android users globally. Just because we have knowledge about what should and shouldn't be on our devices and how to make things work which shouldn't, the average Android user isn't the same.
They'd probably see the message and simply think "It says it could harm my phone but it's a great phone so nothing will go wrong". That is where problems can then occur.
The noobs and the average android owner would then have mucked up their device in one way or another and would be blaming and complaining to Google (as if it was Google's mistake). That makes it cause more harm than good, hence why I don't think it will happen.
Just my 2 cents, of course
''Silence is golden, but duct tape is silver''

[Q] 3 REALLY REALLY! good app ideas.. where to go from there?

Hey, I'm new to this forum so if I'm posting this question in the wrong section, go easy on me. So I have 3 extremely good ideas for mobile apps and I don't know what to do with them. I'm not an app developer or programmer, I don't have capital to pay other developers and programmers to put these apps into motion and I'm not sure what steps I could take to get these ideas off the ground. I have a feeling some people will say, that's nice, but without any of the things I listed in the previous sentence, it'll be just a pipe dream and until I have capital, I'd be better off to forget about my ideas. So I'm here to see if maybe there is a place to go or how to find the right people to talk to about giving out ideas and getting a small percentage from the apps success.
All three ideas are related to business operations and one, in my opinion would be easier to develop than the other two, and as far as I know, there isn't any apps right now that do what my idea for the 3 apps would be doing. I could teach myself how to develop the apps but that would take years and by then, they may already be developed by someone else. I will vaguely describe the 3 ideas as one would grab information from GPS locations to gather information from the user and would be extremely beneficial to any private or public sector's finances. The second one would use a persons location and SIRI. The third would mainly use location and video/audio.
Is there a website people with ideas can go to and send the idea to whoever there with clear terms mentioned before submission of how the ideas are dealt with so that the idea holder gets some recognition or stake in the idea development and then passes on the idea to a company that will make good use out of it. If there isn't anything like that, a website similar to that would also be a good idea. Businesses need to constantly evolve and come up with new ways to attract and retain customers, and my ideas would benefit business operations by saving time, minimizing costs, and staying ahead of the game by taking advantage of new technology.
Even if my app ideas don't come to fruition, I'm still happy that I came up with them and can come up with more, because without new ideas this world would be a sad and boring place to live.
Any feedback is greatly appreciated! Thanks for your time and help in advance!

[Q] [Help!] Video chat to answer lots of questions, general and device specific?

Hello! First off, thanks for having an awesome website like this, and forums full of help!
So as the thread title states, I'm looking for someone to video chat with so I can ask a bunch of questions. I am a slow reader, and have some eye strain issues, so I tend to avoid reading like the plague; so looking through lots of forum threads for each piece of information isn't a great option for me. The other reason why a vid-Q&A session would help me is because I really am pretty ignorant on most of this fancy cell-phone type of stuff, and may have a huge range of questions, from basic definitions, to device-specific possibilities, to program choices, etc. I don't do well learning stuff from reading, and am much more of a discussion-learner. Also, typing back-and-forth is also very time consuming, so I'm not huge on that sort q&a either (though obviously, if someone's willing to spend time helping me out, I'm appreciative of whatever way they help). Finally, the big crunch factor is time. I have 6 days to return this device, and I think I'll need more time than that (due to my schedule) to figure everything out on my own forum-searching. So I'm humbly asking if someone is available and willing to spend their time to make my work easier. I'd be greatly appreciative!
I need someone who speaks English. I'm in the Eastern time zone (US East coast). Please PM me if you're able to help!
Some of my question topics:
I bought a 'new' T-Mobile Galaxy S3 T999. But I'm seeing indications that the device is rooted or something. True?
Is my device disabled from downloading any updates, or just an issue with Samsung holding the current update?
The Root Explorer app shows all options in some oriental language. Is there a way to change that?
***When dialing to make a call, my older phone would allow me to search by name (so I'd hit 5646 and anyone named John, and other possible names would show up as options). My new phone doesn't do this, and I don't see an option anywhere for it. Is there a simple way to change this? (This is the question which started my search in the first place, bringing me here).
All Galaxy S3s are basically the same hardware? The only difference really in how things play out is the programming/OS?
My device has 4.1.2 T999UVDMD5. I read (here: ___support.t-mobile___.com/thread/44716___) that this OS is pretty crappy, and he's happy with the one he replaced it with. I need help figuring out whether switching up my OS is right for me, or no. I do see some lag in performance, and a bit of quick battery eating. Also not so happy with minor changes to the keyboard.
Where can I find layman's definitions of terms that people are throwing around? Like ROM, Firmware, Flashing, Odin, Kernel, etc. I assume that if I'm going to mess with my phone, I should know these things.
If all phones are created equal, and can be stripped down and dressed back up to function as desired, would it make more sense to return my $350 new S3 (non-contract), and buy a used one in good condition from Swappa for $200-300, and rework it?
Is buying from swappa safe? Seems kinda sketchy to me, in terms of reliability for returning a product if needed.
Like I said, lots of questions all over the place. Thanks in advance for reading and any help you can give! (especially to any tech guru's who aren't camera shy.