I have been a fan of installing custom ROMs, root and other mods to my phones since I first owned an Android phone, which was a Sony Xpera Z3 Compact.
Back then I didn't care so much about security, because I was thinking 'What, are they gonna steal my Instagram account?'. But as I grew older the situation got more complex and now I feel the need to feel secure while using a ROM, which is almost never these days. So here are my reasons:
- Custom ROM developers have the exact same device as we do, so if they wanted to exploit it, they would exploit the hell out of it and get their hands on everything we have. (Looking at you, MIUI port)
- Some ROMs come with SELinux disabled which is a problem in itself, I believe.
- Even apps like Magisk, although they're open source (well, most of them) who knows what they're doing in the background.
- It is fairly easy to install a keylogger built into a custom ROM, how do we know that we are already not compromised a few times?
Am I being paranoid here? Or does everyone just want to install their flashy mods and get on with it, like I used to back in the day?
I would love to hear all of your opinions on this!
interesting thoughts and it's always good to be a little concerned about security and privacy!
for custom roms i think in general they tend to be more secure than most stock roms. especially when they have OFFICIAL status - you often get faster updates or updates at all if you have an older device.
unlike big company's, the developer of these roms do it for fun and in general don't have economical interest. so why would they want to steal data/insert backdoors or whatever? thats something company's and governments are interested in...
what i see is that these devs usually check exactly what's happening inside a ROM and a more likely to remove/block suspicious apps or whatever.
also custom ROMs are always open source, aren't they? so everyone can check what's happening... same like Magisk and stuff. everyone's gonna see it if you are trying to steal people's data or something.
i personally trust ROMs based on Lineage OS more than any other stock ROM because they're developed by normal people and not by greedy company's...
although im using MIUI right now because its comfortable but i don't really trust them chinese stuff in terms of data security
merlin.berlin said:
also custom ROMs are always open source, aren't they? so everyone can check what's happening... same like Magisk and stuff. everyone's gonna see it if you are trying to steal people's data or something.
Click to expand...
Click to collapse
First off, thanks for sharing your thought on this. Second, that's been a long time debate, whether open source software is really secure or not. Because although the source of the code is open for inspection, especially in small projects - like device specific projects, many of the security threats and bugs go unnoticed. Of course I trust Magisk, because it is open source AND many Android enthusiasts know about it to a level.
But when it comes to custom ROMs, if you actually check the forum, most of them aren't open source. Hell, we don't even know where they're coming from in some cases (MIUI, EvolutionX etc...). Well, I agree with the Official custom ROMs, because most of the time they're open sourced. But you need to be aware that especially the MIUI ports on this forum, are grabbed from Russian forums. So now (I'm not accusing anyone here), possibly the Russians (4pda), Chinese (Xiaomi) and feds (lol) can reach your data.
I share these concerns. I don't understand why xda doesn't have a policy of not allowing custom roms which don't display their origin/source. Miui mods, Gapps I never use. Bottom line is that with all data collection and spying going on through devices one can only protect her/himself based on personal knowledge and level of concern. And official vs. unofficial is a non issue.
Well, shortly - they aren't secure and you can trust them as much as you trust a person behind them, which you probably don't know well - means not much. And even if there is no bad will from trustworthy community member, you still have to trust that they weren't hacked and let's be honest - big companies are being hacked fairly regularly, let alone hobbyst xda developers. Considering the small user base of the roms, in 99% cases nobody would even realize any malicious stuff happening.
Definitely most stock roms are more secure than custom roms. BUT. Then comes privacy. On stock roms, google, and in most cases phone manufacturer harvest virtually all your data and everything you do, so the only plus here is that you may believe that it will never leak. For me it's not better at all.
At this moment probably the best you can get is a custom rom from trustworthy project with big userbase and many eyes watching - Official Lineage OS builds or one of the few serious privacy focused projects.
Hey,
as somebody who has published ROMs here I really wanted to share my thoughts on this.
First of all, you are right on having concerns about the security of custom ROMs.
There are essentially two types of security at stake here: One is the security of your device, if a third person gets physical control over it. Here, the case is quite clear: The moment you unlock the bootloader, an attacker with physical access to the device will be able to flash anything he wants and essentially circumvent any locking mechanism you have in place. Encryption would help, but implementing properly in a custom ROM and still keeping the functionalities users like about custom ROMs (e.g. easy switching between them, proper updates without the need for OTA) is quite difficult. In short, if you want to prevent anybody who might access your phone physically from gaining access to your data, keep stock ROM and boot loader locked.
The second type is data security and privacy, which was treated in OP. And OP was right, that there is a possibility of adding nearly anything to the code. I am speaking for myself right now, but I guarantee you, that I have never added anything to the ROM code (which for all AOSP ROMs needs to be public, any single line can be reviewed), device tree (public on github as well) or kernel (needs to be published as well). I know, it is my word to be taken here and there is nothing preventing e from lying (because I could add local changes to the code that are never made public). And there is a lot of faith involved, which is why I started building my own ROM. So if anybody feels uncomfortable with installing a ROM that potentially could contain malicious changes, it is better to stay on the stock ROM. On the other side though, the probability that devs like me, that do this essentially for fun and because they want more features and better experience than stock has to offer on their own phones, will invest the time to add a keylogger or other malware to than exploit maybe 10 or 12 people that will actually run the ROM, is quite low imho. Xiaomi, Huawei (or any other company) might be forced by some government to install backdoors or reveal userdata as well. It essentially boils down to trusting the open source community and a dev or trusting some corporation. I honestly do not have an easy answer to this and it probably differs for each person.
As why some ROMs (including my AOSiP 10) run with SELinux on permissive: SELinux enforcing is tricky. If the policy is written poorly, it will prevent your phone from booting or block essential features. And although I am quite android and linux savy and can write my own code, getting SELinux right is still a challenge. On Pie we had an experienced dev like Offain who essentially did it for most others as we used his trees, but for Ten we are still trying to get the devices working to their full extent on a never kernel version (4.9 instead of 3.18). SELinux has a lower priority for me, although I definitely want to make it enforcing as soon as possible.
The example of the kernel is a good point though why I think that custom ROMs can be more secure than stock if you are ready to trust the devs: Most of us use a newer, more up to date kernel than Xiaomi with upstreamed security patches, provide Android security patches earlier than Xiaomi and probably will continue to do so even when for Xiaomi the device will have reached EOL. At the moment, stock probably is the safest in terms of integrity, although it lacks features and is not quite up-to-date. But I have found on any device I owned, that keeping it somewhat up-to-date after official EOL through custom ROMs was a very important part of being able to use it longer than its intended life span.
Long story short: I guarantee you all that I am not interested in your private data and will not try to extort you or sell your credit card information or whatever... If there are bugs and vulnerabilities they are absolutely unintentional and I will try to fix them to my best knowledge if I am made aware of them. Anyway, please think critically and feel free to make the decision you feel best with.
opal06 said:
Hey,
as somebody who has published ROMs here I really wanted to share my thoughts on this.
First of all, you are right on having concerns about the security of custom ROMs.
There are essentially two types of security at stake here: One is the security of your device, if a third person gets physical control over it. Here, the case is quite clear: The moment you unlock the bootloader, an attacker with physical access to the device will be able to flash anything he wants and essentially circumvent any locking mechanism you have in place. Encryption would help, but implementing properly in a custom ROM and still keeping the functionalities users like about custom ROMs (e.g. easy switching between them, proper updates without the need for OTA) is quite difficult. In short, if you want to prevent anybody who might access your phone physically from gaining access to your data, keep stock ROM and boot loader locked.
The second type is data security and privacy, which was treated in OP. And OP was right, that there is a possibility of adding nearly anything to the code. I am speaking for myself right now, but I guarantee you, that I have never added anything to the ROM code (which for all AOSP ROMs needs to be public, any single line can be reviewed), device tree (public on github as well) or kernel (needs to be published as well). I know, it is my word to be taken here and there is nothing preventing e from lying (because I could add local changes to the code that are never made public). And there is a lot of faith involved, which is why I started building my own ROM. So if anybody feels uncomfortable with installing a ROM that potentially could contain malicious changes, it is better to stay on the stock ROM. On the other side though, the probability that devs like me, that do this essentially for fun and because they want more features and better experience than stock has to offer on their own phones, will invest the time to add a keylogger or other malware to than exploit maybe 10 or 12 people that will actually run the ROM, is quite low imho. Xiaomi, Huawei (or any other company) might be forced by some government to install backdoors or reveal userdata as well. It essentially boils down to trusting the open source community and a dev or trusting some corporation. I honestly do not have an easy answer to this and it probably differs for each person.
As why some ROMs (including my AOSiP 10) run with SELinux on permissive: SELinux enforcing is tricky. If the policy is written poorly, it will prevent your phone from booting or block essential features. And although I am quite android and linux savy and can write my own code, getting SELinux right is still a challenge. On Pie we had an experienced dev like Offain who essentially did it for most others as we used his trees, but for Ten we are still trying to get the devices working to their full extent on a never kernel version (4.9 instead of 3.18). SELinux has a lower priority for me, although I definitely want to make it enforcing as soon as possible.
The example of the kernel is a good point though why I think that custom ROMs can be more secure than stock if you are ready to trust the devs: Most of us use a newer, more up to date kernel than Xiaomi with upstreamed security patches, provide Android security patches earlier than Xiaomi and probably will continue to do so even when for Xiaomi the device will have reached EOL. At the moment, stock probably is the safest in terms of integrity, although it lacks features and is not quite up-to-date. But I have found on any device I owned, that keeping it somewhat up-to-date after official EOL through custom ROMs was a very important part of being able to use it longer than its intended life span.
Long story short: I guarantee you all that I am not interested in your private data and will not try to extort you or sell your credit card information or whatever... If there are bugs and vulnerabilities they are absolutely unintentional and I will try to fix them to my best knowledge if I am made aware of them. Anyway, please think critically and feel free to make the decision you feel best with.
Click to expand...
Click to collapse
exactly, we don't need your data, just why we would want it. additionally, as you said, all is open sources so OP can check all. everything was written here, perfect answer
opal06's post is right on the money as explanation to what security can mean for rom/device. No need to be defensive though, trust in developers is the only thing that keeps the custom roms community going and I've been using them since Gingerbread.
On the other hand, I must say, custom roms that come pre-loaded with all bells and whistles from Google diminish the trust factor.
celrau said:
On the other hand, I must say, custom roms that come pre-loaded with all bells and whistles from Google diminish the trust factor.
Click to expand...
Click to collapse
How come ? Could you explain that ?
marstonpear said:
How come ? Could you explain that ?
Click to expand...
Click to collapse
I guess what he means is that Google is notorious for grabbing any bit of data and having a custom ROM preloaded with Google stuff diminishes the need for installing it ib the first place, as it will have the same privacy concerns regarding Google as stock has. In general, Google's involvment into Android is a reason for concern to many, myself included. But there are very few ROMs that actually try to be privacy focused and get rid of Google entirely, although the situation can be improved by using MicroG services instead of GAPPS. They already work on many ROMs
opal06 said:
I guess what he means is that Google is notorious for grabbing any bit of data and having a custom ROM preloaded with Google stuff diminishes the need for installing it ib the first place, as it will have the same privacy concerns regarding Google as stock has. In general, Google's involvment into Android is a reason for concern to many, myself included. But there are very few ROMs that actually try to be privacy focused and get rid of Google entirely, although the situation can be improved by using MicroG services instead of GAPPS. They already work on many ROMs
Click to expand...
Click to collapse
I was half way through typing pretty much the same thing when I noticed your post, that's exactly what I meant. One more thing, some people really need Gapps (i.e. for some banking apps) but they should install them themselves as opposed to providing custom roms with Gapps preinstalled.
Thank you guys for sharing your thoughts on this! I believe all we can do is trust our devs with our info and devices and as a paranoid user, I believe I won't be able to do that, so I'll stick to stock ROMs for our device. But I also believe this has been very helpful for other users who want to try custom ROMs and if they're not as paranoid as I am, they can safely use the open-sourced/official ROMs in the forum. Cheers.
marstonpear said:
Thank you guys for sharing your thoughts on this! I believe all we can do is trust our devs with our info and devices and as a paranoid user, I believe I won't be able to do that, so I'll stick to stock ROMs for our device. But I also believe this has been very helpful for other users who want to try custom ROMs and if they're not as paranoid as I am, they can safely use the open-sourced/official ROMs in the forum. Cheers.
Click to expand...
Click to collapse
I wouldn't call it being paranoid, I think it's very sane.
I agree and have similar view on that, but please ask yourself a question - how much you trust Xiaomi and their security measures? Because in terms of privacy it's obvious that nothing worse than Xiaomi plus Google can happen to you. If you're really what you call "paranoid" you should rather get a device with official Lineage OS support that you would download directly from their servers or systems mentioned here: https://www.privacytools.io/operating-systems/#mobile_os
Thread closed at OP request
Related
Hi all!
I'm an android developer, and I regularly read the official android-dev and android-porting lists, but on all the fan blogs and from lurking here, it seems that all the good development is coming from XDA-dev!
So why don't you guys do some patch submission? Features like auto-rotating browser and the transition animations should really, really be in the main source, but the official Android team have their thumbs up their asses in regards to UI/polished stuff.. (I bet they're too busy working on the lower level cellular stuff and the ARM-generating stuff like in the *flinger libraries).
So you guys should make some patch submissions over at (http://source.android.com/submit-patches)!
That way, the next RC will have all of these lovely features you guys have implemented.
((Or, alternately (but more ambitiously), fork the entire codebase. Strip out the DRM and add a framework for native code execution. Perhaps that's a pipe dream, though..))
Thoughts?
I think forking the Android source would be a very nice touch, if Google doesn't pull it together. We could still add on to stuff from the official code, but add on all the special stuff that Google refuses to (they've said they won't add the ability to change CPU speed, etc).
Oh, absolutely, there would be numerous advantages to having a fork. It should definitely be discussed! I'm afraid that Google may be trying to exert too much control on their platform in ways that we don't always want, so there is nothing legally to stop us from forking and maintain a more badass tree. GitHub could provide the hosting.
Of course, it might be a waste of effort. If you submit the badass patches, then the good features here go out into all the phones in the next versions. Work on the fork, and only the selected users who are able to flash their own phones can use it, unless some Chinese companies start using it or something like that.
Names?
XanDroid? I'd rather like to see Mandroid with in a slick black theme..
Well to me it seems like the only people doing cool things right now with android have rooted devices
So why cant you ***** a little on google lists to make them actually do some work. The Roadmap @ http://source.android.com/roadmap is a joke. Either they give us root or they start working imo. =)
Seanambers said:
Well to me it seems like the only people doing cool things right now with android have rooted devices
So why cant you ***** a little on google lists to make them actually do some work. The Roadmap @ http://source.android.com/roadmap is a joke. Either they give us root or they start working imo. =)
Click to expand...
Click to collapse
Do you think that the release of the new unlocked Dev phones will change things?
Yeah it'll most probably shake things up a bit, however what about all those that already have a g1?
I for sure isnt buying a new phone to get root.
But even so, we're still talking about modifications to the OS and the packaged applications, which would be released in the next RC version, so even non-root users would get the features in the next update, along with anyone running Android on something besides a G1.
my .02
Id say submit some of the things found here and see what goog does with it, if they openly add these things that need root at this point and let xda dev participate in the OS with such submitions...then cool thats how open source works best, when anybody can add to the project, a phone OS utopia
If they ignore it then, a fork is the way to go but give google a chance to do the right thing first before, just leaving them in the xdadevs dust with a custom distro...
bhang said:
Id say submit some of the things found here and see what goog does with it, if they openly add these things that need root at this point and let xda dev participate in the OS with such submitions...then cool thats how open source works best, when anybody can add to the project, a phone OS utopia
If they ignore it then, a fork is the way to go but give google a chance to do the right thing first before, just leaving them in the xdadevs dust with a custom distro...
Click to expand...
Click to collapse
Google has refused to add multiple features. They feel that they aren't necessary, or that your average consumer wouldn't want it (main thing I can think of atm is CPU speed).
If they don't add the features we request, simply because *they* don't like them, then a fork would get us exactly what we want/need. After we fork it, and the number of users using stock Android plummet, maybe they will listen .
I see a problem with forking... who says what is allowed and not allowed? That is the main problem. Now if you wanted to just add an app that would be one thing but there is not going to be an easy way to do this.
Gary13579 said:
Google has refused to add multiple features. They feel that they aren't necessary, or that your average consumer wouldn't want it (main thing I can think of atm is CPU speed).
If they don't add the features we request, simply because *they* don't like them, then a fork would get us exactly what we want/need. After we fork it, and the number of users using stock Android plummet, maybe they will listen .
Click to expand...
Click to collapse
Given the number of G1s with modified fw installed compared to the total number of sold units, I somehow doubt the number of users is going to plummet.
IMHO it would be a needless fork unless some new or considerably modified features were planned. Better to just patch the functionality into the official builds, if at all possible.
I'm not convinced by that logic. There would be an important difference between a fork and patched versions of the firmware, as a fork would have a totally different design philosophy. Whereas Android is focused on speed (or whatever the hell they're concentrating on..but to be honest, I think they're dicking about over there), Mandroid could have more focus on polished features and low-level access. ((And! No DRM, and I'd like to see some more security features..ZRTP?))
Either way, I think it's really important for the success of the open future of phones that the open source community take and give back. There's no need for the back-and-forth like with, say, PSP-cracking as we have the source code and we are allowed to do whatever we like with it. If we just keep patching what they give us and keeping the modifications closed, then we aren't really in control.
As for project management, I'm absolutely sure there are people who are capable of maintaining an active open-source project such as this, as long as there is a well-thought out design philosophy. I'd love to be involved, if enough people are willing to give it a shot. But, first, it'd be easier just to submit patches.
Miserlou! said:
PSP-cracking
Click to expand...
Click to collapse
PSP cracking is insanely different. If you were in that scene, does my name look familiar ? Was net admin at toc2rta/malloc, admin of psp-hacks.com, worked with a lot of people on a lot of stuff that I barely remember as it was years ago .
But for the PSP, we were working with a system we knew nothing about. So yes, Android would be a lot simpler to work with. But if Google doesn't listen to us, it's not like it would really matter.
neoobs said:
I see a problem with forking... who says what is allowed and not allowed? That is the main problem. Now if you wanted to just add an app that would be one thing but there is not going to be an easy way to do this.
Click to expand...
Click to collapse
Android is licensed by both the Apache Software License (do whatever you want with it) and the General Public License (do whatever you want with it as long as you make the source code available for others). We are certainly allowed to do this, but the problem lies with the G1 owners running the official RC30. They wont have the rights required to flash the image which leaves them out of the party.
2 words
The community(did I spell that right?)
Bhang
Datruesurfer said:
Android is licensed by both the Apache Software License (do whatever you want with it) and the General Public License (do whatever you want with it as long as you make the source code available for others). We are certainly allowed to do this, but the problem lies with the G1 owners running the official RC30. They wont have the rights required to flash the image which leaves them out of the party.
Click to expand...
Click to collapse
I meant who is going to the be decision maker of what features will be added... The Community as a whole? What about some that want it but only 25% of the community wants it?
neoobs said:
I meant who is going to the be decision maker of what features will be added... The Community as a whole? What about some that want it but only 25% of the community wants it?
Click to expand...
Click to collapse
That's what project leads are for. And hypothetically when enough people are dissatisfied with the xda-dev fork they will go and create their own fork. Except I don't think there is any real argument yet to go and create an xda-dev fork in the first place. Forking an operating system meaningfully is not a weekend project for a single person.
I have said it before, let's give them a bit more of a chance, a fork isn't something a guy can do in a weekend.
So let's see what happens in RC3X, the next release will give folks a bbetter idea of where their heads are at. If enough of the community is unhappy there will be a fork
Bhang
I've been playing around with all the 6.5 ROMS available on this forum (plus have been lurking for a while so felt like doing some contribution could be appreciated ).
My company is very stringent about enforcing Exchange ActiveSync policies, especially PIN CODE, timeout to lock and remote wipe.
I noticed that on the 230XX series (I have tested up to 23053) posted here, there are two different behaviors, one serie works with my Exchange Active Sync, one does not.
Since the PIN request and lock timeout work fine with them, I have to assume the remote wipe feature has somehow be disabled by this ROM.
I have been able to identify that a ROM will give me this problem even without connecting with my Exchange Server.
in 100% of the case, if I try to import a root certificate on a "hacked" ROM, it will be installed without any warning, just a "Certificate successfully installed, press OK" dialog.
Now, on a ROM that is not "hacked", when you try to import a root certificate, you are warned that this may be an unsafe operation and have actually to confirm.
This is very concerning to me, because the warning being removed means that any bad guy can leverage these ROM to deploy a rogue root certificate to your device and your device can start trusting wrong sites.
I do not intend this to be an exhaustive list, but as of my testing only the following two ROMs work correctly:
- NATF
- RRE
All the others do not. The source of the non-working ones is either the same, or these people have purposedly altered the ROM to change the security settings. But the result is the same, security altered ROMS.
If anyone could confirm they are experiencing the same, I would not feel alone on the planet
UM
I'd just like to reiterate that this is a development community- most of the cooked ROMS you've tried are experimental works in progress. We tend to take our experimenting a bit far here- but as none of our 'products' are really production tested, it's fairly safe to say that all of them are just a bit unsafe.
A stock ROM has the benefit of being tested in a production environment- and while performance on these ROMs may not be optimal, they are composed of a set recipe of components established between the OEM and Microsoft.
Many of our ROMs are conglomerations of various different components- so it's not exactly safe to say that any of them can be held completely accountable for device security- there may be plenty of exploits present behind the scenes that never have been exposed or rectified.
We're small-scale individual developers. Most, if not all of us, do this for fun. Many of our packages deliberately alter the way in which devices handle certificates and signing- because it allows us to expand the boundaries we develop within.
If you're looking for guaranteed security, your best bet is to stick with a completely stock device. If you choose to use another ROM, any insecurity is not on the developer, but you.
Very well said! On top most, actually all of the 6.5 based ROMs have a microsoft beta as a base. Though it may be a save bet that the latest built # may be the closest to the final release at Oct. 9 it's a common practice to reduce/alter some "security" settings an policies for an "easier" way to success. None of these facts is to blame on any ROM chef or developer or however you want to name these creative heads here.
Their work is just incredible and I bet that ms or HTC would be proud to have such guys on board.
Note:
I bet that some individuals of both companies keep a close eye on what's going on here.
Guys,
Don't get me wrong, I know what I'm doing when installing a beta that has been leaked.
First, it's illegal, we are stealing non published source code, infringing intellectual property and probably making ourselves guilty of too many felony counts to be able to get out of jail without a long white beard.
But, joke aside, this was not the point of my post and I am sorry if I didn't explain myself clearly.
There are 23053 builds that work well are 23053 that do not, as was the case with any previous build number and, consistantly, I have had two out of the pack working exactly as expected from a security perspective, and all of the rest not working as expected.
So, since I do not believe MS is deliberately compiling one tree of the code with embedded security and another without, it means that someone in the middle is affecting it.
That was my point.
UM
Hummm...
Wrong approach fellow...
Wrong place, wrong time and wrong people.
Don't expect to be received with an open heart while commenting such things...
Imagine the following scenario:
A priest enters a strip bar and tells the owner of his concerns of moral ground, about the practices that take pace there... LOL
I may understand your point, definitely not your purpose.
If you are lucky enough not the get flamed, you will at least see some frown faces...
Leave it...
As someone suggested before, remember this is a development community...
If what you find doesn't suit your needs simply suggest changes or don't use it at all.
If you concluded, after experimenting, that the only functional ROMs are NATF and RRE ones, allow me the following suggestion:
Choose between 3 options:
1. Use a stock ROM so you don't «steal» form anyone and don't risk having to spend 5 days in a row shaving...
2. Use a NATF ROM
3. Use an RRE ROM
I believe i made my point as gently as I could...
If i may have hurt some feelings, i am deeply sorry for that.
Cheers
Well, 2 points in answer to your post where you obviously did not read mine:
1) Did you miss the sentence that starts with "Joke aside" ??
2) Don't care of being flamed, I provided evidence to people that want to make up their miind, they don't need you to tell them what is safe or not for them
Bottom line is:
- if you do not want to have a phone crashing on you, use a stock ROM (that's actually a good joke... Stock ROMs do not crash less than their beta counterpart).
- if you do not want your passwords, contacts or personal data to end up into some hackers site, be careful about what ROM you install
wearing my flame proof vest.
UM
unlockMe said:
Well, 2 points in answer to your post where you obviously did not read mine:
1) Did you miss the sentence that starts with "Joke aside" ??
2) Don't care of being flamed, I provided evidence to people that want to make up their miind, they don't need you to tell them what is safe or not for them
Bottom line is:
- if you do not want to have a phone crashing on you, use a stock ROM (that's actually a good joke... Stock ROMs do not crash less than their beta counterpart).
- if you do not want your passwords, contacts or personal data to end up into some hackers site, be careful about what ROM you install
wearing my flame proof vest.
UM
Click to expand...
Click to collapse
Dear UM,
I had a good laugh reading your last sentence LOL
I believe that wither you misunderstood me either I was not clear...
1. I am not accusing you of anything.
2. I read you whole message (points 1 and 2 included... They were there, weren't they...?)
3. I am not trying to demote you of you purposes... I was only trying to pass a message but given the fact the message wasn't delivered, I will try to rephrase...:
You are expressing both facts and opinions.
That is, indeed, you right given the fact we are in an open community and we, still, are in a free world (so to speak...).
I do not endorse or condemn none of your previous statements.
Knowing this community for quite some time and specially knowing it's member, active ones, passive ones, contributing ones, parasite ones, etc... I just know for sure that your comment in which you address people in such manner will have one of two possible outcomes:
1. Total ignorance
2. Flaming
Now, after this, do whatever you like Don't get me wrong and sorry if I made myself misunderstood
Nuff said.
Cheers.
This thread is not development related, moved to the appropriate section
This writer seems to think so.
http://www.theverge.com/2012/2/16/2801916/home-baked-roms-its-going-to-blow-up-sometime-soon
Actually he makes some valid points (and I use a Custom ROM myself).
Absolutely ZERO disrespect intended to the ROM developers here --- we should appreciate their very hard work and opening our devices up to so many other options and enhancing performance.
But after reading this article, what do people think about the safety of ROM flashing .... not in terms of bricking the device (we all know the risks), but in terms of:
A) Unintentionally opening the device up to exploits due to poor coding etc
B) A rogue developer intentionally exploiting to capture data for profit
Are you comfortable doing bank transactions on a rooted android device w/ custom ROM?
Interesting question
I have never even thought about what I do and don't do on my custom devices.
Forget the internet banking etc, there's also the entire gamit of email, social sites, work email etc etc
Just as well I trust you all!
This is definitely a concern......
Here in Korea though, the banking apps do not allow you to use them with a rooted device.....So each time, I have to unroot my device in order to do banking.
I do not know, however, if once I root again it would give the developer or hackers access to that data......
Something to think about as well though!
I realized: I never looked for an app that investigates security issues on a smart phone.
perhaps someone with knowledge in this field can give a few hints to usefull apps?
and yes, "I am with stupid too"
Motorola Defy+ with Quarx's CM9 nightlies and most of the time I still have no clue to what I am doing precisly.
But on the bright side: I do not use my phone for banking, there's nothing to "bank around"
Hmmm -- I had never considered that banks would block it -- have not tried yet. You make a good point about what remains on the device later -- at a minimum clearing browser history is a good idea -- but even that could be circumvented with a devious enough approach.
[email protected] said:
This is definitely a concern......
Here in Korea though, the banking apps do not allow you to use them with a rooted device.....So each time, I have to unroot my device in order to do banking.
I do not know, however, if once I root again it would give the developer or hackers access to that data......
Something to think about as well though!
Click to expand...
Click to collapse
I agree. From what I have seen most of the "advanced" posters here dismiss antivirus packages as a waste of time and money and they could well be right. Still I have not been able to find any real discussions on the risks the article I posted raised. It would be great if some of the more "expert" members here could offer their views.
I am loving my rooted G-Note with custom ROM ---- but I do not really have confidence in Android and its various hacks yet. Unfortunately the alternatives are rather poor.
gentle_giant said:
I realized: I never looked for an app that investigates security issues on a smart phone.
perhaps someone with knowledge in this field can give a few hints to usefull apps?
and yes, "I am with stupid too"
Motorola Defy+ with Quarx's CM9 nightlies and most of the time I still have no clue to what I am doing precisly.
But on the bright side: I do not use my phone for banking, there's nothing to "bank around"
Click to expand...
Click to collapse
I would say I agree and disagree with the article.
For me personally, when I decide to get all flash happy with my Android devices, I tend to not put any information regarding banking or credit cards. Logically, at least to me, the concerns sited in this article do occur to me. Then again, to be honest I do not put any of this information on my non jail broken company secured and encrypted I phone either. Call me paranoid.
Where I disagree with the article is in the insinuation that using a stock ROM with apps downloaded from let's say th he iTunes store is really much more secure. If a baked ROM can be pulling information behind your back, and somehow bypass security measures written into a banking app, why could not a fart app some momo downloads to be the life of the party do the same?
Flyer
I have been thinking about this ever since I've rooted my phone and flashed the first custom rom...
-and I still don't have a real answer.
Thats why I prefer stock ROM
finally its your (user) wish, weather to use custom rom or stock rom.
none of the developers are forcing to use their custom rom.
rom development is hobby,passion, and part-time for some of developers.
my few words.pls correct me if I'm wrong
Ever heard of pdroid? Droidwall?
reversegear said:
finally its your (user) wish, weather to use custom rom or stock rom.
none of the developers are forcing to use their custom rom.
rom development is hobby,passion, and part-time for some of developers.
my few words.pls correct me if I'm wrong
Click to expand...
Click to collapse
You are not wrong, but you are definitely off topic.
This is so one sided. You can say the same about any OpenSource program with small userbases. Take any little Linux Distri, any small OSS and you get to this problem quickly. Most of us can't review the source code properly so we have to rely on others. But at least you CAN rely on someone. You can't rely on anyone at closed source programs.
That's why you use Truecrypt for encrypting your hard drive and not Bitlocker, that's why you should use a Linux Distri and not Windows and that's why i use OpenSource ROMs and not the closed source StockRoms and even try to have as much OpenSource Apps on my Phone as possible.
Just my 2 cents.
He has the points and those are sorely his.
Calling other ROM flashers idiots is ridiculous and not very nice. In fact, based on what he typed, he seems to be an idiot himself.
Now to other Rom flashers, as long as then understand the risk of doing so, they entitle and fully responsible for their actions, no need to teach them.
Security issue? I drive a car to a bad area, get off, windows still lower, not even care to lock the car. That is my choice.
Now I'm going to the very nice, high educated area, I choose to lock the car, put the steering-wheel lock on. Again, it's my choice. Home wireless network, I choose to set the password or not, it's my decision. I understand the risk of not doing that. And if I choose not to do that, it doesn't make me an idiot.
Next, not all baked ROM are based on leaked official one. CyanogenMod team is well-known and they based on the Google source code, ASOP, not a leak one from vendors.
So, if ROM flashers realize what source they use, they're all set.
Writing a long article with just one-minded lopsided thinking like this is pretty lame.
an0nym0us_ said:
Ever heard of pdroid? Droidwall?
Click to expand...
Click to collapse
Pdroid: looks very promissing but you need to be a programmer and only for Gingerbread.
Droidwall: from what I understand from it it is a kind of fine-tuning of your data traffic. Pdroid goes much, much further and I would prefer it.
A real shame I'm not a developper/programmer and also very happy with my custom ICS ROM.....
On the bright side; I like tweaking but not social networking or any other more "dangerous stuff" Just like I'm used on my PC.
I've never bothered with a custom ROM, partly because I just realise that pretty much everything I could do with a custom ROM, I can do manually with a rooted phone. I don't like to install a package of software someone else thinks I should use, I prefer to pick and choose the stuff I want. Security concerns never really bothered me, I don't care too much about the security of my phone (I guess maybe some people would be annoyed at me if my contacts were stolen or something, but other than that there isn't really anything I care about on my phone). I never do online banking etc. on it, but that's just because that's something I do very rarely and only do when I'm at a computer anyway.
gentle_giant said:
Pdroid: looks very promissing but you need to be a programmer and only for Gingerbread.
Click to expand...
Click to collapse
You don't need to be a programmer. All you do is get your ROM zip, run the PDroid patcher on the ROM zip, it'll give you a patch zip, flash the patch zip in recovery, install PDroid from market. And I think there are unofficial ports to ICS possibly.
Doesn't stop me from flashing custom ROMs.
Oh well...?
Sent from the future.
I though the article itself was a bit sensationalistic but at the same time I think changing the ROM in a system (not to mention giving root permissions to apps) is a lot more potentially intrusive than downloading apps from Itunes or Gplay.
Anyway I like my custom ROM setup but I sort of feel like I am whistling in the dark at times. I think a lot depends on how sophisticated we are as users.
Case in point:
When I flashed my ROM for the first time, I freaked out seeing a bunch of Chinese names every time I made a call to certain numbers. The good thing about XDA is if you search you can find anything about ROM issues and in this case I learned that this was due to the developer using the contacts part from the leaked Chinese ICS and it had something to do with a "Phone locator service" that could be disabled. Ok so I disable and go back to whistling in the dark --- but I have not been able to learn what the phone locator service is in the first place or WHY i had Chinese names showing in my calls.
As a relative Noob I can follow instructions from most of the generally well written instructions on XDA and not get into trouble --- but (rhetorically) do I really understand the background issues and risks with some of these things?
What is this phone locator service anyway? Why the Chinese Names and Locations in the call indicators?
mcord11758 said:
Where I disagree with the article is in the insinuation that using a stock ROM with apps downloaded from let's say th he iTunes store is really much more secure. If a baked ROM can be pulling information behind your back, and somehow bypass security measures written into a banking app, why could not a fart app some momo downloads to be the life of the party do the same?
Flyer
Click to expand...
Click to collapse
Well you are right that we are all responsible for our own choices. I just think it is better for all that people can make as informed as choices as possible. That is why discussions like these can be good (even if the article was inflammatory).
To extend your analogy, maybe you think it is your choice to leave your car unprotected. But maybe your insurance company will disagree and try to teach you better? Maybe the police inform you to secure your car because you make more work for them when your car is stolen?
So as a car driver it is your choice, but many might argue that the community of car drivers needs to be educated on the risks of their behavior so that they can make more informed decisions. Then you benefit and the community benefits (keep insurance rates down, free up police resources etc.)
I hope I made sense
votinh said:
Now to other Rom flashers, as long as then understand the risk of doing so, they entitle and fully responsible for their actions, no need to teach them.
Security issue? I drive a car to a bad area, get off, windows still lower, not even care to lock the car. That is my choice.
Click to expand...
Click to collapse
I'd rather take the risk and enjoy life than sit on the sidelines. Considering that all smartphones have vulnerabilities, stock or no, I'll take my chances. I also have a bit of faith left in humanity in general and more so some in communities like XDA and Rootz where the general idea is clearly that these are places for everyone to contribute to everyone else, not to come in and scam.
Let's be real: if someone comes through here and drops something that ends up defrauding other for every person involved in coding the malicious item there are ten more capable devs who will have the motivation to take them to task in most unpleasant ways. I, for one, would not put my butt on the line by choosing a dev forum to release or market my malware.
Many of you are going to know all this, and many know far better than I. Please, those that do, please step in and correct my information if I make any mistakes.
I see the word stable thrown around a lot - "Is this ROM stable", "stable release", etc.
I want to attempt to pin down a definition when in use for regular conversation, and I also want to address that there is one use of the word that is clearly defined and cannot be used lightly.
First, in the development/open source world, the vast majority of projects you will see are in beta or sometimes even alpha. This means that it's still in some sort of testing phase, and there are usually some bugs that need to be ironed out before it's termed a "finished product". By the very nature of software and developers' desire to be honest, it's quite common that there are some pieces of software that will never leave beta(and some even used in a corporate production environment. "beta" is not a death sentence and doesn't mean there's something fatally flawed). There is always more work to be done, a bug here, something to smooth out there, something that needs to be optimized, etc. A developer can not be satisfied to release a final version. That being said, it does happen. Once it reaches past beta, it often gets promoted to a "release candidate".
A release candidate, or RC, means that they are fairly satisfied that bugs are taken care of, and that they are PRETTY sure there's no major flaw lurking in the depths waiting for the perfect moment to rise and bring down death and destruction upon any innocent fool who crosses its path. This is the final step leading up to that coveted and rare specimen - the :victory:Stable Release.:victory:
Once the release candidate has gone through rigorous testing by developers, users, testers, etc, it can finally become a stable release. It's a big risk to label something as a stable release. This is the developer giving you their word and staking their reputation to say "there are no bugs in this piece of software. It is being released as a final version and will not cause you any trouble".
I beg you to correct me if I'm wrong, but I don't believe there are stable releases for any any ROM for the MT4GS. Once again, this is very common in the development world, and not just for phones. Just take a look at the number of projects on slashdot that are widely used by thousands of people with no trouble - much of them sitting in beta or even alpha.
Now is where we run into some ambiguity using the term. At a passing glance, and certainly to the uninformed, seeing that software isn't "stable" will naturally and intuitively lead one to believe it must be somehow unstable. Given the nature of open source and development, we know that this isn't necessarily the case. There may be something very minor that only comes up in certain situations, the developer may still feel that there hasn't been enough testing to rule out any bugs, or there may be no bugs at all but the developer is not yet satisfied with the completeness, speed, or number of features.
Now, I would like to address how the word is used in conversation or when asking questions about a ROM. Stability itself, is absolutely very important, with good reason, to a vast majority of people who own a mobile phone. This is often their only source of communication and is required for work, for emergencies, and for generally keeping in contact. If the phone fails to function in a manner that keeps the user reliably connected to their web resources as well as phone, email and messaging communication, there could very well be disastrous results. Therefore, asking if the rom is stable is very valid and relevant, but due to the fact that the word stable can have such an ambiguous definition, and is also a term for a particular stage in development, communication can break down pretty quickly between parties when the term starts getting tossed around.
The device I had previously was a Motorola Droid 1(OG Droid, Sholes, etc.). This phone had a huge and extremely active development community on many different websites. Many devs still hold the moto droid in a special place in their hearts for how hackable it was, the power it had for a device at the time of its release, and the massive userbase ranging from those with no technical ability at all to some of the best hackers ever to work on Android. This device truly represented the renaissance, if not the birth, of custom development for android devices.One thing that was extremely common across almost any ROM or kernel you could put on that phone, however, was a risk of "instability". In this case, this usually meant that the phone would randomly reboot, especially when doing something particularly tasking on the cpu(navigation was a particularly common culprit). In extreme cases, it would reboot and then go into soft bootloops once, twice, even five times. This happened more often with overclocked kernels, and most people had to look for multiple kernels and setcpu settings that would give them a balance between speed and stability. It took some trying and some tweaking. Most people would eventually get a setup that was solid. Even with a "rock solid" kernel and ROM setup, there were very few who NEVER experienced a random reboot when running a custom ROM/kernel. It was just something that happened. The other major issue people saw were force closes of apps. These were extremely common as well, but usually addressed more easily. Your setup was considered stable if you were confident that you could do all of your phone's functions without getting FC's and you weren't going to get a reboot 99% of the time. You could rely on it not to do anything unexpected.
I have, admittedly, not tested every ROM that exists for the MT4GS. I probably haven't tested half of them. I have however, tested most of the later releases with the exception of XMC's Jellybean. What I have found, however, is that out of all the ROMs I have tested for this device, each and every one one of them has met my personal definition of stable. I've never seen a random reboot on the MT4GS. If I see a FC, it's because I failed to clear data and cache before flashing something, forgot to flash or flashed the wrong version of gapps, or I'm trying to get something working that wasn't included in the ROM. It's for this reason that I really don't know how to respond accurately when someone asks something like "what's the most stable ROM for this phone?" or "I saw this particular ROM, can anyone tell me how stable it is?"
So I have two requests. The first is for anyone who cares to read all of this and answer. I'd like to ask you, if you are asking about how "stable" a rom is, what do you mean? Are you asking about whether it has bugs? They all have a bug list of what's working and what's not. Are you asking about whether it has a certain feature fully working? Once again, that's in the works/ doesn't work info usually including in the first post about the ROM.
Request 1:
Answer me this - What does "stable" mean to you?
Request 2:
When considering or just looking for info on a ROM and you have a question about this or that, be specific. If I've checked into a ROM, I very well might have an answer for you. If you just ask whether or not it's "stable", I don't know what you're asking
I can see where you're coming from.
Personally, stability for me is a rom that works well enough where the phone isn't bugged out entirely (has over 80% of the phone's default settings working such as calling or getting into e-mail, etc.).
In general, there are others who request too much and want utter perfection. No rom is ever going to be perfect, regardless of the stage of the rom (alpha, beta, release candidate).
Sent from my myTouch_4G_Slide using xda premium
To me a "stable" ROM is one where all of the phone's functions work as designed, meaning the camera, bluetooth, wifi, keyboard, etc. all function without having to do anything extraordinary. Also, the ROM itself doesn't require extraordinary measures to perform common functions and doesn't FC or random-boot. I can accept a few minor glitches, even stock ROMs from HTC have those. But, for my overall needs, I currently run only a stock-based ROM because I absolutely need the stability and all functions (especially the camera and stable wifi). This is my ONLY phone, I don't have another mobile nor a landline, so stability is #1 priority.
I've waited a long time for your post.
...and I agree with everything you've said thus far in principle.
The concept of stable is in and of itself a dynamic thing in a place like this under the many varied intentions of the people developing anything here.
Consider that in many cases things are made as examples, or proof of concept. Such things may be deemed stable by the creator on the particular proof, yet be unstable for other uses.
In many cases, such things are outlined by the developer and the bounds determining stability vary widely from project to project, and developer to developer.
In the retail world of say, phone sales, and the manufacturers guarantee against defects, the business world is held to a certain threshold of accountability for providing a working product.
For us here, there is no money involved - people aren't paying for a product, and so lose at most up time with the device while it gets sorted out. The total loss of the device itself, as in hard brick, due not to user error but to developer error is where I would say the minimum standard of stability lies.
That bears, in my eyes, the closest relation to the business world standard of a manufacturers guarantee against defects. Buggy software, and the clarification thereof being the topic to pick apart - i'd like to get a consensus of how many other people feel that simply not hard-bricking the device due to developer error is the complete polar opposite of:
karri0n said:
...
that coveted and rare specimen - the :victory:Stable Release.:victory:
...
Click to expand...
Click to collapse
...where the quote is in-context of being a final, finished product.
The minimum threshold being the easier end of the debate to reach agreement on and build our understanding from.
....
So how does a developer get to stable projects?
Drawing a parallel from the manufacturing industry, the answer is quality control.
If your business is running assembly lines of product, at the end of the line needs to be a certain amount of quality control before shipping. Else the product could vary widely in stated ability and function. A shop with little to no quality control could be one equivalent to an unstable release.
This points us in a direction in the determination of stability - the comparable equivalent from our point of view is testing. You have to test your product (project) before sharing, else you don't know if it will work right.
Unlike an assembly line where testing is done on a random small sampling of pieces, a developer must rigorously test and retest the project (product) to ensure stability and reliability of function.
Of course, this begs the question of the standards involved in testing.
Ever seen this movie? The Pentagon Wars
It's a riot - but also illustrates the importance of standards in testing.
To us one way, arguably the most important way, is developing a consistent method of testing to properly evaluate the desired results.
Consider my first project of involvement at XDA was in understanding the differences in MicroSD cards for running CM7 booted off the Sdcard and not the internal memory of a device. Some cards were downright buttery smooth and amazing, other cards were downright impossible to work with. They were directly found to be the culprit of force closes, if it could be run at all.
Once we determined that there was a specific brand that could be consistently counted on to perform to spec (through a massive posting of speed test results by ever so many members of the community!!! :highfive: ) - I set about trying to determine how accurate the posted information was.
This thread: A Closer Look At MicroSD and Reader Speed
...was primarily established to determine how much the type of card reader used skewed the testing results.
Granted, i'm biased based on having written the article, but I would consider that project to be an example of rigorous standards of testing for a particular piece of information.
I use this example to make the point of stability. In this case it directly equates to validity of results. By recording all of the data, publishing all of the data, people can point out where my math may be wrong if i've made a mistake based on calculations of the raw published data.
( just like people can offer suggestions on published open-source code )
...or incorporate the results into further testing of their own - based on the validity ( stability ) of the data.
Another example of what I would consider trying to achieve a "stable release" of an answer to a question through rigorous testing: My first real doubleshot contribution.
So I put forth those two projects of mine to illustrate what I consider stable releases of information. If not, explain why?
So a stable release not only is important from a user perspective, but also from an open-source developers perspective.
How solid is the code(knowledge, information, etc...) being built on, if a coding (or other...) project? Is the code you are nudging in a direction you think would be interesting buggy to start with?
Is your own new code buggy to start with?
Do you just throw it out there and keep working with it until it works? Do you take the time to ensure it works to the best of your ability before releasing?
Both are very valid approaches - some radical concepts are seen to reality much more quickly because the incomplete thought was tossed into cyberspace to grow to maturity.
The developers ability to relay the type of project it is, and the expectations of use can in fact create the business world equivalent of 'buyer beware' in the context of placing the onus of determining stability on the end user.
Because stability really depends on perspective.
Saying that something is a daily-driver, i'd use it everyday kind of thing is most akin to the:
karri0n said:
...
that coveted and rare specimen - the :victory:Stable Release.:victory:
...
Click to expand...
Click to collapse
...that we are trying to define as the upper end of finished.
There again though, this varies based on perspective.
Pretend a large enough user base decided they didn't care about not having any bluetooth ability. Along come some ROMs that don't include that function. They state such, and otherwise have bugs on a very individual user level basis, if at all.
To that user-base, those ROMs are stable. What about you? You lose your bluetooth headset and can't do without that. Being as bluetooth is a functional piece of equipment within the device, any ROM without it is technically unstable. Can we agree with this?
Stability can also be defined, at least in part, by a developers ability and attention to resolve issues "Immediately, if not sooner". This becomes a determination of stability based on the developers ability and timeliness in resolving issues.
Otherwise stable software can become corrupted through interaction with other code that doesn't agree with it. There are a lot of apps out there, and Android is an environment allowing for much more freedom then the app store.
Due to the increase of involvement of chaos theory throughout the Android environment, I'd put forth that the stability of any software is in part tied to the developers attention to unforeseen interactions due to the scope of Android at large.
Here again, is another example - by this definition:
"Bulletproof was more stable when I was actively working on it - before I had to take a leave of absence." During that leave time, the ROM is less stable then it was before, because any new problems aren't attended to.
But we can say that not only the level of attention, but the quality of that attention is important too.
A consistent voluntary lack of desire in chasing down new bugs and fixing them could be seen as the equivalent of that crappy customer service call. Maybe you just exceeded the developers interest in the project, and to that developer it was stable for it's intentions at the time, and has moved on.
From one perspective, the project was completely stable. From another, quite the opposite.
There again, you have developers moving on to other phones, or using projects as stepping stones to other goals. We would need to agree to be able to define something as "stable to a point" if the project was brought so far forwards before the developer left it behind for others to build on.
Sometimes while building bulletproof I threw out stability and claims/remarks thereof in order to challenge the community to define what it was to me.
In the end, stability to me correlates to the endless anal attention to detail - on all fronts. To write clean code, to properly wipe and prepare the device, and the burden of utilizing a stable product rests with both the producer and the user - even if the only user is the producer.
Given the many facets of 'Stability' in trying to define it - how accurately can we do so?
I look forward to the postings on this thought experiment.
How big is big?
I'd bet that the word "stable" means something slightly different to nearly everyone. As an active user that tinkers with their installation a lot "stable" means no more than a 1 problem that requires a reset every week or two. Different usage would mean different definitions. Another user on my account that primarily uses his smart phone for calls won't tolerate more than 1 problem a month and for him, even that is frustrating. For emergency personnel any problem that prevents phone usage would be way too many.
The word also has different meanings for different products. I wouldn't consider a router that has more than 1 or 2 problems a year stable. Commercial communications equipment I've worked with was deployed in environments where it was expected to run at least 2 years without a problem. It was so well designed that occasionally it would run 5 or more years and the end users would forget where it was located and sometimes even that it existed at all.
I guess language just sucks for this type of thing.
All I want is a sense-less ROM that doesn't have random reboots and I'll stick with this phone for another year. As it is now I can't freaking stand it. That's with a totally fresh wipe and install of Virtuous Inquisition. I just don't buy into the idea that these phones aren't meant to download all the apps and games we can fit off the play store (not that I do... I HAVE in the past but I've barely reinstalled anything since my most recent wipe). The idea that installing things is going to lead to issues that aren't the ROMs fault is crazy. The stock ROM doesn't have these issues with my apps being installed. I only rooted to get rid of that dumb genius button (and getting rid of sense was the icing on the cake although not totally necessary).
"Stable" should refer to a ROM that works completely fine except for 2-4 functions that are not essential to smartphone daily function.
"Stable" unfortunately refers to a ROM that boots around here.
Sent from my HTC MyTouch 4G Slide using xda premium
polarbearmc said:
All I want is a sense-less ROM that doesn't have random reboots and I'll stick with this phone for another year. As it is now I can't freaking stand it. That's with a totally fresh wipe and install of Virtuous Inquisition. I just don't buy into the idea that these phones aren't meant to download all the apps and games we can fit off the play store (not that I do... I HAVE in the past but I've barely reinstalled anything since my most recent wipe). The idea that installing things is going to lead to issues that aren't the ROMs fault is crazy. The stock ROM doesn't have these issues with my apps being installed. I only rooted to get rid of that dumb genius button (and getting rid of sense was the icing on the cake although not totally necessary).
Click to expand...
Click to collapse
I can't say I've seen any problems like you are describing. I only used Vinq for a very short time, before I realized that wifi calling didn't work on it. CM9 a5 does not have any random reboots and has more features than Vinq working. That being said, I haven't heard of anyone facng random reboots using Vinq. if I had to guess, I would say it's related to the way Vinq tries to patch some elements of Sense and some elements of AOSP together, and they just don't get along. If it were me, I would move to cm9. I don't like sense's remnants tainting up my device, especially if they're going to lead to problems. the ONLY exception to this is the stock DoubleShot camera I would enjoy having that, but not if it meant that I had to run sense libs and it started causing conflicts with other parts of my AOSP.
hey folks,
PREFACE:
I'm posting this so that others thinking about purchasing the device may get a perspective that they won't find in a YouTube product review, on the huawei subreddit, etc... I'm also posting to bring awareness to device owners/this community... Before replying, please have a look through the thread; I'm starting to provide a lot of info, that may give better insights to the problems I see...
NOTE:
I'm not bashing you for buying this device, so don't take my criticisms personally... I will try to provide as much info as I can. feel free to ask questions, share your own insights/experiences, etc...
First, i'd like to point out that the hardware is great, EMUI is better than i expected and has some nice extras (compared with stock android). There are many aspects that I do like about the phone, however there are many problems too. I take issue with a few things that I will outline in this post && in the thread;
- huawei revoking the bootloader unlock service
- huawei is extremely developer unfriendly/hostile.
- huawei's poor management of customers, poor policies && support
- huawei's "technical support" staff lack any real knowledge of their products.
- huawei as a company seems to be shady, imho && lacks any transparency.
It is very unfortunate, because i do like the device (the hardware/build seems to be very good). the leica cameras + camera software are great. i do like the native dark theme, the CPU is fast, nice display, etc.. but given the above and also after poking around the kernel code, in depth;
- huawei's kernel sources are by far the absolute worst kernel source code that I've seen in my life.
- it appears huawei has intentionally obfuscated their changesets, by how they distribute them...
- the code doesn't follow C standards, nor any consistent coding style / best practices typically found in the linux kernel.
- the published source code may not even be what's running on the device (EDIT: It's not. I've now verified this, follow the link at the bottom).
- they are also using a technology that allows live patching the running kernel remotely (so even if the sources are the same, it can be patched at runtime anyway. cant be properly audited)...
- they are a full year behind on linux LTS.
I have contacted huawei directly via email, phone and live chat (EDIT: everyday now, since I posted this thread and I will be continuing to do so). They have given me the run around continually and their staff were not able to give me any satisfactory answers to my concerns, nor did i get the impression they even gave a crap ... They have only added to my suspicions (significantly) and along with the recent bad press that huawei has had in US, UK, Canada (where i am) and Australia; i don't trust huawei, their lack of transparency and lack of cooperation; is rather unsettling... Likewise, I find their hostility towards developers and users who would like to service their own devices (via OEM unlock) to be a brutal policy. (especially since their justifications are mostly FUD/untrue.).
- Audio latency is also horrible on the P20 Pro. it experiences anywhere from 50-500ms of latency with pro audio type apps. (noise app by roli in playstore shows just how bad it is, so does Beatonal app, many others too.) the device uses x6 the audio buffering compared the OG pixel. (the OG pixel has no problems with low latency at all, with far lower specs).
so to recap; it's pretty sad and unfortunate,
- i can't run my apps. (love my music creation apps)
- i have no control or ownership over my P20 Pro. apparently only huawei and the Chinese gov't do.
- i don't trust or have faith in the manufacturer.
- the kernel source code is disgusting and incomplete.
- I find some of the technology used troubling at best.
Here's some links in the thread, where some of the above is discussed in more detail;
some kernel source related issues outlined in more detail by me:
https://forum.xda-developers.com/showpost.php?p=78186512&postcount=37
(note: I'm discussing evira kernel, but nearly all of the issues apply to the distributed kernel sources that evira is based on)
if you are interested in helping me verify if the kernel sources actually reflect what's running on your device, follow this post;
https://forum.xda-developers.com/showpost.php?p=78182210&postcount=32 (this would be very helpful, as it will be ammo that I bring to huawei).
The distributed kernel sources are absolutely NOT the kernel sources used to compile the kernel that's running on your device:
https://forum.xda-developers.com/showpost.php?p=78188018&postcount=42
(this is an update to the above help request; I've now verified that at least L29/LO4 running kernels differ from the provided sources)
livepatch/OASES/Karma technology used by huawei, zte and others:
https://forum.xda-developers.com/showpost.php?p=78574615&postcount=86
So wait, you've only had it for a few days and you're trying to make a warning against buying the phone?
Giraff3 said:
So wait, you've only had it for a few days and you're trying to make a warning against buying the phone?
Click to expand...
Click to collapse
not exactly. I'm outlining my experience and why i am returning the phone, so that others who may have similar requirements and/or concerns avoid making the same mistake, by purchasing this phone only to be unhappy with it.....
the length of time that I've owned the phone isn't a factor because it doesn't fix any of the issues that i point out... *why would you even think that after reading what i wrote???* ... if it was just a matter of getting used to the device, that would be another story.
to be clear; i don't have any issue with the UX, performance, build quality or any of that jazz, really. the cameras are great, phone is a beast. However, huawei's policies, their lack of transparency, the device being locked down, their source code being sketchy, other security concerns and yeah; the audio latency... big problems (for me, possibly others)...
holding on to or having used the phone for a longer period of time doesn't fix any of these issues... if i wasn't into software development, didn't care about unlocked bootloader, etc - i might very well be happy with the device... It's a great phone, if none of these details/issues effect or matter to you...
the fact you can't run a launcher like Nova does it for me, terrible mistake
ant78 said:
the fact you can't run a launcher like Nova does it for me, terrible mistake
Click to expand...
Click to collapse
I use Nova just fine.
ant78 said:
the fact you can't run a launcher like Nova does it for me, terrible mistake
Click to expand...
Click to collapse
What do you mean? I've had the P20 Pro since end of August, installed Nova Launcher the moment I took it out of the box and been running fine since. Mind you the lack of bootloader unlock or having to pay for it doesn't fly well with me but haven't found myself needing to root this device like all my previous devices for customization. The P20 Pro has let me do everything I wanted.
StatikBlue said:
What do you mean? I've had the P20 Pro since end of August, installed Nova Launcher the moment I took it out of the box and been running fine since. Mind you the lack of bootloader unlock or having to pay for it doesn't fly well with me but haven't found myself needing to root this device like all my previous devices for customization. The P20 Pro has let me do everything I wanted.
Click to expand...
Click to collapse
No idea what they are talking about 3rd part launchers work just fine. It's just less obvious how to change them vs. stock android... but I had Apex launcher installed 15 minutes after turning on the device, wasn't hard to figure out.
the lack of unlocked bootloader is problematic, beyond just having root ~ once huawei stops pushing updates, if you still own the phone; no way to service or update it.... and for me, I actually like to audit my devices and know what's going on inside of them (and that's why I spend days going through their kernel source code too) ~ pretty hard to audit anything on the device though, without unlocked bootloader + root.
I do agree though, there is lots of stuff baked into the rom, so customization OOTB is pretty good...and i do like that...
On the other hand though, I like having AdAway, AFWall and other root apps.... and at least one of the issues that I mentioned; the audio latency problem ~ I could probably fix if I was rooted... I'm actually pretty shocked that huawei software engineers think that high latency is somehow acceptable....
the latency makes playing instruments on my phone impossible ~ latency has to be low, the sound must play as I touch the notes ~ but instead, there is an extremely long delay / completely unusable. The latency is worse than most early / very old android devices...
So you're saying the phone is great then? Bootloader is easily unlocked and if you want to make unsubstantiated claims that Huawei is spying on us you might want to back up with some proof. There would probably more development on this phone if the US didn't stop Huawei from selling it there over unproven spying claims.
Giraff3 said:
So you're saying the phone is great then? Bootloader is easily unlocked and if you want to make unsubstantiated claims that Huawei is spying on us you might want to back up with some proof. There would probably more development on this phone if the US didn't stop Huawei from selling it there over unproven spying claims.
Click to expand...
Click to collapse
That's just the US being the US man. Trump and his clown posse are more of a threat to the citizens then Huawei would ever be.
Giraff3 said:
So you're saying the phone is great then? Bootloader is easily unlocked and if you want to make unsubstantiated claims that Huawei is spying on us you might want to back up with some proof. There would probably more development on this phone if the US didn't stop Huawei from selling it there over unproven spying claims.
Click to expand...
Click to collapse
I'm saying it's a mixed bag, not that it's a great phone... some aspects of the phone are great, some are absolutely terrible. ~ even if I ignore the security issues, poor quality of their source code ~ I'm still left with a locked device, slow updates, a company with crappy policies, crappy support, no accountability && a phone that can't even run my applications; the audio latency is worse than most ancient android devices. seriously... in 2018, several hundred ms of latency is unacceptable (samsung devices, google devices, etc - do not have this problem... and apple products NEVER had this problem, even 10years ago).
Bootloader is easily unlocked by paying shady third parties, who I don't know and who I don't want to give my personal nor unique identifiers to... give me a frickin' break and *stop acting like this is some ideal situation, it's not*.... Huawei has screwed end users by discontinuing the service, their justifications is BS... If they want to void a warranty of unlock bootloaders; that's fine, then do that - but don't lock users out of servicing their own devices that they've purchased with their own money and that THEY OWN.... again, it's BS... and guess what; Google doesn't even void your warranty over oem unlocking, it's a supported feature ~ if you brick your device (through your own stupidity), they may invalidate it ~ but unlocking the device, does not void your warranty (i know from direct experience).... I don't buy into Huawei's excuses at all...
The fact that huawei are live patching the kernel, means that they can essentially backdoor your device at any time. you have ZERO idea what the kernel is doing, no way to proper audit the code.... The fact that they've obfuscated their own changes and their source code for the device has all sorts of problems, says a lot ~ They've went well out of there way to provide their source code like this... There is absolutely no way that during development, they were using these sources.... they've intentionally done this.... why do that, if you have nothing to hide? ... it's highly suspicious and dubious, at best... That is proof enough to cast serious doubt on Huawei.
Huawei is using the same kernel live patching technology in both mobile and IOT ~ no wonder the US wants to purge all of huawei's hardware from their infrastructure and why the gov't doesn't want it's employees using Huawei's devices and also why they are putting pressure on Canada to do the same (for our 5G networks)...
huawei has plenty of controversies; intellectual property theft, espionage, etc. it's not like the US is the only country that that is distrusting of huawei's activities.... e.g: Canada excluded huawei from being involved with the gov't secure network infrastructure too (years ago, long before the USA). We've also denied several Huawei employee's permanent residency, over concerns of espionage, gov't subversion, etc...
You can't really blame the USA for the lack of development for this device... there would be way more development if Huawei didn't screw over users by taking away the unlocking service ~ the US blocking their gov't employees from using Huawei devices && the US carriers dropping their devices, has very little to do with the lack of development... I'm not a fan of the current US prez, nor politics ~ but you can't really blame them, when Huawei controls whether or not you can unlock your bootloader ~ it's Huawei's policy, not the US gov't's policy...
and it's huawei's own fault that they're getting bad press.
Google and your information
But you trust pixel?
kolembo said:
But you trust pixel?
Click to expand...
Click to collapse
Google operates with far more transparency, than huawei... no contest.
A very large part of google's development happens out in the open, their devices are more secure, their code quality is to a much higher standard... like I said; Huawei's code is by far the worst kernel code that I've ever seen... Google actually takes security seriously, Huawei does not (or they should be shipping quality code, distributing their sources in a non-sketchy way, their kernel would be more reasonably up-to-date, they would operate with more transparency, etc.)...
Does Google collect a lot of data? yes. (most tech companies and gov't do).
Do I think they should be, no ~ as I believe that in general, people need better protections in their online / digital lives. Many rights that people have ''in the real world'', we don't have online ~ that's a problem.... But it's also improving to some extent...
At the end of the day; If I have to pick between google's approach and Huawei's approach ~ google is much better... Regardless, the majority of android devices shipping, will have GAPPs installed; which means the P20 Pro that I bought wouldn't be sharing any less info with google than any other device does ~ Pixels don't have a bunch of magical extra code designed to shovel more data to google, if that what you are thinking...
This guy for real? You want optimized kernels, and all that crap go to iOS but don't slander a device without a ounce of knowledge. Huawei have great customer service representatives Maybe you spoke to one that wasn't very intellectual (every company has them) try speaking to there representatives on Facebook/Twitter they are much better on there
TheDevGuy9497 said:
This guy for real? You want optimized kernels, and all that crap go to iOS but don't slander a device without a ounce of knowledge. Huawei have great customer service representatives Maybe you spoke to one that wasn't very intellectual (every company has them) try speaking to there representatives on Facebook/Twitter they are much better on there
Click to expand...
Click to collapse
It's not slander, when it's true.
I've talked to several of their reps and support staff (on 3 separate occasions.). They may very will be better in a public facing forum, but the fact that on multiple non-public interactions; where they didn't have to be worried about PR => they were pure crap to deal with.... I would hardly call that "great customer support".... it sounds like you think "saving-face" = great customer support. (it isn't)... Also, great customer support involves being knowledgeable about the products and services.... Look at your own thread title; "The lack of knowledge is concerning" from September;
https://forum.xda-developers.com/hu...concerning-t3847975/post77741568#post77741568 ... you can't have it both ways.
I'm correct about the issues that I pointed out, in particular with the kernel code.... You may not like it, but that's your problem, not mine... And no, I don't need to go to iOS to have an optimized kernel or have a device that can provide low latency for audio for applications that need it... Other decent devices manage it just fine in android-land...
A good android/linux kernel that has good coding styles / following standards, where compiler warnings are actually taken seriously, fixed properly and where the code can be can be audited, etc ~ These are reasonable expectations one should have out of ANY android vendor. While no one is perfect and you can knit pick any of the vendor's code -> The P20 Pro's kernel, as I said; is literally the worst kernel source code that I've seen in my life... It's worse than any QC/msm kernel that I've ever seen, worse than any of samsung's kernel code, etc.. (you don't believe me??? download the CLT's kernel sources, breakout your cross compiler, enable some extra warnings and actually look through the god damn code yourself! (Does that sound good to "TheDevGuy"???).... then come back and talk to me.
I've spent several days (hours and hours) now going through it, looking at what Huawei is actually doing in the kernel with livepatch, OASES and how some of their specific features work, poking through driver code, etc, etc (i do this with all vendor code for devices that I own)....
Out of curiosity, How much time have you spent???
I'm guessing it's actually you that is " without a ounce of knowledge" and you're just triggered because you didn't like what I had to say.
There are some valid points, and i am aware of p20 pro flaws but do we really need a separate thread for every personal rant?
forever_lol said:
There are some valid points, and i am aware of p20 pro flaws but do we really need a separate thread for every personal rant?
Click to expand...
Click to collapse
hey, i get what you're driving at, but when researching the device - i couldn't find a lot of the info that i was after and i don't think some of what I've touched on has been discussed here.... i know a few people are upset or don't like what I've said, but at the same time - i hope they can appreciate where i'm coming from, that I've actually went way out of me way and spent a lot of my free time, digging through the kernel sources...
there is also still a possibility that i may get stuck with this phone, if my carrier screws me around or has changed their policy - and if that does happen; i can pretty much promise that XDA community for this device are going to benefit;
- I've rebased their kernel on a proper git tree, with all mainline commit history, intact.
- I'm in the process of fixing all of the immediate GCC warnings and some other code issues.
- I'll get it compiling with the latest GCC (possibly clang too).
- I'm figuring out how all of huawei's features work
- i have experience porting/backporting kernel features.
- I'm experienced / know my way around the Linux kernel, having been hacking on it since long before XDA or android existed.
i don't really see much kernel development going on for this device, so who knows; even if i end up exchanging the phone, i still may end up cleaning up the sources and publishing them for other people to use (who may be comfortable using git / cherry-picking, etc - but may have difficulty getting huawei's somewhat broken source code to compile, ootb...
Who would have thought Huawei spies on its users? Geezas. Nobody.
It's not like they have done before.
Wait..
They have.
And bad software? Well, that's Huawei's middle name.
FluFlu said:
No idea what they are talking about 3rd part launchers work just fine. It's just less obvious how to change them vs. stock android... but I had Apex launcher installed 15 minutes after turning on the device, wasn't hard to figure out.
the lack of unlocked bootloader is problematic, beyond just having root ~ once huawei stops pushing updates, if you still own the phone; no way to service or update it.... and for me, I actually like to audit my devices and know what's going on inside of them (and that's why I spend days going through their kernel source code too) ~ pretty hard to audit anything on the device though, without unlocked bootloader + root.
I do agree though, there is lots of stuff baked into the rom, so customization OOTB is pretty good...and i do like that...
On the other hand though, I like having AdAway, AFWall and other root apps.... and at least one of the issues that I mentioned; the audio latency problem ~ I could probably fix if I was rooted... I'm actually pretty shocked that huawei software engineers think that high latency is somehow acceptable....
the latency makes playing instruments on my phone impossible ~ latency has to be low, the sound must play as I touch the notes ~ but instead, there is an extremely long delay / completely unusable. The latency is worse than most early / very old android devices...
Click to expand...
Click to collapse
erm I think you will find that in Huawei's latest firmware updates they have disabled custom launchers, you can install them but when you pick them as your default launcher you will get an error message and it crashes, there's a thread on here about it.
neflictus said:
Who would have thought Huawei spies on its users? Geezas. Nobody.
It's not like they have done before.
Wait..
They have.
And bad software? Well, that's Huawei's middle name.
Click to expand...
Click to collapse
that's some high-level cynicism, right there.... coupled with apathy.
I've never personally dealt with Huawei directly, nor peaked at any of their code (until very recently... and I doubt that I am the only person in this situation), so it shouldn't be surprising that I've chosen to comment about it. (for others who may not be aware).
with you having such disdain and having previous experience with huawei - why did you even buy the phone?
just curious.
You talk so much... I didn't even bother reading all what you said. Given that your frustration isn't about the phone itself but Huawei as a company, why did you buy the phone in the first place?