The Smartphone Wars: Samsung Busts a Move?

Well, now, this is interesting. Cyanogen hints via Twitter that we may get a 4.0 Cyanogen ROM in two months.

The news coverage I’ve seen so far misses what I think is the most important bit of context – that Cyanogen’s eponymous founder and lead developer got hired by Samsung a few months back. Samsung is subsidizing this move.

There are obvious reasons for Samsung to have hired Cyanogen that don’t have anything to do with this tweet…heck, if I were running an Android port team he’d certainly be at the top of my list.

But I wonder. Is this, maybe, in part Samsung turning up the heat on its competition? Or preparing to?

There’s been a lot of disgruntled talk about laggy and skipped upgrades for Android phones. Up to now I think this has mostly been a non-issue, because the app developers’ API compatibility target was really 2.2 or later and upgrades since then have mattered very little in other than cosmetic ways.

But with 4.0 issuing this could change. So…watch Samsung’s tempo on over-the-air upgrades, and watch to see if the Cyanogen project executes on making installation of its ROM on EOLed Samsung hardware substantially easier, perhaps with some sort of look-ma-no-hands PC-based universal installer.

Yes, I’m just speculating. But Cyanogen with Samsung’s backing is a different and more formidable creature than Cyanogen as some guys in garages. What, if anything, does Samsung hope to gain from that alliance? An underexamined question; perhaps the 4.0 cycle will bring us some answers.

121 comments

  1. Do you mean “more formidable creature than Cyanogen as some guys in garages”?

    ESR says: Ooops. Yes. Fixed.

  2. One can hope. However, while I like Cyanogenmod 7 and appreciate the ability to upgrade, it’s a bit crashy on the Galaxy S Vibrant. Quality control is a bit loose in the CM world.

  3. I wonder if we’ll see more phone vendors making complete forks of Android at some stage, like Amazon did? Surely by now the system is settling down enough to make that a real option for phones, not just for book readers.

    I’m interested to see what happens at that point, since there’s no real historical precedent for a commercially successful operating system getting forked.* Imagine if Windows had been open and got forked during the late 90s or early 00s!

    * I know Linux is commercially successful in the enterprise market. That’s much less interesting to me, because I think the various drawbacks of forking, like interoperability and fragmentation and so on don’t really matter very much in enterprise applications.

  4. @esr:

    As I said back in March:

    But I can actually envision a world where a cellphone or tablet manufacturer contracts with the cyanogenmod developers to develop and maintain Android drivers for their device, and everybody[2] is happy — google because Android is shipping on another device, the manufacturer because their software development and support costs are even lower, and cyanogen mod developers, because they’re getting paid to do what they want to. cyanogenmod could be the next RedHat.

    This could be a step that direction…

    Now, if this vision becomes true — if “stock” Samsung ROMs are developed by CyanogenMod — perhaps under limited circumstances they are also distributed by CyanogenMod, which would mean that you could get an up-to-date distribution for an old phone with all of Google’s non-OSS software included. I’m sure the contract could be worded in such a way and the distribution could be handled in such a way as to satisfy the real concerns of all the parties. That would make upgrades painless…

  5. >What, if anything, does Samsung hope to gain from that alliance?

    My guess? Protection, and differentiation. Protection from the fear that Google might abuse it’s ownership of Motorola; or that they might start getting serious about using “preferred partner” status as a stick, and that Samsung may not always be a preferred partner. The cyanogen guys are clearly good and smart, and that would help Samsung stay relevant in a world where Google starts tilting the playing field.

    Differentiation because Samsung is concerned with selling Samsung phones, not Android phones. That is, if you’re right, and this whole Android thing is a repeat of 90’s and early 2000’s, Samsung doesn’t want to be just another manufacturer. Think of how many companies were making computers in the 90’s. Now think about how many there are today. When all you have to differentiate yourself from your competitors is low margin hardware that’s quickly becoming a commodity, it’s real easy to get buried. By having the cyanogen guys on board, Samsung might be able to leverage them to make an Android that’s “better” then everyone else’s Android. Of course, there’s a very fine line between adding to the system and making it “better” and adding carrier (or in this case, manufacturer) cruft, but you can’t win if you don’t try in the first place.

  6. @Bennett I wouldn’t really consider Amazon’s UI changes for the Kindle Fire to be a real fork of Android.

    Sure, the home screen, settings app, and some other UI stuff has been changed around. But the way Android is designed, everything is an app, so they wouldn’t really have to modify the OS to do that. It’s more a matter of developing a new app for Home screen, Settings, etc and having them implement the same Intents as the original apps. This lets them act as drop-in replacements.

    To me, that’s just plain old app development, except that the apps happen to come pre-built into the device. It’s a finer point that most journalists miss.

    I’m fairly certain nothing that significant has changed about the API when Kindle build the Fire. Most apps should run just fine without modification or recompilation. To break compatibility would be against Amazon’s interests anyway. The same could be said for HTC Sense UI, Samsung TouchWiz, or Motorola MotoBlur.

  7. I wouldn’t worry too much about Google “turning evil” and starting to close up Android. The openness of Android is one of its key differentiators. If they closed up then they’d lose one of their big selling points against Apple and Microsoft — particularly Microsoft, who prefers totally closed software on multiple vendors’ hardware. A single vendor Google-rola hardware/software stack has no intrinsic advantage over a single vendor Apple stack.

  8. Samsung makes hardware. Android is software. Samsung wants to sell devices with Android on it. Not only is Android free/open source – it’s *cool*, and the fact that a device runs it is a *feature*.

    If I were Samsung, I’d be very interested in getting the Cyanogen devs involved in help to get Android on my devices in the first place. Yeah, the code is portable, but that doesn’t mean you just set a couple of #defines and start a build.

    A lot of Android device owners have expressed unhappiness about slow or non-existent upgrades for their devices It may not in fact *matter*, as a newer version may not add anything the device and installed apps can use, but the perception will still be there.

    I’m not sure what Samsung’s future moves might be, but they are certainly increasing the size of their Android bet.

    (And I suspect that this move has a lot less to do with phones than tablets, and a tablet is less likely to have the issue of whether Android X can even run on the hardware it provides.)

  9. “By having the cyanogen guys on board, Samsung might be able to leverage them to make an Android that’s “better” then everyone else’s Android. Of course, there’s a very fine line between adding to the system and making it “better” and adding carrier (or in this case, manufacturer) cruft, but you can’t win if you don’t try in the first place.”

    Here’s one obvious option: Cyanogen could add improvements to the speed and efficiency of the core code, give it to Samsung, Samsung releases the updates on its own hardware, and then Cyanogen releases the source changes back to Google. Result: the Google OSS stack continually improves, but Samsung is always one release of Cyanogen-developed improvements ahead of everyone else.

    I’d much rather see than approach than one of “improvements” that are just application cruft unwanted by most users.

    Ironically, the carriers don’t always behave in their own interest on this “cruft”. For example, Virgin Mobile has an “app” on their phones that supposedly lets you add $$$ to your account. Unfortunately, all it provides is a link to the URL of their regular web site add-$ capabiilty, and that site is totally not optimized for mobile. I find it completely unusable, and have to find a real PC when it’s time to replenish my account.

    Having the phone come with an app that offered a mobile-optimized way to replenish the account, or upgrade to a higher level of service, would have been very much in both their interest and that of their customers.

  10. Samsung, if you hired Cyanogen guy, Y U NO MAKE OFFICIAL CM7 FOR GALAXY S?

    Samsung ain’t subsidizing shit on the CM front. They just hired him because he’s a platform expert, and they need platform expertise to do their locked-down, spyware-infested Android builds.

    Bennett,

    When all you have to differentiate yourself from your competitors is low margin hardware that’s quickly becoming a commodity, it’s real easy to get buried. By having the cyanogen guys on board, Samsung might be able to leverage them to make an Android that’s “better” then everyone else’s Android.

    There’s only one company that can differentiate itself well in the low-margin commodity hardware market. Guess who it is. Hint: it ain’t Samsung.

    I’m interested to see what happens at that point, since there’s no real historical precedent for a commercially successful operating system getting forked.

    Haven’t read up much on your Unix history, have you?

    Anyway, it’s starkly instructive for Android. The Unix vendors knew they were at risk of being disrupted from below by Microsoft on peecees. While they were trying to get the upper hand and/or keep each other in check over issues like what buttons should look like (OPEN LOOK vs. Motif vs. NeWS vs. NEXTSTEP vs…) Microsoft went ahead and disrupted the shit out of them. Now they’re all dead, leaving Apple of all companies to come in and dominate the Unix workstation market.

    It’s difficult for several vendors to support the same platform because they can’t resist the urge to differentiate and compromise the unity of the platform. By presenting a unified face to Windows (on cheap hardware at that), Microsoft was able to get a lot more support from developers than the schismatic Unix world of the day.

    We’re already seeing Android vendors in jeopardy because they can’t keep up with an increasingly aggressive market. Watch them go for each other’s throats soon, and start doing things like putting vendor-specific APIs on their phones in order to vendor-lock apps.

  11. @Jeff Read
    You just proved Android does not exist.

    In other news, bumblebees cannot fly, as airodynamics has proven.

  12. OK, if Samsung hiring Cyanogen will mean CyanogenMod will arrive sooner on Samsung devices, what does this say about CyanogenMod on non-Samsung devices? I’d like to see CM9 on Nook Color sometime, too, you know.

  13. By having the cyanogen guys on board, Samsung might be able to leverage them to make an Android that’s “better” then everyone else’s Android.

    I wonder how much of Samsung’s competitive advantage is already currently embodied in touchwiz. It sucks less than sense or blur IMHO and it’s on a lot of their products, not just the Android ones.

    If I were Samsung I’d invest very little into improving core Android since Google is going to do it’s own thing anyway AND anything I send upstream ends up in the hands of my competitors. Unless I was ready to completely fork the codebase like Amazon and forego the market (not happening).

    Remember as Samsung I still have Bada and I’m the one shipping over 70M phones. The thing I want to do big time is kicking LG and other Android handset makers while they are down. Then my primary competitors are Apple (not gonna ever ship 70M phones and whom I’m copying) and Nokia running WP7 (which I can ship too to undercut them if need be).

    I’d let Cyanogen spend 20% of his time doing whatever the hell he wants (likely CM9) but the other 80% of the time working on improving Touchwiz and maybe Bada. Wasting his time on making CM9 work on older Samsung phones full time is non-optimal. You can hire some less talented coders to do backports and testing and have cyanogen available as a consultant when they run into snags.

  14. @jeff I disagree. Samsung is THE Android handset maker that is able to differentiate and that’s been their strategy from the start with touchwiz.

    The lesson from the Unix wars I believe to be the opposite. Fuck collaborating with your competitors. Bury them. All those bloated Open and Common system crap was exactly the wrong thing to do. If Sun told the other vendors (especially IBM and HP) to go pound sand and pushed forward with OpenSTEP and their own stuff they’d have been better off.

    Sun’s other problem was a big fear of cannibalizing their own sales. Something Apple has been very aggressive the other way. Cannibalizing your own sales beats the hell out of letting someone else do so. Sun whined about MS but THEY had an answer to windows server with Solaris X86 and priced it wrong, killed it more than once and essentially gave MS an entry to the low end server market. Had they sold Solaris X86 for $99 they’d have neutered BOTH windows server AND enterprise linux. Which probably would have meant that neither IBM nor HP would have dumped massive amounts of money and valuable IP into Linux.

  15. @Nigel:

    > Had they sold Solaris X86 for $99 they’d have neutered BOTH windows server AND enterprise linux.

    And then been able to follow the Microsoft tactic of bumping the price up slowly enough the frog never notices what is happening.

  16. > Haven’t read up much on your Unix history, have you?

    Reading seems like more of a problem for you than for me, since I explicitly explained why I don’t think Unix counts in my original comment.

  17. Reading seems like more of a problem for you than for me, since I explicitly explained why I don’t think Unix counts in my original comment.

    You were talking about Linux in the server room; I was talking about Unix on the desktop. (Yes, such a thing seemed actually feasible… in the late 80s when 32-bit desktop hardware was hitting the mainstream.)

  18. @Pat, Nigel:

    Eh? I think Solaris x86 was that cheap; I recall $50/socket for the supported version, with freeware (still!) available:

    https://www.illumos.org/

    Hardware support was more of a problem than Linux, IIRC, and Sun in general was always ambivalent at best about it.

  19. Jeff Read said: (And I agree completely) It’s difficult for several vendors to support the same platform because they can’t resist the urge to differentiate and compromise the unity of the platform. By presenting a unified face to Windows (on cheap hardware at that), Microsoft was able to get a lot more support from developers than the schismatic Unix world of the day.

    We’re already seeing Android vendors in jeopardy because they can’t keep up with an increasingly aggressive market. Watch them go for each other’s throats soon, and start doing things like putting vendor-specific APIs on their phones in order to vendor-lock apps.

    Yep. Samsung doesn’t care about the Android brand nearly as much as it cares about the Samsung brand, and/or getting carriers to push their phones. The only significant entity that cares about Android as a brand is Google.

    I’m not sure what the app-developer logic for using such a vendor-specific API is, though. It’d have to be pretty compelling to get someone to use it, knowing that it’ll either restrict their app to one vendor (or, worse, one vendor on one carrier!) or make them fork their app, and in any case deal with lots of horrible “it didn’t work on my phone!” reviews. It’s a developer nightmare, unless the vendor can basically shovel cash at them.

    (I’d also add that Microsoft, at least in my experience with them as a developer since 2000, really, really wants developers to be happy and to be able to use every bit of MS tech possible. My even more limited experience with The Big Unix Vendors (and god help us all, Linux APIs) suggests they were… not as developer-focused, shall we say?*

    I don’t know about The Before Times, but Ballmer’s oft-mocked “Developers! Developers! Developers!” rant expressed something about MS’s plan very accurately. And it’s done them a whole lot of good – which sounds like it ought to be sarcasm, but isn’t. MSDN is an amazing resource for Windows development.

    I haven’t looked into the Android dev resources, but I imagine they’re not too shabby.)

    (Snarkish TL;DR: Buy Apple stock.)

    * If anyone who Was There In The Trenches knows otherwise, I’ll be happy to be corrected. Or maybe it was all there and you just needed a “membership” or official dev relationship to see it. Which is a wall MS happily doesn’t have for API documentation.

  20. @sigivald Sun did a good job at dev support. You know, the OTHER major web app stack (J2EE vs .NET) Sun’s dev environments were quite good. Sun compilers and debuggers were great. They had good SDKs and APIs even ignoring the entire Java stack. MSDN was cheaper than Sun’s offerings which I think were tied to service agreements on hardware…at least ours were. We bought silver or whatever coverage that gave us access to sun engineers.

    So yeah, I’d say that Sun was very dev centric.

  21. Patrick Maupin said: And then been able to follow the Microsoft tactic of bumping the price up slowly enough the frog never notices what is happening.

    Win2K Pro cost $319 when it came out.
    Upgrades cost $149 (from NT) or $219 (95/98).

    Windows 7 Ultimate is $319 today (Home is a mere $199).
    Upgrades cost $169 (from Starter) to $139 (from Home Premium) to $129 (Pro) (or $79, Starter to HP, for people who don’t want Ultimate).

    Even without inflation, prices are flat or down; with inflation, prices are down, not up.

    (Now, sure, Win 98 was only $210 new, or a $109 upgrade. But it’s not exactly comparable to Win7 Ultimate. If we compare to Win7 Home Premium, we find… cheaper.)

    I deny your thesis, at least as applies to consumer OSes. I haven’t checked “enterprise” licensing, since it’s a maze…

  22. @Mike E:

    > Eh? I think Solaris x86 was that cheap…

    Check the timeline. I think that was reactionary. Nigel was talking about if Sun had had the balls to lower the price before Linux or Windows Server gained a foothold.

    @Sigivald:

    Yes, MSDN used to cost significant money. But then it got free. Microsoft is capable of learning.

  23. @Mike They briefly had a $99 dev copy for developers and system administrators then the price shot up like $700…more than what MS was charging for windows server.

    They had an agreement to ship Solaris X86 on Dell servers and then killed that. Then Solaris X86 got backburnered right when MS really got it’s windows server act really together and the rest is history. Exchange/SQL Server/Sharepoint servers everywhere and Windows the dominant business server outside of Big Iron Unix, IBM Mainframes and Linux Web Servers.

    Sure, Sun would have taken big hits if it had cannibalized their own lower end Sparc servers with Intel based servers running X86 but they could have kept MS at bay. Probably. Maybe. Well, sure as hell better than it ended up turning out anyway…getting bought by Oracle.

  24. @Sigivald:

    > I deny your thesis, at least as applies to consumer OSes. I haven’t checked “enterprise” licensing, since it’s a maze…

    First of all, MS is an office app company that happens to sell an OS.

    Second of all, software and electronics don’t follow the typical inflation curve — prices go down as more units are built. A better metric would be to analyze OS cost as a percentage of ASP. I think you will find it has risen sharply and steadily (except for the fiasco where MS almost lost the netbook market entirely and dropped prices like a rock for limited hardware). Which is amazing considering that the hardware has a per-unit manufacturing cost and the software doesn’t.

    And finally, I disagree with your assertion that Win 98 was “different” in the sense of who was selling it, who was marketing it, and how much time, energy, and effort went into it…

  25. Back when I was at Interactive Systems, and was peripherally involved with their Solaris / Sparc ports and the System V / 386 group that Sun later bought, we felt pretty developer friendly …

  26. @Patrick significant money is relative. MSDN was 4 digits or less if I remember right ($5-$6K). Sun’s equivalent was 5 digits. Everything on Windows was cheaper. IDEs, compilers, service contracts, OS, hardware. Visual Studio was dirt cheap in comparison to things like IBM Worksomethingorother. Sparc Solaris was $15K if I remember right.

    The cost differential between spec’ing a low end sparc development station and a fully tricked out Pentium 90 uber desktop was HUGE. And if you put linux on the thing it would run rings around the sparc 5 or IPX or whatever equivalent for the time period. I remember having a personal P90 running slackware and comparing to the IPX I had to share at work.

  27. @Nigel:
    “significant money is relative. MSDN was 4 digits or less if I remember right ($5-$6K). Sun’s equivalent was 5 digits. Everything on Windows was cheaper. IDEs, compilers, service contracts, OS, hardware. Visual Studio was dirt cheap in comparison to things like IBM Worksomethingorother. Sparc Solaris was $15K if I remember right.”

    This was true for third-party products as well. I remember a time when Framemaker/Framebuilder was about $2500 a copy on Solaris and $400 on a PC or Mac. It just came down to volume. Now if Solaris or other Unix had been as common on PC’s as DOS/Windows was, the economics would have been different…

  28. @Nigel:

    I think at its peak, MSDN was about 10X less than you say (only around $500). And you’re right, compared to Unix tools, it was a bargain. But I was comparing it to the present-day $0.

  29. they were trying to get the upper hand and/or keep each other in check over issues like what buttons should look like (OPEN LOOK vs. Motif vs. NeWS vs. NEXTSTEP vs…

    My impression of the UNIX workstation vendors was that their GUIs were an afterthought, and what they liked to brag about was the MIPS rating of their CPUs, their transactions per second, etc. I knew some users who used to argue OpenLook vs. Motif, etc, but as far as I could tell, Sun and DEC never cared.

  30. I was talking about Unix on the desktop. (Yes, such a thing seemed actually feasible… in the late 80s when 32-bit desktop hardware was hitting the mainstream.)

    Yeah, it did seem feasible, but it wasn’t.

    To topple x86 and DOS, one needed to be able to run x86 DOS PC software (very nearly) as well as a DOS PC, for the same price as (or less than) a DOS PC. Otherwise, businesses were going to stick with DOS PCs, because they met business requirements at a lower price. Anybody who introduced a new product at a higher cost was pre-disrupted from below. By the time it became possible to ship a Unix box that ran DOS as well as a DOS PC for the same price as a DOS PC, Windows had become entrenched by network effects, and you had to run x86 Windows PC software as well as a Windows PC, for the same price as a Windows PC.

    (This is also why the 32-64 bit transition wasn’t a good opportunity for Linux on the desktop, even coupled with the Vista teething troubles. 32-bit XP remained available to businesses, and they weren’t going to switch until they could get a 64-bit OS that could run their 32-bit Windows software (very nearly) as well as Windows XP. WINE doesn’t manage it nearly as well as 64-bit Windows 7.)

  31. @Steven Ehrbar:

    By the time it became possible to ship a Unix box that ran DOS as well as a DOS PC for the same price as a DOS PC, Windows had become entrenched by network effects,

    And don’t forget the infamous Microsoft pricing model, where shipping DOS (then Windows) on 100% of your machines was as cheap or cheaper than shipping it on only 50% of your machines…

  32. Interesting new comscore report: http://blog.comscore.com/2011/11/the_rise_of_digital_omnivores.html

    Their ‘MobiLens’ method reports iOS devices as having the largest installed base share of ‘non-computer devices’ in the US in the three months ending in August this year, with 43.1% of the installed units.

    “The iPad significantly contributes to giving iOS the largest share of non-computer devices in use. The pie chart on the left illustrates each platform’s share of devices in use and shows iOS accounting for the highest share at 43.1 percent.”

    Another interesting item is that the iPad accounts for 97% of all tablet web traffic in the US.

  33. @Mikko
    “In other news: AT&T in Talks to Carry Nokia Windows Phone (Bloomberg) Ars Technica reviewed the new Lumia models a couple of weeks ago.”

    A heqvily subsidized (free?) NoWin phone with CyanogenMod*?

    That could be a winner ;-)

    *Of did Nokia lock the bootloader real good?

  34. Sorry for not understanding something.

    ESR’s initial post in this thread contains the phrase: “… that Cyanogen’s eponymous founder and lead developer …”.

    The name of said person is Steve Kondik. Please, how is that eponymous with the name Cyanogen? Or is it eponymous with something else?

    Thank you.

    1. >Please, how is that eponymous with the name Cyanogen?

      It was my understanding that CyanogenMOD is called CyanogenMOD because Steve Kondik uses “Cyanogen” as his handle.

  35. In related news, Barnes & Noble cite the Emacs manual (Stallman, GNU Emacs Manual, 7/1994, pp. 1 et seq. ) as prior art to one of MS’ patents. Reams of prior art are listed to these bogus patents. See Groklaw:

    http://www.groklaw.net/article.php?story=20111116222255905

    You’ll also enjoy the list of supplemental prior art [PDF], which is old stuff like Netscape and Mosaic. The GNU Emacs Manual. Publications written by Microsoft itself. It begins on page 2 and runs on and on and on until page 45. I’m not kidding. I think you could conclude that Barnes & Noble doesn’t think much of Microsoft’s patents.

  36. A heqvily subsidized (free?) NoWin phone with CyanogenMod*?

    Meh. I’m still butthurt that they gave up on MeeGo.

    All reports indicate that the N9 is a fucking amazing phone. More advanced hardware than the Lumia with a similar design, and it runs freakin’ Linux! Not Android but the real deal.

  37. Mark Says: Sure, the home screen, settings app, and some other UI stuff has been changed around. But the way Android is designed, everything is an app, so they wouldn’t really have to modify the OS to do that

    This is how good operating systems have been since Tenex in the 70s. Another related term is micro-kernel. The OS deals with hardware, and you have an app that does look and feel. Don’t like the look and feel? Change the UI out.

    We have, IMHO, spent the past 30 years confusing the term operating system.

    As long as there is nothing keeping me from changing the app, I’m happy to let the vendors think that their app is better.

  38. And don’t forget the infamous Microsoft pricing model, where shipping DOS (then Windows) on 100% of your machines was as cheap or cheaper than shipping it on only 50% of your machines…

    That was nasty, but probably not all that important, actually. The barriers to entry as a manufacturer of PCs weren’t all that onerous. Sun, for example, could easily have started its own clonemaking division without any MS contracts in 1989 (though they’d need a DR contract). The trouble is that the Unix-capable machines, 386es with 4+ MB RAM, were inevitably going to be substantially pricier than DOS 286s with 1 MB of RAM. By the time 386s with 4 MB were the cheap end, Windows was standard, and WABI wasn’t good enough soon enough to compete with Windows on its own (using Windows libraries directly of course instantly increased licensing costs and meant having to have a contract with Microsoft, the same problem OS/2 2.x-3 had).

  39. @Steven Ehrbar:

    > That was nasty, but probably not all that important, actually. The barriers to entry as a manufacturer of PCs weren’t all that onerous.

    Those two statements are in direct contradiction. Most of the early enthusiast growth in the PC market came through small stores that manufactured their own white-box systems. They couldn’t afford to push anything except DOS.

  40. My Nooks hadn’t shipped yet today, and I cancelled the order. Now taking a wait and see approach. Apparently Kindle Fire quite easy to hack (and sideload), but Nook Tablet is a little harder to sideload, and might have a locked bootloader:

    http://forum.xda-developers.com/showpost.php?s=0daece45eac6069f7a29b2d62e2780cf&p=19404898&postcount=1

    Sad. I was rooting for the underdog, especially after the way they are going mano a mano with Microsoft.

  41. @Patrick: “Apparently Kindle Fire quite easy to hack (and sideload), but Nook Tablet is a little harder to sideload, and might have a locked bootloader.”

    I’m shocked. I thought that B&N had learned from the success of their Nook Color, no doubt do in part to the enthusiasm of the hacker community.

    On the other hand. I figured that Amazon would lock the Fire up tight because the cost is so low they can’t make any money on it unless it leads to content sales.

    “Amazon Kindle Fire Costs $201.70 To Make, Just Topping $199 Price”

    http://online.wsj.com/article/BT-CO-20111118-706635.html

  42. @Patrick yah, but in IRC there’s progress. Pokey is being unnecessarily pessimistic and a real downer.

    Frankly, as long as they keep sideloading open I don’t think I really care. Especially given that Amazon Prime video appears to be working as long as you don’t root.

    I’m still not interested in the KF. I might try to get a Playbook on Fire Sale (heh) if they don’t have the NC opened up.

    $199 for the 16Gb version seems like a great deal and I appear to be collecting defunct tablets anyway. :) I’m betting a CM7 or CM9 port for the Playbook.

  43. All reports indicate that the N9 is a fucking amazing phone. More advanced hardware than the Lumia with a similar design, and it runs freakin’ Linux! Not Android but the real deal.

    This is a fairly good argument in favor of GNU’s “GNU/Linux” campaign. Android on Linux is nice and all, but I’m really going to miss my Pre when it dies. Nothing like having the entire Optware repository one “ipkg install” away.

  44. Those two statements are in direct contradiction. Most of the early enthusiast growth in the PC market

    My statements weren’t made in the context of the early enthusiast growth, but rather in the context of the late 1980s. Starting a new PC manufacturer was perfectly possible at that point, and would involve licensing a BIOS from one of the BIOS makers, buying x86 chips and other chips from standard manufacturers unlinked to any PC manufacturer, buying one of the Taiwanese reference motherboard designs, et cetera. Such a business could then license DR-DOS 3.31, released May 1988, and would accordingly be entirely free of MS licensing terms.

    If there accordingly had been a better-than-DOS OS available in 1988-1989 that, critically, could run DOS programs as well as DOS on hardware no more expensive than that needed by DOS, any new PC manufacturer could have come in and ripped anyone with the per-processor or per-system licenses from Microsoft a new asshole. The MS contracts were accordingly completely beside the point. The problem was that a 286 couldn’t possibly manage the task of running DOS programs under a real operating system (even if you could manage to get a real OS to run on a 286), and somebody who was buying systems to run DOS programs on a secretary’s desktop wasn’t going to spend the extra money to buy a 4 MB 386 in 1989.

    MS selling only per-copy licenses would have resulted in things being fractionally easier for people who wanted alternative OSes without breaking the network-and-cheapness effects that really drove DOS then Windows sales. DR, IBM, and SCO lost a little money 1990-1994 because of MS licensing, but no paradigm shift was stifled by it.

  45. @Steven Ehrbar:

    > but rather in the context of the late 1980s.

    I’m talking about the same time frame. At least around here, most PCs were still sold from little shops.

    > Such a business could then license DR-DOS 3.31, released May 1988, and would accordingly be entirely free of MS licensing terms.

    I think almost all PC manufacturers started small. (Dell started by selling stuff from the trunk of his car.) I also think Microsoft’s pricing strategy had more impact than you are acknowledging. BTW, I did some contract programming through little computer shops in the 80s…

    If there accordingly had been a better-than-DOS OS available in 1988-1989 that, critically, could run DOS programs as well as DOS on hardware no more expensive than that needed by DOS, any new PC manufacturer could have come in and ripped anyone with the per-processor or per-system licenses from Microsoft a new asshole.

    DR-DOS was better (and cheaper, at least at retail) than MS-DOS in that timeframe.

  46. @Nigel:

    Frankly, as long as they keep sideloading open I don’t think I really care. Especially given that Amazon Prime video appears to be working as long as you don’t root.

    Agreed, except…

    With a locked bootloader, how do you know that an OS upgrade won’t disable or cripple the sideloading? It could be Sony Playstation all over again.

  47. I used DR DOS for awhile in that era, Microsoft’s tactic of deliberately breaking compatibility was well known.

  48. @Jeff Read Says:
    >Meh. I’m still butthurt that they gave up on MeeGo.

    They stil have a single GNU/Linux system left. I’m talking of their ‘Meltemi’ platform, which they are planning to replace the aging S40 in the low-end phones. It’s catchphrase is “Internet for the next billion.”

    The downside is that it will always be cheaper low-end hardware as opposed to the high-end that maemo/meego was.

    The upside is that afaik it’s run by people who have solid experience in making kick-ass products, and Nokia is a lot more serious about it than it ever was about Meego.

  49. I don’t think the updates were just cosmetic. They fixed quite some bugs…
    And that means ‘security issues closed’ – at least to me that’s quite important…

  50. @Patrick

    >Interesting survey of IT professionals:

    I think it is pretty clear that this survey is all but useless. The participants are drawn from IBM’s ‘developerWorks’ community, which is focussed on Java, Linux, and web technologies, so it is hardly a surprise that they would be interested in developing for a Java- and Linux-based platform.

    Secondly, just look at the results: 9% of respondents are interested in developing for WebOS, a platform that is all but dead. This should tell us something about how meaningful and realistic these results are.

  51. @Tom:

    > I think it is pretty clear that this survey is all but useless.

    That’s not clear at all. Yes, it reflects a subset of the market. No, that doesn’t make it useless.

    > so it is hardly a surprise that they would be interested in developing for a Java- and Linux-based platform.

    “planning to develop and deploy applications for the Android platform” is a bit stronger statement than “would be interested.”

    > Secondly, just look at the results: 9% of respondents are interested in developing for WebOS, a platform that is all but dead.

    WebOS was pretty nifty. I imagine its learning curve was pretty good for corporate IT web developers (who aren’t typically trying to build high-performance games), and HP hadn’t yet killed WebOS when the survey was conducted.

    > This should tell us something about how meaningful and realistic these results are.

    Well, it certainly tells us they’re out of date. All those WebOS guys probably redirected to Android apps now.

  52. >“planning to develop and deploy applications for the Android platform” is a bit stronger statement than “would be interested.”

    Ok, let me rephrase:

    It is hardly a surprise that they would be planning to develop and deploy on a Java- and Linux-based platform, given that they are members of a community focussed on Linux and Java.

  53. It is hardly a surprise that they would be planning to develop and deploy on a Java- and Linux-based platform, given that they are members of a community focussed on Linux and Java.

    As you point out, it’s no surprise that this IBM developerWorks survey participants are working with Java or Linux. I still think its newsworthy that 70% of the respondents are in the planning stage or better for mobile platforms.

  54. @Patrick

    Yes, I’d certainly take that point.

    Perhaps I was rather too hasty in assuming you were making an Android vs. iOS argument.

  55. @Patrick Maupin
    Groklaw has more on how MS used its monopoly to stop research on alternatives:

    http://www.groklaw.net/article.php?story=20111112150717289

    The exhibit I wanted to highlight, though, is Exhibit 1521, a 1993 slide presentation by Compaq, which was considering how badly Microsoft would retaliate if it didn’t go along with a proposed deal, and two items stand out:

    1) Compaq perceived that Microsoft wanted it to be “monogamous” and have no dealings with Novell; and

    2), it believed that if it didn’t go along, one of the retaliations would be getting cut off from early information about Microsoft products and deliberate incompatibility, as per what Microsoft did to DR DOS.

    Since that is in the ballpark of what Novell currently is claiming in the litigation against Microsoft over WordPerfect, except what they are claiming is even worse, namely that Microsoft induced Novell to use the APIs and then did a switcheroo that left Novell with its pants down — while Microsoft is asserting that any last minute changes or delays were business-related, not anticompetitive conduct, I thought I’d show it to you. It seems at least one other company at the relevant time expected retaliation from Microsoft more or less of the type Novell is alleging.

  56. Seriously thinking about that iPhone 4S come upgrade time.

    My Android got infected by a bit of malware which caused it to send out weird random messages that said “urgent please reply” and random garbage.

    It’s happened once or twice to other isolated users (mainly Droid users) but I’ve been unable to Google an exact cause.

    I used to think it wouldn’t happen to me if I were careful. But Android is a malware playground compared to iOS, and that isn’t even counting the malware carriers put on your phone before you even receive it…

  57. A report that makes percentage increase claims – without a single base number – is pretty bogus Jeff. Even if we took their claim at face value, we don’t know if the increase was from 1000 to 4720 or from 50 to 236 …

    In fact, that kind of number is a pretty clear indicator of someone lying with numbers.

  58. @Jeff Read:

    The full report is here: http://www.juniper.net/us/en/dm/interop/go/

    In the mobile security space, a relationship seems to exist between market share and mobile malware. Until recently, the Nokia Symbian operating system led the worldwide mobile OS market and, as such, Symbian malware dominated the samples that the Juniper Networks Global Threat Center discovered and analyzed on a daily basis. Malware affecting Symbian devices make up 77% of the virus definitions found in the Junos Pulse Mobile Security Suite’s database.

    Key Mobile Malware Findings
    • Mobile device and OS marketshare and mobile malware infection rates are linked
    • Mobile malware uses the same techniques as PC malware to infect mobile devices.
    • The greatest mobile malware risk comes from rapid proliferation of applications from app stores.
    • RIM BlackBerry, Google Android, and Apple iOS operating systems suffer predominantly from spyware applications

    Of course, “everybody knows” Android is less secure, so that gets some airplay. But what are they selling?

    Data compiled in 2010 by the GTC from actual Juniper Networks customers noted an average 2.2 percent infection rate across all mobile platforms. Results from a specific Fortune 15 enterprise customer that deployed the Junos Pulse Mobile Security Suite to over 25,000 global mobile devices noted that the Junos Pulse Mobile Security Suite software uncovered a five percent infection rate.

    Well, that explains a lot. They do have a vested interest in scaring people, but they also are collecting some useful data (and as SPQR points out, not sharing all of it with us). Just means we have to think critically (you know, like looking at the source report in the first place, not just blindly parroting what the press says).

    Spyware capable of monitoring any and all forms of communication to and from a mobile device accounted for 61 percent of all reported Juniper Networks mobile customer infections. More tellingly, spyware accounted for 100% of all infections for Android devices as reported by Juniper Networks customers. Specifically designed to reside silently and invisibly on devices, and be undetectable by traditional means, spyware can only be detected by professional mobile anti-malware products.

    Well, that sounds bad. But how does the spyware manage to get the capabilities to do what it does?

    In the summer of 2010, the GTC identified applications capable of malicious activity in the Android Market. The findings showed that one out of every 20 applications requested user permissions that could allow the application to place a call without a user knowing it or without any user interaction required. In
    all, the research indicated that 29 applications were found to request exactly the same permissions as known spyware applications.

    So, maybe if an application requests extra permissions that very few applications request, you should be careful about granting them…

    (BTW, the SoundMiner proof of concept mentioned in the paper is quite scary, but is simply security researchers doing what they do best.)

    Then the paper turns to Apple.

    The Apple iPhone suffers from relatively little known malware, although applications exist to obtain user data and clandestinely transmit this information outside of the device. In a study prepared for the NDSS 2011 conference, researchers from the Technical University of Vienna and the University of California, Santa Barbara worked with other universities to analyze 1,400 iPhone and iPad applications to determine the extent of personal data leakage by developers to third parties.

    The results showed that nearly half of the analyzed applications leaked various forms of sensitive data to third parties. In most cases, application developers used prepackaged code purchased from advertising agencies, originally intended to collect device information that could be used to build advertising profiles of the device user.

    I suppose it kind of, sort of, makes sense to distinguish apps that “leak personal data” from spyware, especially since no major companies are ever hacked…

    According to the researchers, the amount of data leakage was about the same in Apple App Store applications as in Cydia applications associated with jailbroken devices.

    Hmmm, doesn’t appear that vendor curation is the panacea for solving phone security.

    Jailbreaking an Apple iOS device not only allows a user to sever ties with the vetting process of the Apple App Store; it allows users to install services such as SSH, which open the device to a plethora of risks.

    But then on the other hand, Juniper implies its helpful. I’m so confused. Also, I never knew SSH was a security risk. Anybody know a good substitute? I hate to admit it, because somebody might figure out how to take advantage of me, but I use SSH a lot.

    Of course, even if you don’t want to go to the trouble to read the report, you could look for other coverage of the issue you purport to raise. You know, like this:

    http://www.macobserver.com/tmo/article/everything_you_know_about_android_malware_may_be_wrong/

    But that’s not as much fun as baseless snarks, is it?

  59. @SPQR

    A report that makes percentage increase claims – without a single base number – is pretty bogus Jeff. Even if we took their claim at face value, we don’t know if the increase was from 1000 to 4720 or from 50 to 236 …

    Also, these sorts of articles are always vague on whether the malware is on Google’s Android market, or dodgy Chinese sites that nobody in the Western world will come across. Considering their business model, if it were the former they’d be loudly trumpeting it.

  60. And this is Google’s opinion on Android Mallware:

    Googler: Android antivirus software is scareware from ‘charlatans’
    http://news.cnet.com/8301-30685_3-57327424-264/googler-android-antivirus-software-is-scareware-from-charlatans/

    “No major cell phone has a ‘virus’ problem in the traditional sense that Windows and some Mac machines have seen,” he said. “There have been some little things, but they haven’t gotten very far due to the user sandboxing models and the nature of the underlying kernels.”

    Sandboxing confines computing processes to memory compartments and restricts their privileges, making it harder for a compromised program to be used as a launching point for more extensive attacks on a computing device.

    Responses:
    Kapersky

    It’s also worth noting that “viruses” don’t exist on the Android to date–but Trojans certainly do.

    Nothing can prevent a user from installing mallware.

    MacAffee

    McAfee stands by its research, which shows an increasing number of attacks on mobile devices.

    Attacks do not have to succeed. We want to know how many phones are compromised.

    Fsecure

    What @cdibona is missing is that these tools do much more than just antivirus: Antitheft. Remote lock. Backup. Parental control. Web filter.

    So, indeed, no viruses?

  61. Hi ESR,

    Sorry to drop this in out-of-context, but your “previous/next entries” and “previous/next pages” links on the blog are broken. They point to, for example, “http://esr.ibiblio.org/esrblog/?paged=2” where in fact it’s necessary to hack in “http://www.ibiblio.org/esrblog?paged=2” in order to go where you want to go (the first resulting in a 404).

  62. @Winter:

    The quotes you found are interesting and disingenuous. Chris diBona says:

    Please note: Policy engines, and those tools that manage devices from an corporate IT department are not the same thing at all, but sometimes marketers in companies that sell such things sometimes tack on ‘virus’ protection. That part is a lie, tell your vendor to cut it out.

    And then Mikko Hypponen says:

    What @cdibona is missing is that these tools do much more than just antivirus: Antitheft. Remote lock. Backup. Parental control. Web filter.

    Well, that’s just a breathtakingly willful mischaracterization of what Chris diBona wrote. Mikko should be a politician or something.

  63. @SPQR:

    I will note that I went a level deeper to the Juniper release.

    I hope you didn’t think I was calling you out. You weren’t fearmongering by passively transmitting unexamined FUD.

  64. @Patrick
    The AV industy is a good illustration that organizations tend to become what they fight.

  65. No, not at all Patrick. I just didn’t want Jeff Read to claim I hadn’t gone the next level link when I had and also failed to find any hard numbers.

  66. @Patrick
    More about MS’ tactics to stiffle competition by using their monopoly, as presented in court (published on Groklaw)

    Novell Asks to Reopen Case in Chief & Tells the Court How Microsoft Stabbed It In The Back ~pj
    http://www.groklaw.net/article.php?story=20111121214458515

    It’s in an exhibit [PDF] that Microsoft itself presented to the court with a motion for summary judgment, back in 2009, before the appeals court ordered there to be a trial, and the relevant part reads like this:

    Further, there are two antitrust issues that must be addressed. First, Novell continues to have a strong antitrust claim against Microsoft that it will not forsake simply because Microsoft refuses to acknowledge it. Second, the equal access issue must be addressed. Novell, as well as other applications companies, should be given access to Microsoft’s operating system equal to that of your applications developers. There are still five or six bugs that Microsoft has refused to fix which would allow Wordperfect to run smoothly with Windows95. We will have Dave Miller send a specific list to Bob Kruger. The result of the lack of equal access costs Novell, and others, months to release products that are Windows95 compatible. These issues that need to be a major topic of discussion in our meeting.

    And yet Gates’s testimony has been reported like this:

    Gates said Novell just couldn’t deliver a Windows 95 compatible WordPerfect program in time for its rollout, and its own Word program was actually better. He said that by 1994, Microsoft’s Word writing program was ranked No. 1 in the market above WordPerfect.

    (emphasis in original)

  67. @winter

    Nothing can prevent a user from installing mallware.

    Actually products like Bit9 will. Users, even with admin controls, can’t install anything not whitelisted. I’m guessing some of the Android “virus protection” uses blacklists and whitelists to combat known trojans.

    While the major vectors might be sideloading vs downloads from the Android Market, sideloading is far more common (obviously) than on iOS. So Android is more vulnerable to the “Hey, here’s a cool game, try this apk!” attacks. Android Market is also more vulnerable than the iOS app store because of the underlying differences in policy.

    The curated iOS App Store is not immune. It’s just a lot harder to make that happen.

    I like Chris. He came to speak at my company and he’s a good guy. And while I completely agree with every one of his points it’s also a bit disingenuous. Sure, there’s little VIRUS risk on Android but viruses are but one aspect of malware. Between spyware and SMS trojans I don’t care what the spread vector was if I’m looking at a huge SMS bill whether it was a trojan, worm, virus or even malicious QR code that was the vector used.

    For iOS I don’t have to worry about it. Not that it can’t happen but that it’s unlikely enough that I don’t have to do more than regular prudent behavior. Just like with OSX. Sure there is malware for OSX but mostly I don’t have to worry about it as much as Windows. Which in some areas is more secure than OSX.

  68. @Nigel
    “Android Market is also more vulnerable than the iOS app store because of the underlying differences in policy.
    The curated iOS App Store is not immune. It’s just a lot harder to make that happen.”

    With Freedom comes risk. A CD player has no malware. Nor has the average TV set. If you want an appliance to be more flexible, you get the risk that it will behave different than you wanted.

    Back to the curated Appstore. We all know that a police state tend to have less crime than a “free society”. We also know that is because the officials want no competition in fleecing the population. iOS can be saver as much as they lock down the apps and put up a high barrier of entry. Then we can also be sure all profits stays at Apple.

  69. @Winter: Back to the curated Appstore. We all know that a police state tend to have less crime than a “free society”.

    Bit of a nitpick, but that part about the police state isn’t actually true. At best, the police state just has less *visible* crime, but overall levels of criminal activity will be higher, because absolutely noone respects the law.

    Not sure yet what that says about the App Store.

  70. I would argue that in a police state, crime is always rampant, but that the majority of crimes are committed by employees of the state.

  71. ‘ We all know that a police state tend to have less crime than a “free society”. ‘

    No it doesn’t. In a typical police state absolutely everything is a crime.

  72. @Doc Merlin et al
    “No it doesn’t. In a typical police state absolutely everything is a crime.”

    It seems my sarcastic remark is widely misunderstood.

    A police state is a country where the police have absolute power over the non-elite (the 99%). In practice, the police do not have to answer to the law when commoners are involved. Indeed, this generally is implemented by making sure everyone breaks some laws (like in the USA).

    People who have lived in a police state often remark that “there was less crime then”, by which they mean, there were less free-lancers in crime. It is obvious that in a police state, the whole state can be understood as an organized crime syndicate. One that does not allow any competition by non-members.

    If you want to remark that all states are police states, and that it is just a matter of degree, I can already answer that the difference between health and last stage terminal disease too is just a matter of degree. The degree matters, though.

  73. I could have sworn I wrote this buy maybe not…been busy.

    Comparing the iOS App Store to a police state is why normal people roll their eyes at FOSS proponents.

    If all the profit was staying at Apple why has Apple paid out more to app devs than Google?

    Get back to me when you have something more cogent than sarcasm eh?

    And did you seriously just imply that the US was a police state? Because it makes really light of actual, you know, police states. No, not everyone here breaks laws. There are quite a few very annoying folks that drive at the speed limit. And that idiot that pepper sprayed a bunch of non-elites is going to get his ass fired, likely along with the police chief and chancellor. And likely sued out of his retirement money for good measure.

    Oh, wait was that sarcasm again? Damn, I’m rolling my eyes, time for bed.

  74. @Nigel
    “Comparing the iOS App Store to a police state is why normal people roll their eyes at FOSS proponents.”

    Telling us that Android is unsafe because you are free to install what you want on your own phone is why FOSS proponent roll their eyes at Apple fanboys. Apple does engage in censorship beyond the call of security. But if can easily install your own software, that must be “unsafe”. So I feel free to call that the safetety of a police state.

    @Nigel
    “And did you seriously just imply that the US was a police state?”
    No. I did not. I wrote that the laws of the USA are drawn up in ways that make everyone break at least some of them.

    “No, not everyone here breaks laws.”
    Oh yes, you do. Because there are so many ill drafted contradictory laws that everyone who stays in the USA is breaking some laws. I did not think of this myself, I got it from USA Americans.

    You are saved by the fact that there are also strict laws governing what the police are doing. So, you are breaking some law if you walk on the street with an opened bottle of liquor (I do not make this up). However, the police is not allowed to check your bag for liquor.

    On the other hand, it has long been established that you are allowed to burn or abuse the flag, but if you are arrested anyhow, you will find that you were resisting arrest.

    More can be found here:
    http://www.angelfire.com/falcon/flamingchickens/pointlesslaws.html

  75. @winter I didn’t say android was “unsafe” because you can install your own apps. I said it was more vulnerable (less safe) than iOS because you can install your own apps from untrusted sources. Which is pretty much a true statement. Just like it is less safe to install untrusted apps via Cydia on the iPhone.

    You can claim that the iOS app store is “less free”. Which would also be pretty much a true statement.

    However, comparing the iOS app store to a police state is just stupid. You can certainly feel free to make stupid statements, presumably you live in a free country and not a police state. Probably if you DID live in a police state you’d understand how stupid that statement actually is.

    Likewise, if I declared that Android was “unsafe” I’d have to more rigorously defend that assertion lest it also be considered stupid. Good thing I never said that eh? Nice strawman.

    Android is “more safe” than Windows and given sandboxing likely to always remain “more safe” than any desktop OS.

    But I can see where “virus protection” or more accurately, malware protection, would be of use for Android owners. Given that Norton’s anti-malware app is free (I’m guessing with ads) I don’t see this to be an excessive burden. Just load that and be done. It’s not like it costs $50 like it does for Windows users that want a brand name like Norton.

    So malware on Android is mostly a non-issue for MOST sane adults that aren’t installing random apps from who knows where. It would be prudent for them, but probably not necessary, to run anti-malware on Android just like it’s prudent for folks to run anti-malware on OSX but probably not necessary. For adults and teenagers more prone to install random games from who knows where then running anti-malware is probably necessary on Android just like it is on Windows.

    Windows 7 isn’t “unsafe” either. Unfortunately there are more successful malware attacks on Windows (in general, I dunno Win7 stats) than OSX or Linux. Unfortunately the same can be said for Android vs iOS, BB and WP7.

    As far as there being some dumb laws on the books in the US, yep sure are. On the other hand I’m 99.99999% certain I’m never going to run afoul of taking a lion to a theater, hunting camels or wearing a fake mustache to church. Having stupid laws on the books does NOT imply that it is impossible for folks not to break laws.

  76. Telling us that Android is unsafe because you are free to install what you want on your own phone is why FOSS proponent roll their eyes at Apple fanboys. Apple does engage in censorship beyond the call of security. But if can easily install your own software, that must be “unsafe”. So I feel free to call that the safetety of a police state.

    Android is unsafe because you can publish what you want. That’s how people get infected: malware masquerading as legitimate software and getting onto the Android Market because there is no filter. As a result the end user has to exercise caution in what he downloads.

    Any platform that relies on care or knowledge on the end user’s part is a loser from a UX standpoint. Smart people do outrageously stupid things to their computers. My dad is a mechanical engineer, served as a maufacturing director in some big-ass tech companies. He still can’t untangle his Windows box to save his life. How would he manage if he had an Android phone and it got infected?

    Even most of the developers I know would rather live a home life that’s free of all the shit they have to put up with at work. Accordingly, many of them choose Macs for their home workstations. I’m a developer, and I’m seriously looking at the iPhone because I know better than most about what a security compromise can cost you.

    Apple has given us, in the form of the iPhone, iPod Touch, and iPad, precisely the right amount of computer for most of the 99%’s needs (browsing, email, Facebook, games, maybe some short documents, etc.). With virtually none of the hassles. Android devices still have too much computer in them, and not enough appliance in them.

  77. @Jeff Read:

    Apple has given us, in the form of the iPhone, iPod Touch, and iPad, precisely the right amount of computer for most of the 99%’s needs (browsing, email, Facebook, games, maybe some short documents, etc.). With virtually none of the hassles. Android devices still have too much computer in them, and not enough appliance in them.

    That doesn’t make any sense. If you just want the appliance, use it as the appliance. Even on Android. If you want the computer, you have to decide what to download. No matter the platform. Is the Apple App store perfectly safe? No. Is it more safe than Android? Probably. Has anybody quantified that advantage in terms of what it means for the average US consumer? No. Is that for lack of data on their (e.g. Juniper Network’s) part? No. Does that mean that the safety difference is negligible? Probably.

    Now, there is no doubt that if you sideload apps, you have to be more careful. But would your Dad do that, or would he just go to the Android market?

  78. @Patrick

    I’m going to make the unsupported assertion that the Amazon App Store is about as safe as the iOS App Store and that both are safer than the Android Market. Is a trojanized app far more likely to appear on the Market than Amazon? Yes. This isn’t theoretical. DroidDream wasn’t some hacking contest but actual malware downloaded in the tens (or perhaps hundreds) of thousands from the Market.

    http://www.zdnet.com/blog/hardware/stolen-apps-that-root-android-steal-data-and-open-backdoors-available-for-download-from-google-market/11689

    With respect to sideloading apps, that’s an exploitable vulnerability that iOS doesn’t have. That means that iPhones are likely mostly immune to sideloading apps via QR codes. On the other hand if the QR code takes you to a malicious PDF that Apple hasn’t fixed it could be compromised that way.

    Is my dad going sideload apps? Geez, there’s a reason I got him a mac. I got freaking tired of wiping his totally compromised PC every month. I can go to ZDNet and see a QR code to download the ZD android app. Wanna bet that someone’s dad has been merrily doing that to many QR codes they’ve encountered on sites they like? Wanna bet that there are sites where it is trivial for hackers to download that site’s app, trojanize it and stick it back up without the site owner noticing? Or modify the QR code to take you to some other site that will give you the trojanized version instead?

    Wanna bet that it’s trival for someone to use a compromised email account to send out “Hey, try this cool XMas android app I found on the net” and get takers? Because that was pretty common in the windows world with MS Office macros and pictures. It’s amazing what dear ol’ dad will do.

  79. Netflix is likely a good example of a widely sideloaded app because folks really wanted netflix. Predictably there was a trojan masquerading as the real thing.

    http://www.net-security.org/malware_news.php?id=1873

    Heck, I’ve dl’d the Amazon Video apk off XDA. I’m TRUSTING it’s not a trojanized version but seriously it’s not hard to sideload. There are enough really good YouTube how-tos that even semi-technical dads can figure out how to do it for an app he really wants.

    Here’s a windows trojan being pushed via a facebook campaign:

    http://www.net-security.org/malware_news.php?id=1915

    Want to bet that if it were an apk at the other end that folks wouldn’t do an install? Especially if the app did what it said it would do AND was hosted on the official Android Market? Do you not think that there wouldn’t be tens of thousands of downloads before Google figured it out and pulled the plug?

    Macs aren’t immune:

    http://www.net-security.org/malware_news.php?id=1914

  80. @Nigel:

    I’m going to make the unsupported assertion that the Amazon App Store is about as safe as the iOS App Store and that both are safer than the Android Market.

    I believe that. And B&N’s store will probably be pretty safe, too. But I can also believe that the Android market will be getting safer as time goes on.

    This isn’t theoretical.

    But I haven’t heard for a fact that there are no non-theoretical malware apps in the Apple store. And I haven’t heard exactly what anybody lost to Android malware yet, either, so all the losses to date may be theoretical.

    That means that iPhones are likely mostly immune to sideloading apps via QR codes.

    I thought QR codes went through the Android market. But I’m no expert, and I suppose you could download an app that would download other stuff around the market via QR codes in any case.

    Is my dad going sideload apps? Geez, there’s a reason I got him a mac. I got freaking tired of wiping his totally compromised PC every month.

    Yeah, I started using Linux at home around a decade ago when I got tired of seeing a purple gorilla swinging across the screen. But that was due to kids looking for game cheat codes. Certainly, though, there’s a market for curation. It will probably mostly happen on the phone, with an app that gives you meta-information it finds on the web about an app you’re currently trying to install, and that also monitors the behavior of other apps.

    Wanna bet that it’s trival for someone to use a compromised email account to send out “Hey, try this cool XMas android app I found on the net” and get takers? Because that was pretty common in the windows world with MS Office macros and pictures. It’s amazing what dear ol’ dad will do.

    So, the reasoning is basically that Apple is better for the people who are too stupid or ignorant to understand exactly why Apple is better. Not only can I believe that, I also think there’s a marketing campaign in there somewhere. It could be spun to work for either Apple or Google.

  81. QR codes do nothing but map to a URL. However your phone is set up to deal with URL’s is what happens.

  82. From your link:

    STEP 1: ENABLE SIDE-LOADING

    To enable side-loading on your device, you’ll need to go into your phone’s Settings, then Application Settings. Tap the check box next to “Unknown Sources” to enable the installation of non-Market apps.

    STEP 2: DOWNLOAD THE SKYPE APK

    Now you need to download the hacked Skype APK file and copy it from your computer to your phone via your phone’s memory card.

    you can browse to forum user Xeudoxus’s original post from your mobile and tap the link to the Skype APK.

    Once installed on the phone, you run it just like any other application.

    That’s it!

  83. @Nigel:

    Sure, but earlier you said “That means that iPhones are likely mostly immune to sideloading apps via QR codes.” The implication being, that Android phones are not.

    The article I linked to that you quoted implies use of an adjunct computer every time you sideload an app. (There may be an app to fix that, but I don’t know about it.) In contrast, if your phone has a barcode app on it, it’s really easy to download from the market straight to your phone. Hence my comment about QR codes mainly being about the market afaik…

  84. No, it doesn’t.

    “you can browse to forum user Xeudoxus’s original post from your mobile and tap the link to the Skype APK.”

  85. @Nigel:

    I really don’t understand what you’re trying to get at about malicious QR codes.

    Whenever you install an APK (via the Android Market, via Amazon or another third-party’s app store, via a URL, … or, in other words, anything other than an “adb push” from your computer which also requires conscious action on the user’s part) you get a confirmation screen asking if you actually want to install this thing (and listing permissions it uses, etc.). If you can get the user to say yes to that, I don’t think it matters if your vector is an app store, a link, an email, a QR code or a smoke signal. Unless you’re claiming that using a QR code lets you avoid that confirmation somehow…

  86. @ravi QR codes are just another form of link, yes. But sideloading isn’t hard for many android devices. I have no idea why websites provide QR codes vs just links to the apps.

    I guess the assumption is you’re reading on your desktop/laptop and snap the QR code with your phone.

  87. I guess the assumption is you’re reading on your desktop/laptop and snap the QR code with your phone.

    Or, you see the QR on a poster on the train or in a station, and you point your phone at it instead of having to type the URL in.

  88. @Marco this is one area I can’t imagine Android fan-bois can come up with any sort of spin. Apple doesn’t allow carriers to install crapware, Android does. And this is some seriously bad crapware.

  89. @phil:

    > this is one area I can’t imagine Android fan-bois can come up with any sort of spin.

    Actually, I think it’s quite easy to spin as an on-going improvement.

    On this issue, it’s basically Apple vs. everybody else — yes, the crapware is on Nokia and Blackberry phones, too.

    There is no question that Apple wrested some control from the carriers and gave it to themselves, and no question that, for Apple customers, this is far better than the control the carriers exert on all non-Apple phones.

    But for non-Apple phones, what are the chances that somebody would have noticed this on a BlackBerry if they weren’t pointed there because it was easier to spot on Android?

    Short-term, Apple’s strategy of forcibly removing power from the carriers is a good thing for their users.

    Long-term, I think Android’s strategy of unbridled competition combined with open source components will be good for all users. The upcoming class action suits and regulatory headaches are just the tip of the iceberg for the carriers — I wouldn’t be surprised if they capitulate rather quickly.

    Medium-term, anything that is good for CyangenMod is good for the ecosystem.

  90. BTW, the CarrierIQ fiasco has gotten enough play in the general press that you can bet multiple class action law firms are burning the midnight oil to try to be fastest to the best court with the most number of plaintiffs to make it worthwhile. Apparently, around 55 million people carry Android or Blackberry phones in this country.

    Here’s an article about some of the issues:

    http://www.forbes.com/sites/andygreenberg/2011/11/30/phone-rootkit-carrier-iq-may-have-violated-wiretap-law-in-millions-of-cases/

    And that doesn’t even cover the child pornography aspect from capturing the pictures of all those teens sexting each other. Get the popcorn…

  91. I think CarrierIQ officials should also cancel any travels outside of the USA. They have broken every privacy law on the planet. And many countires do have privacy laws with long and sharp teeth.

  92. CarrierIQ software runs in a much more limited form on iOS: http://blog.chpwn.com/post/13572216737

    And (probably) doesn’t run on Nexus phones: http://www.theverge.com/2011/12/1/2602313/google-nexus-android-phones-and-original-xoom-tablet-do-not-include

    So this is not a Google vs. Apple thing. It is a demonstration of the downside of open; there are always going to be vendors who’ll work with the carriers to do whatever the carriers want. A single-sourced phone that carriers want is more powerful. That power can be used for good or for ill, of course.

  93. @Bryant:

    > It is a demonstration of the downside of open;

    And this explains CarrierIQ on Nokia and Blackberry how?

  94. I don’t disagree at all with the concept that if I have something that you really want, I have more leverage over you than if I have something that you’re not jonesing for. That’s pretty standard.

    But it’s still a non-sequitur to comparing the upside of Apple against the downside of “open” using an example that is apparently Apple against all the other smartphones.

  95. android allows carriers to install crapware/modify the OS to their uses. This is one of the downsides of “open”. Apparently in this particular case, Blackberry is “open” too.

    The root problem is the carriers all suck/are incompetent/user hostile. In this case openness allows the carriers to cause damage.

  96. > In this case openness allows the carriers to cause damage.

    That’s still a non-sequitur that fails to explain explain CarrierIQ on Nokia or Blackberry.

    I think it would be more accurate to say that a strong negotiating position like Apple has allows the device vendor to mitigate the carrier hostility (if they choose to do so), while openness like Android provides makes it much more likely that hostile acts by the carrier will be noticed by the public.

    Although Apple might smell better than the other options in this instance (CarrierIQ is installed on iOS, but turned off by default. But what does it take to turn it on? Can it be done remotely? etc.), there is no doubt that openness makes it easier for third parties to figure out and report on what is going on.

  97. @Patrick Maupin see ‘Apparently in this particular case, Blackberry is “open” too’.

    you are right that Apple gets away with this because of their strong negotiating purpose.

    True on your comment that it makes it easier to figure it out. But this supposedly has been going on for years.

    I see this as just an extension of crapware. Crapware is installed on almost every Android phone.

  98. You seem to be using “open” in the sense that a carrier can modify the firmware. That’s fine, but that’s a subset of what most of the rest of the software community means by open.

  99. The root problem is the carriers all suck/are incompetent/user hostile. In this case openness allows the carriers to cause damage.

    I’d be willing to lay long odds that this is largely an American thing. In post-9/11 Murka we’ve gotten used to deep surveillance as the normal state of things, but as Winter says, other countries actually do have some notion of a right to privacy, and it is enforced. Ask Google. Or Facebook.

  100. BTW, the CarrierIQ fiasco has gotten enough play in the general press that you can bet multiple class action law firms are burning the midnight oil to try to be fastest to the best court with the most number of plaintiffs to make it worthwhile.

    No, the Bush appointees on the Surpeme Court negated that right, remember?

  101. > No, the Bush appointees on the Surpeme Court negated that right, remember?

    Good point. Well, maybe a couple of states attorneys general can take time off from their busy schedule harrassing google to take a look at it.

Leave a Reply to Ravi Cancel reply

Your email address will not be published. Required fields are marked *