The downside to fragmentation (1 Viewer)

[Sam Posten]

Like I said, make it convenient, inexpensive, and worthwhile and people will upgrade in droves:
http://www.macstories.net/news/apple-iphone-5-sales-top-five-million-over-opening-weekend-100-million-ios-devices-updated-to-ios-6/

 

[Sam Posten]

Per my Galaxy owning coworker: "Dude, we just got Samsunged" =(
http://thenextweb.com/mobile/2012/09/25/possible-flaw-samsungs-touchwiz-ui-leaves-smartphones-open-data-wiping-sim-locks/

 

[Hanson]

On the bright side, no one hijacking your personal information

But seriously, this is more like the basis of a prank than a security issue. There's no financial gain from tricking you into wiping your device. And speaking of pranks, if you input the wrong password 10 times on a password protected Blackberry, it will wipe itself as a security measure. I actually had a user do that to himself, but it's a totally dickish prank you can pull on anyone's BB.

 

[Hanson]

So maybe the original story was a bit overstated:

http://www.androidpolice.com/2012/09/25/video-most-galaxy-s-iii-devices-are-not-vulnerable-to-ussd-wiping-exploit-it-was-already-fixed-in-an-update/

Looks like there are only a few phones affected, updated S3 phones are not vulnerable (which includes all US models), and it is only an issue if you use the stock browser (Chrome, Dolphin, etc will not run the exploit).

 

[Sam Posten]

Yeah cause changing the default browser is something most users are doing, right? And yes, the latest pushes to JB will fix it, but there's 100+ million Samsung androids out there now, how many of them have never and never will get a carrier update?
If this had been on the Apple side you wouldn't be giggling about it? You'd say "oh its just a prank, no big deal"?

 

[Hanson]

Actually, I don't go over to the Apple forums to post about vulnerabilities and security issues. I don't really post them here either. The only person in the whole of the HTF who likes to spread around FUD about Android security issues is a certain Sam Posten. Don't drag me into this "shoe on the other foot" nonsense.

The fix, BTW, is not the JB update but rather a maintenance patch that was released for the S3 on all carriers. From what I've read, if you have updated your S3, it is not vulnerable.In fact, there are only one or two models that are vulnerable.


Let's see how many times this exploit actually gets into the wild (right now it's ZERO) before we declare that the sky is falling. Apple didn't patch a PDF vulnerability for the iPhone for a while and no one cared because it didn't affect anybody.

 

[Sam Posten]

It's not just S3 Hanson, it's every TouchUI device ever. Did you miss what Verge and Engadget had to say about it?
"Tweakers.net has been able to replicate the security hole on a Galaxy S Advance, while The Verge has confirmed that it works on both the Galaxy S II and the AT&T Galaxy S III. Samsung has told us it's looking into the issue."
http://www.engadget.com/2012/09/25/dirty-ussd-code-samsung-hack-wipe/
http://www.theverge.com/2012/9/25/3403928/samsung-touchwiz-reset-vulnerability
"Update: We have now tested this flaw on an AT&T Samsung Galaxy S III and have confirmed it works on that carrier's version of the phone. Samsung tells us it's "looking into" the reports.
Pau Oliva @pof
the USSD code to factory data reset a Galaxy S3 is *2767*3855# can be triggered from browser like this:
"
http://www.theverge.com/2012/9/25/3403928/samsung-touchwiz-reset-vulnerability

 

[Hanson]

And then you didn't read this:

http://www.androidpolice.com/2012/09/25/video-most-galaxy-s-iii-devices-are-not-vulnerable-to-ussd-wiping-exploit-it-was-already-fixed-in-an-update/

Even though I posted it after your links.




Quote:

[COLOR= rgb(17, 17, 17)]Here's a stock AT&T [/COLOR]Galaxy S III[COLOR= rgb(17, 17, 17)] on the latest OTA update (issued last week) initiating the exploit - it doesn't work. It just goes to a blank dialer.[/COLOR]

But I guess any bit over-reactionary FUD on a slow news day is more your cup of tea.




Quote:

[COLOR= rgb(17, 17, 17)]What we do know is that every variant of the Galaxy S III in the United States received very similar OTA updates in the last few weeks (see: [/COLOR]Verizon[COLOR= rgb(17, 17, 17)], [/COLOR]T-Mobile[COLOR= rgb(17, 17, 17)], [/COLOR]Sprint[COLOR= rgb(17, 17, 17)], [/COLOR]AT&T[COLOR= rgb(17, 17, 17)]). And if the exploit isn't working in the most recent AT&T OTA, it's probably fair to assume the same fixes were contained in all three other carriers' updates. So, if your GS3 is up to date, you're probably not vulnerable.[/COLOR]

 

[Sam Posten]

What about all the others tho?

 

[Sam Posten]

No soup for you:
http://arstechnica.com/gadgets/2012/10/motorola-reneges-on-ice-cream-sandwich-software-update/
Before you immediately rush to shout me down with "But you can run your own custom ROM, dummy", be sure to read the featured comment.

 

[Hanson]

No, customs ROMs are a hobby, not a solution.That they locked the boot loader is a real dick move on Motorola's part.

Note that what I am about to say is not an excuse for Google or Motorola, just an explanation of why Moto likely canned all of the ICS upgrades.

Stepping up from GB to ICS was a big enough change that every single ICS upgrade has been frought with bugs and other issues. Almost all of them can be resolved by performing a factory reset either before or after the update. However, due to the lack of a good rootless backup solution, most users do not want to do this unless it's a last resort. The result, depending on a range of factors including how many apps you have installed and uninstalled and how long you've used it, ranges from "great" to "worse than before".

And users who are performing factory resets as a last resort are being justifiably confused between "SD Storage" (which is internal storage) and External SD (which is the actual microSD card). Thinking the files on SD Storage are on the microSD card, they're wiping all of their pictures and music with the factory reset (which wipes all internal storage).

Both Samsung and HTC pulled their first ICS update after being swamped with support issues and angry users. I believe Motorola saw this and concluded it was better to just leave things alone. They may be right to do so -- due to hardware or legacy storage partitions, ICS isn't much more than a skin update. No one's ICS upgrade significantly improved performance. I like my ICS upgrade on my Epic 4G Touch because Sprint allowed their users to change their launcher to stock ICS, which is better than Touchwiz and I can use Chrome browser. But there are lot of E4GT users who refuse to upgrade to ICS.

Hopefully, Motorola will unlock the bootloaders for the users who want to install custom ROMs. Maybe they'll be kind enough to leak their build to the dev community. We'll see.

 

[Sam Posten]

Great and informative analysis Hanson, thanks.

 

[Sam Posten]

Not sure what to think of this:
http://www.brisbanetimes.com.au/business/world-business/us-congress-rules-huawei-a-security-threat-20121008-278h9.html

 

[Sam Posten]

Bad taste alert!

Spoiler: Warning: Spoiler!

Even QVC faints over selling these things...
http://newsfeed.time.com/2012/10/09/watch-qvc-host-keeps-selling/

 

[Sam Posten]

Android gaming stinks.
http://www.wired.co.uk/news/archive/2012-10/31/android-games?utm_source=feedburner&utm_medium=twitter&utm_campaign=Feed%3A+hnycombinator+%28HN+-+hnycombinator%29

 

[Sam Posten]

Samsung is a machine:
http://www.asymco.com/2012/11/14/google-vs-samsung/
The question remains is it 'helpful' to have one Android vendor getting the majority of the sales and all of the profits for that platform?

 

[Hanson]

Android is Google's shift to the future of the Internet, which is moving to the mobile space. Right now, the profits themselves aren't that important. What is important is that they have a beachhead when the inevitable shift happens. That said, I don't think anyone at Google anticipated the breadth of adoption in such a short period of time. As such, it's easy for Asymco and others to draw the line between install base and revenues and declare Android as a failure for Google. But for what Google envisioned when they launched their own mobile OS, it has been a success beyond everyone's wildest dreams.



That said, there are likely concerns at Mountain View about Samsung's almost monopolistic control of the OEM market. The first sign was the whole Aliyun kerfuffle with Acer, where reiterated their position on OEMs in the open handset alliance. They made it very clear that any OS that could run Android apps, even if the underlying OS was not an Android fork, would be considered an Android fork. This came on the heels of the Verizon CEO hinting that Samsung could sell phones with their own OS. Samsung has their own Android market. It's tiny, to be sure, but it exists. The infrastructure exists. If they released Badu phones with Android app compatibility, they could conceivably fork away from Google and use their marketing clout to take control of the handset industry. Google's position was that Samsung would have to leave the OHA for this to happen.

Now, this could still be Samsung's end game. And I'm sure that worries Google. But until they can put the Apple litigation behind them, Samsung will continue to operate under the Android umbrella.

Marketing and Samsung's ability to spend heavily on it is just part of the reason they're so successful. The other part is that they make good phones with great specs. It's one thing for an average consumer to know the Samsung brand. What puts them over the top is that the techie friends whom they mine for advice also recommend them. Without that factor, Samsung wouldn't be as omnipresent.

The funny thing is that Asymco had been beating the drum for years that the lack of profits would bury Android and Apple would be the biggest player in the smartphone space. Now that Samsung has busted that theory out of the water, they're using Samsung's success to paint Google as flailing. As someone is fond of saying, we shall see.

 

[Sam Posten]

Legit question: Does Samsung have ANY consumer facing software that is more than a skin on top of someone else's OS? Cause making an OS isn't a trivial task. Might be good to start with some quality App development first and build up expertise from there.
Also, you clearly seem to think that Samsung's current profit storm is going to continue for the forseeable future. I wouldn't be too sure on that. There's an awful lot of other Android developers smarting over this dominance, one of which happens to be owned whole by Google now. We'll see how that shakes out.

 

[Hanson]

Samsung has developed and is likely continuing to develop Badu as a smartphone OS. As long as they continue with their cutting edge tech and marketing, they should be a force for years.

Motorola was bought for patents. Google has shown zero interest in making them their hardware arm because of the perception of monopolistic practices.

 

[Hanson]

Also realize there a huge market of users who still use feature phones as well as emerging markets that are starting to look for smartphones. So this gravy train should last a while barring an unforeseen bungle.