[Android Software Development] marty1976:
First of all: I'm an OSS advocate and love the idea of open source. Don't forget that while reading this.

Some 2 month ago, I got myself a Galaxy S. It's not exactly cheap, but on the other side, it's really good hardware. This thread is not about Samsung or the Galaxy S. It's about the missing parts of android security.

We all know it from our home computers: Software sometimes has bugs. Some just annoy us, others are potentially dangerous for our beloved data. Our data sometimes gets stolen or deleted due to viruses. Viruses enter our machines by exploiting bugs that allow for code execution or priviledge escalation. To stay patched, we regularly execute our "apt-get update;apt-get dist-upgrade" or use windows update. We do this to close security holes on our systems.

In the PC world, the software and OS manufacturers release security bulletins to inform users of potentially dangerous issues. They say how to work around them or provide a patch.

How do we stay informed about issues and keep our Android devices updated?

Here's what Google says:

Source: http://developer.android.com/guide/appendix/faq/security.html#informed

OK, that particular group is empty (except for a welcome post). Maybe there are no bugs in Android. Go check yourself and google a bit - they do exist.

"So why doesn't Google tell us?", you ask. I don't know. What I know is that the various components of Android (WebKit, kernel, ...) do have bugs. There's nothing wrong with that BTW, software is made by people - and people make mistakes and write buggy code all the time. Just read the changelogs or release notes.

"Wait", I head you say, "there are no changelogs or release notes for Android releases".

Oh - so let's sum up what we need to stay informed about security issues, bugs and workarounds:

* Security bulletins and

* Patches or Workaround information

What of these do we have? Right, nada, zilch, rien.

I'll leave it up to you to decide if that's good common practise.

"But why is this important anyway", you ask.

Well, remember my example above. You visit a website and suddenly find all your stored passwords floating around on the internet. Don't tell me that's not possible, there was a WebKit bug in 2.2 that did just that. Another scenario would be a drive-by download that breaks out of the sandbox and makes expensive phone calls. Or orders subscriptions for monthly new ringtones, raising your bill by orders of magnitute. Or shares your music on illegal download portals (shh, don't tell the RIAA that this is remotely possible).

The bug is probably fixed in 2.2.1 - but without changelogs we can't be sure.

But that's not all - there's a second problem. Not only are we unaware of security issues, we also don't have automated update mechanisms.

We only receive updates when our phone's manufacturers release new firmware. Sadly, not all manufacturers support their phones in the long run.

In the PC world, most Distros have a central package management - that Google forgot to implement in Android. Agreed, some phones can receive OTA updates, but that depends on the carrier. And because of the differences in Android versions it's not possible to have a central patch management either. So we do not know if our Android devices might have security issues. We also have no easy way to patch them.

Perhaps you knew this before, then I apologize for taking your time.

What do YOU - the computer literate and security aware XDA users - think about this? Do you think that's a problem? Or would you rather say that these are minor problems?