Google trying to make Android another iOS speedrun
I’m a time where ios is beating Android’s ass. I guess 2023 is the year all the dumbest tech bros tell their competition to take over.
If I don’t have the ability to control which CAs I trust, things become useless fast. This is why I fully ditched chomeOS.
This will also make https filtering that is used by ad blocking apps impossible since you need to trust a certificate in order for it to work
I learned that Android was not open under my personal definition of “open” right from the outset, because there was no programmatic access to telephony. My first project was to build an on-board answering machine with call screening capabilities.
I used an answering machine on my landline to avoid paying for caller id and voicemail and wanted to do the same with my cellphone. I was very disappointed to learn that this was not possible, at least with my skillset.
I knew that things were going the wrong way when my Tasker script to manage airplane mode stopped working when Android required locked it away. My use case there was that lack of connectivity at the gym and at home meant that connection attempts were draining my battery and heating up the phone. Now, of course, Android does a much better job of that particular task on its own, but it still makes me cranky. :)
Everything that has happened since has only cemented my opinion that Android is not actually an open platform. I do see many of the changes as potentially valuable security measures for the masses, but I wish that it wasn’t quite so difficult for a power user to use the power of the little computer we carry in our pockets.
It’s open as in “look but don’t touch”
As a Pixel user, I’m looking into either Graphene or CalyxOS
I ran Copperhead OS (the predecessor to Graphene) and really liked it. Sadly, the phone went into the lake and I’ve not been able to afford to replace it with one capable of Graphene.
It’s absolutely open source, but you might rather be limited in your software freedom.
If root can’t manage these, then who can and how?
PUID:GUID::-1:-1Time for superroot!
I would like to speak to the manager!
Ah yes, the karen account!
From an IT perspective with little context on this change other than what’s in the article, if there’s no way to import your own certs using an MDM, this change is terrible for businesses.
You need custom certs for all kinds of things. A company’s test servers often don’t use public CA certs because it’s expensive (or the devs are too lazy to set up Let’s Encrypt). So you import a central private CA cert to IT-managed devices so browsers and endpoints don’t have a fit.
For increased network security, private CAs are used for SSL decryption to determine what sites devices are going to and to check for malware embedded in pages. In order to conduct SSL decryption, you need your own private CA cert for decrypting and re-encrypting web content. While this is on the decline because of pinned certs being adopted by big websites, it’s still in use for any sites you can get away with. You basically kill any network-level security tools that are almost certainly enabled on the VPN/SASE used to access private test sites.
Re: too lazy for Let’s Encrypt, a) last I used LE (for my personal site), your site had to be publicly available on the Internet so that you could prove you controlled the site. Most test servers are not public. and b) many (most?) companies would throw a fit if you started generating your own certificates for their domains.
But there are always solutions. I was able to talk my company into getting properly signed certs for our test servers.
Super handy for if a certificate gets out and needs to be revoked.
Idiots.
Maybe read the article and not look like an idiot. All they did was move the certificates into a signed package that is updated through Google Play. They can revoke certs even faster now because it doesn’t require a system update.
Cool, so I can’t revoke the certs myself? Still bad.
I can’t add my own for testing? Still bad.
They manage it via an app that I can’t change at all? Still bad.
I mean thats what its mainly for? To quickly update CAs without needing to do it as a system update that the vendor needs to vet first
Time to buy a pinephone.
I’m pretty sure I can’t even connect to my university’s network without installing a custom certificate.
What brainlet at Google thought this was a good idea?
By all means correct me if I’m wrong, but looking at the PR this article links to. It looks like all that’s happening is that Google’s trusted certs are being added to an android security API and are now immutable. Any non Google certs are still going to be saved to ANDROID_ROOT/etc/security/cacerts the same as they currently are.
