That particular group is empty (except for a welcome post).
I can hardly believe that there were no security bugs in the past - or
are they all unfixed and therefore not published?
Anyway, Google (through his employee Tavis Ormandy), goes for
"responsible disclosure":
"Serious bugs should be fixed within a reasonable timescale. Whilst
every bug is unique, we would suggest that 60 days is a reasonable
upper bound for a genuinely critical issue in widely deployed
software.
[...]
We of course expect to be held to the same standards ourselves."*
If I remember correctly, Google is a huge player in the Open Handset
Alliance. Applying this policy to Android security would lead me to
the conclusion that there are no security relevant bugs in Android
that are older than 60 days.
As a practical matter, there is a large difference between google
employees fixing something in git vs waking up to find that your
carrier has pushed an OTA update to your phone.
The irony of course is that the only way to stay patched on most
consumer phones is to exploit one of the current bugs to obtain do it
yourself update permissions ;-)
> That particular group is empty (except for a welcome post).
> I can hardly believe that there were no security bugs in the past - or
> are they all unfixed and therefore not published?
> Anyway, Google (through his employee Tavis Ormandy), goes for
> "responsible disclosure":
> "Serious bugs should be fixed within a reasonable timescale. Whilst
> every bug is unique, we would suggest that 60 days is a reasonable
> upper bound for a genuinely critical issue in widely deployed
> software.
> [...]
> We of course expect to be held to the same standards ourselves."*
> If I remember correctly, Google is a huge player in the Open Handset
> Alliance. Applying this policy to Android security would lead me to
> the conclusion that there are no security relevant bugs in Android
> that are older than 60 days.
> As a practical matter, there is a large difference between google > employees fixing something in git vs waking up to find that your > carrier has pushed an OTA update to your phone.
Although I agree, that's not my point. I'm wondering if there are really no security bugs at all, as I can hardly believe that.
> The irony of course is that the only way to stay patched on most > consumer phones is to exploit one of the current bugs to obtain do it > yourself update permissions ;-)
Also true, but also not what I wanted to know.
The Android Security Team introduced itself on 18 Aug 2008 to the full disclosure mailing list, saying: "Our vulnerability bulletins will credit responsible reporters of any flaws." Now, where *are *those bulletins? Can someone plase confirm that since its very beginning, there are no noteworthy security bugs in Android?
First off, there have been a number of "android" vulnerabilities, go
look at haxxor news and see what you turn up. Secondly the most
common method to attack a phone is to have you install something you
shouldn't. I could make you install an image that has my own
personal backdoor onto it. Most vulnerabilities are introduced by
the user. More so those bulletins probably were taken down when the
vulnerability was removed in the followup emergency push.
Lastly what is your definition of noteworthy? Is note worthy DOSing
your phone via SMS? that has been done
I'm sure there are also other areas of the phone that need to be
researched and looked at. Having some toolrod open a PDF and pwn
their phone just like they did on the iphone is an example.
The point is, you have a phone, its actually a computer, it will have
vulnerabilities, they are doing their best to remove them. The most
you may hear of it is a little blurb with someones name on it for
finding the bug.
On Sep 10, 5:19 am, Jan Niggemann <jan.niggem...@gmail.com> wrote:
> > As a practical matter, there is a large difference between google
> > employees fixing something in git vs waking up to find that your
> > carrier has pushed an OTA update to your phone.
> Although I agree, that's not my point. I'm wondering if there are really no
> security bugs at all, as I can hardly believe that.
> > The irony of course is that the only way to stay patched on most
> > consumer phones is to exploit one of the current bugs to obtain do it
> > yourself update permissions ;-)
> Also true, but also not what I wanted to know.
> The Android Security Team introduced itself on 18 Aug 2008 to the full
> disclosure mailing list, saying:
> "Our vulnerability bulletins will credit responsible reporters of any
> flaws."
> Now, where *are *those bulletins?
> Can someone plase confirm that since its very beginning, there are no
> noteworthy security bugs in Android?
> First off, there have been a number of "android" vulnerabilities, go > look at haxxor news and see what you turn up.
I'm aware of the attack vectors and possibilities, thank you.
> More so those bulletins probably were taken down when the > vulnerability was removed in the followup emergency push.
That's absurd. If so, why isn't there an archive for those security bulletins? And where are the postings to the full-disclosure mailing list? Let me remind you that in 2008, the Android security team posted to that list, that they'll publish security bulletins "when the fixes are available". And I'm pretty certain that there have been no security bulletins so far. Neither in the Google group, nor on said mailing list.
> Lastly what is your definition of noteworthy?
I'm pretty sure that no one cares about _my_ definition.
Google writes:
"We will publicly announce security bugs when the fixes are available via postings to the android-security-announce group on Google Groups." (link in my 1st post). So it all boils down to this:
IF security_bug found AND fixed THEN publish bulletin.
> Is note worthy DOSing > your phone via SMS? that has been done > I'm sure there are also other areas of the phone that need to be > researched and looked at. Having some toolrod open a PDF and pwn > their phone just like they did on the iphone is an example.
The question is: Would that be a design flaw in the OS implementation or in an app? If it's the OS, following their own guidelines, Google should publish a security bulletin. Either after the availability of a fix, or after 60 days.
> The point is, you have a phone, its actually a computer, it will have > vulnerabilities, they are doing their best to remove them. The most > you may hear of it is a little blurb with someones name on it for > finding the bug.
So please show me the blurbs - where are they to be found? You say there _are_ security issues. If that assertion is true, then there should inevitably be a publication of that issue, if Google respects their own guidelines. At least if the issue is fixed, if I understand correctly. Or it's just a matter of misintepretation, maybe because my 1st language isn't English ;-) I just can't get straight that there _are_ security issues* AND there's no publication of bulletins yet.
Regards jan * No big deal for me, every piece of software has 'em.
I'm gonna go ahead and assume that with 9/900 some messages on this
board, and how slow things are this is probably not the place that
those bulletins get posted. Secondly look at patch notes for the
android mobile phone, I am sure they mention it. Also keep in mind
that there is a good probability that posts get archived that aren't
current, including old fixed bulletins.
> > First off, there have been a number of "android" vulnerabilities, go
> > look at haxxor news and see what you turn up.
> I'm aware of the attack vectors and possibilities, thank you.
> > More so those bulletins probably were taken down when the
> > vulnerability was removed in the followup emergency push.
> That's absurd. If so, why isn't there an archive for those security
> bulletins?
> And where are the postings to the full-disclosure mailing list? Let me
> remind you that in 2008, the Android security team posted to that list, that
> they'll publish security bulletins "when the fixes are available".
> And I'm pretty certain that there have been no security bulletins so far.
> Neither in the Google group, nor on said mailing list.
> > Lastly what is your definition of noteworthy?
> I'm pretty sure that no one cares about _my_ definition.Google writes:
> "We will publicly announce security bugs when the fixes are avandroid security bulletinailable
> via postings to the android-security-announce group on Google Groups." (link
> in my 1st post).
> So it all boils down to this:android security bulletin
> IF security_bug found AND fixed
> THEN publish bulletin.
> > Is note worthy DOSing
> > your phone via SMS? that has been done
> > I'm sure there are also other areas of the phone that need to be
> > researched and looked at. Having some toolrod open a PDF and pwn
> > their phone just like they did on the iphone is an example.
> The question is: Would that be a design flaw in the OS implementation or in
> an app?
> If it's the OS, following their own guidelines, Google should publish a
> security bulletin. Either after the availability of a fix, or after 60 days.
> > The point is, you have a phone, its actually a computer, it will have
> > vulnerabilities, they are doing their best to remove them. The most
> > you may hear of it is a little blurb with someones name on it for
> > finding the bug.
> So please show me the blurbs - where are they to be found?
> You say there _are_ security issues. If that assertion is true, then there
> should inevitably be a publication of that issue, if Google respects their
> own guidelines.
> At least if the issue is fixed, if I understand correctly.
> Or it's just a matter of misintepretation, maybe because my 1st language
> isn't English ;-)
> I just can't get straight that there _are_ security issues* AND there's no
> publication of bulletins yet.
> Regards
> jan
> * No big deal for me, every piece of software has 'em.
On Fri, Sep 10, 2010 at 7:18 AM, Tauren <tauren...@gmail.com> wrote: > I'm gonna go ahead and assume that with 9/900 some messages on this > board, and how slow things are this is probably not the place that > those bulletins get posted. Secondly look at patch notes for the > android mobile phone, I am sure they mention it. Also keep in mind > that there is a good probability that posts get archived that aren't > current, including old fixed bulletins.
> As for your definition, how can we answer your question without your > definition?
> On Sep 10, 9:53 am, Jan Niggemann <jan.niggem...@gmail.com> wrote: >> 2010/9/10 Tauren <tauren...@gmail.com>
>> > First off, there have been a number of "android" vulnerabilities, go >> > look at haxxor news and see what you turn up.
>> I'm aware of the attack vectors and possibilities, thank you.
>> > More so those bulletins probably were taken down when the >> > vulnerability was removed in the followup emergency push.
>> That's absurd. If so, why isn't there an archive for those security >> bulletins? >> And where are the postings to the full-disclosure mailing list? Let me >> remind you that in 2008, the Android security team posted to that list, that >> they'll publish security bulletins "when the fixes are available". >> And I'm pretty certain that there have been no security bulletins so far. >> Neither in the Google group, nor on said mailing list.
>> > Lastly what is your definition of noteworthy?
>> I'm pretty sure that no one cares about _my_ definition.Google writes:
>> "We will publicly announce security bugs when the fixes are avandroid security bulletinailable >> via postings to the android-security-announce group on Google Groups." (link >> in my 1st post). >> So it all boils down to this:android security bulletin
>> IF security_bug found AND fixed >> THEN publish bulletin.
>> > Is note worthy DOSing >> > your phone via SMS? that has been done >> > I'm sure there are also other areas of the phone that need to be >> > researched and looked at. Having some toolrod open a PDF and pwn >> > their phone just like they did on the iphone is an example.
>> The question is: Would that be a design flaw in the OS implementation or in >> an app? >> If it's the OS, following their own guidelines, Google should publish a >> security bulletin. Either after the availability of a fix, or after 60 days.
>> > The point is, you have a phone, its actually a computer, it will have >> > vulnerabilities, they are doing their best to remove them. The most >> > you may hear of it is a little blurb with someones name on it for >> > finding the bug.
>> So please show me the blurbs - where are they to be found? >> You say there _are_ security issues. If that assertion is true, then there >> should inevitably be a publication of that issue, if Google respects their >> own guidelines. >> At least if the issue is fixed, if I understand correctly. >> Or it's just a matter of misintepretation, maybe because my 1st language >> isn't English ;-) >> I just can't get straight that there _are_ security issues* AND there's no >> publication of bulletins yet.
>> Regards >> jan >> * No big deal for me, every piece of software has 'em.
> -- > You received this message because you are subscribed to the Google Groups "Android Security Discussions" group. > To post to this group, send email to android-security-discuss@googlegroups.com. > To unsubscribe from this group, send email to android-security-discuss+unsubscribe@googlegroups.com. > For more options, visit this group at http://groups.google.com/group/android-security-discuss?hl=en.
On Sep 10, 5:19 am, Jan Niggemann <jan.niggem...@gmail.com> wrote:
> 2010/9/10 Chris Stratton <cs07...@gmail.com>
> Although I agree, that's not my point. I'm wondering if there are really no
> security bugs at all, as I can hardly believe that.
Some of the major ones that have resulted in pushed updates have not
been unique to android but inherited from the linux kernel -
disclosed, discussed, and fixed upstream with only the patches showing
up in android git.
Chris, Jeff: Thank you.
Assuming that all Android issues were originating from the Linux
kernel,don't you think that these bugs (leading to fixes from
upstream) should be published, too?
Imean, no need to reproduce the whole information, but a short notice
with a pointer to the kernel bug tracker should suffice.
Or am I asking for too much?You know, not everyone is reading the
LKML...
Anyway, if the said google group is not the place to stay informed
about Android specific security issues:
Where do I stay tuned?
>> Anyway, if the said google group is not the place to stay informed >> about Android specific security issues: >> Where do I stay tuned?
I've been eagerly following this thread to hear Google's answer to this question, and nobody as of yet provided an answer. This is one of the cases where RTFC won't do.
On Sat, Sep 11, 2010 at 10:02 AM, jan <jan.niggem...@gmail.com> wrote: > Chris, Jeff: Thank you. > Assuming that all Android issues were originating from the Linux > kernel,don't you think that these bugs (leading to fixes from > upstream) should be published, too? > Imean, no need to reproduce the whole information, but a short notice > with a pointer to the kernel bug tracker should suffice.
> Or am I asking for too much?You know, not everyone is reading the > LKML... > Anyway, if the said google group is not the place to stay informed > about Android specific security issues: > Where do I stay tuned?
> -- > You received this message because you are subscribed to the Google Groups > "Android Security Discussions" group. > To post to this group, send email to > android-security-discuss@googlegroups.com. > To unsubscribe from this group, send email to > android-security-discuss+unsubscribe@googlegroups.com<android-security-disc uss%2Bunsubscribe@googlegroups.com> > . > For more options, visit this group at > http://groups.google.com/group/android-security-discuss?hl=en.
> I too have been hoping for some official response.
> D
> -- > You received this message because you are subscribed to the Google Groups > "Android Security Discussions" group. > To post to this group, send email to > android-security-discuss@googlegroups.com. > To unsubscribe from this group, send email to > android-security-discuss+unsubscribe@googlegroups.com<android-security-disc uss%2Bunsubscribe@googlegroups.com> > . > For more options, visit this group at > http://groups.google.com/group/android-security-discuss?hl=en.
On Sep 13, 4:10 am, Hadi Nahari <hadi.nah...@gmail.com> wrote:
> Dianne, et al;
> When can we expect Google to respond to this thread?
I wrote a letter to one of Europes most-read computer magazines c't
and asked them the same question. They even printed my letter,
together with the remark:
"We asked Google the same question and have not received an answer".
Google: Such behaviour won't satisfy customers who bought Android
cellphones.
The sales of Android powered devices are soaring, so having up-to-date
information on security issues (and fixes / workarounds) will be
crucial for more and more people.
You can be sure there is an internal list or similar announcement forum for OHA members. Maybe you need to join the OHA before you get security announcements.. it wouldn't be out of character..
On Tue, Sep 28, 2010 at 11:53 AM, jan <jan.niggem...@gmail.com> wrote: > On Sep 13, 4:10 am, Hadi Nahari <hadi.nah...@gmail.com> wrote: > > Dianne, et al; > > When can we expect Google to respond to this thread? > I wrote a letter to one of Europes most-read computer magazines c't > and asked them the same question. They even printed my letter, > together with the remark: > "We asked Google the same question and have not received an answer". > Google: Such behaviour won't satisfy customers who bought Android > cellphones. > The sales of Android powered devices are soaring, so having up-to-date > information on security issues (and fixes / workarounds) will be > crucial for more and more people.
> jan
> -- > You received this message because you are subscribed to the Google Groups > "Android Security Discussions" group. > To post to this group, send email to > android-security-discuss@googlegroups.com. > To unsubscribe from this group, send email to > android-security-discuss+unsubscribe@googlegroups.com<android-security-disc uss%2Bunsubscribe@googlegroups.com> > . > For more options, visit this group at > http://groups.google.com/group/android-security-discuss?hl=en.
Why would security announcements be limited to OHA members? Of course, there are public-disclosure-when-fixed scenarios, but everyone else on the planet discloses security vulnerabilities publicly so that people can make their own informed decisions.
On Tue, Sep 28, 2010 at 9:11 AM, Disconnect <dc.disconn...@gmail.com> wrote: > You can be sure there is an internal list or similar announcement forum for > OHA members. Maybe you need to join the OHA before you get security > announcements.. it wouldn't be out of character..
> On Tue, Sep 28, 2010 at 11:53 AM, jan <jan.niggem...@gmail.com> wrote:
>> On Sep 13, 4:10 am, Hadi Nahari <hadi.nah...@gmail.com> wrote: >> > Dianne, et al; >> > When can we expect Google to respond to this thread? >> I wrote a letter to one of Europes most-read computer magazines c't >> and asked them the same question. They even printed my letter, >> together with the remark: >> "We asked Google the same question and have not received an answer". >> Google: Such behaviour won't satisfy customers who bought Android >> cellphones. >> The sales of Android powered devices are soaring, so having up-to-date >> information on security issues (and fixes / workarounds) will be >> crucial for more and more people.
>> jan
>> -- >> You received this message because you are subscribed to the Google Groups >> "Android Security Discussions" group. >> To post to this group, send email to >> android-security-discuss@googlegroups.com. >> To unsubscribe from this group, send email to >> android-security-discuss+unsubscribe@googlegroups.com. >> For more options, visit this group at >> http://groups.google.com/group/android-security-discuss?hl=en.
> -- > You received this message because you are subscribed to the Google Groups > "Android Security Discussions" group. > To post to this group, send email to > android-security-discuss@googlegroups.com. > To unsubscribe from this group, send email to > android-security-discuss+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/android-security-discuss?hl=en.
On 28 Sep., 19:47, Jeff Enderwick <jeff.enderw...@gmail.com> wrote:
> Why would security announcements be limited to OHA members? Of course,
> there are public-disclosure-when-fixed scenarios, but everyone else on
> the planet discloses security vulnerabilities publicly so that people
> can make their own informed decisions.
Jeff, IMHO you're approaching this from a developers point of view.
You and I might know where to look for certain information, but you'll
never get Joe Average to check the CVE DB to find out about issues.
And of course let's not forget that Google itself wrote that
vulnerabilites, once fixed, would be listed in a Google Group. And
that's my point, they just don't live up to their promise.
Were there means for average users to easily stay informed about
issues, be it a forum, a blog or something else, then security-aware
users could at least apply workarounds for issues until Google /
manufacturers / carriers release patches.
>> Maybe you need to join the OHA before you get security >> announcements.. it wouldn't be out of character..
Well, that's weird and not doesn't bode well with the open nature of Android. I'm hoping that the reason Dianne, et al from Google aren't responding to this thread is that they're just busy
-Hadi
On Tue, Sep 28, 2010 at 10:47 AM, Jeff Enderwick <jeff.enderw...@gmail.com>wrote:
> Why would security announcements be limited to OHA members? Of course, > there are public-disclosure-when-fixed scenarios, but everyone else on > the planet discloses security vulnerabilities publicly so that people > can make their own informed decisions.
> On Tue, Sep 28, 2010 at 9:11 AM, Disconnect <dc.disconn...@gmail.com> > wrote: > > You can be sure there is an internal list or similar announcement forum > for > > OHA members. Maybe you need to join the OHA before you get security > > announcements.. it wouldn't be out of character..
> > On Tue, Sep 28, 2010 at 11:53 AM, jan <jan.niggem...@gmail.com> wrote:
> >> On Sep 13, 4:10 am, Hadi Nahari <hadi.nah...@gmail.com> wrote: > >> > Dianne, et al; > >> > When can we expect Google to respond to this thread? > >> I wrote a letter to one of Europes most-read computer magazines c't > >> and asked them the same question. They even printed my letter, > >> together with the remark: > >> "We asked Google the same question and have not received an answer". > >> Google: Such behaviour won't satisfy customers who bought Android > >> cellphones. > >> The sales of Android powered devices are soaring, so having up-to-date > >> information on security issues (and fixes / workarounds) will be > >> crucial for more and more people.
> >> jan
> >> -- > >> You received this message because you are subscribed to the Google > Groups > >> "Android Security Discussions" group. > >> To post to this group, send email to > >> android-security-discuss@googlegroups.com. > >> To unsubscribe from this group, send email to > >> android-security-discuss+unsubscribe@googlegroups.com<android-security-disc uss%2Bunsubscribe@googlegroups.com> > . > >> For more options, visit this group at > >> http://groups.google.com/group/android-security-discuss?hl=en.
> > -- > > You received this message because you are subscribed to the Google Groups > > "Android Security Discussions" group. > > To post to this group, send email to > > android-security-discuss@googlegroups.com. > > To unsubscribe from this group, send email to > > android-security-discuss+unsubscribe@googlegroups.com<android-security-disc uss%2Bunsubscribe@googlegroups.com> > . > > For more options, visit this group at > > http://groups.google.com/group/android-security-discuss?hl=en.
> -- > You received this message because you are subscribed to the Google Groups > "Android Security Discussions" group. > To post to this group, send email to > android-security-discuss@googlegroups.com. > To unsubscribe from this group, send email to > android-security-discuss+unsubscribe@googlegroups.com<android-security-disc uss%2Bunsubscribe@googlegroups.com> > . > For more options, visit this group at > http://groups.google.com/group/android-security-discuss?hl=en.
No - I'm approaching this from the POV of enterprise customers that I've had in prior lives. InfoSec wants the details, and wants to make their own decisions w/r/t risk.
On Tue, Sep 28, 2010 at 12:09 PM, jan <jan.niggem...@gmail.com> wrote: > On 28 Sep., 19:47, Jeff Enderwick <jeff.enderw...@gmail.com> wrote: >> Why would security announcements be limited to OHA members? Of course, >> there are public-disclosure-when-fixed scenarios, but everyone else on >> the planet discloses security vulnerabilities publicly so that people >> can make their own informed decisions. > Jeff, IMHO you're approaching this from a developers point of view. > You and I might know where to look for certain information, but you'll > never get Joe Average to check the CVE DB to find out about issues. > And of course let's not forget that Google itself wrote that > vulnerabilites, once fixed, would be listed in a Google Group. And > that's my point, they just don't live up to their promise. > Were there means for average users to easily stay informed about > issues, be it a forum, a blog or something else, then security-aware > users could at least apply workarounds for issues until Google / > manufacturers / carriers release patches.
> -- > You received this message because you are subscribed to the Google Groups "Android Security Discussions" group. > To post to this group, send email to android-security-discuss@googlegroups.com. > To unsubscribe from this group, send email to android-security-discuss+unsubscribe@googlegroups.com. > For more options, visit this group at http://groups.google.com/group/android-security-discuss?hl=en.
> No - I'm approaching this from the POV of enterprise customers that > I've had in prior lives. InfoSec wants the details, and wants to make > their own decisions w/r/t risk.
> On Tue, Sep 28, 2010 at 12:09 PM, jan <jan.niggem...@gmail.com> wrote: > > On 28 Sep., 19:47, Jeff Enderwick <jeff.enderw...@gmail.com> wrote: > >> Why would security announcements be limited to OHA members? Of course, > >> there are public-disclosure-when-fixed scenarios, but everyone else on > >> the planet discloses security vulnerabilities publicly so that people > >> can make their own informed decisions. > > Jeff, IMHO you're approaching this from a developers point of view. > > You and I might know where to look for certain information, but you'll > > never get Joe Average to check the CVE DB to find out about issues. > > And of course let's not forget that Google itself wrote that > > vulnerabilites, once fixed, would be listed in a Google Group. And > > that's my point, they just don't live up to their promise. > > Were there means for average users to easily stay informed about > > issues, be it a forum, a blog or something else, then security-aware > > users could at least apply workarounds for issues until Google / > > manufacturers / carriers release patches.
> > -- > > You received this message because you are subscribed to the Google > Groups "Android Security Discussions" group. > > To post to this group, send email to > android-security-discuss@googlegroups.com. > > To unsubscribe from this group, send email to > android-security-discuss+unsubscribe@googlegroups.com. > > For more options, visit this group at > http://groups.google.com/group/android-security-discuss?hl=en.
> Am Dienstag, 28. September 2010 21:17:30 UTC+2 schrieb
> jeff.en...@gmail.com:
>> No - I'm approaching this from the POV of enterprise customers that
>> I've had in prior lives. InfoSec wants the details, and wants to make
>> their own decisions w/r/t risk.
>> On Tue, Sep 28, 2010 at 12:09 PM, jan <jan.niggem...@gmail.com> wrote:
>> > On 28 Sep., 19:47, Jeff Enderwick <jeff.enderw...@gmail.com> wrote:
>> >> Why would security announcements be limited to OHA members? Of course,
>> >> there are public-disclosure-when-fixed scenarios, but everyone else on
>> >> the planet discloses security vulnerabilities publicly so that people
>> >> can make their own informed decisions.
>> > Jeff, IMHO you're approaching this from a developers point of view.
>> > You and I might know where to look for certain information, but you'll
>> > never get Joe Average to check the CVE DB to find out about issues.
>> > And of course let's not forget that Google itself wrote that
>> > vulnerabilites, once fixed, would be listed in a Google Group. And
>> > that's my point, they just don't live up to their promise.
>> > Were there means for average users to easily stay informed about
>> > issues, be it a forum, a blog or something else, then security-aware
>> > users could at least apply workarounds for issues until Google /
>> > manufacturers / carriers release patches.
>> > --
>> > You received this message because you are subscribed to the Google
>> Groups "Android Security Discussions" group.
>> > To post to this group, send email to android-security-discuss@**
>> googlegroups.com <android-security-discuss@googlegroups.com>.
>> > To unsubscribe from this group, send email to android-security-discuss+
>> **unsubscribe@googlegroups.com<android-security-discuss%2Bunsubscribe@googl egroups.com>
>> .
>> > For more options, visit this group at http://groups.google.com/** >> group/android-security-**discuss?hl=en<http://groups.google.com/group/android-security-discuss?hl=en>
>> .
> To post to this group, send email to
> android-security-discuss@googlegroups.com.
> To unsubscribe from this group, send email to
> android-security-discuss+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/android-security-discuss?hl=en.
Sent from my HTC on the Now Network q éfrom Sprint!lu
----- Reply message ----- From: "Jeff Enderwick" <jeff.enderw...@gmail.com> To: "Roman" <roman.schoenbich...@gmail.com> Cc: <android-security-discuss@googlegroups.com> Subject: [android-security-discuss] Re: Not a single security announcement? Date: Sun, May 20, 2012 12:20 am AFAIK, nothing.
On Sat, May 19, 2012 at 4:46 AM, Roman <roman.schoenbich...@gmail.com> wrote:
So what has happened in the last 1 1/2 years?
Am Dienstag, 28. September 2010 21:17:30 UTC+2 schrieb jeff.en...@gmail.com: No - I'm approaching this from the POV of enterprise customers that I've had in prior lives. InfoSec wants the details, and wants to make
their own decisions w/r/t risk.On Tue, Sep 28, 2010 at 12:09 PM, jan <jan.niggem...@gmail.com> wrote:
> On 28 Sep., 19:47, Jeff Enderwick <jeff.enderw...@gmail.com> wrote: >> Why would security announcements be limited to OHA members? Of course, >> there are public-disclosure-when-fixed scenarios, but everyone else on >> the planet discloses security vulnerabilities publicly so that people >> can make their own informed decisions. > Jeff, IMHO you're approaching this from a developers point of view. > You and I might know where to look for certain information, but you'll > never get Joe Average to check the CVE DB to find out about issues. > And of course let's not forget that Google itself wrote that > vulnerabilites, once fixed, would be listed in a Google Group. And > that's my point, they just don't live up to their promise. > Were there means for average users to easily stay informed about > issues, be it a forum, a blog or something else, then security-aware > users could at least apply workarounds for issues until Google / > manufacturers / carriers release patches.
> -- > You received this message because you are subscribed to the Google Groups "Android Security Discussions" group. > To post to this group, send email to android-security-discuss@googlegroups.com. > To unsubscribe from this group, send email to android-security-discuss+unsubscribe@googlegroups.com. > For more options, visit this group at http://groups.google.com/group/android-security-discuss?hl=en.
--
You received this message because you are subscribed to the Google Groups "Android Security Discussions" group.
-- You received this message because you are subscribed to the Google Groups "Android Security Discussions" group. To post to this group, send email to android-security-discuss@googlegroups.com. To unsubscribe from this group, send email to android-security-discuss+unsubscribe@googlegroups.com.
