Android 6.0 Marshmallow / 7 Nougat for FP2?

[kuleszdl]

@Stefan

But back on topic: I’ve read that other phones with the FP2’s Snapdragon 801 have received upgrades to Android 6. Additionally Fairphone promised to release the source codes, so even if they cannot provide an upgrade themselves, the community will be able to do so.

This is not about source code (which is mostly all GPL or Apache2 licensed) but about the proprietary vendor files (aka blobs) which MTK probably didn’t allow FP to distribute. Regarding the FP2 it would be interesting to know whether FP gained the permission from QC to distribute these files (like obviously Sony got) or if they are still negotiating (well, FP and transparency, the good old story). The sad thing here is that QC also does not publish these files themselves (unlike their CAF kernels) but - just like MTK - they only give them to the vendors directly, connected to terms for redistribution.

@Stefan

And even if not, one can follow the tips for improved security for the FP1(U). (There has been a lot of discussion about security already. I’d like to ask you to read through the forum a bit, if you are interested. )

Unfortunately, none of these is effective in adressing the Webview vulnerabilites. Even the “visit only trustworthy websites” stuff is not effective, as we’ve seen in the past that some malware is distributed e.g. by ads shown on trustworthy websites. The bigger issue here is that just any app can make use of the Webview component, and then it’s pretty hard to check / control if the traffic goes exclusively to “trustworthy” websites. Furthermore, if you look at apps which display contents via Webview from social networks - you can only regard the network as “trustworthy” or not, but the network usually doesn’t have much control about the contents the users put there.

@Stefan

But back on topic: I’ve read that other phones with the FP2’s Snapdragon 801 have received upgrades to Android 6. Additionally Fairphone promised to release the source codes, so even if they cannot provide an upgrade themselves, the community will be able to do so.

You can get the source code for the FP1 as well, including the MTK sources for the kernel. Still this does not help, as the device relies on those closed source blobs which only the vendor can provide (unless somebody comes up with a free replacement).

@ben

we have a quite functional custom rom now thanks to @chrmhoffmann.

My last update was that it was not very functional (especially regarding bluetooth problems), but if this has changed meanwhile that’s very good news.

@ben

fairphone is releasing security updates regulary. the FP1 was one of the first devices to recieve a stagefright fix, for example.

There is no real advantage in running a system which has a 3 months old hole fixed while having a 1 years old hole still open. Often, attackers (especially the less talented ones) are exploiting rather older security holes.

@ben

sony provides AOSP sources and binaries for 6.0 since a while now, still the official update seems to be at least two months away.

The validation and certification process through which official OS updates by the vendors have to go through before being released is very lengthy and complicated. Especially, when vendors provide various “branded” variants. There are loads of articles explaining this, e.g. this one:

Why Android Updates Are So Slow