• Home
  • About
  • Blog
  • News
  • Events
  • Media
  • Video
  • Glossary
  • Contact
  • Download
  • RSS

Android’s security model and Wikipedia

January 29th, 2009  |  by elisabeth  |  Published in Future of the Internet  |  8 Comments

—By Elisabeth Oppenheimer

There’s been some recent discussion about a “rogue” Android app, MemoryUp, which was supposed to manage memory on the G1 phone, preserving battery life and allowing apps to run more smoothly. Apps are posted in the Android Market with user reviews, and many of the reviews for MemoryUp complained that it froze the phone, erased data, or corrupted the memory. The app’s maker, eMobiStudio, vigorously denies that the app did or even could have caused these problems.

ReadWriteWeb floats the theory that people holding a “grudge” against eMobiStudio faked the bad reports just to damage the company. Apparently the company disguised too much advertising as forum posting, and other members of the Android community weren’t pleased by what they saw as spam. And the app didn’t seem to be useful enough to rally users to defend it.

Now the app is off the market, but we don’t know who took it down. (We also don’t know whether it was taken off phones that installed it, but I haven’t seen any reports of a kill switch being used.) A Google spokesperson said that Google had investigated the app and determined that it couldn’t cause the kind of problems it was reported to cause. But the spokesperson “declined to comment” about who had removed it from the Market. This situation leads to several thoughts:

First, if Google is going to have the kind of open marketplace they want, they’re going to have to be more clear about what they’re doing. No one seems to know who pulled the app—the developer, Google itself, or perhaps some automatic system based on customer complaints. If Google is silently pulling disputed apps while the developers protest … they’ve replicated the iPhone’s App Store. There hasn’t been much protest about the Android kill switch, and people might well be okay with pulling apps that pose security problems from the Market (especially since there are alternative distribution methods). But Android users ought to know who pulled the app, and why.

Second, if—and it’s a big if—Google was willing to pull the app just based on unsubstantiated (and possibly faked) customer complaints, that’s a pretty abuse-prone system. It is also, as ReadWriteWeb points out, shortsighted on the part of people who fake claims: outcries about Android security flaws will drive people away from the OS and hurt everyone.

On the other hand, if Google plans to maintain any sort of control over apps with security problems—whether at the Market stage, or by pulling them off phones—they’ll have to listen to customer complaints to a certain extent. Google tested this app, but I don’t think they really want to be in the business of extensively testing apps for security breaches; the point of open-source is to outsource that function to users. But the implication that developers might use that power against each others is disturbing, and if true, Google (and anyone who wants to see Android succeed) will have to figure out what balance to strike.

The book is about dilemmas like these. Android is designed to be generative: it’s just a platform, and it can’t become brilliant until users innovate for it. Contribution costs are purposefully kept low, with a freely-distributed SDK and multiple distribution outlets. But profitable systems invite malware creation, and so people have been worried about Android security since it was first released—how can we let people enjoy and experiment with all this code without damaging phones they depend on? Will we have to trade (some) generativity for (some) security, as Apple has done with the iPhone? In the book, Professor Zittrain argues for solutions that engage the community of users and don’t assume a zero-sum game. Having users test and rate applications—as they do on Android—is a certainly a step in that direction. (Google removing apps without explanation would be a step in the opposite direction, and would make developers nervous.) Yet, the story of MemoryUp illustrates that user ratings alone may not be enough, if some users want to manipulate the system.

This problem a little bit similar to the problem Wikipedia faces—how to keep the malicious few from subverting the work of the benevolent many—but with a different commercial motivation, and perhaps more panic on the part of those who fear their phones will be compromised. In Wikipedia-land, there’s a core of people deeply committed to making the model work—a group of good Wikipedia citizens who supplement the more ad hoc work of the larger group. And there are some primitive, but transparent, hierarchical controls. As Google tinkers with Android’s security design, it may find it can best encourage generativity by moving from a purely open, egalitarian model to something more nuanced, like the Wikipedia model.

Responses

Feed
  1. Steven Walling says:

    January 29th, 2009 at 4:55 pm (#)

    This is a good read, but you get one thing exactly wrong…

    It isn’t that a core community of Wikipedians “supplements” the work of a larger ad-hoc group. Ad-hoc, anonymous contributions supplement the work of the core community of dedicated editors. This is verified by both internal statistical studies and third party work by organizations such as PARC’s Augmented Social Cognition research group.

  2. Bob says:

    January 31st, 2009 at 4:18 pm (#)

    I might have found something interesting on your page but black type on a dark blue background is unreadable. Have you ever tried to read it yourself? This is the kind of design flaw one expects to find only in homemade amateur websites.

  3. Mark Murphy says:

    January 31st, 2009 at 4:50 pm (#)

    I’m a fan of the book, and I saw Prof. Zittrain speak at last year’s PdF.

    I’m also fairly heavily involved with Android. While I agree with much of your post, I wanted to clarify some things:

    “If Google is silently pulling disputed apps while the developers protest … they’ve replicated the iPhone’s App Store”

    There’s still the fundamental difference that the iPhone App Store is a focused monopoly: it is the *only* way to get apps on an iPhone. You mention “alternative distribution methods” parenthetically later in the paragraph, but it’s really central to Android’s openness. What happens in the Android Market has some impact on a publisher, but it is not the death-knell that being kicked out of the App Store is.

    “But Android users ought to know who pulled the app, and why.”

    I wouldn’t quibble if this information were made available, but it’s unclear why you feel it’s a consumer right. If your local grocer switches suppliers of eggs, or discontinues selling some breakfast cereal, there is usually no notice to you that such a lineup change has been made and why. If your local shoe store stops carrying Timberland shoes, they probably won’t put up a poster explaining why. If your local computer store stops shelving TaxACT, they do not owe you a justification for this move. It is unclear why the Android Market would be any different.

    Again, it is different with the iPhone App Store due to the monopoly status the App Store holds vis a vis iPhone apps. Apple pulling a product from the App Store removes 100% of distribution (akin to forcing a product off all stores’ shelves, not just a single store).

    Now, had you phrased this as more of a “here’s what Google gets by opening up this information”, as you allude to in the second-to-last paragraph, that would have been excellent. As it stands, though, the current phrasing is couched more in terms of a right than “merely” a really good idea, and at least I’m not ready to make that leap just yet.

    BTW, a typo: in the second-to-last paragraph, you have “MemberUp” instead of “MemoryUp”.

  4. Bertil Hatt says:

    February 1st, 2009 at 2:54 pm (#)

    Let’s assume the App was not designed to harm: we don’t even have to have an opinion about whether the app was actually bugged and harmful — simply that the developpers could not identify the problem and resolve it, be it defamation or an unforseen interaction with another buggy app.

    What would have been the developpers best option? To avoid any buzz: remove the App silently and have no communication around what happened until they can safely offer a better and trustable product. It would be in Google’s interest to explain things clearly, but they might have decided to favor the developper’s reputation.

    > the point of open-source is to outsource [testing apps for security breaches] to users

    Wich explains why the only users of Linux are marginal geeks. ;^)

    Seriously, no — and it’s a crucial point: the point of Open source it not to let anyone do the dirty work, because most aren’t able. The point is to let anyone decide he can certify software, based on his expertise, so that the (id10t) user can have choices about who he trusts. Not having certification around Open source is ineffective, and those certification can be dictatorial if it is the choice of their initiator.

  5. Ben says:

    February 8th, 2009 at 5:27 pm (#)

    @Steven Walling:

    If I understand your comment correctly, you are stating that the “Gang of 500″ (actually 524 users, from Jim Wales’s lecture at Stanford) provide the majority of Wikipedia content, while the global community acts as a supplement to that.

    Aaron Swartz (www.aaronsw.com) recently conducted research that came to the conclusion that while the core users provided a majority of the edits to Wikipedia, the ad-hoc community provided an overwhelming majority of the content.

    Granted, his survey set wasn’t the entirety of Wikipedia, but I believe it was large enough to infer a larger pattern of behavior.

    –

    If I misunderstood your intent, and we are arguing the same point, then /salute ;)

  6. Steven Walling says:

    February 9th, 2009 at 4:26 pm (#)

    @Ben

    It’s not actually a gang of 500 anymore. Now it’s between one and three thousand. :)

    A lot of people trot out Aaron Swartz (likely since he’s one of the first serious hits in a Google search on the topic), but two serious problems are neglected when he is brought up:

    1. A little slice of the pie does not show an accurate picture of editing behaviors, because those behaviors vary wildly based on the exact slice you take. Based on subject matter, size of the article, how and/or whether it has ever been peer assessed, or any number of other factors show radically different editing patterns. A Featured Article candidate gets edited in an entirely different way that say, Zittrain’s bio. To draw a really broad conclusion about who does the editing, you must look at the whole project and average it out.

    2. Aaron’s numbers are from 2006. Considering that the community has shown exponential growth and grew by the thousands in just 06-07 alone, his numbers are no longer accurate.

    3. Swartz is just one guy. PARC’s stats on who does editing are not only based on much more recent data, but they were compiled by a pretty brilliant team of scientists.

  7. Tethered Appliances : péril en la demeure « Le monde change…et pourquoi pas? says:

    February 16th, 2009 at 10:54 am (#)

    [...] tout nouveau système d’exploitation Open Source pour les appareils mobiles. Et déjà une première controverse se dessine peut-être à l’horizon pour [...]

  8. Openness versus consumer protection? Android, iPhone, and transparency | Security Hero says:

    March 22nd, 2009 at 10:47 pm (#)

    [...] Elisabeth Oppenheimer, of StopBadware director Jonathan Zittrain’s "Future of the Internet" blog, writes: [...]

Blog

  • Rethinking Online Culpability: The Amazon “Keep Calm” Shirts Controversy (Part 1: A/B Testing)
  • In early March, the online retailer Solid Gold Bomb provoked outrage when customers discovered that its Amazon store, which featured apparel bearing dozens of variants on the “Keep Calm [and Carry On]” slogan, included a t-shirt that read “Keep Calm and Rape A Lot.” Solid Gold Bomb generated the shirts, and Amazon offered them for sale in its marketplace. To complicate matters, it appears that Amazon doesn’t review the stores in its marketplace like a mall owner might review physical storefronts, and, particularly unusual, Solid Gold Bomb didn’t review the shirts it offered for sale: the designs were computer generated. How far, then, should blame extend? When unsupervised automation produces results that everyone regrets, how do we decide whom to hold responsible, and when do we decide to hold anyone responsible in the first place?

    Solid Gold Bomb’s official apology explained that its Amazon store featured millions of hypothetical shirts to be produced on-demand, should anyone order one. The “Keep Calm” debacle resulted from an automated script that generated words to approximately fit the design’s syntax and layout. The resulting list, says SGB owner Michael Fowler, “was culled from 202k words to around 1100 and ultimately slightly more than 700 were used due to character length and the fact that I wanted to closely reflect the appearance of the original slogan graphically.” Clearly, the vendor is at fault for failing to eliminate possible ending phrases to the Keep Calm slogan like “rape a lot” and “choke her” from a 700-word list. However, similarly automated practices regularly take place on a much larger scale across the internet. Determining accountability for these widespread and fundamental operations can be much less straightforward.

    In some ways, Solid Gold Bomb’s generation of the offensive shirts can be seen merely as A/B testing gone awry. Offering thousands of options and printing shirts to order is a way of using user behavior to cull successful products. Presumably, if one of the quasi-randomly-generated shirts began to outstrip the others in sales, Solid Gold Bomb would have adjusted its inventory and marketing accordingly.

    With A/B testing, the line between savvy capitalism and unethical business practice can get fairly nebulous. Zynga, for example, relies on a practice that CEO Mark Pincus calls “ghetto testing.” One of Zynga’s approaches to game development is to advertise games that do not yet exist, in order to test consumer response to a basic premise. Says Pincus,

    “We’ll put up a link for five minutes saying,  ‘Hey!  Do you ever fantasize about running your own hospital?’…We’ll put that up for five minutes, and the link will maybe take you to a survey, where you give us your email and we say when this comes out we’ll contact you. If you’re really doing ghetto, it says ‘404 not found’.  That’s bad. So first you try to get the heat around it, you see how much do people like it, then…”

    This isn’t all that dissimilar to Solid Gold Bomb’s approach. Like Zynga’s “ghetto-tested” games, the “Rape a Lot” shirts didn’t actually exist, and would only have been produced in accordance with user demand. In fact, Solid Gold Bomb didn’t misdirect potential buyers as deliberately as Zynga’s “ghetto testing” approach does.

    In large, computer-conducted A/B testing campaigns, it becomes impossible to demand human supervision of every output. Solid Gold Bomb’s 700-word list for generating T-shirts should have been thoroughly scrutinized, of course, but operations with more permutations of A’s and B’s seem less accountable for each potential outcome. For example, it’s hard to believe it would be within a webmaster’s responsibility—or even her ability—to make sure that every possible banner ad on every single page of a site doesn’t combine unfortunately with the page’s content.

    A/B testing is practically ubiquitous online, and most of its applications are unequivocally benign. Wikipedia, for one, famously self-published the test results of its 2010 fundraising push. Moreover, unsupervised, computer-conducted A/B testing can produce serendipitous results that no human could ever have engineered or anticipated. The popular twitter handle @horse_ebooks, for example, began as a poorly functioning spam account intended to drive traffic to an e-book site. But its garbled messages are so striking—and occasionally poignant (cf. a recent example)—that the bot currently has over 170,000 followers.

    The problem, then, is that our expectations for internet commerce haven’t quite caught up with the techniques that drive internet commerce. If a store offers things for sale that we find offensive, our typical reaction is to get mad at the store—after all, being willing to profit off an item seems to imply some kind of endorsement of that item. Today, however, these assumptions about endorsement are challenged by the ubiquity of A/B testing and other automated content generators. A “ghetto test” by Zynga might not mean that the company fully endorses a game that simulates running a hospital. Similarly, the presence of an item in the Amazon Marketplace might not be enough to presume Amazon’s approval of that item.

    [Parts 2-4 will be published over the next week]

    - Ben Sobel, Kendra Albert, and JZ

  • The Future of the Internet: Five Years Later
  • In 2008, The Future of the Internet called attention to a “sea change” in the way consumer devices interact with the Internet. “The future is not one of generative PCs attached to a generative network,” the book warns; “it is instead one of sterile appliances tethered to a network of control.” In response to the security threats posed by malicious third-party code, increasing numbers of users will likely gravitate towards gadgets “tethered” by continuous communication between product and vendor. And this proliferation of tethered computing—the “appliancization” of PCs—will deal a serious blow to the principles of generativity and free expression that drove the early Internet.

    Since the publication of The Future of the Internet, the ethos of strict appliancization has taken a new turn. In 2011, Professor Zittrain wrote an update on the book’s message: “at the time of the book’s drafting, the alternatives seemed stark: the “sterile” iPhone that ran only Apple’s software on the one hand, and the chaotic PC that ran anything ending in .exe on the other. The iPhone’s openness to outside code beginning in ’08 changed all that. It became what I call “contingently generative” — it runs outside code after approval (and then until it doesn’t).” This trend towards contingently generative models continues into the present day, and represents a shift similar in many respects to the one The Future of the Internet predicted.

    Jon Brodkin and Peter Bright’s Ars Technica op-ed on the Microsoft Metro app store offers some valuable commentary on a big development in this “sea change.” The article recognizes that “Microsoft is imitating Apple in one very bad way, by limiting the distribution of Metro applications to a Microsoft-controlled app store… by bringing Windows to tablets, Microsoft could strike a blow for openness in a market dominated by a closed system. Instead, Microsoft is bringing the same restrictions found on iPads to both Windows tablets and PCs.” As forecasted by The Future of the Internet, devices that only run approved code are gaining popularity. Metro, the curated user interface that has found its way onto Microsoft’s tablets and PCs (in the case of the PCs, alongside a fully-functional desktop mode capable of side-loading non-Windows Store applications), won’t run applications from outside the Windows Store. Moreover, the apps available through the Store are subject to a bevy of restrictions on content. With these restrictions on installable applications come the restrictions on generativity that The Future of the Internet anticipated: “lock down the device, and network censorship and control can be extraordinarily reinforced.” And, as the Ars Technica piece observes, the Windows Store’s rules would exclude critically-acclaimed content like the video game Elder Scrolls: Skyrim, simply for its PEGI 18/ESRB M rating. It isn’t hard to extrapolate, as Brodkin and Bright do, that these rules could give rise to debacles similar to Apple’s (repealed) ban of a satire app developed by a Pulitzer Prize winner.

    Though the Windows Store’s restrictions resemble Apple’s policies in many ways, there is a crucial difference: Metro-running Windows 8 products are designed as PC replacements, rather than sui generis devices like the iPad. And since Windows desktops have long been preferred gaming platforms, the theoretical exclusion of content like Skyrim from the Windows Store makes Windows 8’s emphasis on the Metro interface particularly jarring.

    With Metro, Microsoft has made a decisive move towards contingent generativity. Brodkin and Bright note that “there are security benefits to a closed app store model, particularly for less tech-savvy users who may not understand all the dangers on the Web. There are also, arguably, convenience benefits; end-users can be reasonably confident that the apps they download will work correctly and be at least marginally useful…But while these security and convenience benefits might be enough to justify the existence of a curated app store, they don’t justify the decision to make that store the only option for all users. Informed users should be allowed to install applications from wherever they want.” Brodkin and Bright prefer a system like Gatekeeper, a fixture in newer versions of Apple’s OS X, from Mountain Lion forward. Gatekeeper gives users the choice to restrict their operating system to App Store apps and outside apps that have been signed with Apple-issued Developer IDs, or open up the device to all programs, whether or not they’ve been vetted by Apple. The “Future of the Internet” Blog is fairly enthusiastic about Gatekeeper: about a year ago, a post here suggested that “the middle ground of allowing non-App Store signed code may represent the best of both worlds.” But we were quick to warn that Gatekeeper strikes a tenuous balance: “one small tweak — lose that Control-click for sideloading — and OS X could fully merge with iOS, both in functionality and in security methods.” Metro’s riff on content control could be just that sort of tweak—especially given recent speculation that Microsoft may dump desktop mode in Windows 9, leaving only Metro.

    Moreover, a contingently generative business model like the Windows Store’s carries some ethical implications that, while not damning, are certainly worth examining. Distribution systems like the Windows Store, Apple’s App Store, and the Android Market receive 30% of the sales revenue from applications sold in their stores (in the Windows Store, this cut drops to 20% after an app reaches $25,000 USD in revenue). Further restrictions on side-loading in new operating systems would drive a great deal of business towards big companies’ proprietary marketplaces—and with that traffic would come big payouts. With the uptick in store traffic that tighter gatekeeping would engender, it’s easy to imagine the equilibrium of Mac’s OS X Gatekeeper being forsaken for more restrictive, and more lucrative, operating systems. To analogize, a la The Future of the Internet: when the company that makes your computer requires you to install programs through their official store, it isn’t so different from the company that makes your toaster forcing you to buy from their bakery—and taking a cut out of every bread purchase you make.

    Even though Windows 8 PC users can still make use of a fully-functioning desktop operating system, Microsoft’s failure to include a side-loading option for the heavily-emphasized Metro interface—particularly in devices marketed as PC replacements—is a step in the wrong direction. It’s also an indication that the seas are changing in the way The Future of the Internet predicted. Given that Android’s more open approach to outside applications[1] still leaves the Android Market increasingly economically viable, Ars Technica is right to voice its disappointment in xenophobic operating systems like iOS and Metro.

    - Ben Sobel, Kendra Albert, and JZ

    [1] Though the Google Play approach to openness is far from perfect! Ad-Blocking apps were recently pulled from the Play Store, in a move that will come to illustrate just how viable it is to distribute a side-loaded Android app without any help from the Play Store.

  • Rock star RA wanted
  • I’m seeking a full-time one-year rock star research associate to engage with a variety of projects and classes, with a broad opportunity to immerse in cyberlaw and Internet topics.   Blurb below, with more information on how to apply at <http://cyber.law.harvard.edu/getinvolved/jzra>.  …JZ

    –

    Professor Jonathan Zittrain of Harvard Law School, the Harvard Kennedy School of Government, the Harvard School of Engineering and Applied Sciences, and the Berkman Center for Internet & Society, seeks a full-time research associate in Cambridge, MA for a period of one year, beginning no sooner than June 1, 2013.

    This position requires the ability to absorb large amounts of written and other media materials from various sources (including but not restricted to: original sources, scholarly articles, news articles/blogs, interviews, databases) in a short amount of time, critically analyze that material and render it forward. This could take the form of prep materials for panels, conferences and presentations; article outlines; fact checking materials; original article or paper drafts; slide decks or other digested forms. The research assistant should be prepared to help prepare materials for class sessions and syllabi, lead discussions and work with project managers to accomplish research-related goals.

    Research is often self-directed with little outside guidance beyond broad outlines and themes (though occasional targeted research assignment for a specific fact or image can be expected, and feedback is provided), so the ability to quickly critically appraise sources and identify interesting, relevant and original paths is essential. Wide-ranging interests and the ability to work on almost any issue or topic that arises is a plus, as is an ability to ramp up quickly on unfamiliar fields or topic areas. Excellent writing and editorial skills with an attention to detail are also required.

    This job is an ideal opportunity for those interested in future graduate school or law school studies, whether currently admitted or still applying to such programs.

    Over the course of the year, a motivated individual will sharpen and focus his or her research agenda and make valuable contributions (in his or her own name) to the field of cyberlaw and beyond, while being exposed to interesting thinkers in academia, industry, and government. A research associate in this position will work very closely with Professor Jonathan Zittrain and his team, assisting in a variety of research areas, e.g. ubiquitous human computing, mesh networking, and cybersecurity, as well as on topics around access to knowledge and open scholarly publishing under the auspices of the Harvard Law School Library.

    The position will not start before June 1, 2013.  As with all Berkman staff positions, this is a term position, ending June 30, 2014.

  • F-T: Don’t sue over tweets
  • I just published a short piece in the F-T in the wake of legal threats against users who tweeted or retweeted a link to a BBC report of child abuse that turned out to be wrong.  Here’s the full text –

    Those who didn’t see the false child abuse accusations against Lord Alistair McAlpine on an ill-considered BBC documentary may have instead heard about them through social media. This week, London’s Metropolitan Police suggested they might file charges against those Twitter users who sullied the reputation of the retired Conservative politician by knowingly repeating the lie that he was a child abuser. But the police may be less fearsome to the average BBC-linking tweeter than Lord McAlpine himself. Read more »

  • Taking More than Candy from a Baby
  • Update – 10/17/2012: The parties involved in the lawsuit – Speak for Yourself and SCS/PRC reached a settlement, allowing the app to remain in the Android and iOS app stores. More at the Nieder family blog.

    Original Post:

    Generativity hasn’t had a poster child — until now.

    Meet Maya, a four-year-old child who could lose her ability to speak with the elimination of an app from the iOS App Store.

    As detailed in the Nieder family’s original blog post on the subject, Maya uses Speak for Yourself (SfY), an iPad app that serves as an “augmentative and alternative communication” (AAC) device. Before finding SfY, Maya had tried multiple AAC devices, but hadn’t found one that worked for her. Read more »

About Jonathan Zittrain

jonathan zittrain

Jonathan Zittrain is Professor of Law at Harvard Law School and co-founder of the Berkman Center for Internet and Society at Harvard Law School

RSS Tweets from Z

  • An error has occurred, which probably means the feed is down. Try again later.

Blog Archives



Creative Commons BY-NC-SA Jonathan Zittrain unless otherwise noted.
Powered by WordPress using Gridline Lite.