• Home
  • About
  • Blog
  • News
  • Events
  • Media
  • Video
  • Glossary
  • Contact
  • Download
  • RSS

Android’s security model and Wikipedia

January 29th, 2009  |  by elisabeth  |  Published in Future of the Internet  |  8 Comments

—By Elisabeth Oppenheimer

There’s been some recent discussion about a “rogue” Android app, MemoryUp, which was supposed to manage memory on the G1 phone, preserving battery life and allowing apps to run more smoothly. Apps are posted in the Android Market with user reviews, and many of the reviews for MemoryUp complained that it froze the phone, erased data, or corrupted the memory. The app’s maker, eMobiStudio, vigorously denies that the app did or even could have caused these problems.

ReadWriteWeb floats the theory that people holding a “grudge” against eMobiStudio faked the bad reports just to damage the company. Apparently the company disguised too much advertising as forum posting, and other members of the Android community weren’t pleased by what they saw as spam. And the app didn’t seem to be useful enough to rally users to defend it.

Now the app is off the market, but we don’t know who took it down. (We also don’t know whether it was taken off phones that installed it, but I haven’t seen any reports of a kill switch being used.) A Google spokesperson said that Google had investigated the app and determined that it couldn’t cause the kind of problems it was reported to cause. But the spokesperson “declined to comment” about who had removed it from the Market. This situation leads to several thoughts:

First, if Google is going to have the kind of open marketplace they want, they’re going to have to be more clear about what they’re doing. No one seems to know who pulled the app—the developer, Google itself, or perhaps some automatic system based on customer complaints. If Google is silently pulling disputed apps while the developers protest … they’ve replicated the iPhone’s App Store. There hasn’t been much protest about the Android kill switch, and people might well be okay with pulling apps that pose security problems from the Market (especially since there are alternative distribution methods). But Android users ought to know who pulled the app, and why.

Second, if—and it’s a big if—Google was willing to pull the app just based on unsubstantiated (and possibly faked) customer complaints, that’s a pretty abuse-prone system. It is also, as ReadWriteWeb points out, shortsighted on the part of people who fake claims: outcries about Android security flaws will drive people away from the OS and hurt everyone.

On the other hand, if Google plans to maintain any sort of control over apps with security problems—whether at the Market stage, or by pulling them off phones—they’ll have to listen to customer complaints to a certain extent. Google tested this app, but I don’t think they really want to be in the business of extensively testing apps for security breaches; the point of open-source is to outsource that function to users. But the implication that developers might use that power against each others is disturbing, and if true, Google (and anyone who wants to see Android succeed) will have to figure out what balance to strike.

The book is about dilemmas like these. Android is designed to be generative: it’s just a platform, and it can’t become brilliant until users innovate for it. Contribution costs are purposefully kept low, with a freely-distributed SDK and multiple distribution outlets. But profitable systems invite malware creation, and so people have been worried about Android security since it was first released—how can we let people enjoy and experiment with all this code without damaging phones they depend on? Will we have to trade (some) generativity for (some) security, as Apple has done with the iPhone? In the book, Professor Zittrain argues for solutions that engage the community of users and don’t assume a zero-sum game. Having users test and rate applications—as they do on Android—is a certainly a step in that direction. (Google removing apps without explanation would be a step in the opposite direction, and would make developers nervous.) Yet, the story of MemoryUp illustrates that user ratings alone may not be enough, if some users want to manipulate the system.

This problem a little bit similar to the problem Wikipedia faces—how to keep the malicious few from subverting the work of the benevolent many—but with a different commercial motivation, and perhaps more panic on the part of those who fear their phones will be compromised. In Wikipedia-land, there’s a core of people deeply committed to making the model work—a group of good Wikipedia citizens who supplement the more ad hoc work of the larger group. And there are some primitive, but transparent, hierarchical controls. As Google tinkers with Android’s security design, it may find it can best encourage generativity by moving from a purely open, egalitarian model to something more nuanced, like the Wikipedia model.

Responses

Feed
  1. Steven Walling says:

    January 29th, 2009 at 4:55 pm (#)

    This is a good read, but you get one thing exactly wrong…

    It isn’t that a core community of Wikipedians “supplements” the work of a larger ad-hoc group. Ad-hoc, anonymous contributions supplement the work of the core community of dedicated editors. This is verified by both internal statistical studies and third party work by organizations such as PARC’s Augmented Social Cognition research group.

  2. Bob says:

    January 31st, 2009 at 4:18 pm (#)

    I might have found something interesting on your page but black type on a dark blue background is unreadable. Have you ever tried to read it yourself? This is the kind of design flaw one expects to find only in homemade amateur websites.

  3. Mark Murphy says:

    January 31st, 2009 at 4:50 pm (#)

    I’m a fan of the book, and I saw Prof. Zittrain speak at last year’s PdF.

    I’m also fairly heavily involved with Android. While I agree with much of your post, I wanted to clarify some things:

    “If Google is silently pulling disputed apps while the developers protest … they’ve replicated the iPhone’s App Store”

    There’s still the fundamental difference that the iPhone App Store is a focused monopoly: it is the *only* way to get apps on an iPhone. You mention “alternative distribution methods” parenthetically later in the paragraph, but it’s really central to Android’s openness. What happens in the Android Market has some impact on a publisher, but it is not the death-knell that being kicked out of the App Store is.

    “But Android users ought to know who pulled the app, and why.”

    I wouldn’t quibble if this information were made available, but it’s unclear why you feel it’s a consumer right. If your local grocer switches suppliers of eggs, or discontinues selling some breakfast cereal, there is usually no notice to you that such a lineup change has been made and why. If your local shoe store stops carrying Timberland shoes, they probably won’t put up a poster explaining why. If your local computer store stops shelving TaxACT, they do not owe you a justification for this move. It is unclear why the Android Market would be any different.

    Again, it is different with the iPhone App Store due to the monopoly status the App Store holds vis a vis iPhone apps. Apple pulling a product from the App Store removes 100% of distribution (akin to forcing a product off all stores’ shelves, not just a single store).

    Now, had you phrased this as more of a “here’s what Google gets by opening up this information”, as you allude to in the second-to-last paragraph, that would have been excellent. As it stands, though, the current phrasing is couched more in terms of a right than “merely” a really good idea, and at least I’m not ready to make that leap just yet.

    BTW, a typo: in the second-to-last paragraph, you have “MemberUp” instead of “MemoryUp”.

  4. Bertil Hatt says:

    February 1st, 2009 at 2:54 pm (#)

    Let’s assume the App was not designed to harm: we don’t even have to have an opinion about whether the app was actually bugged and harmful — simply that the developpers could not identify the problem and resolve it, be it defamation or an unforseen interaction with another buggy app.

    What would have been the developpers best option? To avoid any buzz: remove the App silently and have no communication around what happened until they can safely offer a better and trustable product. It would be in Google’s interest to explain things clearly, but they might have decided to favor the developper’s reputation.

    > the point of open-source is to outsource [testing apps for security breaches] to users

    Wich explains why the only users of Linux are marginal geeks. ;^)

    Seriously, no — and it’s a crucial point: the point of Open source it not to let anyone do the dirty work, because most aren’t able. The point is to let anyone decide he can certify software, based on his expertise, so that the (id10t) user can have choices about who he trusts. Not having certification around Open source is ineffective, and those certification can be dictatorial if it is the choice of their initiator.

  5. Ben says:

    February 8th, 2009 at 5:27 pm (#)

    @Steven Walling:

    If I understand your comment correctly, you are stating that the “Gang of 500″ (actually 524 users, from Jim Wales’s lecture at Stanford) provide the majority of Wikipedia content, while the global community acts as a supplement to that.

    Aaron Swartz (www.aaronsw.com) recently conducted research that came to the conclusion that while the core users provided a majority of the edits to Wikipedia, the ad-hoc community provided an overwhelming majority of the content.

    Granted, his survey set wasn’t the entirety of Wikipedia, but I believe it was large enough to infer a larger pattern of behavior.

    –

    If I misunderstood your intent, and we are arguing the same point, then /salute ;)

  6. Steven Walling says:

    February 9th, 2009 at 4:26 pm (#)

    @Ben

    It’s not actually a gang of 500 anymore. Now it’s between one and three thousand. :)

    A lot of people trot out Aaron Swartz (likely since he’s one of the first serious hits in a Google search on the topic), but two serious problems are neglected when he is brought up:

    1. A little slice of the pie does not show an accurate picture of editing behaviors, because those behaviors vary wildly based on the exact slice you take. Based on subject matter, size of the article, how and/or whether it has ever been peer assessed, or any number of other factors show radically different editing patterns. A Featured Article candidate gets edited in an entirely different way that say, Zittrain’s bio. To draw a really broad conclusion about who does the editing, you must look at the whole project and average it out.

    2. Aaron’s numbers are from 2006. Considering that the community has shown exponential growth and grew by the thousands in just 06-07 alone, his numbers are no longer accurate.

    3. Swartz is just one guy. PARC’s stats on who does editing are not only based on much more recent data, but they were compiled by a pretty brilliant team of scientists.

  7. Tethered Appliances : péril en la demeure « Le monde change…et pourquoi pas? says:

    February 16th, 2009 at 10:54 am (#)

    [...] tout nouveau système d’exploitation Open Source pour les appareils mobiles. Et déjà une première controverse se dessine peut-être à l’horizon pour [...]

  8. Openness versus consumer protection? Android, iPhone, and transparency | Security Hero says:

    March 22nd, 2009 at 10:47 pm (#)

    [...] Elisabeth Oppenheimer, of StopBadware director Jonathan Zittrain’s "Future of the Internet" blog, writes: [...]

Blog

  • FOI Topics and Links of the Week
  • The Extraordinaries Haiti Earthquake Support Center. A followup post on the Extraordinaries’ efforts to use ubiquitous human computing to help find missing people after the Haiti earthquake — a positive vision inspired by JZ’s nightmare scenario of crowdsourced secret police work. Did they succeed? “Yes and no”—but, as they detail, there’s obvious potential for future disaster relief.

    Amazon Cracks Open the Kindle. Amazon is opening the Kindle to outside developers who can market their products in what sounds exactly like an App Store, down to the 70-30 revenue split and and light policing of apps. (One difference is that developers have to pay for wireless delivery.) It’s seeming like this is *the* model for the next few years. Speaking of which…

    Computers Should Be More Like Toasters. The sale of the Apple Tablet could mark an important moment for generativity. Computers have been shrinking and phones have been growing—but the critical difference has been that anyone could still code for a computer, until now. The Tablet looks more like a computer than a phone, but will Apple will prescreen apps they way it does for the iPhone? Farhad Manjoo thinks that would be a good thing, but there are clear generativity costs.

    The Splinternet means the end of the Web’s golden age. Josh Bernoff points out that, as we switch to appliancized computers and smart devices instead of PCs, the web becomes a “splinternet.” Websites show up and operate differently on each device. He thinks about how to handle this from a business and marketing perspective, advising: “Here’s what not to do: panic and try to unify things again. The shattering cannot be undone.”

    Technology Changes “Outstrip” Netbooks. Meanwhile, the BBC considers the convergence among netbooks, smartphones, and tablet notebooks, and who the short- and long-term winners are likely to be.

    Apple censors Dalai Lama iPhone Apps in China. An interesting look at how censorship works on iPhones in China. (The story was written pre-Google announcement, so some portions are out of date.) Apple, complying with local law, appears to be removing apps related to the Dalai Lama in the Chinese App Store, and a search for Falun Gong apps freezes the search page. On the other hand, it’s possible to access YouTube through an iPhone app, which isn’t always possible on a PC.

    And in the crystal ball dep’t — from JZ’s book:

    Imagine entering a café in Paris with one’s personal digital assistant or mobile phone, and being able to query: “Is there anyone on my buddy list within 100 yards? Are any of the ten closest friends of my ten closest friends within 100 yards?” Although this may sound fanciful, it could quickly become mainstream. With reputation systems already advising us on what to buy, why not have them also help us make the first cut on whom to meet, to date, to befriend? These are not difficult services to offer, and there are precursors today.

    As usual, there’s an app for that… the “datecheck” app allows you to enter a name, phone number, or email address, and get information on your date. The categories are “sleaze detector” (check of criminal convictions & sex offenses), “$$$” (home ownership, etc), “interests” (gleaned from social networks), “living situation” (who they live with), and “compatibility”—although unfortunately, the “compatibility” check is still just a check of astrological signs. Now all they need is friends’ feedback rankings.

    —By Elisabeth Oppenheimer

  • Life in a clickshop
  • In talks about ubicomp, JZ gives an example of a worst-case scenario involving ubicomp platforms. He imagines that the Iranian government could use Amazon Mechanical Turk to identify dissidents, simply by posting pictures of protestors and ID-card pictures of the adults in the country, then asking Turkers to match protestor pictures to ID-card pictures. Voila—and the Turkers wouldn’t necessarily have to know what they were doing. In the department of amazingly cool ideas, though, the folks at the Extraordinaries reflected on the Iran example and then turned it around. After the earthquake in Haiti, they posted news wire pictures of people in Haiti (with crowdsourced help), asked others to post pictures of missing relatives, and finally asked volunteers to try to match the two up. This is v 1.0 of what could be a terrific and widely-used technology after natural disasters, allowing people at home to do more than just donate money.

    As we keep thinking about ubicomp and the potential upsides and downsides, it’ll be important to keep in mind that it’s a tool—a largely undeveloped one as yet—with much room to develop in both directions. In that spirit, I wanted to comment on this piece from Technology Review that casts a skeptical eye on Prof. Zittrain’s recent column in Newsweek on cloud labor (also known as ubiquitous human computing). The Newsweek editors gave the piece the ominous headline “Work the New Digital Sweatshops,” and Tech Review bloggers question whether that’s really a fair description of the Mechanical Turk platform. I’m not sure there’s a real disagreement here—the Newsweek headline overstated the content of the piece. Much of the point, as I read it, was just that cloudwork practices are so new, dynamic, and varied that it’s hard to know what the good and bad effects will turn out to be. As they point out, this could be a boon for workers here in the US who want flexibility and autonomy, as well as creating new kinds of opportunities for workers abroad. A few specific points are worth thinking about, though.

    They quote John Horton, at Harvard, who put out a HIT (“human intelligence task”) on Amazon Mechanical Turk asking about working conditions, and found that a small majority think AMT requestors treat workers better than most real-world employers. That surprised me—maybe I spend too much time reading Turker messageboards, where the theme is often discontent. I wonder, though, whether many responders use AMT for fun or small income supplements, rather than to earn a living wage, which changes the complexion of the situation. Even if Horton is wholly correct, though, it doesn’t mean requestors can’t improve. For a project I’m doing for JZ’s winter cyberlaw class, we’ve put up some AMT HITs asking about worker satisfaction. We’ve found that people do not like doing search engine optimization or creating spam, and a majority (though not an overwhelming one) likes knowing what the project is for. Disclosure of the company’s identity or the project purpose could become a much stronger norm on AMT, which would help fend off the problems of work alienation and unwittingly doing bad things with the platform, but wouldn’t detract from any of the benefits TR bloggers praise.

    The other major point they make is that this type of work can be good for workers in developing countries. That’s definitely true in some cases (see, for instance, previous blogging about CrowdFlower’s GiveWork program). I certainly don’t have enough background in international development to make an unambiguous statement either way. But surely it’s worrisome that children can be made to do the work as well as adults—there’s just no way of knowing who’s at the other end of the system. Overall, for better or for worse, we live in a society where we’ve decided that paternalistic labor laws play some valuable role. Some of them can be imported into an AMT context—but maybe not internationally—and the technology means that some can’t, even if, like child labor, there’s widespread condemnation. I would agree, and I think JZ would too, that we don’t want regulators charging in with too heavy a hand. But we should be alert to what’s happening on these platforms.

    —By Elisabeth Oppenheimer

  • A quick cosmology question
  • The amazing Hubble telescope has now shown us images of galaxies from 13.2 billion years ago.  That’s because the light comes from 13.2 billion light years away, and took (by definition) that much time to get here:

    “The deeper Hubble looks into space, the farther back in time it looks, because light takes billions of years to cross the observable universe,” the Space Telescope Science Institute said in a statement released Tuesday.

    So that makes sense on one level.  But here’s what I don’t get: the light only took that long to get here if the starting point for it was in fact 13.2 billion light years away.  Since the universe is expanding, if one rewinds time, it shrinks.  Indeed, I thought the Big Bang to mean that at one point the Universe was a singularity, both meaning in a condition for which our laws of physics can’t say anything, and that it was essentially compressed into a single point.

    But if it was compressed into a single point — apparently about 5-600 million years further back from the 13.2 billion we’re now seeing — that means that 14 billion years ago everything was, well, extremely close to everything else.  So unless the universe is expanding faster than the speed of light, how could anything be 13.2 billion light years away from us, 13.2 billion years ago?  Maybe something is that far now, but if so its light would only just be starting its journey to us.  The whole light year calculation presumes that something was that far away from us then – a time when the whole universe was much, much smaller in diameter.  Maybe it has something to do with the universe’s expansion as a matter of dark energy, e.g., the fabric of the universe itself expanding, vs. the expansion found as all the galaxies speed away from one another (countered by the actions of gravity)?  Something to do with the “inflationary period” catapulting everything really far away from everything else in one swoop?

    I’m sure I’m missing something here.  What is it?

  • Google takes on China
  • Google announced today that it would cease (well, phase out) censoring the results in google.cn, the Chinese-language version of its famed search engine.  It’s a pretty stunning move, both in its fact and in its execution.  First, the announcement of “A new approach to China” may appear to have buried the lede.  The lion’s share of the post is devoted to describing a series of coordinated attacks on the accounts of human rights activists, including those who use Google.  It includes a link to the amazing story of GhostNet, discovered by fellow ONI researchers when the Dalai Lama gave them his oddly-acting laptop to examine.

    Companies rarely share information about the cyberattacks they experience — conventional wisdom has it that it makes the company appear vulnerable, and drives customers away.  Here Google is open about the attacks, while of course assuring readers that it had tightened security as a result.  Google then links these attacks to a lessening of enthusiasm for doing business in China.  Eliminating censorship in google.cn is only mentioned after that.

    Suppose the Chinese government acts as expected and tells Google that it may no longer operate in China.  Google.cn might vanish as a domain name, since it’s hosted under the Chinese country-code TLD of .cn, ultimately controllable by the Chinese government.  But the search engine found there could of course keep operating from a different location, like cn.google.com.  Suppose then that China attempts to filter out traffic to and from that new location — and to and from google.com for good measure, as it has done from time to time, especially before the advent of google.cn and its agreement to censor.  (We’ll be watching for such moves at herdict.org, a site where users can report Web blockages.)

    What next?  My hope, and expectation, is that Google engineers who might have been a bit halfhearted about implementing censorship mandates in google.cn could be full-throttle in coming up with ways for Google to be viewed despite any network interruptions between site and user.  There are lots of unexplored options here.  They’re unexplored not because they’re infeasible, but because most sites would rather not provoke a government that filters.  So they don’t undertake to get information out in ways that might evade blockages.  Here, Google would have nothing more to lose, so could pioneer some new approaches.  Circumvention of filtering (or other blockages, for that matter) tends to happen on the user side of things, seeking out proxies like the Tor network, or anonymizer.com.

    To be sure, many of the larger benefits of operating in China originally cited by Google four years ago — exposing the citizenry to services beyond those locally grown and monitored; engaging them beyond the “China Wide Web” to which some government officials aspire to limit them; and gaining market share that can create momentum and support for later loosening of restrictions — may attenuate.  Google.cn is less known and used than, say, the local Baidu search engine, which boasts about 60% market share.  That share is about to get even bigger.

    But drawing a line is both the right move and a brilliant one.  It helps realign Google’s business with its ethos, and masterfully recasts the firm in a place it will feel more comfortable: supporting the free and open dissemination of information rather than metering it out according to undesirable (and capricious) government standards.

  • Malicious Apps in the Android Market
  • As we knew would happen sooner or later, a dangerous malicious app has apparently made its way into Android’s Market. The app is said to “create[] a shell of mobile banking apps” and collect users’ personal information. It’s been removed; no word on how many users, if any, were actually affected.

    Offhand, I can’t think of an app with comparable problems that has gotten into iPhone’s app store. What will be really interesting about this incident, and the similar ones that are sure to follow, is how users and vendors react. I can imagine this creating hysterical urging for Google to pre-screen all Android apps the way Apple does, but I think that would be premature. Yes, an open Market(s) is going to have more questionable apps, but there are many solutions other than lockdown—a strong user ranking for apps (which already exists), a way to alert people who have already downloaded the app, sandboxing (which admittedly wouldn’t have mattered here), or a quick way to freeze the app while complaints are investigating. They’re only partial solutions, but lockdown is only partial, too.

    Now that the Android OS is really starting to take off, this story is going to be repeated, and we’ll get to see how strongly committed Google is to the principles it built the OS on — and whether there are models out there for vetting third party code that do better than those of the generative PC, but aren’t as restrictive as that of the iPhone.

    —By Elisabeth Oppenheimer

    Update: eWeek reports that Google has removed a number of suspicious apps from its marketplace.  Of course, the more generative structure of the Android market means that “banned” apps can be obtained elsewhere — unlike the iPhone app monopoly enjoyed by Apple, where the iPhone App store is the only point of distribution.  –JZ

About Jonathan Zittrain

jonathan zittrain

Jonathan Zittrain is Professor of Law at Harvard Law School and co-founder of the Berkman Center for Internet and Society at Harvard Law School

RSS Tweets from Z

  • Hosting Cliff Stoll at the Berkman Center tonight http://cyber.law.harvard.edu/events/2010/02/stoll
  • Iranian internet+sms "conveniently" slowing down b4 planned protests: http://bit.ly/9YzC3m
  • RT @ruskin147: http://bit.ly/aLmScH New blog post - Apple - an open and shut case. Linking to the Zittrain piece in FT - and starting in ...
  • iPad: a fight over freedom at Apple's core http://bit.ly/bglwoG

Blog Archives



Creative Commons BY-NC-SA Jonathan Zittrain unless otherwise noted.
Powered by WordPress using Gridline Lite.