Remember just because the phone is rooted doesn't mean it also isn't running the manufacturer's (if any) malware.

Sure. But we're talking about evaluating trust, not whether or not the phone's running malware. If I'm running a stock firmware, in my mind it's already compromised; slapping an XDA hack on top of it doesn't strike me as increasing risk substantially.

That being said, I don't find getting root at all useful unless it's a means to the end of unlocking the phone and replacing the stock firmware. I trust XDA hacks to perform that function, at least, and at that point trusting the manufacturer becomes moot.

I'm a little surprised that the comments so far haven't really tackled the crux of your question, which was NOT "how do I find root exploits", but "are they trustworthy".

Well, the way I see it, I'll trust a random XDA developer pushing closed-source hacks way more than I trust my carrier and/or handset manufacturer.

It'll grant you that it's a low bar.

Think of it as evolution in action. You can stay on one planet while some disaster takes it out. We have lots of choices of disaster, don't we? The human race can continue via those "space nutters".

Sure, we should try to avoid the disaster, etc., but planets are not forever.

I thought it was sarcasm, too.

So 90 days is an appropriate time to wait but not 106 days?

I wouldn't be surprised if there was a "give an inch, take a mile" kind of situation, where they tried allowing some flexibility and got into a cycle where the vendor kept requesting more time each time around.

i imagine if you did this in the usa you'd get sued for using spectrums you don't own.

I imagine if you did this in the USA, you'd get sued for not waiting for the nearest local incumbent to provide the service.

If you stop option ROMs from loading, you can say goodbye to using external ...

Would it really be so terrible if the owner of the hardware could decide whether or not their device supported that kind of thing, or even which specific things it supported?

No, not with encrypted-locked bootloaders becoming common.

Yeah, you're pretty much outlining exactly why I tend to research unlockability prior to buying my devices. I'm not going to pretend that even a small fraction of buyers do this.

  I don't really have much of a solution for people who blindly buy whatever junk the carriers decree that they're allowed to buy. Google's worked on migrating to the Play services approach to get around this, but short of hacking into, unlocking and updating everyones devices I'm not sure what more they can do.

Know, you are talking about an exploit that could be affecting 60% of Android phones...

No, I'm not.

I was responding to a comment about the general state of Android and iOS security updates, not anything specific to this security vulnerability.

In general, if you have an iOS device and Apple decides not to fix a security problem on your phone, it's most likely not going to be fixed.

In general, if you have an Android device and both Google and your vendor decide not to fix a security problem on your phone, you might have a chance to get it fixed by other means. It's not a sure thing, it's not without risk, and you might not be entirely happy with the end result, but it works often enough that it's not a crapshoot.

Now, if you want to get into specifics, I don't know how many of the 60% of vulnerable devices might be able to take advantage of non-Google support, but it's far better than nothing.

... nascent artificial intelligences now have a comprehensive list of people they need to kill as soon as possible.

This is a hit job from a shitty windows enthusiast website (neowin.net).

Do not click any links!

Relax. This is slashdot. Almost nobody reads the source article unless they need to grab a quote in order to prove a point.

I do argue that Google's role in this malfeasance is that they haven't contractually obligated handset manufacturers to make updates available for 2+ years after model introduction.

Given the pile of shit Google's been catching over their Play store contracts, can you really blame them for avoiding anything that leaves a paper trail of arm twisting?