Gadgetell | Tech News, Reviews, and Interesting Things

When Apple introduced its App Store, many were angered by their decision to make the store a closed universe.  They cited security concerns and they did not want AT&T’s network to be damaged due to a rogue application.

T-Mobile’s G1 Android phone pushes “open” as one its huge selling points.  How do Google and T-Mobile create a safe environment with all this openness?  I did some digging and found some answers.

How do you protect the network?
The question: “How do you protect your network if someone has created a malicious application that is eating up all your bandwidth?  If some dummy downloads a ‘Dancing Bear’ application and it turns out to be a spambot, what will T-Mobile or Google do?”

T-Mobile’s Response
When I asked one T-Mobile person involved in network engineering, I was brought to another person for an answer.  The second person thought it was a good question.  That’s when we started talking to third T-Mobile guy. 

Third T-Mobile fellow let me know that T-Mobile will be able to monitor your usage using technologies they already use in determining how data you use.  I mentioned how the people who will be hit are probably not going to using their own account to make a spambot. 

He understood the point and said that T-Mobile could use its monitoring to stop the application.  How exactly this stopping would happen was not fully explained.  T-Mobile could also pull the application from the market to avoid repetition.  They directed me to the Google folks.

Google’s Response
Speaking to Google, I could tell they had thought this out for a while.  The Google representative was quite confident that they had the proper solutions in place. 

Each application must tell the Google Market what APIs and resources it will use.  If you download “Dancing Bear” and it turns out that it wants to use your address book, you may get suspicious.  I was also told that each application is separate from others unless they are signed with a particular code that enables them to work together. 

If you download separate apps, they cannot secretly work together to create some kind of evil Voltron and wreak havoc.  Google is trying to make sure no one can sneak a malicious application into the marketplace. 

I tested out an installation of an application.  If you tap install, you are given a notification of what resources the application wants to use.  The application I was using was going to change the appearance of parts of the system.  That’s exactly what the notification told me—this will modify system settings and images.  The notification is pretty much in plain English and does not feature any weird “Application will use API Resource Parameter #7867 Alpha” kind of messages.

The rep and I tried to find an application that requested multiple permissions, but we couldn’t find any.  He remembered that the applications on the server for the demo did not have any of the less-baked applications that require permission to play with multiple APIs. 

Sounds like a challenge to me.
Google’s foray into an operating system opens them up to the same challenges that Microsoft and Apple have faced for a long time.  Someone will try to bust your system—even if it is just for fun, someone will try.