a question about security

[blind-confused]

hi, I had a question... please excuse me if it's a stupid question...
I'm a casual user that doesn't know how to code, or how software really works, that's why I had this question, I guess.

so... since the original OpenBoard seems to have been discontinued, and hasn't been receiving any updates (including security updates) since long ago... wouldn't that mean that it also applies to this keyboard (since it's a fork of OpenBoard)? Should anyone be concerned about this keyboard inheriting the lack of security updates from OpenBoard?

[Helium314]

I don't really understand which kind of security updates you are expecting from this app.
As far as I know there haven't been any security issues reported with OpenBoard.

[blind-confused]

well... I'm not expecting anything special. I just assumed that every app has it's own security updates and patches, because I watched videos from security experts, where they recommended always updating all your apps and system as soon as it's available, just for the security aspect of it.

so, naturally, I assumed that any outdated or discontinued software is a security risk. And if this keyboard is built on top of a discontinued one... I was just worried that it would have the same problems.
(I'm not trying to accuse or blame in anything, I'm sorry if my words sounded that way. I just have some concerns, which I'm not sure whether I should have those concerns at all)

I know a person that said:

"Every DDoS attack I analyze at work is coming from tens and thousands of devices all over the globe running Android 4-8, Windows XP to 8.1, Linux Kernels from the 2.X era up to the 5.X era and even Mac and iOS devices running years old operating systems. Per attacking device, those packets are so lightweight that they are not really visible in traffic or even battery usage (one would need to closely look into all connections that are made by the device to see them), but all devices together form a botnet and cause serious damage."

I'm really not sure whether any of this should be applied to a keyboard app though. All I know is that OpenBoard looks discontinued. And well... it was based on the AOSP keyboard, which GBoard is based on as well (right?), so... perhaps malware that affects GBoard (which is far more popular, and could more likely be a target for malware) can affect OpenBoard and it's derivatives as well?.. I don't know...

I'm sorry, I'm really not sure whether my worries are something realistic, or more of overthinking :"D

[Pietro395]

@Helium314 I think @blind-confused means whether the project dependencies are updated regularly to avoid any vulnerabilities, and I do believe that is the case

[Helium314]

I just assumed that every app has it's own security updates and patches

I'm not sure about that, for most apps the security is typically tied to the system. When the Android system is already compomised, I would expect most apps to be easily compromised too.

I don't think there is malware that would specifically affect the keyboard only. The keyboard does not make any network connections and does not react to intents in potentially dangerous ways (might change if tasker support is added, but that will be opt-in).

[blind-confused]

@Helium314 I think @blind-confused means whether the project dependencies are updated regularly to avoid any vulnerabilities, and I do believe that is the case

@Pietro395 apart from that, I was also wondering whether this new OpenBoard is like a layer placed on top of the old OpenBoard, and with each new release, only that top layer would be updated, while the underlying base stays the same;
OR whether the entire code (including the code from old OpenBoard) is being updated and changed, not just the top layer.
(don't know if my understanding of code is even correct :"D)

I don't think there is malware that would specifically affect the keyboard only.

@Helium314 I didn't think that way either, I just thought that any app (including a keyboard) could be what security community refers to as "attack surface" (I guess it's like a point where malware enters the system from). I remember hearing advice that "all unused apps should be removed to minimize the attack surface of your device" and things like that.

The keyboard does not make any network connections and does not react to intents in potentially dangerous ways (might change if tasker support is added, but that will be opt-in).

that's really good to know, thank you for making it opt-in