We are Steve (cyanogen) Kondik and Koushik (koush) Dutta of the CyanogenMod Project. Ask Us (Almost) Anything!

You guys really need to get your shit together. Every single time you make a post on Google+/your website/twitter I make a comment requesting that you make a build of CM for my toaster, and lo and behold my toaster is still running on stock firmware. I'm very disappointed.

So for the last time, can you guys PLEASE release a CM build for my toaster? I'm not sure what model it is, but it's white and I got it at Savers.

Ship it to me and I'll duct tape a G1 running CM to it :)

How do you plan to monetize CM? Ads, sales of the installer, or something else?

Monetization isn't an immediate concern and our investors and Benchmark and Redpoint feel the same. CyanogenMod has the potential to become an enormous platform play, and to do that, we need to foster and grow the ecosystem. Right now, we just want to build something compelling and grow the user base. Eventually, there are innumerable paths to monetization once we reach economics of scale: licensing our software/services to OEMs, building hardware, creating secure enterprise solutions, etc.

Creating disruption in a multibilion dollar market is enough to make any investor raise their eyebrow.

If you plan on selling hardware units, there is going to be a lot of R&D and massive amounts of bug testing. Will this slow down updates to phones when Google releases a new version of Android? I know when a new version is released, a nightly is usually found for most phones within a few days' time, but for a piece of hardware shipped to thousands of users there must be a lot more put into it.

Right now we only have the capacity for partnerships with well established OEMs. We certainly couldn't take on the monumental task of building/testing hardware. Hardware would be one of many potential very long term paths we could take.

Investors wouldn't give them 7mi without any sort of monetization plan. Great question.

Here is a blog post from Mitch at Benchmark, where he talks about his investment in Cyanogen. http://mitchlasky.biz/cyanogen-mod/

How are you going to manage providing Google services on CyanogenMod going forward? Are you going to certify CyanogenMod with Google?

We're in an interesting spot, because typically GSF is licensed to OEMs, not software vendors (us). But becoming a legitimate business entity and partnering with an OEM are the first steps to licensing GSF. Most of the technical hurdles have already been overcome (passing CTS).

Tom Moss, who is on our board, is the ex-head of Business Developments and Partnerships at Google. He basically drafted all the agreements to license GSF, anti fragmentation clauses, etc. He'll be very helpful as well on this front moving forward.

Will the CM account allow settings (lockscreen, notification bar, etc.) sync in the future ?

If by settings sync you mean between devices, yes, this is really important for our target audience since we're more likely to have multiple devices. I shouldn't have to spend hours configuring a new device, ever.

Have any device makes approached your team about offering CM as stock software on their device? Do you think you will ever release your own device?

We have a least one OEM partnership in the works, there will be an announcement next week regarding our plans there.

Can you give us an ETA on when you'll start giving out ETAs?

Yesterday.

A large amount of people are worried that this new direction will lead in a separation from the Play Store (and other Google Services) - Is this in any way something that current (and future) CM users should be worried about?

No need to worry. We love Google services, and so do our users. Despite sensationalist headlines from earlier today, we feel we are an ally to Google, not a competitor.

Speaking of that, did you get any blowback from Google after your ahem candid Chromecast post?

Nah, they invited me out to lunch, I met up with the team, we shot the sh*it. They tried to hire me. I actually accidentally blurted out that CyanogenMod got funded.

It was a fun visit.

Have you considered directly cooperating with Google to obtain pre-releases of upcoming versions of Android?

We'd love to, but I think we'd need to be an OEM for that to happen.

For someone who is technical but not a developer (I'm a sys ops/admin) how can I contribute to CM or any Android or ROM project?

I was a sysadmin in a former life :) Hack around on the lower layers like the kernel and see what you can come up with.

I'd like to know this too, very recent converted supporter and would love to be able to help to some of the logistics behind the scenes.

The biggest thing that anyone can do to help from a non-technical POV is to write documentation and just spread the word. Installing it on a friend's device is good way to spread the word of course.

How does your one click installer solution deal with locked devices?

What qualifications does Fin have to be the VP of Security?

Should we expect changes to how fast CM pushes out updates?

Currently the installer supports unlockable devices and devices that come unlocked out of the box (ie, most Samsungs via Download Mode).

We're still deciding how to handle locked devices. There's legislation (DMCA clause) in the US that allows the user to bypass copy protection to essentially root their phone. We could do it, it's not hard, but we have to make sure that this won't get us into any hot water later.

The Twitter account Fin@CyanogenMod is not actually Fin, and it's not actually any of us either. I think it's Justin Case trolling as usual :)

The first release of the installer won't support devices that require exploits. The long-term goal is to open up OEMs to the possibility of supporting us officially- there's zero technical reason for these measures and the best way to fix it is to not buy these devices and speak your mind.

We're going to be adopting a much more firm release procedure, and there will be various options on how you'll get your updates depending on your needs.

I saw where Koush posted on Twitter that CyanogenMod is hiring engineers. Are you planning on having internships for the summer of 2014?

Edit: more concise.

Good idea :) The announcement and company page was put together last minute. We'll get better position details up in short order.

With all the news lately surrounding the NSA, spying, privacy, and security, how much focus is CM putting on giving control back to the user? Can I use CM without worrying about back doors or unauthorized leaks of information to "the cloud?"

Once you decide to hand your data over to Facebook or Google, all bets are off. It's a goal for us to help contain that data to your device, if you choose.

We're also working closely with Moxie Marlinspike from Open Whisper Systems on building secure services into the platform. Integrating strong crypto is hard if you want to make it usable- we want it to be transparent.

So if I were to install CM, I have the option of completely leaving google services out of the install?

Yes, CM by default does not ship Google applications or services - users supplement their install with "gapps" packages that add the GSF layer. You can use CM and a FOSS market like FDroid without issues.

What are the Cyanogenmod team's thoughts on other popular third party Android-based ROMs such as Paranoid Android & AOKP? I must admit, as a long time CM user, the recent UI developments in Paranoid Android seem like quite a killer feature. Are there any plans for similar UI changes for CM in the short/long term?

No, we're not adopting Halo. We are however working on quite a few "adaptive" behaviors in the platform, and I think our solution is better. Halo is confusing, has a hundred options, and never does what you expect. It's a great idea, but needs a lot of polish still. PA seems like a pretty competent team though and I hope they keep at it.

In general, we love that our base and device work is the foundation for all these forks. There's so much cool stuff being developed. The best features are born this way.

I feel we're all on the same side here, as we have similar goals. Cyanogen Inc's goal is to get as many people to escape from the market status quo and join us in the new direct to consumer Android ecosystem we're building.

A lot of people I've seen have been concerned about the development of Cyanogen Inc. and the road to corporatism. What can you say to address these concerns? How does the open source CyanogenMod we already know relate to Cyanogen Inc. and the future of the project?

EDIT: And do you plan to fork Android like Amazon did? p.s. please don't

What are the concerns?

close sourcing the CM code I believe

There are no plans to close the source for things such as device support and work done in the community. We do need to build value for the company, and there are various things we are working on that require significant time and capital to develop- these may be proprietary but we won't pervert/close the core OS for this to happen.

Our strength is that we have a strong open source community behind us.

The core of the project (hardware support, community contributions, etc) will always remain open source. But obviously, as a company that has financial needs, employees to pay, Cooper treats to buy, and Cyanogen-babies to feed, we will need to make careful decisions about what we open source, and what may become proprietary.

What is one feature you wish was part of Android and/or Cyanogen that just seems too difficult to implement correctly?

I wouldn't say that anything is too "difficult" to implement. But there are a lot of opportunities at the platform layer to implement interesting features that OEMS/carriers would never do themselves as it may conflict with their own interests. Airplay Mirroring support on a CyanogenMod for example. Or transparent secure/encrypted SMS transport.

What about all the contributors? Do you think it's fair to them that only a selected group are Cyanogenmod the company and stand to make money on the contributions make by many other developers that were not picked to be the core cm team and stand to not get a cent for their contributions, while the core of you does? I'm not trolling just asking legitimate question. I think it's great to see how this project has evolved and I wish you the best of luck with it but at the same time I am a bit concerned about the future.. Will you guys be going more closed source with stuff?

We actively hired and are hiring out of our contributor pool. We're doing the best to reward our past contributors by turning their hobby into a job they love. At current count, we've hired 8 contributors from the project, and plan to hire more.

Thanks for all the great questions and I hope I gave some helpful answers. Ciwrl thinks something is wrong with me because I've been typing so much without saying a word for the last hour :) You guys are awesome.

Hi, CyanogenMod team, long time fan. My question is: with the recent leaks, what can we look forward to regarding Cyanogenmod/general Android security and privacy?

In my mind, the two critical threats are: apps that ask for unneeded permissions & exploits

Incognito mode for apps is a great option to have, to keep apps in check as to what permissions are allowed. Too many developers overstate their requirements. While many Android fans enjoy moding their phones, I must agree with Steve's recent "Death of Root" g+ post. Root compromises your mobile device security, and there are better ways to do certain things that would normally require root. Now, I don't believe in removal of user choice, that's why I'm on Android...Obviously, for those that "need" root, there is ADB, or countless custom ROMs with security features (like setuid/setgid restrictions) removed.

For the Linux side of things, Google is pushing SELinux. My issue here is that it is "only" an access control model. There are alternative options, like grsecurity (with PaX) that actively restrict attack vectors for kernel level exploits. The biggest hurdle I see is grsec is not included upstream, however I have seen other projects like Guardian Rom implement it. Later Android versions do include some ASLR features, but not to the full extent of what PaX provides.

I'm a Linux sysadmin, but I admit I don't know the specifics of the Android model to know how much would break. However, with the growth of the Android system's popularity around the world, it's obviously a desirable platform to attack. I feel that the more security/privacy features, the better...even if that means I could lose the functionality of xyz.

Thanks for all your work on Android! I hope to try out 10.2 on my S4 soon.

I wrote Privacy Guard as an answer to this. There were a bunch of other solutions, but they were done in a way that was either too complicated for an actual human to use or didn't actually perform. It's really important for CM to build features and services with privacy and thoughtfulness on how we use data in mind. We created our "Find My Phone" service with this in mind- a cryptographic exchange between your device and your browser ensures that there is no man in the middle. Current solutions work using a message relay concept, and ultimately give control of your device to the provider of that service. We want to protect you from everyone, including us.

Grsec is pretty awesome, but I believe that are still issues on ARM systems. It's been a little while since I've worked with it. There is definitely a lot of potential for it, but it's not something that's on our roadmap today.

What is CyanogenMod's relationship with AOSP? Is it hard to integrate changes from "upstream" like 4.2, 4.3, etc? Do you keep in contact with official Android developers?

Does the official Android project ever integrate code from CyanogenMod if you fix some bug or add a neat enhancement?

Yes, we frequently push bug fixes up to AOSP. Integrating new versions released by Google is always a fun time though :) The various Jellybean releases have been easy, but some previous releases have been so disruptive that we decided to reevaluate everything we had first. It's usually several months of work before stable releases are ready.

Do you plan on releasing other core apps such as Focal?

Yes, we have a number of new applications in the works. I can't announce anything yet, though :)

Will the AllCast ("AirPlay") functionality become a part of the new Rom going forward ?

I'm working on bringing Chromecast/Airplay mirroring support, as that requires a custom Android build to even be possible. (you can't do this with stock OR root, you must be running custom firmware) The guys from AirParrot actually just sent me secret protocol info that will be super helpful in getting the AirPlay stuff ironed out. I've already posted some videos on it.

Are there plans to continue the support of 'forgotten' devices, or would the new Cyanogen be focused solely on creating an alternate version of Android for future unreleased phones with an OEM partner?

We will support devices until they have crossed the line where too many compromises are made in order to run the latest version. This is usually due to hardware limitations, lack of upstream support, and lack of actual users. We still support the original Galaxy line, but we had to draw the line on some older Qualcomm-based devices because no GPU drivers are available.

The beauty of it all is that the community still supports some of these devices. CM wants everything to pass CTS, and if it can't, then we won't ship it. This might not be an issue for someone else though, and we'll do our best to enable it.

What has Google done wrong with Android and how do you think you can improve it upon with CyanogenMod?

That's a loaded question :)

Google's hands are tied with contractual obligations to various OEMs and carriers. I think we can fill the gap here, as we are not beholden to those constraints.

Do you have any features that were planned for Cyanogenmod but didn't flesh out? If so what were they?

We looked at doing account backup and restore using CM Account (ie, all your Google, Facebook, and whatever accounts come back after logging into CM). That turned out to be much trickier than initially anticipated, so we have shelved it for now. Superuser style permission escalation to request system permissions. The use case on this is powerful, but too small scope.

[deleted]

Yes, a big goal is to release a "mass market" ready version of our work. There is a huge amount of work to do, and we are hiring :)

Arbitrarily paying money to community members is a really complicated thing. I'd rather have them come work for us.

A non-profit is not out of the question, and something we have talked about for a long time. We did quite a bit of work to lay the groundwork for it, but when we started down the venture road we decided to back-burner it until we had a better idea of how it would come together. The ideal situation would be where we had a non-profit to house the huge amount of work done by the community, as well as the for-profit company. We are exploring the options and will choose the route which provides the most benefit.

We currently have not yet implemented any particular business model. The problem is that there are many when you begin to scale up. This may come from hardware, releasing paid applications, service subscriptions and many other options. Today we are going to stay the course we're on and grow our userbase while keeping the various options in mind. There is too much work to do before we can monetize yet.

I can answer some of those, but the rest I've answered elsewhere or are not applicable to our plans (hardware).

Hardware is interesting, but not in the scope of our current funding. We are purely focused on software right now.

We are in the process of setting up a nonprofit to foster the open source side.

Why was forming Cyanogen Inc necessary? What will be different in Cyanogen Mod than before?

What nemith said.

Going full time on the project has notably increased our output, and has enabled all sorts of new opportunities that wouldn't have been possible as a ragtag bunch of hackers.

Hours in the day, and amount of ambition.

There's a huge amount of stuff I want to see happen with CM. Once we started to get big, the amount of time I was spending on it began to consume my life. I brought a little girl into the world last year, and my available time decreased even more.

I can't stress how much I <3 this project. Being able to work on it full time is huge. And it's often difficult to do "big" things as a community because you can't ask people to really commit to certain things on a schedule. It just kind of happens naturally. This is great, and it's how a lot of awesome stuff happens, but mobile is moving too fast and I want CM to be a real player.

What's Cooper Bubbles' (Chief Entertainment Officer) compensation?

I'm not at liberty to discuss employee salaries. Let's just say he's put on a few pounds since joining the team.

What are 10 of your favorite lines of source code?

The ones that worked when they shouldn't have.

What is your "game plan" with Google Apps moving forward? As most people know they are currently a separate install but you mentioned you are trying to simplify the installation process. Have you been in talks with Google about getting whatever certification is needed to bundle GApps?

We want to improve our relationship with Google, for sure. We're still a bit outside their model, but I believe that what we are doing is still in their best interests.

One of our advisors and board members is Tom Moss, who led the development of the Android partner program for Google under Andy. His insight has been incredibly valuable.