The problems which were pointed out are good ones, and they should be fixed. Fortunately, they are easy to fix.<p>In the grand scheme of things, though, this isn't as bad as it seems, since the vast majority of Android applications run in the Dalvik JVM. Hence the amount of code that is subject to weaknesses that could be exploited by the attacker to cause a jump into the non-randomized dynamic loader (for example) are much smaller.<p>Of course, there could still be bugs in native code applications, libraries, and system executables, so the ALSR should definitely be improved. Again, fortunately, this should be relatively easy to do.