5 ms·

What an ignorant comment. To call Android the "worst currently-shipping security product" is representative of your knowledge on the matter.

rdl 11y ago
Within the space of general purpose desktop/mobile operating system products: Windows 10 (pretty good). OS X (not great -- which is a shame). Most Linux distributions (OK to good as shipped, can be great). Most BSD distributions (good to great). iOS (fucking AMAZING). ChromeOS (great, RIP). Windows Phone (honestly don't know much about it). BB OS 10/QNX (great, but irrelevant sadly). And then there's Android.
- bitmapbrother 11y ago
  This is pretty funny considering Windows is the cause for nearly all of the security exploits that occur. The horror stories of people being infected with viruses, malware and ransomware all have one thing in common - Windows. You only need to look at the thousands of security patches this OS has had applied to it over the years and the new ones applied every month to truly grasp what a sieve it really is. BTW, where are all of the horror stories concerning the Stagefright exploit that so many "pundits/idiots" predicted would be a disaster for Android? I'm still waiting for that. Also, was there a reason you started referring to specific versions of OS's like Windows 10 and BB OS 10 and then disrespectfully mentioned Android without a version number? Don't you think that was a bit disingenuous, and lame, of you to start mentioning specific OS versions and leave out Android? If you're going to use version numbers then shouldn't you have applied them to all of the OS's you mentioned instead of cherry picking OS versions and then shitting out the line "And then there's Android" at the end?
  - rdl 11y ago
    OK -- Android (until absolute latest) = lovecraftian horror. Android marshmallow = exceptionally bad. BB10 is a fundamentally different OS (QNX based) than pre-BB10. but Pre-10 was also a good OS from a security perspective, just utter shit to develop meaningful third party apps for. Windows...used to be horrible. Big changes around Vista (although, ~unusable). Since Windows 7, it's been "reasonable" in a highly managed corporate environment, and not bad even out of the box. 8, 8.1, and 10 have been improvements on that. It's actually easier to do a 10k user highly locked down Windows deployment (although expensive, and involving a lot of experts and third-party tools) than to do a 10k user locked down Mac OS X deployment. Apple had a lot of advantages by starting from UNIX and from basically starting after security was a "thing", but hasn't done as good a job on OS X security as I'd like. iOS, on the other hand, is amazing -- the only serious deficiencies I find with iOS are a lack of "enterprise as sole root of trust" (which no one does, with the possible exception of (Blackberry Pre-10 and post-10), or roll-your-own open source linux/bsd with a lot of trusted computing grafted on in ways which are not at all trivial to do), and a lack of emphasis on anti-forensics on the device itself -- if you unlock it, it contains an sqllite db with ~every message, which shouldn't be how they do it. OTOH, on cloud services, Google is far and away superior to Apple. The biggest problem with Apple is you're largely pushed toward iCloud which is not amazing from a security perspective. The true win of ChromeOS was you were equally pushed to the Google ecosystem, which is amazing for cloud service security -- the sole problem being you're 100% exposed to Google, Inc. which is both a US company and a single third-party entity, but if you had to pick a single company to be responsible for your cloud services security, you'd probably pick Google on the merits.
    - voltagex_ 11y ago
      Why is Android 6.0 exceptionally horrible? I found one bug in a Play Services API that can crash Play Services remotely, but I can't get code execution so Google aren't interested.
    - bitmapbrother 11y ago
      Could you explain why you think Android Marshmallow is "exceptionally bad"? Because I'd really like to know why you think it is. Android gets a bad rap for malware, but it's really a lie perpetuated by people who dislike the platform because they're jealous of its popularity. And even when malware laden apps are sideloaded by people from questionable sites the effects are often minor due to the mitigation strategies employed by Android. Like I said before - where is this pandemic of Android infected phones wreaking havoc? Where are all of the stagefright exploit stories? There's virtually none. Additionally, Android patches are distributed pretty fast by Google to their phones. It's unfortunate that the OEM's and carriers delay the process for their phones, but Google has no current control over this.
      - andreyf 11y ago
        Your explanation that Ryan is jealous of Android's popularity doesn't make sense to me. This is a guy that has been working in security for some time, on both ends of the public / private infosec space [1]. Why would he be jealous of Android, but not ChromeOS? Someone else expounded earlier: "On Android, questionable apps have direct access to the entire kernel system call interface, as well as to other OS features. Personally, I'm not so much upset because Android is uncommonly bad (it's like any other system that gives untrusted users non-root access to Linux: you can probably get away with it, but eh), but because CrOS is uncommonly good." I don't think it's reasonable to ask for pointers on how to root an Android device in a public forum, and the size of the attack surface seems to me like a rather reasonable measure of a system's security. 1. https://en.wikipedia.org/wiki/Ryan_Lackey https://en.wikipedia.org/wiki/Ryan_Lackey
        ocean3 11y ago
        A explanation would be better. What is CrOS? edit: got it ChromeOS
- ocean3 11y ago
  Care to explain the reasons? Doesn't windows 10 phone home? The window xp/7 i used previously would inevitability get affected by viruses. I am using Android for last 4 years have not have single virus or even malware problem.
castis 11y ago
rdl works on security at CloudFlare. What do you do?
- bitmapbrother 11y ago
  I'm a developer at one of the world's biggest computer companies. And you?
- scintill76 11y ago
  OK, this is one of those times where infosec people get annoyingly close to "appealing to authority." So far 'rdl has said Android is "the worst currently-shipping security product", "[Blah blah blah], and then there's Android", "Android (until absolute latest) = lovecraftian horror" but the latest is upgraded to "exceptionally bad", and a deeply-nested subcomment about running every task on a separate machine (which I'm sure ChromeOS does... /s) But who needs to hear logical arguments? When the guy from CloudFlare speaks, the thinking is done! Alright, as something of an Android fanboy it pains me to admit, he probably has a point in this case. But it'd be nice to hear about what specifically is wrong, especially since it would seem there's a fair bit right, like SELinux, automatic encryption, ASLR. The worst thing in my view, is the permissions system, which is probably salvageable (and as I understand it, was improved in Marshmallow.) 'rdl has given more details about pretty much every imaginable system but Android -- are we supposed to just assume Android does every bad thing he mentioned, and the opposite of every good thing? Edit: I could almost let this slide since the particular counter-comment was equally vacuous. It's still annoying to see "security guy from $BIG_CO => GTFO" (who is apparently smarter than all the security people at Google who've worked on Android, but we just have to take your word for it since you didn't elaborate.)
  - chetanahuja 11y ago
    OK, this is one of those times where infosec people get annoyingly close to "appealing to authority." This. It's not just "close to" appealing to authority, it's straight up appealing to authority. And yes, it's a common practice in the infosec community. The whole security industry is built on a reputation system. It pays to remember that the number of exploits and vulnerabilities etc. in commonly used software that are reported on practically a daily basis came out of the same reputation based system.

rdl 11y ago

Within the space of general purpose desktop/mobile operating system products: Windows 10 (pretty good). OS X (not great -- which is a shame). Most Linux distributions (OK to good as shipped, can be great). Most BSD distributions (good to great). iOS (fucking AMAZING). ChromeOS (great, RIP). Windows Phone (honestly don't know much about it). BB OS 10/QNX (great, but irrelevant sadly). And then there's Android.

bitmapbrother 11y ago
This is pretty funny considering Windows is the cause for nearly all of the security exploits that occur. The horror stories of people being infected with viruses, malware and ransomware all have one thing in common - Windows. You only need to look at the thousands of security patches this OS has had applied to it over the years and the new ones applied every month to truly grasp what a sieve it really is. BTW, where are all of the horror stories concerning the Stagefright exploit that so many "pundits/idiots" predicted would be a disaster for Android? I'm still waiting for that. Also, was there a reason you started referring to specific versions of OS's like Windows 10 and BB OS 10 and then disrespectfully mentioned Android without a version number? Don't you think that was a bit disingenuous, and lame, of you to start mentioning specific OS versions and leave out Android? If you're going to use version numbers then shouldn't you have applied them to all of the OS's you mentioned instead of cherry picking OS versions and then shitting out the line "And then there's Android" at the end?
- rdl 11y ago
  OK -- Android (until absolute latest) = lovecraftian horror. Android marshmallow = exceptionally bad. BB10 is a fundamentally different OS (QNX based) than pre-BB10. but Pre-10 was also a good OS from a security perspective, just utter shit to develop meaningful third party apps for. Windows...used to be horrible. Big changes around Vista (although, ~unusable). Since Windows 7, it's been "reasonable" in a highly managed corporate environment, and not bad even out of the box. 8, 8.1, and 10 have been improvements on that. It's actually easier to do a 10k user highly locked down Windows deployment (although expensive, and involving a lot of experts and third-party tools) than to do a 10k user locked down Mac OS X deployment. Apple had a lot of advantages by starting from UNIX and from basically starting after security was a "thing", but hasn't done as good a job on OS X security as I'd like. iOS, on the other hand, is amazing -- the only serious deficiencies I find with iOS are a lack of "enterprise as sole root of trust" (which no one does, with the possible exception of (Blackberry Pre-10 and post-10), or roll-your-own open source linux/bsd with a lot of trusted computing grafted on in ways which are not at all trivial to do), and a lack of emphasis on anti-forensics on the device itself -- if you unlock it, it contains an sqllite db with ~every message, which shouldn't be how they do it. OTOH, on cloud services, Google is far and away superior to Apple. The biggest problem with Apple is you're largely pushed toward iCloud which is not amazing from a security perspective. The true win of ChromeOS was you were equally pushed to the Google ecosystem, which is amazing for cloud service security -- the sole problem being you're 100% exposed to Google, Inc. which is both a US company and a single third-party entity, but if you had to pick a single company to be responsible for your cloud services security, you'd probably pick Google on the merits.
  - voltagex_ 11y ago
    Why is Android 6.0 exceptionally horrible? I found one bug in a Play Services API that can crash Play Services remotely, but I can't get code execution so Google aren't interested.
  - bitmapbrother 11y ago
    Could you explain why you think Android Marshmallow is "exceptionally bad"? Because I'd really like to know why you think it is. Android gets a bad rap for malware, but it's really a lie perpetuated by people who dislike the platform because they're jealous of its popularity. And even when malware laden apps are sideloaded by people from questionable sites the effects are often minor due to the mitigation strategies employed by Android. Like I said before - where is this pandemic of Android infected phones wreaking havoc? Where are all of the stagefright exploit stories? There's virtually none. Additionally, Android patches are distributed pretty fast by Google to their phones. It's unfortunate that the OEM's and carriers delay the process for their phones, but Google has no current control over this.
    - andreyf 11y ago
      Your explanation that Ryan is jealous of Android's popularity doesn't make sense to me. This is a guy that has been working in security for some time, on both ends of the public / private infosec space [1]. Why would he be jealous of Android, but not ChromeOS? Someone else expounded earlier: "On Android, questionable apps have direct access to the entire kernel system call interface, as well as to other OS features. Personally, I'm not so much upset because Android is uncommonly bad (it's like any other system that gives untrusted users non-root access to Linux: you can probably get away with it, but eh), but because CrOS is uncommonly good." I don't think it's reasonable to ask for pointers on how to root an Android device in a public forum, and the size of the attack surface seems to me like a rather reasonable measure of a system's security. 1. https://en.wikipedia.org/wiki/Ryan_Lackey https://en.wikipedia.org/wiki/Ryan_Lackey
      - ocean3 11y ago
        A explanation would be better. What is CrOS? edit: got it ChromeOS
ocean3 11y ago
Care to explain the reasons? Doesn't windows 10 phone home? The window xp/7 i used previously would inevitability get affected by viruses. I am using Android for last 4 years have not have single virus or even malware problem.

castis 11y ago

rdl works on security at CloudFlare. What do you do?

bitmapbrother 11y ago
I'm a developer at one of the world's biggest computer companies. And you?
scintill76 11y ago
OK, this is one of those times where infosec people get annoyingly close to "appealing to authority." So far 'rdl has said Android is "the worst currently-shipping security product", "[Blah blah blah], and then there's Android", "Android (until absolute latest) = lovecraftian horror" but the latest is upgraded to "exceptionally bad", and a deeply-nested subcomment about running every task on a separate machine (which I'm sure ChromeOS does... /s) But who needs to hear logical arguments? When the guy from CloudFlare speaks, the thinking is done! Alright, as something of an Android fanboy it pains me to admit, he probably has a point in this case. But it'd be nice to hear about what specifically is wrong, especially since it would seem there's a fair bit right, like SELinux, automatic encryption, ASLR. The worst thing in my view, is the permissions system, which is probably salvageable (and as I understand it, was improved in Marshmallow.) 'rdl has given more details about pretty much every imaginable system but Android -- are we supposed to just assume Android does every bad thing he mentioned, and the opposite of every good thing? Edit: I could almost let this slide since the particular counter-comment was equally vacuous. It's still annoying to see "security guy from $BIG_CO => GTFO" (who is apparently smarter than all the security people at Google who've worked on Android, but we just have to take your word for it since you didn't elaborate.)
- chetanahuja 11y ago
  OK, this is one of those times where infosec people get annoyingly close to "appealing to authority." This. It's not just "close to" appealing to authority, it's straight up appealing to authority. And yes, it's a common practice in the infosec community. The whole security industry is built on a reputation system. It pays to remember that the number of exploits and vulnerabilities etc. in commonly used software that are reported on practically a daily basis came out of the same reputation based system.