3 ms·

CyanogenMod's priority is not security; it prioritizes things like stability, compatibility, non-technical end-user experience, and relationships with developer

CyanogenMod's priority is not security; it prioritizes things like stability, compatibility, non-technical end-user experience, and relationships with developers. For example:[1] Rule #1 of CM is "Don't break apps". We recognize that there are nefarious apps out there, and many of our users would actually understand how to use permission controls (and the implications of using them). With our huge userbase, we have a responsibility to ensure that applications aren't running in a hostile environment, and work as designed. We are all privacy advocates at CM, but I am not willing to compromise our good relationship with application developers in order to implement features like this. Much more here: https://plus.google.com/+SteveKondik/posts/iLrvqH8tbce https://plus.google.com/+SteveKondik/posts/iLrvqH8tbce [1] See Kondik's 29 May 2013 message in https://jira.cyanogenmod.org/browse/CYAN-28?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel https://jira.cyanogenmod.org/browse/CYAN-28?page=com.atlassi...

gsnedders 10y ago
And unlike Debian[1], RedHat[2], OpenSUSE[3], FreeBSD[4] they don't even have a documented list of security advisories and what update fixed them—and given the haphazard nature of CyanogenMod stable builds (including some devices receiving none for months when there are high profile security issues, yet no statement anywhere that those devices have any less security support than any other), I have little faith in the security processes of CyanogenMod. And that's before you even start to touch on the privacy aspects which his post is mostly about, as far as I can tell! [1] https://www.debian.org/security/ https://www.debian.org/security/ [2] https://access.redhat.com/security/security-updates/#/security-advisories https://access.redhat.com/security/security-updates/#/securi... [3] https://www.suse.com/support/update/ https://www.suse.com/support/update/ [4] https://www.freebsd.org/security/advisories.html https://www.freebsd.org/security/advisories.html

gsnedders 10y ago

And unlike Debian[1], RedHat[2], OpenSUSE[3], FreeBSD[4] they don't even have a documented list of security advisories and what update fixed them—and given the haphazard nature of CyanogenMod stable builds (including some devices receiving none for months when there are high profile security issues, yet no statement anywhere that those devices have any less security support than any other), I have little faith in the security processes of CyanogenMod. And that's before you even start to touch on the privacy aspects which his post is mostly about, as far as I can tell! [1] https://www.debian.org/security/ https://www.debian.org/security/ [2] https://access.redhat.com/security/security-updates/#/security-advisories https://access.redhat.com/security/security-updates/#/securi... [3] https://www.suse.com/support/update/ https://www.suse.com/support/update/ [4] https://www.freebsd.org/security/advisories.html https://www.freebsd.org/security/advisories.html