6 ms·

I have a better idea, how about we just kill ChromeOS and call it an Android device.

by smrtinsert 10y ago

msh 10y ago
And replace one of the most secure operating systems with one of the most insecure... :(
- Crito 10y ago
  Okay, do it the other way around then. Or, at least make the two compliment each other, like iOS and OSX. As it is, the two products seem like they are competing for resources at Google. Maybe that's because they are, I don't know. But from a consumer perspective it is a wasted opportunity.
- bitmapbrother 10y ago
  And yet the number of CVE's raised against Android is far below that of iOS or Windows.
  - skrowl 10y ago
    The fact that you're being downvoted just shows how many Apple zealots unwilling to accept Apple recent (last few years) across-the-board failings in software security there are still here at HN. Your reply is factually correct and rather than attempt to rebut it in any way, they just downvote you.
  - dsp1234 10y ago
    This isn't a good metric unfortunately. A much more realistic metric is % of devices with unpatched CVEs. With iOS updates and Windows updates, most devices get their vulnerabilities patched (assuming the vendor addresses it at all), unless specific action is taken not to update them. However, most android devices are not updated past a few minor Android versions, and once the carrier no longer provides patches, there is often no way for a normal user to patch the OS at all. So Windows could theoretically have 100x the number of vulnerabilities over time, but if they are fixed and autopatched, then those systems can still be more secure than a system that doesn't get patches past the first year.
    - magicalist 10y ago
      This seems irrelevant because if ChromeOS machines became Android ones, Google would still control the updates and so they be like Nexus devices and would always get updates.
      - tauntz 10y ago
        Nexus devices are getting updates for just around 2 years. All the older devices (including my dear Galaxy Nexus) are left behind. Imagine if your newly bought windows 10 PC would get security updates for only 2 years
  - smhg 10y ago
    A quick search indeed seems to agree with the statement the number of CVE's raised against Android is below that of iOS. Numbers from cvedetails.com: Android 245, iOS 857 I guess it is not a direct proof something is more insecure? There are other factors that push the numbers up or down. Project popularity, the type of CVE,... And projects depend on each-other too (Linux kernel -> Chrome OS and Android). Am I missing anything? Can any of the downvoters please elaborate?
  - millstone 10y ago
    How did you determine this? Comparing the list at CVEDetails.com [1] [2] would seem to support this at first blush, but this is because the iOS list contains Safari and WebKit vulnerabilities, while the Android one does not include Chrome, Blink, or WebBrowser/WebKit vulnerabilities. If you include Chrome [3] they look to be about even. [1] http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224 http://www.cvedetails.com/product/19997/Google-Android.html?... [2] http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html?vendor_id=49 http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html... [3] http://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 http://www.cvedetails.com/product/15031/Google-Chrome.html?v...
- geofft 10y ago
  Are Android apps running on Chrome OS actually going to be more secure, or does the platform inherently require things that are hard to secure? (And, conversely, if it doesn't require that, what prevents Google from adding CrOS-style isolation to Android?)
  - ultramancool 10y ago
    Android already has superior isolation to Chrome OS. The permission system is much more broad and flexible than that offered by browsers and in 6.0 it gives even more direct control.
  - hawski 10y ago
    AFAIK Android Runtime for Chrome is running on NaCl meaning it's properly isolated.
    - geofft 10y ago
      Right, if you can do that, why not stick NaCl + Android Runtime for Chrome on everyone's cell phone? NaCl is designed to be very low-overhead, and low-end Chromebooks are probably as underpowered as low-end phones. NaCl is a very good isolation layer, but it's certainly possible that to make Android apps work / interoperate the way you'd expect (e.g., one app can broadcast an intent that another app can receive), you have to open up holes that are too big to secure. It's sort of like how the CPU-level distinction between kernel-mode and user-mode code is a very good isolation layer, but when you run actual operating systems that need their processes to communicate, it gets much harder to secure.
      - mikecb 10y ago
        I personally imagine that when all that hype came out recently about merging chrome and android, that's what they're trying to do. Security of chrome and usability of android would be perfect, and hopefully also allow underlying OS pushes independent of manufacturer or carrier.
  - mtgx 10y ago
plexicle 10y ago
Why? ChromeOS is so much better. This is coming from an ardent Android user. Just curious why you would want to see Android instead? ChromeOS has potential to become a productive platform. I don't really see Android ever becoming that. They are two different beasts.
- smrtinsert 10y ago
  Nothing about the ecosystem attracts me. What is the value proposition again?
  - amerkhalid 10y ago
    Simple, elegant, fast, secure, and cheap laptop.
    - stephenr 10y ago
      Completely hogtied and forced to use nothing but "apps" running in chrome?
      - golfer 10y ago
        Many people use browsers for the vast majority of their computing tasks (email, facebook, word processing, etc). Chrome handles this easily without the burden of general OS maintenance.
      - soared 10y ago
        You mean like your iPhone which is "hogtied" to "apps" only running in iOS?
        stephenr 10y ago
        An iPhone is not billed as a replacement for a laptop (which ChromeOS devices most definitely are). Also, they can run the vast majority of web apps in addition to native iOS apps. iPhone development shares first party language support (albeit with some different frameworks) with a major desktop OS, and has third party support for a number of other languages.

I have a better idea, how about we just kill ChromeOS and call it an Android device.

msh 10y ago

And replace one of the most secure operating systems with one of the most insecure... :(

Crito 10y ago
Okay, do it the other way around then. Or, at least make the two compliment each other, like iOS and OSX. As it is, the two products seem like they are competing for resources at Google. Maybe that's because they are, I don't know. But from a consumer perspective it is a wasted opportunity.
bitmapbrother 10y ago
And yet the number of CVE's raised against Android is far below that of iOS or Windows.
- skrowl 10y ago
  The fact that you're being downvoted just shows how many Apple zealots unwilling to accept Apple recent (last few years) across-the-board failings in software security there are still here at HN. Your reply is factually correct and rather than attempt to rebut it in any way, they just downvote you.
- dsp1234 10y ago
  This isn't a good metric unfortunately. A much more realistic metric is % of devices with unpatched CVEs. With iOS updates and Windows updates, most devices get their vulnerabilities patched (assuming the vendor addresses it at all), unless specific action is taken not to update them. However, most android devices are not updated past a few minor Android versions, and once the carrier no longer provides patches, there is often no way for a normal user to patch the OS at all. So Windows could theoretically have 100x the number of vulnerabilities over time, but if they are fixed and autopatched, then those systems can still be more secure than a system that doesn't get patches past the first year.
  - magicalist 10y ago
    This seems irrelevant because if ChromeOS machines became Android ones, Google would still control the updates and so they be like Nexus devices and would always get updates.
    - tauntz 10y ago
      Nexus devices are getting updates for just around 2 years. All the older devices (including my dear Galaxy Nexus) are left behind. Imagine if your newly bought windows 10 PC would get security updates for only 2 years
- smhg 10y ago
  A quick search indeed seems to agree with the statement the number of CVE's raised against Android is below that of iOS. Numbers from cvedetails.com: Android 245, iOS 857 I guess it is not a direct proof something is more insecure? There are other factors that push the numbers up or down. Project popularity, the type of CVE,... And projects depend on each-other too (Linux kernel -> Chrome OS and Android). Am I missing anything? Can any of the downvoters please elaborate?
- millstone 10y ago
  How did you determine this? Comparing the list at CVEDetails.com [1] [2] would seem to support this at first blush, but this is because the iOS list contains Safari and WebKit vulnerabilities, while the Android one does not include Chrome, Blink, or WebBrowser/WebKit vulnerabilities. If you include Chrome [3] they look to be about even. [1] http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224 http://www.cvedetails.com/product/19997/Google-Android.html?... [2] http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html?vendor_id=49 http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html... [3] http://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 http://www.cvedetails.com/product/15031/Google-Chrome.html?v...
geofft 10y ago
Are Android apps running on Chrome OS actually going to be more secure, or does the platform inherently require things that are hard to secure? (And, conversely, if it doesn't require that, what prevents Google from adding CrOS-style isolation to Android?)
- ultramancool 10y ago
  Android already has superior isolation to Chrome OS. The permission system is much more broad and flexible than that offered by browsers and in 6.0 it gives even more direct control.
- hawski 10y ago
  AFAIK Android Runtime for Chrome is running on NaCl meaning it's properly isolated.
  - geofft 10y ago
    Right, if you can do that, why not stick NaCl + Android Runtime for Chrome on everyone's cell phone? NaCl is designed to be very low-overhead, and low-end Chromebooks are probably as underpowered as low-end phones. NaCl is a very good isolation layer, but it's certainly possible that to make Android apps work / interoperate the way you'd expect (e.g., one app can broadcast an intent that another app can receive), you have to open up holes that are too big to secure. It's sort of like how the CPU-level distinction between kernel-mode and user-mode code is a very good isolation layer, but when you run actual operating systems that need their processes to communicate, it gets much harder to secure.
    - mikecb 10y ago
      I personally imagine that when all that hype came out recently about merging chrome and android, that's what they're trying to do. Security of chrome and usability of android would be perfect, and hopefully also allow underlying OS pushes independent of manufacturer or carrier.
- mtgx 10y ago

plexicle 10y ago

Why? ChromeOS is so much better. This is coming from an ardent Android user. Just curious why you would want to see Android instead? ChromeOS has potential to become a productive platform. I don't really see Android ever becoming that. They are two different beasts.

smrtinsert 10y ago
Nothing about the ecosystem attracts me. What is the value proposition again?
- amerkhalid 10y ago
  Simple, elegant, fast, secure, and cheap laptop.
  - stephenr 10y ago
    Completely hogtied and forced to use nothing but "apps" running in chrome?
    - golfer 10y ago
      Many people use browsers for the vast majority of their computing tasks (email, facebook, word processing, etc). Chrome handles this easily without the burden of general OS maintenance.
    - soared 10y ago
      You mean like your iPhone which is "hogtied" to "apps" only running in iOS?
      - stephenr 10y ago
        An iPhone is not billed as a replacement for a laptop (which ChromeOS devices most definitely are). Also, they can run the vast majority of web apps in addition to native iOS apps. iPhone development shares first party language support (albeit with some different frameworks) with a major desktop OS, and has third party support for a number of other languages.