5 ms·

And replace one of the most secure operating systems with one of the most insecure... :(

by msh 11y ago

Crito 11y ago
Okay, do it the other way around then. Or, at least make the two compliment each other, like iOS and OSX. As it is, the two products seem like they are competing for resources at Google. Maybe that's because they are, I don't know. But from a consumer perspective it is a wasted opportunity.
bitmapbrother 11y ago
And yet the number of CVE's raised against Android is far below that of iOS or Windows.
- skrowl 11y ago
  The fact that you're being downvoted just shows how many Apple zealots unwilling to accept Apple recent (last few years) across-the-board failings in software security there are still here at HN. Your reply is factually correct and rather than attempt to rebut it in any way, they just downvote you.
- dsp1234 11y ago
  This isn't a good metric unfortunately. A much more realistic metric is % of devices with unpatched CVEs. With iOS updates and Windows updates, most devices get their vulnerabilities patched (assuming the vendor addresses it at all), unless specific action is taken not to update them. However, most android devices are not updated past a few minor Android versions, and once the carrier no longer provides patches, there is often no way for a normal user to patch the OS at all. So Windows could theoretically have 100x the number of vulnerabilities over time, but if they are fixed and autopatched, then those systems can still be more secure than a system that doesn't get patches past the first year.
  - magicalist 11y ago
    This seems irrelevant because if ChromeOS machines became Android ones, Google would still control the updates and so they be like Nexus devices and would always get updates.
    - tauntz 11y ago
      Nexus devices are getting updates for just around 2 years. All the older devices (including my dear Galaxy Nexus) are left behind. Imagine if your newly bought windows 10 PC would get security updates for only 2 years
- smhg 11y ago
  A quick search indeed seems to agree with the statement the number of CVE's raised against Android is below that of iOS. Numbers from cvedetails.com: Android 245, iOS 857 I guess it is not a direct proof something is more insecure? There are other factors that push the numbers up or down. Project popularity, the type of CVE,... And projects depend on each-other too (Linux kernel -> Chrome OS and Android). Am I missing anything? Can any of the downvoters please elaborate?
- millstone 11y ago
  How did you determine this? Comparing the list at CVEDetails.com [1] [2] would seem to support this at first blush, but this is because the iOS list contains Safari and WebKit vulnerabilities, while the Android one does not include Chrome, Blink, or WebBrowser/WebKit vulnerabilities. If you include Chrome [3] they look to be about even. [1] http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224 http://www.cvedetails.com/product/19997/Google-Android.html?... [2] http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html?vendor_id=49 http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html... [3] http://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 http://www.cvedetails.com/product/15031/Google-Chrome.html?v...
geofft 11y ago
Are Android apps running on Chrome OS actually going to be more secure, or does the platform inherently require things that are hard to secure? (And, conversely, if it doesn't require that, what prevents Google from adding CrOS-style isolation to Android?)
- ultramancool 11y ago
  Android already has superior isolation to Chrome OS. The permission system is much more broad and flexible than that offered by browsers and in 6.0 it gives even more direct control.
- hawski 11y ago
  AFAIK Android Runtime for Chrome is running on NaCl meaning it's properly isolated.
  - geofft 11y ago
    Right, if you can do that, why not stick NaCl + Android Runtime for Chrome on everyone's cell phone? NaCl is designed to be very low-overhead, and low-end Chromebooks are probably as underpowered as low-end phones. NaCl is a very good isolation layer, but it's certainly possible that to make Android apps work / interoperate the way you'd expect (e.g., one app can broadcast an intent that another app can receive), you have to open up holes that are too big to secure. It's sort of like how the CPU-level distinction between kernel-mode and user-mode code is a very good isolation layer, but when you run actual operating systems that need their processes to communicate, it gets much harder to secure.
    - mikecb 11y ago
      I personally imagine that when all that hype came out recently about merging chrome and android, that's what they're trying to do. Security of chrome and usability of android would be perfect, and hopefully also allow underlying OS pushes independent of manufacturer or carrier.
- mtgx 11y ago

And replace one of the most secure operating systems with one of the most insecure... :(

by msh 11y ago

And replace one of the most secure operating systems with one of the most insecure... :(

Crito 11y ago

Okay, do it the other way around then. Or, at least make the two compliment each other, like iOS and OSX. As it is, the two products seem like they are competing for resources at Google. Maybe that's because they are, I don't know. But from a consumer perspective it is a wasted opportunity.

bitmapbrother 11y ago

And yet the number of CVE's raised against Android is far below that of iOS or Windows.

skrowl 11y ago
The fact that you're being downvoted just shows how many Apple zealots unwilling to accept Apple recent (last few years) across-the-board failings in software security there are still here at HN. Your reply is factually correct and rather than attempt to rebut it in any way, they just downvote you.
dsp1234 11y ago
This isn't a good metric unfortunately. A much more realistic metric is % of devices with unpatched CVEs. With iOS updates and Windows updates, most devices get their vulnerabilities patched (assuming the vendor addresses it at all), unless specific action is taken not to update them. However, most android devices are not updated past a few minor Android versions, and once the carrier no longer provides patches, there is often no way for a normal user to patch the OS at all. So Windows could theoretically have 100x the number of vulnerabilities over time, but if they are fixed and autopatched, then those systems can still be more secure than a system that doesn't get patches past the first year.
- magicalist 11y ago
  This seems irrelevant because if ChromeOS machines became Android ones, Google would still control the updates and so they be like Nexus devices and would always get updates.
  - tauntz 11y ago
    Nexus devices are getting updates for just around 2 years. All the older devices (including my dear Galaxy Nexus) are left behind. Imagine if your newly bought windows 10 PC would get security updates for only 2 years
smhg 11y ago
A quick search indeed seems to agree with the statement the number of CVE's raised against Android is below that of iOS. Numbers from cvedetails.com: Android 245, iOS 857 I guess it is not a direct proof something is more insecure? There are other factors that push the numbers up or down. Project popularity, the type of CVE,... And projects depend on each-other too (Linux kernel -> Chrome OS and Android). Am I missing anything? Can any of the downvoters please elaborate?
millstone 11y ago
How did you determine this? Comparing the list at CVEDetails.com [1] [2] would seem to support this at first blush, but this is because the iOS list contains Safari and WebKit vulnerabilities, while the Android one does not include Chrome, Blink, or WebBrowser/WebKit vulnerabilities. If you include Chrome [3] they look to be about even. [1] http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224 http://www.cvedetails.com/product/19997/Google-Android.html?... [2] http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html?vendor_id=49 http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html... [3] http://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 http://www.cvedetails.com/product/15031/Google-Chrome.html?v...

geofft 11y ago

Are Android apps running on Chrome OS actually going to be more secure, or does the platform inherently require things that are hard to secure? (And, conversely, if it doesn't require that, what prevents Google from adding CrOS-style isolation to Android?)

ultramancool 11y ago
Android already has superior isolation to Chrome OS. The permission system is much more broad and flexible than that offered by browsers and in 6.0 it gives even more direct control.
hawski 11y ago
AFAIK Android Runtime for Chrome is running on NaCl meaning it's properly isolated.
- geofft 11y ago
  Right, if you can do that, why not stick NaCl + Android Runtime for Chrome on everyone's cell phone? NaCl is designed to be very low-overhead, and low-end Chromebooks are probably as underpowered as low-end phones. NaCl is a very good isolation layer, but it's certainly possible that to make Android apps work / interoperate the way you'd expect (e.g., one app can broadcast an intent that another app can receive), you have to open up holes that are too big to secure. It's sort of like how the CPU-level distinction between kernel-mode and user-mode code is a very good isolation layer, but when you run actual operating systems that need their processes to communicate, it gets much harder to secure.
  - mikecb 11y ago
    I personally imagine that when all that hype came out recently about merging chrome and android, that's what they're trying to do. Security of chrome and usability of android would be perfect, and hopefully also allow underlying OS pushes independent of manufacturer or carrier.
mtgx 11y ago