4 ms·

And yet the number of CVE's raised against Android is far below that of iOS or Windows.

skrowl 11y ago
The fact that you're being downvoted just shows how many Apple zealots unwilling to accept Apple recent (last few years) across-the-board failings in software security there are still here at HN. Your reply is factually correct and rather than attempt to rebut it in any way, they just downvote you.
dsp1234 11y ago
This isn't a good metric unfortunately. A much more realistic metric is % of devices with unpatched CVEs. With iOS updates and Windows updates, most devices get their vulnerabilities patched (assuming the vendor addresses it at all), unless specific action is taken not to update them. However, most android devices are not updated past a few minor Android versions, and once the carrier no longer provides patches, there is often no way for a normal user to patch the OS at all. So Windows could theoretically have 100x the number of vulnerabilities over time, but if they are fixed and autopatched, then those systems can still be more secure than a system that doesn't get patches past the first year.
- magicalist 11y ago
  This seems irrelevant because if ChromeOS machines became Android ones, Google would still control the updates and so they be like Nexus devices and would always get updates.
  - tauntz 11y ago
    Nexus devices are getting updates for just around 2 years. All the older devices (including my dear Galaxy Nexus) are left behind. Imagine if your newly bought windows 10 PC would get security updates for only 2 years
smhg 11y ago
A quick search indeed seems to agree with the statement the number of CVE's raised against Android is below that of iOS. Numbers from cvedetails.com: Android 245, iOS 857 I guess it is not a direct proof something is more insecure? There are other factors that push the numbers up or down. Project popularity, the type of CVE,... And projects depend on each-other too (Linux kernel -> Chrome OS and Android). Am I missing anything? Can any of the downvoters please elaborate?
millstone 11y ago
How did you determine this? Comparing the list at CVEDetails.com [1] [2] would seem to support this at first blush, but this is because the iOS list contains Safari and WebKit vulnerabilities, while the Android one does not include Chrome, Blink, or WebBrowser/WebKit vulnerabilities. If you include Chrome [3] they look to be about even. [1] http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224 http://www.cvedetails.com/product/19997/Google-Android.html?... [2] http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html?vendor_id=49 http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html... [3] http://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 http://www.cvedetails.com/product/15031/Google-Chrome.html?v...

The fact that you're being downvoted just shows how many Apple zealots unwilling to accept Apple recent (last few years) across-the-board failings in software security there are still here at HN. Your reply is factually correct and rather than attempt to rebut it in any way, they just downvote you.

dsp1234 11y ago

This isn't a good metric unfortunately. A much more realistic metric is % of devices with unpatched CVEs. With iOS updates and Windows updates, most devices get their vulnerabilities patched (assuming the vendor addresses it at all), unless specific action is taken not to update them. However, most android devices are not updated past a few minor Android versions, and once the carrier no longer provides patches, there is often no way for a normal user to patch the OS at all. So Windows could theoretically have 100x the number of vulnerabilities over time, but if they are fixed and autopatched, then those systems can still be more secure than a system that doesn't get patches past the first year.

magicalist 11y ago
This seems irrelevant because if ChromeOS machines became Android ones, Google would still control the updates and so they be like Nexus devices and would always get updates.
- tauntz 11y ago
  Nexus devices are getting updates for just around 2 years. All the older devices (including my dear Galaxy Nexus) are left behind. Imagine if your newly bought windows 10 PC would get security updates for only 2 years

smhg 11y ago

A quick search indeed seems to agree with the statement the number of CVE's raised against Android is below that of iOS. Numbers from cvedetails.com: Android 245, iOS 857 I guess it is not a direct proof something is more insecure? There are other factors that push the numbers up or down. Project popularity, the type of CVE,... And projects depend on each-other too (Linux kernel -> Chrome OS and Android). Am I missing anything? Can any of the downvoters please elaborate?

millstone 11y ago

How did you determine this? Comparing the list at CVEDetails.com [1] [2] would seem to support this at first blush, but this is because the iOS list contains Safari and WebKit vulnerabilities, while the Android one does not include Chrome, Blink, or WebBrowser/WebKit vulnerabilities. If you include Chrome [3] they look to be about even. [1] http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224 http://www.cvedetails.com/product/19997/Google-Android.html?... [2] http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html?vendor_id=49 http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html... [3] http://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 http://www.cvedetails.com/product/15031/Google-Chrome.html?v...