4 ms·

I'm not so convinced Linux is a "tire fire". Just about everything has vulnerabilities and needs to be occasionally patched, doesn't mean we need to get into so

I'm not so convinced Linux is a "tire fire". Just about everything has vulnerabilities and needs to be occasionally patched, doesn't mean we need to get into some sort of holy war every time there's a new exploit for one device or the other. That said, Android's lack of updates for older devices is its biggest weakness. Google is looking to fix this next version as they separate the HAL out. Something to look at is definitely if there would be a standard kernel with loaded modules or if it would still be left to manufacturers.

dguido 9y ago
No, Linux is qualitatively worse off since it keeps bug-dense code in areas of high privilege with few mitigating controls. Yes, there will be bugs but refusing to properly address that ahead of time by separating and lowering privileges, applying sandboxes, and proactively auditing external attack surface is why Android is worse than iOS for security.
- problems 9y ago
  I'm not disagreeing that it's poorer for security, but in practice under most threat models you'll be able to patch in time for it to not even matter. And you'd still need to patch, even if it was nicely sandboxed - getting access to just the bluetooth stack could allow emulation of a keyboard or internet connection. Let's not forget that Apple has had trivially exploitable vulnerabilities in the past too - I'd argue that Linux's recent history has been significantly better in that department actually, despite the technical merits of the mitigations being worse. There's no PoC code out for this even and it's been many times longer than it would take to patch something like this in most cases. What I'm saying is that going from "Linux has worse security design" to "use an iPhone" is just a non-sequitur - people choose devices and operating systems for reasons other than the best security design and there's no reason that an attack like this should force you onto a single platform. It comes off as nothing more than fanboyism.
- vacri 9y ago
  If I have to wait 3 minutes for a bus instead of 2, I am 'qualitatively worse off', but that extra minute doesn't flip into being 'a tire fire'.

dguido 9y ago

No, Linux is qualitatively worse off since it keeps bug-dense code in areas of high privilege with few mitigating controls. Yes, there will be bugs but refusing to properly address that ahead of time by separating and lowering privileges, applying sandboxes, and proactively auditing external attack surface is why Android is worse than iOS for security.

problems 9y ago
I'm not disagreeing that it's poorer for security, but in practice under most threat models you'll be able to patch in time for it to not even matter. And you'd still need to patch, even if it was nicely sandboxed - getting access to just the bluetooth stack could allow emulation of a keyboard or internet connection. Let's not forget that Apple has had trivially exploitable vulnerabilities in the past too - I'd argue that Linux's recent history has been significantly better in that department actually, despite the technical merits of the mitigations being worse. There's no PoC code out for this even and it's been many times longer than it would take to patch something like this in most cases. What I'm saying is that going from "Linux has worse security design" to "use an iPhone" is just a non-sequitur - people choose devices and operating systems for reasons other than the best security design and there's no reason that an attack like this should force you onto a single platform. It comes off as nothing more than fanboyism.
vacri 9y ago
If I have to wait 3 minutes for a bus instead of 2, I am 'qualitatively worse off', but that extra minute doesn't flip into being 'a tire fire'.