3 ms·

That doesn't obviously follow. CVE entries are both a function of security and interest. My github projects don't have any CVEs, not because they aren't woeful

That doesn't obviously follow. CVE entries are both a function of security and interest. My github projects don't have any CVEs, not because they aren't woefully insecure to anyone who bothers to investigate deeply, but because no one cares. "Android" is installed on more devices than any other OS in the world. So it stands to reason that there would be more interest in finding exploits in android than in OS's that are often airgapped or locked away behind firewalls.

pjmlp 7y ago
It is also very seldom updated, my dummy GitHub projects have more updates than many common Android brands, so whatever security Pixel devices sell, it is hardly a reflection of what most consumers outside North America get to use.
- joshuamorton 7y ago
  Which isn't a reflection on Google's security practices, but that of cell phone companies. My OS is secure and, if third party vulnerability prices are anything to go by, as or more secure than any other consumer OS. That would reflect well on the Android security teams.
  - pjmlp 7y ago
    It definitely is, an OS is as secure as consumers get to use it, not a some experimental lab in Mountain View. So if Google doesn't care what the OEMs do with Android, it definitely shows that Google doesn't care about security on Android as a whole, as long as it can write blogs about how perfect the security in Pixel devices looks like, which by the way are on sale just in a couple of selected tier 1 countries. That isn't caring about security, what Apple does, it is caring about it.
    - joshuamorton 7y ago
      > It definitely is, an OS is as secure as consumers get to use it, not a some experimental lab in Mountain View. "my parents pockets" isn't an experimental lab, I don't think. > So if Google doesn't care what the OEMs do with Android I don't think I said this. > That isn't caring about security, what Apple does, it is caring about it. Open ecosystem, maximally secure ecosystem, pick 1. Android offers equal security to iOS if one chooses to pursue it. That most OEMs don't give a shit about security reflects badly on those OEMs, there's only so much any software provider can do.
      - pjmlp 7y ago
        Let me correct it for you, from those of us that aren't attached to Google. "That most OEMs don't give a shit about security reflects badly on Google security polices". Google can go ask Microsoft how it does make OEMs play by the rules, or legal about how to properly write contracts that enforce such security practices. Until it happens, how secure a Pixel device might be in theory and Google blog posts, isn't representative of the Android that 90% of the world actually gets to use.
        joshuamorton 7y ago
        > Google can go ask Microsoft how it does make OEMs play by the rules OEMs of what? All the custom forks of windows floating around? The mobile device market doesn't work anything like the deskop market, and you know that. Unless you're suggesting that the drivers for the networked, LED-light-toting hyper-gaming mouse you can get from Razer is more secure than OEM Android, because that's the closest things I can come up with, and it's laughable. We're well off track though, the original question was if there was a more secure (implied consumer) os. You mentioned two non consumer OSs, so I think it's safe to say that the answer is no.
        pjmlp 7y ago
        OEMs of Windows Phone for example. My Windows 10 devices still get more security updates than a couple of Asus Android ones I have here lying around about the same age. You are the one moving the goal posts to consumer OSes, in a failed attempt to protect Google's security story. Well, if you want to go that way, then iOS has definitely a better security story than Android ever will. Every iOS powered device has the same security hardware, and update story regardless where in the world it gets bought. Android, well better have luck with the OEM device, despite what gets written in Google blog posts and demoed at IO.

pjmlp 7y ago

It is also very seldom updated, my dummy GitHub projects have more updates than many common Android brands, so whatever security Pixel devices sell, it is hardly a reflection of what most consumers outside North America get to use.

joshuamorton 7y ago
Which isn't a reflection on Google's security practices, but that of cell phone companies. My OS is secure and, if third party vulnerability prices are anything to go by, as or more secure than any other consumer OS. That would reflect well on the Android security teams.
- pjmlp 7y ago
  It definitely is, an OS is as secure as consumers get to use it, not a some experimental lab in Mountain View. So if Google doesn't care what the OEMs do with Android, it definitely shows that Google doesn't care about security on Android as a whole, as long as it can write blogs about how perfect the security in Pixel devices looks like, which by the way are on sale just in a couple of selected tier 1 countries. That isn't caring about security, what Apple does, it is caring about it.
  - joshuamorton 7y ago
    > It definitely is, an OS is as secure as consumers get to use it, not a some experimental lab in Mountain View. "my parents pockets" isn't an experimental lab, I don't think. > So if Google doesn't care what the OEMs do with Android I don't think I said this. > That isn't caring about security, what Apple does, it is caring about it. Open ecosystem, maximally secure ecosystem, pick 1. Android offers equal security to iOS if one chooses to pursue it. That most OEMs don't give a shit about security reflects badly on those OEMs, there's only so much any software provider can do.
    - pjmlp 7y ago
      Let me correct it for you, from those of us that aren't attached to Google. "That most OEMs don't give a shit about security reflects badly on Google security polices". Google can go ask Microsoft how it does make OEMs play by the rules, or legal about how to properly write contracts that enforce such security practices. Until it happens, how secure a Pixel device might be in theory and Google blog posts, isn't representative of the Android that 90% of the world actually gets to use.
      - joshuamorton 7y ago
        > Google can go ask Microsoft how it does make OEMs play by the rules OEMs of what? All the custom forks of windows floating around? The mobile device market doesn't work anything like the deskop market, and you know that. Unless you're suggesting that the drivers for the networked, LED-light-toting hyper-gaming mouse you can get from Razer is more secure than OEM Android, because that's the closest things I can come up with, and it's laughable. We're well off track though, the original question was if there was a more secure (implied consumer) os. You mentioned two non consumer OSs, so I think it's safe to say that the answer is no.
        pjmlp 7y ago
        OEMs of Windows Phone for example. My Windows 10 devices still get more security updates than a couple of Asus Android ones I have here lying around about the same age. You are the one moving the goal posts to consumer OSes, in a failed attempt to protect Google's security story. Well, if you want to go that way, then iOS has definitely a better security story than Android ever will. Every iOS powered device has the same security hardware, and update story regardless where in the world it gets bought. Android, well better have luck with the OEM device, despite what gets written in Google blog posts and demoed at IO.