3 ms·

> The answer is obvious. Is it? I'm not overly familiar with any security exploits, but my understanding is that (at least for Android) the phone OS is often w

by Reelin 6y ago

> The answer is obvious. Is it? I'm not overly familiar with any security exploits, but my understanding is that (at least for Android) the phone OS is often woefully out of date simply because the vendor stopped supplying updates. The end user generally can't supply updates themselves because everything is locked down in a decidedly user hostile manner. For the vendor's part, they often stop supplying updates (as I understand it) because the proprietary hardware doesn't have it's drivers upstreamed into the kernel (they're proprietary after all) which leads to a completely unjustifiable maintenance burden. They can't simply open source things because the hardware manufacturers generally require NDAs. As far as the hardware goes, my (probably woefully incomplete) understanding is that it remains proprietary due to a combination of attempting to maintain a competitive edge through secrecy, licensing complexities due to containing third party IP, and DRM issues (which are again a licensing concern).

bad_user 6y ago
No, that's not what happens on iOS. I'm writing this on a 5 year old device still getting updated. The iOS exploits that have historically allowed the device to be jailbroken have been zero-day vulnerabilities. And I'm assuming the TFA is about a zero-day too. Also Android is open source (AOSP). How does that help?
- Reelin 6y ago
  I'm well aware that this isn't nearly as much of an issue for Apple devices - that's why I very clearly specified Android in my previous comment. Yes AOSP is open source but that doesn't help as much as one might hope for the reasons I outlined in my previous comment. Basically most end user devices aren't actually running AOSP at the end of the day, and can't without investing a nontrivial amount of effort. (And that still wouldn't prevent vulnerabilities related to out of date firmware.) The comment of yours that I originally responded to seemed to me to insinuate that having access to fully open sourced phones wouldn't be able to do anything to improve device security as a foregone conclusion. I was objecting to that, pointing out that there are a number of real world examples where access to a fully open source mobile stack would immediately and drastically improve the current situation. In a hypothetical world full of such stacks perhaps this article would never have been written.

by Reelin 6y ago

bad_user 6y ago

No, that's not what happens on iOS. I'm writing this on a 5 year old device still getting updated. The iOS exploits that have historically allowed the device to be jailbroken have been zero-day vulnerabilities. And I'm assuming the TFA is about a zero-day too. Also Android is open source (AOSP). How does that help?

Reelin 6y ago
I'm well aware that this isn't nearly as much of an issue for Apple devices - that's why I very clearly specified Android in my previous comment. Yes AOSP is open source but that doesn't help as much as one might hope for the reasons I outlined in my previous comment. Basically most end user devices aren't actually running AOSP at the end of the day, and can't without investing a nontrivial amount of effort. (And that still wouldn't prevent vulnerabilities related to out of date firmware.) The comment of yours that I originally responded to seemed to me to insinuate that having access to fully open sourced phones wouldn't be able to do anything to improve device security as a foregone conclusion. I was objecting to that, pointing out that there are a number of real world examples where access to a fully open source mobile stack would immediately and drastically improve the current situation. In a hypothetical world full of such stacks perhaps this article would never have been written.