4 ms·

I mean, is it really that far out there if you look at the past two decades of history of malware on Windows and particularly Android? Sandboxing has not preve

I mean, is it really that far out there if you look at the past two decades of history of malware on Windows and particularly Android? Sandboxing has not prevented the proliferation of malware on Android, why would it be any different on iOS? Sandboxing also doesn't really address the other major risk which is theft of personal information by supposedly "trustworthy" apps.

fouric 6y ago
Malware is less of a problem for Android now than any point in Windows' history except for possibly the past few years, so I think that sandboxing has succeeded rather well, given that Windows has had 34 years to evolve defenses and Android has only had 11. Even early on in its life, Android was still better off than Windows at the time, and what do you know - Android has allowed sideloading and alternative app stores this entire time. That is, Android is doing now what we're discussing what Apple might do, and it's worked out pretty well for them.
- nodamage 6y ago
  That's not exactly a ringing endorsement, is it? Sure, the malware situation on Android is better than Windows. It's still far worse compared to iOS. https://arstechnica.com/information-technology/2020/02/researcher-says-nasty-android-infection-survived-a-factory-reset/ https://arstechnica.com/information-technology/2020/02/resea... (Note the date. This is an ongoing problem.) https://www.theverge.com/2019/7/10/20688885/agent-smith-android-malware-25-million-infections https://www.theverge.com/2019/7/10/20688885/agent-smith-andr... https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/ https://securelist.com/skygofree-following-in-the-footsteps-... https://arstechnica.com/information-technology/2016/07/virulent-auto-rooting-malware-takes-control-of-10-million-android-devices/ https://arstechnica.com/information-technology/2016/07/virul... Don't you think there's a direct correlation between the ability to install APKs from random shady internet sources and the spread of malware on Android? Even macOS has a worse malware situation than iOS for the exact same reason. If you believe this has "worked out well" for Android, you and I must have very different definitions of the phrase. You also didn't address my other point, which is sandboxing is only meant to address operating system level security, not developer abuse of legitimate APIs.
  - fouric 6y ago
    > That's not exactly a ringing endorsement, is it? Sure, the malware situation on Android is better than Windows. It's still far worse compared to iOS. > If you believe this has "worked out well" for Android, you and I must have very different definitions of the phrase. Yes, it's a ringing endorsement. Android is good enough - actually, better than good enough. I've seen at least five cases of Windows malware from friends and family over the years, and zero Android cases. As the article you listed above shows, xHelper has had 33K detected cases. That's literally two decimal orders of magnitude less than Conficker, which had over 9M cases, in 2008, when there were, if anything, fewer Windows devices than there are Android devices now. iOS is only better than Android because it sacrifices a lot of user freedom for a little security - which is not an acceptable tradeoff. If I pay for a device, I (should) own it - not the company. If you, personally, are not going to check the box that says "let me install third-party apps" then you, personally, are at no risk of infection, and you have absolutely no right to tell me that you think that I should not have the right to check that box. > Don't you think there's a direct correlation between the ability to install APKs from random shady internet sources and the spread of malware on Android? Even macOS has a worse malware situation than iOS for the exact same reason. Yes, there's a direct correlation. If you give users sharp tools, the dumb ones will stab themselves. This is normal, and good. Users deserve the sharp tools. Put a sheath around them, but device makers intentionally restricting users from things that they might reasonably want to do, for the sake of their own profit, is borderline theft. > You also didn't address my other point, which is sandboxing is only meant to address operating system level security, not developer abuse of legitimate APIs. Yes, because developer abuse of legitimate APIs is irrelevant to what we're talking about here, which is whether or not to allow third-party app stores. Why? Because (a) both Apple and Google's app store review processes have let malware through before and (b) sandboxing, which doesn't necessarily prevent developers from abusing legitimate APIs, is necessary for it - and both iOS and Android take advantage of sandboxing to make it harder for devs to do bad things. For instance, iOS (now) gives you a notification if an application accesses the clipboard. Even better, there are modifications for Android that allow you to intercept and fake API data (so that an application doesn't refuse to work if you deny it access to an API) - which is significantly better than anything you can get on iOS.

fouric 6y ago

Malware is less of a problem for Android now than any point in Windows' history except for possibly the past few years, so I think that sandboxing has succeeded rather well, given that Windows has had 34 years to evolve defenses and Android has only had 11. Even early on in its life, Android was still better off than Windows at the time, and what do you know - Android has allowed sideloading and alternative app stores this entire time. That is, Android is doing now what we're discussing what Apple might do, and it's worked out pretty well for them.

nodamage 6y ago
That's not exactly a ringing endorsement, is it? Sure, the malware situation on Android is better than Windows. It's still far worse compared to iOS. https://arstechnica.com/information-technology/2020/02/researcher-says-nasty-android-infection-survived-a-factory-reset/ https://arstechnica.com/information-technology/2020/02/resea... (Note the date. This is an ongoing problem.) https://www.theverge.com/2019/7/10/20688885/agent-smith-android-malware-25-million-infections https://www.theverge.com/2019/7/10/20688885/agent-smith-andr... https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/ https://securelist.com/skygofree-following-in-the-footsteps-... https://arstechnica.com/information-technology/2016/07/virulent-auto-rooting-malware-takes-control-of-10-million-android-devices/ https://arstechnica.com/information-technology/2016/07/virul... Don't you think there's a direct correlation between the ability to install APKs from random shady internet sources and the spread of malware on Android? Even macOS has a worse malware situation than iOS for the exact same reason. If you believe this has "worked out well" for Android, you and I must have very different definitions of the phrase. You also didn't address my other point, which is sandboxing is only meant to address operating system level security, not developer abuse of legitimate APIs.
- fouric 6y ago
  > That's not exactly a ringing endorsement, is it? Sure, the malware situation on Android is better than Windows. It's still far worse compared to iOS. > If you believe this has "worked out well" for Android, you and I must have very different definitions of the phrase. Yes, it's a ringing endorsement. Android is good enough - actually, better than good enough. I've seen at least five cases of Windows malware from friends and family over the years, and zero Android cases. As the article you listed above shows, xHelper has had 33K detected cases. That's literally two decimal orders of magnitude less than Conficker, which had over 9M cases, in 2008, when there were, if anything, fewer Windows devices than there are Android devices now. iOS is only better than Android because it sacrifices a lot of user freedom for a little security - which is not an acceptable tradeoff. If I pay for a device, I (should) own it - not the company. If you, personally, are not going to check the box that says "let me install third-party apps" then you, personally, are at no risk of infection, and you have absolutely no right to tell me that you think that I should not have the right to check that box. > Don't you think there's a direct correlation between the ability to install APKs from random shady internet sources and the spread of malware on Android? Even macOS has a worse malware situation than iOS for the exact same reason. Yes, there's a direct correlation. If you give users sharp tools, the dumb ones will stab themselves. This is normal, and good. Users deserve the sharp tools. Put a sheath around them, but device makers intentionally restricting users from things that they might reasonably want to do, for the sake of their own profit, is borderline theft. > You also didn't address my other point, which is sandboxing is only meant to address operating system level security, not developer abuse of legitimate APIs. Yes, because developer abuse of legitimate APIs is irrelevant to what we're talking about here, which is whether or not to allow third-party app stores. Why? Because (a) both Apple and Google's app store review processes have let malware through before and (b) sandboxing, which doesn't necessarily prevent developers from abusing legitimate APIs, is necessary for it - and both iOS and Android take advantage of sandboxing to make it harder for devs to do bad things. For instance, iOS (now) gives you a notification if an application accesses the clipboard. Even better, there are modifications for Android that allow you to intercept and fake API data (so that an application doesn't refuse to work if you deny it access to an API) - which is significantly better than anything you can get on iOS.