4 ms·

If security patching is important to you, you aren't carrying an Android. This has never not been true. Even here, on a Google phone, where Google can't blame m

If security patching is important to you, you aren't carrying an Android. This has never not been true. Even here, on a Google phone, where Google can't blame manufacturers for dragging their feet on releases. Over a year after Microsoft officially abandoned Windows Mobile, I was still getting security patches faster and more often than Android phones ever did. If security is important to you, you carry an iPhone. That's a sad state of affairs, Apple has all sorts of problems and a ton of things I just find weird about the way their devices tend to do things and organize information, but it's just the only actual option right now.

lern_too_spel 4y ago
On the contrary, Android is the only somewhat sane popular mobile OS today. I don't want to reboot my phone to update the web browser the way MacOS and iOS update Safari and the way Windows used to update IE. The browser is the application I use the most, and it has the largest attack surface. It should update transparently and not stop updating after the OS falls out of service, like Macs with Nvidia GPUs. The problem in this case isn't Google dragging its feet on releases. It releases Chrome updates frequently and OS updates monthly. The problem here is Google failing to include security patches for known vulnerabilities in those releases. What's ridiculous is that this is something that can be automated, and after multiple failures, it should have been automated, but here we are.
- ocdtrekkie 4y ago
  Don't get me wrong, having to reboot your device to update your browser is silly. But if the choice is between that and waiting until a vulnerability is actively exploited before it's patched, anyone who cares about security will choose the former. It's very obvious when something like Heartbleed comes around which affects a ton of operating systems, and Windows and iOS and major Linux distros are patched in like a week and then there's a chart to look at for which manufacturer and model and carrier on whether or not you'll see a fix in the next couple months or ever.
  - lern_too_spel 4y ago
    Except if you get your OS from a particular vendor, like Apple, Google, or Ubuntu, you only have to check with the vendor to see when it will be released. All three have track records of timely updates. The real problem is patch-gapping across updates (instead of within an update), which Apple also suffers from: https://blog.theori.io/research/webkit-type-confusion/ https://blog.theori.io/research/webkit-type-confusion/ I'd expect both Apple and Google to spend the resources to automate this problem away, but the article shows this hasn't happened.
gradeless 4y ago
It used to be the case that iphones were way ahead of security in android. With the efforts that have gone into improving things in the last few years and Google stepping up the quality of their hardware security with their Pixel lines that is no longer the case. iPhones also have nasty (sometimes unpatchable) vulns. Android gets ever stronger protections against malicious apps, doesnt rely so much on Malware being screened from the store (malware regularly gets through onto both Play Store and Apples App Store)
- tux2bsd 4y ago
  [dead]
cvalka 4y ago
No longer true. Iphones 0-days are cheaper than Android 0-days.
palata 4y ago
> If security is important to you, you carry an iPhone Ever heard of NSO's Pegasus? xD
heavyset_go 4y ago
iOS exploits are cheaper than Android exploits because they're so plentiful. Apple's security model is about securing App Store revenue first and foremost.
howinteresting 4y ago
This has empirically not been true for a while, as shown by open market zero-day costs. (Though I believe iOS has been catching up recently.)
realusername 4y ago
> If security is important to you, you carry an iPhone. That's a sad state of affairs, Apple has all sorts of problems and a ton of things I just find weird about the way their devices tend to do things and organize information, but it's just the only actual option right now. Are you aware that the state of security on iPhone is even worse nowadays? At least on Android the system surface has been reduced to its minimum. In iOS, pretty much every system component depends on the OS update and nothing has been decoupled yet.

lern_too_spel 4y ago

On the contrary, Android is the only somewhat sane popular mobile OS today. I don't want to reboot my phone to update the web browser the way MacOS and iOS update Safari and the way Windows used to update IE. The browser is the application I use the most, and it has the largest attack surface. It should update transparently and not stop updating after the OS falls out of service, like Macs with Nvidia GPUs. The problem in this case isn't Google dragging its feet on releases. It releases Chrome updates frequently and OS updates monthly. The problem here is Google failing to include security patches for known vulnerabilities in those releases. What's ridiculous is that this is something that can be automated, and after multiple failures, it should have been automated, but here we are.

ocdtrekkie 4y ago
Don't get me wrong, having to reboot your device to update your browser is silly. But if the choice is between that and waiting until a vulnerability is actively exploited before it's patched, anyone who cares about security will choose the former. It's very obvious when something like Heartbleed comes around which affects a ton of operating systems, and Windows and iOS and major Linux distros are patched in like a week and then there's a chart to look at for which manufacturer and model and carrier on whether or not you'll see a fix in the next couple months or ever.
- lern_too_spel 4y ago
  Except if you get your OS from a particular vendor, like Apple, Google, or Ubuntu, you only have to check with the vendor to see when it will be released. All three have track records of timely updates. The real problem is patch-gapping across updates (instead of within an update), which Apple also suffers from: https://blog.theori.io/research/webkit-type-confusion/ https://blog.theori.io/research/webkit-type-confusion/ I'd expect both Apple and Google to spend the resources to automate this problem away, but the article shows this hasn't happened.

gradeless 4y ago

It used to be the case that iphones were way ahead of security in android. With the efforts that have gone into improving things in the last few years and Google stepping up the quality of their hardware security with their Pixel lines that is no longer the case. iPhones also have nasty (sometimes unpatchable) vulns. Android gets ever stronger protections against malicious apps, doesnt rely so much on Malware being screened from the store (malware regularly gets through onto both Play Store and Apples App Store)

tux2bsd 4y ago
[dead]

cvalka 4y ago

No longer true. Iphones 0-days are cheaper than Android 0-days.

palata 4y ago

> If security is important to you, you carry an iPhone Ever heard of NSO's Pegasus? xD

heavyset_go 4y ago

iOS exploits are cheaper than Android exploits because they're so plentiful. Apple's security model is about securing App Store revenue first and foremost.

howinteresting 4y ago

This has empirically not been true for a while, as shown by open market zero-day costs. (Though I believe iOS has been catching up recently.)

realusername 4y ago

> If security is important to you, you carry an iPhone. That's a sad state of affairs, Apple has all sorts of problems and a ton of things I just find weird about the way their devices tend to do things and organize information, but it's just the only actual option right now. Are you aware that the state of security on iPhone is even worse nowadays? At least on Android the system surface has been reduced to its minimum. In iOS, pretty much every system component depends on the OS update and nothing has been decoupled yet.