4 ms·

Is it? The claim is Android is much more secure than other Linux, but if 40% of all Android devices don‘t get a security patch and you can’t even do it yoursel

by croes 6mo ago

Is it? The claim is Android is much more secure than other Linux, but if 40% of all Android devices don‘t get a security patch and you can’t even do it yourself I would call the more secure per se. Hardening is one part of security, patchability another. Android lacks in the latter.

a96 6mo ago
You can take many computers from 1999 and update them to the best software available today. Most phones won't even do that for a few years. And that is security in the real sense of the word, as in "this won't just pull the rug from under me". (Of course the problem isn't Android, it's the chipset vendors that the SW depends on. They drop support fast and never give enough info for anyone else to keep things up to date. Also Google.)
akimbostrawman 6mo ago
>if 40% of all Android devices don‘t get a security patch No system will stay secure once it does not receive updates. That does not exclude it from being more secure than another system based on security feature merits as long as it does get updated. >Hardening is one part of security, patchability another. Android lacks in the latter. That is not an inherent flaw with android but OEM devices shipping modified android they don't bother keeping up to date. Some OEMs are trying to mitigate this by increasing security update support up to 7 years which still is not long enough but also doesn't make them less secure than a desktop that gets updated longer. What people forget is that not only desktop and mobile phone software is different but also the hardware. If your desktop pc hardware is out of date / EOL nobody cares usually. Meanwhile on a phone this can be a lot more relevant because security expectations and threat models are a lot higher, for example see all the zero/one click compromise headlines.
- croes 6mo ago
  It is an inherent flaw of android. Imagine no Windows update because Lenovo stopped support for 4 year old notebooks
  - akimbostrawman 6mo ago
    It's 7 years because there limiting factor is hardware firmware support. A lot of desktop hardware does not receive firmware updates above 4 years either but that just gets shrugged off like you do because "OS still gets updates so it means it's secure".
  - koutakun 6mo ago
    Funny comparison seeing as Windows decided to drop support for any machines without TPM (some as young as 2017/2018)
mike_hearn 6mo ago
So what? Most devices running Linux don't get security patched, it was ever thus. Think about all the kernels running in wifi routers and other embedded devices.
- akimbostrawman 6mo ago
  Your outdated linux is not reachable world wide by a public phone number. Once again phones do not have the same threat model as desktops. try running your outdated Linux without a firewall and see how long that will survive.

by croes 6mo ago

a96 6mo ago

You can take many computers from 1999 and update them to the best software available today. Most phones won't even do that for a few years. And that is security in the real sense of the word, as in "this won't just pull the rug from under me". (Of course the problem isn't Android, it's the chipset vendors that the SW depends on. They drop support fast and never give enough info for anyone else to keep things up to date. Also Google.)

akimbostrawman 6mo ago

>if 40% of all Android devices don‘t get a security patch No system will stay secure once it does not receive updates. That does not exclude it from being more secure than another system based on security feature merits as long as it does get updated. >Hardening is one part of security, patchability another. Android lacks in the latter. That is not an inherent flaw with android but OEM devices shipping modified android they don't bother keeping up to date. Some OEMs are trying to mitigate this by increasing security update support up to 7 years which still is not long enough but also doesn't make them less secure than a desktop that gets updated longer. What people forget is that not only desktop and mobile phone software is different but also the hardware. If your desktop pc hardware is out of date / EOL nobody cares usually. Meanwhile on a phone this can be a lot more relevant because security expectations and threat models are a lot higher, for example see all the zero/one click compromise headlines.

croes 6mo ago
It is an inherent flaw of android. Imagine no Windows update because Lenovo stopped support for 4 year old notebooks
- akimbostrawman 6mo ago
  It's 7 years because there limiting factor is hardware firmware support. A lot of desktop hardware does not receive firmware updates above 4 years either but that just gets shrugged off like you do because "OS still gets updates so it means it's secure".
- koutakun 6mo ago
  Funny comparison seeing as Windows decided to drop support for any machines without TPM (some as young as 2017/2018)

mike_hearn 6mo ago

So what? Most devices running Linux don't get security patched, it was ever thus. Think about all the kernels running in wifi routers and other embedded devices.

akimbostrawman 6mo ago
Your outdated linux is not reachable world wide by a public phone number. Once again phones do not have the same threat model as desktops. try running your outdated Linux without a firewall and see how long that will survive.