That's not how it works.
I'm also not saying that it's perfect, but it is clearly better than Apple's alternative, which you have not disputed.
I'm also not saying that it's perfect, but it is clearly better than Apple's alternative, which you have not disputed.
Sure there is a lot of C floating around but there is a solution in sight and there is some amount of effort being put in to rewriting things in Rust.
Again, you have not disputed that Apple is worse.
You really think people are auditing all of the open source software you are using? Where were they the year and a half the HeartBleed bug was out in the wild?
I'm saying it's significantly better than the alternative, and you continue to ignore that point. For example, reproducible builds directly stops XCodeGhost from ever happening, which was the single largest mobile malware infection in history by a wide margin. As another example, heartbleed has nothing on this 15 year old MacOS bug. https://www.macworld.com/article/3250125/macs/full-macos-com...
https://en.wikipedia.org/wiki/Stagefright_(bug)
And since Android phones both have a horrible security model and a horrible history of receiving updates, any malware or security issue is made worse.
I live in a neighborhood that has never had a reported break in. Does that mean I’m not more vulnerable if I leave my door unlocked and post a huge sign outside letting everyone know?
Even if you look at something like the way that third party keyboards work on Android, it’s a security nightmare.
On iOS, users have to explicitly go into settings to add a third party keyboard and even then it doesn’t have network access by default. The user has to go back into settings to enable the keyboard to have network access and then they get a big scary warning. Android users happily install keyloggers.
Also, even after you both install the keyboard and give the keyboard network access, iOS still switches back to the default keyboard when entering passwords.
Blocking exploits in the Play Store, among other things. Why do you think Stagefright was never exploited?
> It would have been just as easy for someone to infect the Android build chain.
We were just talking about reproducible builds.
> Keyboard nonsense.
Android also displays a scary warning for keyboards.
If the MMS app and the browsers were updated to filter Stagefright exploits (on Android, unlike iOS, system app updates do not require an OS update and happen through the Play Store, one of many things Android gets right and iOS gets wrong), the only way to exploit it is by publishing your own app to the Play Store and getting somebody to install it and hoping that the device doesn't have an selinux policy that limits the privileges of the exploit. The Play Store can trivially block apps that don't use an approved wrapper library for media that filters Stagefright exploits.
Also, what’s the differences between updating the OS from Apple’s servers and hypothetically updating an app from Apple’s servers. Are you trying to turn a weakness that Google can’t just press a button and allow every single Android worldwide to receive an OS update into a strength?