Do Android users blame Google or the phone manufacturer when they download a damaging app?
https://www.forbes.com/sites/daveywinder/2019/11/19/google-c...
This exploit existed in the wild for iOS for years[1], and all a user had to do is visit a website for their device to be exploited.
There are plenty of other recent exploits found in the wild for iOS[2][3]. This implant is undetectable and uploaded iOS users' photos and location data to the attackers[4].
All four of these iOS exploits were found in the same month.
[1] https://googleprojectzero.blogspot.com/2019/08/jsc-exploits....
[2] https://googleprojectzero.blogspot.com/2019/08/in-wild-ios-e...
[3] https://googleprojectzero.blogspot.com/2019/08/in-wild-ios-e...
[4] https://googleprojectzero.blogspot.com/2019/08/implant-teard...
You have a single "store" interface with user configurable channels which users can add at their own risk.
If you don't make it trivial for an attacker to induce a user to configure such a channel you avoid most bad outcomes for stupid people. For example you shouldn't be able to click a link and prompt the user as such prompts do not work.
Personally I would expect
- A setting in configuration menus to enable 3rd party channels
- explicitly entering the channel data
- a white list of known safe channels run by good actors even if not reviewed
- a black list of known bad channels that can't be enabled
Those ‘attackers’ will be the same media outlets who encouraged people to Jailbreak in the early days, or Google and Facebook using their respective monopolies to blanket advertise.
I think we should call it Android. Given that, and a lack of a closed ecosystem, is why Android is hacked as much as it is, which is why I would never get rid of my iPhone in favor of an Android device - well, that and the lesser quality hardware, of course. But I think you see my point.
As an Apple user, I don't say this very often, but you're seriously drinking the Kool-Aid here. Neither mobile OS has a significant advantage in hardware quality at the high end.