> If web-based installs were the norm, there would be better security hardening efforts made. Today Apple and Google don't have to care about it. If there reputation was at stake, they would care a great deal.
Well, web base installs are the norm. That's how malware and ransomware spreads.
The problem with security is that is usually anti features. That't why webbrowsers use the path of least resistance and declare that they are secure, they have containers and isolation etc. And Google with project Zero is playing the good guy.
It is all security theater. Security is expensive and no one wants to invest in it because it does not have a clear ROI.
> I'm also of the belief that we don't have to be a nanny state. We trust people to pour gasoline, drive death chariots at 70 miles per hour, open lines of credit as teenagers, buy and shoot guns, etc.
We do not trust people to buy and shoot guns.
> Why all the ceremony here? I think it serves the owners of the platform more than us.
Of course it serves only them. Security in android stops when you give apps access to SD card or camera or microfone or phone or contacts. And the fact that Google apps have all this access by default says a lot about how much google is interested in security.