Slashdot Mirror


Accountability, Not Code Quality, Makes iOS Safer Than Android

chicksdaddy writes "Threatpost is reporting on a new study of mobile malware that finds accountability, not superior technology, has kept Apple's iOS ecosystem free of viruses, even as the competing Android platform strains under the weight of repeated malicious code outbreaks. Dan Guido of the firm Trail of Bits and Michael Arpaia of iSEC Partners told attendees at the SOURCE Boston Conference on Thursday about an empirical analysis of existing malicious programs for the Android and iOS platforms which shows that Google is losing the mobile security contest badly — every piece of malicious code the two identified was for the company's Android OS, while Apple's iOS remained free of malware, despite owning 30% of the mobile smartphone market in the U.S. Apple's special sauce? Policies that demand accountability from iOS developers, and stricter controls on what applications can do once they are installed on Apple devices."

210 comments

  1. under the wait? by Anonymous Coward · · Score: 0, Troll

    Time is money and I could stand to lose a few pounds

  2. Low bandwidth? by Anonymous Coward · · Score: 0, Troll

    "Strains under the wait"?

  3. You have to be kidding by Anonymous Coward · · Score: 3, Insightful

    Since when is the iOS more secure? The latest Android has a very stable code and a solid permission system that allows the user to set exactly what an app can or can't do. This in contrast to an OS that can be rooted by a fucking website.

    1. Re:You have to be kidding by ircmaxell · · Score: 3, Insightful
      This. Very much this.

      This article is pure FUD. Plain and simple.

      Malware, by its very definition is:

      Malware is a general term used to describe any kind of software or code specifically designed to exploit a computer, or the data it contains, without consent.

      Android requires that you give consent, since it tells you what permissions the application needs prior to installing it. So by very definition, these data leakages on Android are not malware. The user said it was ok for that application to collect that data.

      --
      If a man isn't willing to take some risk for his opinions, either his opinions are no good or he's no good
    2. Re:You have to be kidding by Anonymous Coward · · Score: 3, Insightful

      and what percentage of phones out there have the latest Android release? My Galaxy S2 is still waiting...

    3. Re:You have to be kidding by Anonymous Coward · · Score: 2, Insightful

      Could you post the link, please? Seriously. I have an iPhone 3GS which I want to jailbreak to use with another phone carrier, but it has been updated to ios 5.1 and nothing I find (whited00r, redsn0w, tinyumbrella etc) seems to work. The most I've been able to is make the phone boot with a non-working 3G/Wifi radio, which defeats the device being a mobile. Fucking Apple support doesn't want to make it free, and my old operator says it has been freed (my ass).

      Please, post the link, it would have saved me a week of failed hacking attempts so far!

    4. Re:You have to be kidding by Anonymous Coward · · Score: 0, Flamebait

      Well, the main problem Android has is that is made by a bunch of assholes, lead by the major asshole himself: Mr. Andy Rubin. Also, the SDK is a fucking joke. Get a Nokia N900 or N9 if you want the real deal.

      --
      Sundar Pichai's incompetence costed me my job. Fucking him and his fucking family!

    5. Re:You have to be kidding by Anonymous Coward · · Score: 0

      can you disable an applications access to the internet per application, without rooting.

    6. Re:You have to be kidding by Anonymous Coward · · Score: 0

      Sure. You only have to turn off wifi and 3g.

    7. Re:You have to be kidding by mysidia · · Score: 5, Informative

      Since when is the iOS more secure? The latest Android has a very stable code and a solid permission system that allows the user to set exactly what an app can or can't do.

      The reason there are fewer iOS malware infections has to do with something totally separate from security of the device.

      There is a 'more efficient' distribution channel for Android platform malware.

      Developing for the Apple platform requires a security certificate from Apple to sign applications, paying money to apple, signing a contract, and approval from Apple and review to be listed on the pap store, which makes the app store a less efficient means of distributing malware than the Android marketplace.

      An operating system can be extremely insecure, but if there is no useful distribution channel, or no network connection, it is not likely to be infected.

    8. Re:You have to be kidding by Black+Parrot · · Score: 4, Insightful

      This article is pure FUD. Plain and simple.

      Can't imagine that a company called "iSEC" would be biased on this matter.

      --
      Sheesh, evil *and* a jerk. -- Jade
    9. Re:You have to be kidding by DavidRawling · · Score: 5, Interesting

      On the contrary, the user has NO control over app permissions, by default. The app author sets what he/she wants, and the user has the choice of accepting it or finding an alternative. No justification, no ability to say "well I want this useful SSH app but I don't want it reading my contacts, so I'll deny that permission". Yes, there are firewall apps (the permissions are in the OS, why do I need an APP to enforce OS permissions?) and for rooted devices, apps that can tweak permissions. But the default is horribly, terribly broken because most of the power is in the hands of the developers, NOT the users.

    10. Re:You have to be kidding by cyber-vandal · · Score: 3, Informative

      No it isn't, the firmware's been out for a long time now.

    11. Re:You have to be kidding by BasilBrush · · Score: 5, Informative

      Since when is the iOS more secure? ...an OS that can be rooted by a fucking website.

      If that is your measure, the answer to the question you pose is July 15th 2011. That was when the last version of iOS that could be rooted via a website was replaced.

      4.3.3 could be jailbroken via website, 4.3.4 would not.

      5.x has been out since Oct 2011.

      Personally I'd say a better measure is the amount of malware. And on that measure, Android has always been many times worse than iOS.

    12. Re:You have to be kidding by wvmarle · · Score: 4, Informative

      Afaik most Android malware is not from the Play Store, but from third-party Android stores.

      And besides Play Store does have accountability: every developer has to register, and pay a small one-off registration fee as form of identification.

    13. Re:You have to be kidding by Anonymous Coward · · Score: 5, Insightful

      There's a number of things you're missing. Most importantly: practically everyone would consider trojan horses to be malware, or at least an important security issue. Just because the user checked a box somewhere doesn't mean that trojans don't count.
      Beyond that, trojan horses are due to their very nature less useful in an environment where accountability is higher. This is definitely the case with Apple/iOS, and has lead to a large number of false positives and censorship by Apple, both of which have been discussed at length here on slashdot.
      Thirdly, unlike Android, I haven't seen any major and widely-reported breaches of apple devices, despite widely-available jailbreaking tools. This surprises me quite a bit. According to the iPhone users I've asked about this they claim that the cause is that most jailbreaks these days work through a physical connection (ie. with a computer).

      Android may be more secure in capable hands, but the average user is safer in an environment where available software is code-signed and strictly supervised, either by a single entity such as Apple's iOS market or by the community such as the debian repositories.

    14. Re:You have to be kidding by Anonymous Coward · · Score: 5, Insightful

      Sure, but if the user is asked for every app whether to share data, the act of sharing data then becomes a standard part of the install. Very technically aware users will make use of this, but for most users it's effectively worthless: it's just another mind-numbingly annoying button you click for the app to run, like EULAs almost no one reads. (Just to be clear, I'm not really arguing about Android vs. iOS, I'm just pointing out the generally low value of relying on users giving consent for an install.)

    15. Re:You have to be kidding by jsvk · · Score: 4, Informative

      the exploit you're talking about existed for 1 or 2 minor version numbers, and can no longer be exploited (including by the device owner) due to the OS version(s) no longer being installable without jumping through some hoops (apple's server no longer signs off on the installation). It was a bug in the PDF renderer for safari, for anyone wondering.

      Rooting iOS devices remains a hunt for exploits in every version release, and no one's ever sure if and when the next version's exploit will be released. Many 4S/iPad users on iOSv5.1 are have been stuck using a jailed, but perfectly secure device for months now, with no guarantee that the jailbreak will come anytime soon.

      Each version makes iOS more and more secure, and there's no guarantee Apple won't eventually release a perfectly secure, jailed OS, and I hope at that point this OS dies off, but that may be asking too much.

    16. Re:You have to be kidding by Anonymous Coward · · Score: 0

      The latest Android has a very stable code and a solid permission system that allows the user to set exactly what an app can or can't do.

      So the code and permissions are stable and solid

      That doesn't help much when even the preinstalled apps demands your position, data and full rights to send them back to google.

      Hey, you can't even turn on your own gps sensor without agreeing to that!

      So now that all apps usually gets full permissions, how do we stop the malware.

    17. Re:You have to be kidding by Anonymous Coward · · Score: 0

      My Samsung/T-Mobile Galaxy 4G isn't likely to get ICS ever, unless I switch to a community created image. But, as much as I like running the latest stuff, I'm not sure it matters unless there's something wrong with Gingerbread. I haven't, to my knowledge, had any viruses, and I pay attention when I update apps and they want access to things like my contact list for no good reason. Has my phone been "pwned" and I just don't know it? What is the REAL risk here?

    18. Re:You have to be kidding by gstrickler · · Score: 2

      Since when is the iOS more secure?

      Headline says "safer", not "more secure". Safer != more secure. A Windows 95 machine that is not connected to the internet is safer than a Linux web server, but it's certainly not more secure.

      BTW, most Android devices have Flash. If Flash isn't current (and even if it it), it's likely your device can be rooted by a website. I haven't heard about targeted attacks on Flash for Android, but Flash for Android has most of the same vulnerabilities as Flash on the desktop.

      --
      make imaginary.friends COUNT=100 VISIBLE=false
    19. Re:You have to be kidding by chrb · · Score: 5, Interesting

      I don't think that is the reason that we hear more about Android malware, although it may be a factor. The barrier to entry of becoming an iOS developer is: buy a Mac (Intel Mac Mini will do), pay $99, sign up on web site. The barrier to entry of becoming an Android developer is: buy a PC (any will do), pay $25, sign up on web site. You could argue that the cost of a Mac Mini is prohibitive, or that hackers are less likely to own a Mac and begin hacking around on iOS in the first place, but for serious malware authors these are not significant barriers.

      The real reasons that we hear more about Android malware:

      1. Android users can enable installs of apps from non-official markets and random web sites. Many of the reported malware apps come from these kind of sites. But users have to explicitly do this, no phone ships with random web sites enabled as app stores. These same users, having enabled random app sources, then presumably don't bother to check the permissions that the app they install requests.
      2. Android allows apps to send premium rate SMS messages and calls without an explicit popup. I personally think Google should probably kill this ability, but then I never call premium rate numbers. Blocking premium rate texts would kill the profit incentive for most malware. If this were an explicit, in your face, permission or setting (like the big warning for data roaming in settings!), then we wouldn't have seen any premium SMS fraud malware.
      3. Apple marketing is happy for the media to push the "no iOS malware" angle in the same way that they did successfully with "no OS X viruses". It isn't strictly true, but people believe it anyway, and there is a huge class of users who are willing to pay more for the belief that there will be fewer problems in future. Malware that affects a few thousand people really isn't important in the big scheme of things, but it is something that marketing can use to try and differentiate iPhones in the eye of the consumer from very similar and equally capable Android phones.
      4. Apple fans are pushing the "Android is full of malware" meme extensively, even though very few Android users have actually been affected. Is malware an issue that should be dealt with? Yes, but these same Apple fans who argue that Android is "straining under the weight of malware" after a few thousand users have been infected, are also the ones who claim that half a million infected Apple desktops is no big deal.

      History has shown that a monoculture is actually more vulnerable to attack. There were some very skilled virus writers back in the 80s who innovated with polymorphic, anti-virus proof code, hidden boot sector infections etc. For whatever reasons, these kinds of hackers moved on to other projects, and what we see now in the virus/malware sector is mainly an industry driven by financial profit motive. iOS has had root exploits, and getting an app on the iPhone app store isn't that hard. Maybe they scan code and do some static analysis to try and spot dodgy functions, but at least one person has gotten malware into the iPhone app store, so it is certainly possible. I really do think that the only reason this hasn't been done is due to the explicit permission that the iPhone requires to send a premium rate SMS. If people ever start doing widespread banking on the Android/iPhone, or Android/iPhone malware ever becomes a populist hobby again (like viruses of the 80s), then I'm sure there will be more. An X-Prize, designed to stimulate malware production on either platform, would almost certainly produce results.

    20. Re:You have to be kidding by AmberBlackCat · · Score: 1

      Since when is the iOS more secure? The latest Android has a very stable code and a solid permission system that allows the user to set exactly what an app can or can't do. This in contrast to an OS that can be rooted by a fucking website.

      None of that matters as long as that version of android doesn't exist on any Android phone sold.

    21. Re:You have to be kidding by Anonymous Coward · · Score: 0

      Here You go: http://www.google.com

    22. Re:You have to be kidding by kthreadd · · Score: 1

      What about security updates, are they also delayed for months (or never shipped?) to most Android phones?

    23. Re:You have to be kidding by Anonymous Coward · · Score: 0

      Thanks, moron, I've been using that for a week and it's of no use.

    24. Re:You have to be kidding by thegarbz · · Score: 2

      You would have a point in the case of a killer app, or an only app. In the case of the SSH app, simply pick one of 20 other SSH apps in the market place. Typically for most things you want to do on your mobile there is ample choice available.

      The only time this breaks down is when you're forced to use an app for a specific purpose due to popularity. If for instance Draw Something suddenly needed a stupidly unrealistic set of permissions then you'd have something there, but the app would likely drop in ratings quite quickly too.

    25. Re:You have to be kidding by kthreadd · · Score: 4, Insightful

      I like Android, but what has kept me away from it is that I have not found an Android phone that consistently gets new updates after they are released for a long period of time. Sure, Apple makes mistakes like this but the important thing is that they shipped an update and basically all affected phones got it even if they were a couple of years old.

      Let's say that the same thing happened to Android. How large percentage of Android phones would even get the update at all?

    26. Re:You have to be kidding by multi+io · · Score: 2

      Android requires that you give consent, since it tells you what permissions the application needs prior to installing it. So by very definition, these data leakages on Android are not malware. The user said it was ok for that application to collect that data.

      Does that mean that there can never be malware on an operating system like Windows which (AFAIK) doesn't have a mechanism for the user to "say that it's ok for an application to collect that data"?

    27. Re:You have to be kidding by yoctology · · Score: 2

      But consent has to be informed. What are the implications, amount, frequency, and potential commercial exploits of the data you are giving permission to use?

    28. Re:You have to be kidding by AmberBlackCat · · Score: 1

      Android requires that you give consent, since it tells you what permissions the application needs prior to installing it. So by very definition, these data leakages on Android are not malware. The user said it was ok for that application to collect that data.

      If all users factor out the apps that require these kinds of permissions, how does the set of Android apps compare to the set of iPhone apps?

    29. Re:You have to be kidding by shoehornjob · · Score: 1

      The latest Android has a very stable code and a solid permission system that allows the user to set exactly what an app can or can't do.

      Therein lies your problem....the user. Oh and it doesn't hurt that a large portion of the marketplace is crawling with malware. Google does not do a good enough job of policing the apps and end users can't be relied on to secure their machine.

      --
      "We are just a war away from Amerikastan. When god vs god the undoing of man." Dave Mustaine
    30. Re:You have to be kidding by youn · · Score: 2

      iLOL, what makes you think so :p

      --
      Never antropomorphize computers, they do not like that :p
    31. Re:You have to be kidding by mkraft · · Score: 4, Insightful

      I'm not sure why this was modded insightful, let alone +5 since if you read TFA you'd know that they weren't saying that iOS is more secure, only that there are virtually no delivery mechanism for malware because of Apple's app store policies of requiring real world identification of an app author to publish apps in the app store. That and iOS apps are more restricted in what they can do over Android apps.

      That's the problem when articles like this hit Slashdot. Rabid fanboys (Apple and Google) start posted without even reading the article. The same thing with modders.

    32. Re:You have to be kidding by Anonymous Coward · · Score: 0

      Unfortunately, OP was referring to a website that worked for iOS 4 rather than iOS 5. It exploited a security flaw in the iOS pdf viewer to gain root and jailbreak the device. For you, who who want to unlock your phone's radio in addition to jailbreaking, I'm afraid you're currently out of luck. blog.iphone-dev.org has a tool that will allow you to jailbreak, but if you updated the phone normally, your baseband (the phone software on your phone) doesn't have the exploit ultrasn0w (dev team's unlocking firmware) needs to work properly, and your phone can't be unlocked illegitimately. however, if you're in the states, you can take your phone to a friend with an AT&T contract and they should be able to get it unlocked for you (just did that myself last week, takes a couple of days). Hope that helps.

    33. Re:You have to be kidding by Nemyst · · Score: 2

      So basically the only way would be protecting users from themselves?

      Do you see where that'd be going?

    34. Re:You have to be kidding by Nemyst · · Score: 3, Interesting

      Get a Nexus phone? They tend to get extensive updates, and once your warranty's up/official support dries up, you're guaranteed to be able to flash to Cyanogenmod or any other distribution you can think of thanks to unlocked bootloaders and the inherent popularity of the device.

      For anyone remotely tech savvy, it's the logical choice.

    35. Re:You have to be kidding by MacDork · · Score: 3, Insightful

      What about the Path app. It would steal your address book and private photos. It's recent and very high profile. That's not malware?

      I find it very suspicous that their "empirical analysis" didn't uncover a single bit of "malware" on iOS. Mod article Troll.

    36. Re:You have to be kidding by MoronGames · · Score: 2

      Android requires that you give consent, since it tells you what permissions the application needs prior to installing it. So by very definition, these data leakages on Android are not malware.

      Do you really think that a significant number of users actually read what permissions they are giving to applications? The problem is that most users are not to be trusted!

      --
      hey!
    37. Re:You have to be kidding by Deorus · · Score: 4, Insightful

      Wow! What a fair and unbiased comparison! A year old iOS version that anyone with an at least 3 year old iPhone could and should have upgraded from, versus the latest Android version that most people can't upgrade to! Rated Insightful, of course, because there's a lot of circle jerk insight in that nonsense of a post!

      This is not even to mention that the article has nothing to do with the security of the platform itself but rather its exposure to malware, but hell, let us make it about security and debate the merits of each platform, shall we?

      I find it interesting how ignorant some Android fanboys are regarding iOS' sandbox, which is extremely restrictive and does not, by design, allow apps to do anything too fishy even if all permissions are granted. At most an app may be able to pull up your contacts without your permission or access call information, but not much beyond that without the user being notified unless they pierce through the sandbox. An app can't keep itself running in the background for longer than 10 minutes (unless specific profiles that permit so are chosen and approved by Apple for each app), run any kind of code not present during the approval process (meaning it's not OK to download code unless it's an in-app purchase, which may be free, and this includes interpreting code other than HTML and Javascript on Safari, which is why emulators are not permitted), launch or interact directly with other applications unless they register themselves as resource handlers (even running a secondary executable within your own application will result in iOS completely obliterating it without even bothering to inform any attached debuggers of what happened).

      In essence, the article hits the spot by claiming that it is the screening process and its walled gardens that keep the nastiness away. It's simply not worth developing malware for iOS, you don't have much to gain by doing it, either you pierce through the sandbox and your app will be rejected (with potential consequences to your developer and / or publisher certificates) or you can be easily detected by any user. There are exceptions, of course, but compared to Android, they are very few in number.

    38. Re:You have to be kidding by jfengel · · Score: 2

      Good question. My Droid won't even run the latest release, and I have no idea how good they are about security updates for out of date releases.

    39. Re:You have to be kidding by Anonymous Coward · · Score: 0

      You could make the permissions meaningful and more fine-grained. The clueless user would still click-through anyway, but the clued-in ones would pay attention to the and ask themselves if the app/game really needs those permissions.

    40. Re:You have to be kidding by MacGyver2210 · · Score: 2

      Not to mention Apple has a huge cert process for their iOS store, versus basically anyone being able to code and upload to the Android markets. They do some minor "known problem" screening, but largely it is up to the user to determine what they allow the software to do on their device.

      That said, it is the fact that people who are too lacking in knowledge(stupid seems a bit harsh) who use Android are at a greater risk than if they use an iOS device, because Android actually allows you to control your device and allow it to do things that are dangerous in the hands of the computer-knowledge-deficient(aka, your average Apple customer).

      If you can't read a list of settings and pick out that a flashlight app doesn't need to access your SD card and make calls/charges on your account, please get an iPhone instead of becoming a misrepresented Android statistic. You'll be happier with the device that does all the thinking for you.

      --
      If the only way you can accept an assertion is by faith, then you are conceding that it can't be taken on its own merits
    41. Re:You have to be kidding by del_diablo · · Score: 1

      Flashing is a activity that is not to be done. It is a sympthom of a manifacturer and carrier leaving its users to the wolves, instead of doing a proper job.

    42. Re:You have to be kidding by BasilBrush · · Score: 4, Interesting

      The Path app is not malware. It's still on sale on the App Store, and has 5 times as many five star ratings as any other rating, and litterally zero one star ratings. (the possible ratings run from one to five stars).

      Email addresses were uploaded simply to facilitate a find-my-friends feature of social networking.

      It was a naive implementation, because the same functionality could be achieved simply by uploading hashes of the email addresses. And it was wrong that in earlier versions it didn't explicitly ask the users permission to upload those email addresses.

      But there's no evidence of malign behaviour. Only behaviour intended to implement the advertised features.Therefore it's not malign software; it's not malware.

    43. Re:You have to be kidding by BasilBrush · · Score: 1

      Well, in country politics terms it'd be more like Sweden, and less like Columbia.

    44. Re:You have to be kidding by Sebastopol · · Score: 2

      So it depends on your definition of the word "is"?

      Gotcha.

      --
      https://www.accountkiller.com/removal-requested
    45. Re:You have to be kidding by PapayaSF · · Score: 3, Informative

      And besides Play Store does have accountability: every developer has to register, and pay a small one-off registration fee as form of identification.

      But as the article points out, Apple requires verification of a developer's identity, and Google does not, so a malware author who gets banned from Play can just sign up under a new identity.

      Plus:

      Beyond that, Guido said that Apple's iOS ecosystem has put controls in place that squeeze malware authors in other ways. An automated and manual application vetting system includes static analysis of compiled binaries that make it very difficult for developers to merely repackage malicious or legitimate applications for sale on the AppStore. That prevents infections of Trojaned applications like the DroidDream malware, which frequently popped up on Google's Android Market.

      --
      Q: What does the "B." in Benoit B. Mandelbrot stand for? A: Benoit B. Mandelbrot
    46. Re:You have to be kidding by BasilBrush · · Score: 1

      Android requires that you give consent, since it tells you what permissions the application needs prior to installing it.

      It's the wrong time to ask, and the information to make the decision isn't complete enough. For example, these days huge numbers of apps have social components, so permission to access the contacts list is not a warning sign. And at install time the user may only have a hazy idea of the features of the app anyway.

      If you're going to have a permission based system, the request for permission should come at the point in time when the restricted resource is about to be used, and should come with an explanation for why.

      Even them such permission schemes are of limited utility. If I was a malware creator who wanted access to the contacts list, I'd make sure that the malware was hidden in an app category where access to the contact list was normal.

      Positive vetting of apps is a far better scheme for weeding out malware.

    47. Re:You have to be kidding by MrHanky · · Score: 0

      The fact that it can silently upload personal data without user acknowledgement means other, lower profile apps can do the same. Since Apple didn't care about Path doing it, I'm sure it was OK for others to do it as well, which means they do.

    48. Re:You have to be kidding by Anonymous Coward · · Score: 0

      Sundar Pichai's incompetence costed me my job. Fucking him and his fucking family!

      Your job was fucking Sandar Pichai and his family?

    49. Re:You have to be kidding by Anonymous Coward · · Score: 1

      Installing a new version of Windows is an activity that is not to be done. It is a symptom of Microsoft leaving its users to the wolves, instead of doing a proper job.

      Nobody would ever install a new version of Windows themselves.

    50. Re:You have to be kidding by Anonymous Coward · · Score: 0

      You're comparing a year old iOS version to the latest and greatest Android this is on all of two brand new shipping devices (Galaxy Nexus, HTC One X) and maybe two other previous devices (Galaxy SIII, Transformer Prime)? You have to be kidding.

      Remember Gingerbreak? Know how many devices it -still- works on because carriers and manufacturers let Android devices rot without updates? How about DroidDream? Same trouble. I refer you to here here and here for a comparison of device update percentages.

      The gist of the article is that Apple's app review process is better and therefore there's no malware, and that's true - but they don't take into account jailbroken software, which is a valid point - JB introduces OpenSSH bugs if you install that and keep default settings, and opens up the possibility of other software from Cydia that is potentially malicious. But you know what device has no malware right now? iPhone 4s on 5.1. There's no jailbreak, no bootrom exploit, and no malware in the appstore except by the metric of "Downloaded a social app; had my contacts uploaded." While skeevy, that's not malware except by the most inane and permissive definition.

      Stable code? Tell that to everyone with the Galaxy Nexus accelerometer glitch. It's fixed in the latest Android you say? Well look at that! So is the iOS "website root"! Solid permissions? Well, sure. Except with ROP code in a malicious app, you can write an app for Android and put it in the market that will write garbage to your entire SD card and steal all of the other app's data while you're at it. There's still no sandbox for Android like there is in iOS. Yes, that enables you to do nifty things like change launchers and change keyboards and Android is open and customizable and so on and so on. Awesome. You're on slashdot, so you're already way above Grandma and the 99% (that would be a great band, by the way) and you can take care of yourself. For most folks, iOS is still safer and more secure.

    51. Re:You have to be kidding by Anonymous Coward · · Score: 0

      The 4S was jailbroken months ago, and the iPad 3 was within days of its release.

    52. Re:You have to be kidding by Deorus · · Score: 1

      That didn't stop them from comparing it to the latest version of Android, though...

    53. Re:You have to be kidding by Anonymous Coward · · Score: 0

      You mean like that "copy & paste" update that took years? I really appreciate them taking forever to get that one out...

    54. Re:You have to be kidding by Anonymous Coward · · Score: 0

      How many devices are running the latest Android build again?

      Don't much matter if "the latest code" fixes the issue if nobody's running "the latest code."

    55. Re:You have to be kidding by Anonymous Coward · · Score: 0

      You are correct that uploading contacts was a common practice for social apps.

      However if you had RTFA, the point is that Apple can fix these things on a policy level (which they did) and developers have to comply or be banned for all eternity.

    56. Re:You have to be kidding by Plunky · · Score: 1

      And in fact I'd prefer to see a method where you can say "No permission for that" and yet still install the app because the app does not get to know what permissions you gave.. eg for reading email contacts, then it would think they read ok but find none. In fact, if you could approve contacts individually or by group, then you could have a set of fake friends that you might allow a suspicious app to see (and make it so that your inbuilt contacts app can't see them, so they don't clutter up your contacts list :)

    57. Re:You have to be kidding by Dr_Barnowl · · Score: 3, Interesting

      .NET gets this right, as it happens - the administrator can grant or deny permissions on a fine-grained level, on a per-app or per publisher basis. The downside to that, though, is that if your app isn't well written, the permissions exception will kill it, which is a big no-no on a phone.

      You can do automatic static analysis to determine which APIs the app calls, which provides a list of permissions it might request, but doing analysis to check that it copes with permission denied exceptions is much harder, so you can understand their choice.

      What really sticks in my craw is that despite doing this static analysis, and providing this information on the Android market, you can't filter the listings based on the permissions that an app requests.

      Anecdote : my wife wanted a bible reader app. I couldn't find a single one, paid or free, that didn't want what I considered an unnecessary level of permissions for something that is essentially an offline eBook reader. What the hell does a bible app need SMS, or contact list access for? In the end, she just installed the one she liked the look of the most, even though I couldn't say I approved of any of them. And I'm sure most people won't even consider it, and click through.

    58. Re:You have to be kidding by Anonymous Coward · · Score: 0

      Seriously?

      1. Which of those 146 SSH apps do you choose, and how? Because there are 20 SSH apps that are ripoff clones of the most popular brand names alone. Plus another 126 that either have "ssh" in the name for no clear reason, are wallpaper of a singer's heinie, or other such trash. Ample trash, but trash.

      2. Nowadays, every other app developer seems to think that their app needs a "social" component --Facebook or Twitter integration, so you can "like" or "share" or otherwise shill the app right from within the app itself. Good luck finding the app that does just want you want and DOESN'T want to snarf your contacts. They're getting to be pretty rare.

      *Hahahaha, I just looked. 146 apps with "ssh" in the name. Ranked by popularity, the first actual SSH client was #9 on the list, #2 by relevance. Hahahaha.

    59. Re:You have to be kidding by Anonymous Coward · · Score: 2, Interesting

      6. Because it's amusingly easy to publish an app on Google Play--any app that does any darn thing. You just...publish it. Done. OTOH, you need to get your app past an actual human reviewer and Apple's automated software checkers to publish on the App Store. It's not just a little harder to publish crap on the App Store than Google Play, it's a lot harder.
      7. Because Apple is usually pretty quick for a giant monoculture to jump on actual malware apps. While Google has a history from day 0 of letting malware slide and slide and slide until it's a serious problem and then letting it slide a little longer.
      8. Because the Android Faithful like yourself are quick to defend Google's Wild West policies towards apps and their market. rather than decry those policies. Google Play is a mess, a stinking mess. If you really love Android, you should be the first to complain about that mess, rather than defend it.

    60. Re:You have to be kidding by Anonymous Coward · · Score: 0

      We've got a Nexus S at work. Nice piece of hardware.

      Last week I tried to install a simple magnifier app on it (uses the camera, zooms the image on screen). I tried about a dozen, most of them are full of horribly annoying ads, and not a single one of them was actually able to zoom. Apparently this is some flaw with the Nexus S, because there are lots of comments from people with the same version. Wasted 2 hours on what should have been a 2 minute job.

      Then I tried the new Explore by Touch feature to see how it compares to VoiceOver.. Pretty buggy, something as simple as dialing a phone it sometimes says "dash" instead of "1", and sometimes activates a button when you push the one next to it. Lots of times it says the wrong thing.

      The nexus phones are ok, but I still much prefer my iPhone for actually getting things done. It's just miles ahead in polish.

    61. Re:You have to be kidding by BasilBrush · · Score: 3, Informative

      You're showing your ignorance again. Apple did care about it, and that's what got the rule about asking for user permission before uploading contact details came from. A rule which Path now adheres to, which is why it's still in the App Store.

    62. Re:You have to be kidding by SuperKendall · · Score: 1

      You mean like that "copy & paste" update that took years? I really appreciate them taking forever to get that one out...

      Actually I do because they did it right to start with.

      The delay to fix notification center is what you should gripe about since there's nothing special in the fix they did for that.

      But really your complaint is pretty irrelevant now that it is done.

      --
      "There is more worth loving than we have strength to love." - Brian Jay Stanley
    63. Re:You have to be kidding by Anonymous Coward · · Score: 0

      So if you have an old non-Intel MAC, are you saying that the company who makes it sucks donkey balls because they don't update their old hardware?

      I have a Nexus One that I haven't rooted or used a custom ROM (yet). It's still receiving updates (perhaps not to 4.0, but 2.3.x and bug fixes / updates to individual app [browser, market]). Nexus S and Galaxy Nexus which have much more app storage space are receiving updates (and should continue to do so as long as the hardware allows).

    64. Re:You have to be kidding by thegarbz · · Score: 1

      Actually why do you need to block the data and ultimately kill the app? Why not feed it bogus information when a user denies access to an actual contact list? Let the app think it sent an SMS, let it think it dialled a number which failed to connect, or let it think your contact list actually has 50 people called Joe Bloggs in it. Just a thought.

    65. Re:You have to be kidding by Spykk · · Score: 1

      Counting "malware" is a ridiculous way to judge security. If I sat down and wrote 1,000 linux programs that did bad things if you were dumb enough to run them as root would I have made linux less secure?

    66. Re:You have to be kidding by thegarbz · · Score: 1

      Flashing software on some phones is no different than installing a new OS on a computer, or even an update. Every manufacturer pushed software upgrade is either done via a computer using some form of download mode on the phone, or they can even be done over the air.

      In the case of Cyanogenmod and clockwork recovery flashing a phone can be done from an app. This makes it no different to installing a service pack on a computer except it's much faster to do.

      Anyone with an aversion to flashing doesn't understand the process and how little the risks are. This is not like flashing a new bios in the 90s where a floppy drive read error could brick your entire computer. The process on many phones is quite foolproof.

    67. Re:You have to be kidding by lanner · · Score: 2

      First off, I want to say that I own a Nexus One and really like my Android phone. I have no intention of going iPhone. I get to hands-on with iPhones all the time and I still like Android better. I both iPhone and Android to everyone, they are both awesome compared to old stupid phones and Blackdeathberry.

      That being said, the truth is that Apple does a much better job at releasing updates and supporting older phones than ANY Android phone manufacture out there.

      Obviously, Apple has a much much easier time since they have fewer phone models than you do fingers, where the various Android manufactures have hundreds if not more than a thousand phones to choose from. Those manufactures do a very poor job of releasing updates for their phones.

      The last update Google/HTC released for the Nexus One was 2.3.6 (GRK39F) in September of 2011. The phone is not yet three years old now and it's basically dead from a development standpoint. I have to go to community mods and rooting my phone for a better experience.

      Meanwhile, Apple releases updates for three years. The 3GS, which came out before the Nexus One, is still fully supported by the latest iOS!

      Reference: http://theunderstatement.com/post/11982112928/android-orphans-visualizing-a-sad-history-of-support

      I want everyone to know this because it will force the Android phone makers to shape up. Why buy an Android, which will barely get one year of feature updates, if ANY OS feature updates, when an iPhone will last you three years (assuming you don't break it first).

    68. Re:You have to be kidding by RulerOf · · Score: 1

      Actually why do you need to block the data and ultimately kill the app? Why not feed it bogus information when a user denies access to an actual contact list?

      It's funny that you bring that up. In Windows, UAC does these things for a non-elevated app. The problem is that, even though MANY applications would work just fine with this type of filesystem and registry virtualization, they force a UAC elevation prompt through their manifest anyway.

      Or they register and install a system service that runs ALL THE TIME to do their dirty work for them. *Casts a dirty glance at Steam*

      Developers won't work within the confines of such a system because it's infinitely easier to get a user to click "Yes" on the prompt that allows their app to just bypass it entirely. And the developers that WILL work within such confines are the kind of people that wouldn't have an ulterior motive for you to install their app anyway.

      --
      Boot Windows, Linux, and ESX over the network for free.
    69. Re:You have to be kidding by dave87656 · · Score: 1

      Can't imagine that a company called "iSEC" would be biased on this matter.

      Then you might think that the Patriot Act is about patriotism??

    70. Re:You have to be kidding by BasilBrush · · Score: 1

      The ultimate question is how likely is it that a user of a particular system will get malware or get hacked. Reducing that number is what security measures are all about. If there is a lot of malware around for a system, then obviously users are more likely to get it.

      You can argue all you like about the security features of Chubb and Yale locks, but if lots of Chubb locks are bypassed by thieves and virtually no Yale locks are, that would be strong evidence that Yale is more secure.

    71. Re:You have to be kidding by Spykk · · Score: 1

      Let's try a hypothetical example:

      KnoxOS is so locked down that the only way to install software on your machine is to mail your passport and a hand-written request to the company that wrote it.
      BasementOS is written in javascript, tries to execute anything it receives on a socket and has a mandatory root shell with no password accessible on port 23.

      KnoxOS runs on the security system at fort knox while BasementOS runs on a super nintendo in someone's basement. Several trojans are written for KnoxOS because everyone wants that gold, but they are never installed because the admin isn't stupid. Zero malware is written for BasementOS because nobody cares about some basement dwellers super nintendo.

      If we apply your metrics, BasementOS is more secure than KnoxOS.

      Any sufficiently advanced operating system can have malware written for it. Counting how many trojans are written for an OS might give you an idea of how valuable of a target it is, but it doesn't tell you how secure it is.

    72. Re:You have to be kidding by BasilBrush · · Score: 1

      There's a very big difference between in the wild malware and not in the wild. Clearly malware thats not in the wild is irrelevant. Hence in your made up example, both OSs would be the same.

    73. Re:You have to be kidding by Anonymous Coward · · Score: 0
    74. Re:You have to be kidding by wintersdark · · Score: 1

      Jailbreaking allows you to install unsigned apps. Unlocking is what you need, though in order to unlock you typically need to jailbreak (depending on your carrier, it's sometimes possible to get an official unlock).

      Further, it depends on which 3GS you have - new or old bootrom. Old bootrom 3GS's can always be jailbroken by redsn0w - and it can tell you which bootrom you have.

      There is a tethered 5.1 jailbreak right now(Limera1n should work on your 3GS), but if you power cycle (manually or run your battery dead) you need to start your phone in DFU mode and use redsn0w to do a tethered boot. If you are out and about, and unable to plug into your PC and boot tethered, you can use the semi-untether in Cydia to unlock basic phone functions but you'll still be unable to use Safari or any unsigned apps until you can do a tethered reboot.

      Finally, as for unlocks: I'm unsure if this works on 5.1 or not, but there's a current bug with Apple's activation servers allowing you to fully unlock your phone for a specific SIM. The unlock is tied to that particular SIM, however, so you can't swap it for another carriers SIM later. Directions for this can be found, with links to the newest redsn0w and other valuable information, on the iphone devteam blog here: http://blog.iphone-dev.org/

      --
      Meh.
    75. Re:You have to be kidding by wintersdark · · Score: 1

      Gah, forgot the unlock link:

      This probably won't last long, but once your phone+SIM is unlocked it'll stay that way.
      http://laforeta.blogspot.co.nz/2012/04/how-to-spoof.html

      --
      Meh.
    76. Re:You have to be kidding by Anonymous Coward · · Score: 0

      Email addresses were uploaded simply to facilitate a find-my-friends feature of social networking.

      They didn't need to upload email addresses to find friends. They could have just as easily uploaded one way hashes of those addresses. They got busted stealing private data. They got a letter from freakin' Congress! That's no simple 'Oops' you play it off to be. Their app was approved AND it's still on the app store. They should have been shut down as malware and keys revoked. Apple isn't protecting anyone but Apple.

  4. what counts as malware.. by gl4ss · · Score: 5, Insightful

    ..and how would they detect it on the ios? they just said that there is _zero_ malware, yet there's plenty of ios games/apps which leak all your contact info?(as is there for android).

    (and the accountability part is that it takes a little more checks to get yourself identified as a publisher for itunes appstore.. however.. it doesn't take that much, there is and has been plenty of unauthorized distribution of asian comics etc there)

    I haven't identified any iOS malware either, but that could be because I haven't looked for any(just not my field).

    --
    world was created 5 seconds before this post as it is.
    1. Re:what counts as malware.. by pankkake · · Score: 4, Informative

      Malware has been accepted in the Apple App Store, TFA is bullshit.

      --
      Kill all hipsters.
    2. Re:what counts as malware.. by BasilBrush · · Score: 3, Insightful

      As a tul of thumb:

      Uploading your contact data for the purposes of expected social connections within the app is not malware. It's not the way it should be done, and poses a security risk if the server is compromised. But there is no mal-intent there. Nevertheless such practice is now explicitly banned without asking the users permission via a dialog at the time.

      Uploading your contact details to a server for the purposes of mailing lists, tracking outside of the intended application domain would be malware.

      The former is what was flagged up for iOS.

      Android meanwhile suffers from both, and much, much worse, such as malware sending premium rate SMSs, thus potentially causing users severe financial losses.

    3. Re:what counts as malware.. by wvmarle · · Score: 5, Funny

      No, no, no. Totally wrong. If it's reviewed and accepted for listing in the App Store, then it's not malware. So the App Store is by definition 100% malware free. QED.

    4. Re:what counts as malware.. by chrb · · Score: 5, Insightful

      ..and how would they detect it on the ios?

      Good point. The security researchers who identified some of the Android malware visited third party Android app stores and downloaded all of the apps so that they could build up a huge app corpus, which they could then scan (static analysis) for malware suggestive signatures. They stated that they couldn't do the same with the iPhone because Apple prohibits mass downloading of iPhone apps in order to build an iPhone app corpus. So the only people who can look for malware across the whole range of iPhone apps is Apple, and it seems unlikely that they would announce if they found any malware, when they can instead just silently remove it from the app store.

    5. Re:what counts as malware.. by Anonymous Coward · · Score: 0

      News of app removals travels fast in the Mac world, because there are many sites that scan the store to see what contents do exist. Apple even has RSS feeds for when new apps are posted these sites can use, so even if the removal happens within a day, someone will notice.

      And Apple does admit themselves when malware spreads via their OS X system.

      http://support.apple.com/kb/HT5244 http://support.apple.com/kb/HT4650

  5. Freedom has it's risks by Zico · · Score: 5, Insightful

    Guess what?! Freedom comes with risks! I don't make any decision until I weigh the pros and cons and do a bit of research, and yes, this includes any and all apps I may want to use.

    1. Re:Freedom has it's risks by Anonymous Coward · · Score: 2, Insightful

      Freedom has little risks compared to looking to be "taken care of".

    2. Re:Freedom has it's risks by vakuona · · Score: 4, Insightful

      And that is why the Android model is flawed. Not fatally mind you, but flawed nonetheless.

      You can't expect people to have to audit every bit of software that they install on their smartphone. In fact, it ought to be reasonable for users to expect software they download off the official repositories (App Store, Market) to be malware free.

      And yes freedom comes with risks. But freedom also allows users to choose a phone that doesn't require them to expend more effort than necessary to be able to do what they require. Don't forget, a smartphone is a luxury, not a necessity.

    3. Re:Freedom has it's risks by marcello_dl · · Score: 2

      > to choose a phone that doesn't require them to expend more effort than necessary to be able to do what they require

      Am reading this the day after having to perform a forced itunes upgrade (no not on my boxes of course)

      --
      ---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
    4. Re:Freedom has it's risks by squiggleslash · · Score: 5, Insightful

      If you ever feel like it, buy yourself an Android device (one with Google), and actually try buying some software - or even downloading stuff from a third party website and installing it directly.

      You'll notice that "auditing every bit of software (you) install" is ridiculously easy. The installer tells you what rights the app needs when you install it. It's pretty easy to determine that a game does not need to capture your keystrokes, and if a cool tool to change the wall paper needs "access to your Google account" then there's obviously something odd going on.

      If an app doesn't ask for a particular right, Android's security model prevents it from doing whatever it was that required the right in the first place.

      By comparison, as I understand it, I only have Apple's (and a developer's) word that a particular tool for iOS doesn't contain malware. I'm not going to be told what parts of the system it needs to access, I just get a straight "Do you want the advertised features or not?" choice.

      The flaw here is on Apple's side. Both systems require you audit the apps you install. Only Android actually lets you do that.

      --
      You are not alone. This is not normal. None of this is normal.
    5. Re:Freedom has it's risks by QuasiSteve · · Score: 5, Insightful

      It's pretty easy to determine that a game does not need to capture your keystrokes, and if a cool tool to change the wall paper needs "access to your Google account" then there's obviously something odd going on.

      Certainly, but even when setting aside that people ignore this all too easily because they simply want the shiny, your examples are obvious.

      What if a chat app wants access to the internet, your contacts, and your phone?
      Well the internet makes sense - can't very well expect an app that is intended for chatting to not have that connectivity.

      Contacts also makes sense because in combination with the phone, it allows the app to send a text message if you have no internet connectivity or simply choose to use SMS instead of its internet-based chat functionality.

      So you install the app, and the app sends all your text for datamining to China, all of your contacts to some company in Bulgaria, and sends a bunch of texts to expensive SMS service numbers.
      Oh, and it also lets you chat with people, so as far as you know, it's doing exactly as advertised.

      This is no different on any other platform, of course. It may have been different in the early days of the iPhone, but I rather doubt that they still check each and every app before making them available and instead rely on exactly what the article says.. accountability.. you only get away with malware once unless you also manage to fool Apple into allowing you a new account. But to the end-user(s), the damage is already done anyway.

    6. Re:Freedom has it's risks by betterunixthanunix · · Score: 1

      Don't forget, a smartphone is a luxury, not a necessity.

      This may change over the next few years, if efforts to turn smart phones into payment devices gain enough traction. You might find yourself in a store that is not equipped to handle transactions by any means other than smart phones (or paper money, but for something items paper money is a bit impractical -- do you really want to hand someone a wad of $20 bills when you buy a new matress?).

      --
      Palm trees and 8
    7. Re:Freedom has it's risks by BasilBrush · · Score: 1, Insightful

      Guess what?! Freedom comes with risks! I don't make any decision until I weigh the pros and cons and do a bit of research, and yes, this includes any and all apps I may want to use.

      That's a pretty high cost. A bit like living in a ghetto, and having to consider your personal safety every time you go out, versus living in a nice, safe, pleasant community.

    8. Re:Freedom has it's risks by BasilBrush · · Score: 0

      There's no such thing as a forced iTunes upgrade.

    9. Re:Freedom has it's risks by Anonymous Coward · · Score: 0

      Here's the reality: only a unbelievably small subset of people will even look and/or understand/or care about that permissions message. This is a trope that drives me nuts. YOU, poster, need to understand that your tech level != almost everyone else. And aside from that, do you test your water every time you drink it? Do you test your meat every time you buy it? This list can go on forever. Not everyone can have knowledge of everything.

      This is the same reason we have governments, FDA, etc etc. It's much easier to have an inherent trust than having to make sure everything you use (be it water or android apps) is safe. Sometimes shit happens, but on the whole, you can see which one works for more people.

    10. Re:Freedom has it's risks by FireFlie · · Score: 0

      If you want to continue using your phone there is. I upgraded two iphones in my home at one point. Turned out we lost access to our phones because itunes was too old. We had to upgrade our os before we could update itunes just so we could load our music and applications.

    11. Re:Freedom has it's risks by BasilBrush · · Score: 1, Insightful

      You CHOSE to upgrade your iPhones to the latest iOS version, that iOS version wasn't supported by the version of iTunes you had on your computer, so you CHOSE to upgrade iTunes too.

      The fact that one software product is only compatible with certain version numbers of another software product doesn't make for a forced upgrade.

    12. Re:Freedom has it's risks by jedidiah · · Score: 2

      No. He was forced to upgrade his software and devices because of the restrictive nature of Apple products. Being told that you can either upgrade or lose access to your personal property is not a "choice", it's coercion.

      --
      A Pirate and a Puritan look the same on a balance sheet.
    13. Re:Freedom has it's risks by jedidiah · · Score: 1

      So what you are advocating really is extensive government meddling in the app stores.

      Either that you you don't fully understand what sort of government oversight occurs within our food and water supply.

      --
      A Pirate and a Puritan look the same on a balance sheet.
    14. Re:Freedom has it's risks by BasilBrush · · Score: 0

      No one told him to upgrade or lose access to his personal property. If he'd have done nothing he wouldn't have lost access to his personal property.

    15. Re:Freedom has it's risks by Sebastopol · · Score: 1

      And that's why only a fool would buy a gun that might blow up every 10th round fired.

      Enjoy your free STDs.

      --
      https://www.accountkiller.com/removal-requested
    16. Re:Freedom has it's risks by celle · · Score: 1

      The guy said itunes functionality on his phones failed due to the age of itunes and he had to upgrade his os to get the newest itunes to install. Yes, basil you dumbass it's coercion. Look up dependancies and understand they are not options but requirements and up to Apple to set them.

          Isec stated ios has 30% of the market which is probably a little high. Using the example of the desktop market, which part of the market would you write viruses and malware to get the best return for your effort for? The 30% part of the market or 70% part of the market. My educated guess it's the 70% but feel free to state any evidence with citations to contest my claims. The less than 30% share is the main reason ios is relatively malware and virus free and why Apple is a joke in the phone market just like in the desktop market. There's a reason Apple always is the first to fall in hacking contests and lack of security and accountability is it. Take your fanboyism somewhere else.

    17. Re:Freedom has it's risks by AthanasiusKircher · · Score: 1

      I weigh the pros and cons and do a bit of research, and yes, this includes any and all apps I may want to use.

      That's a pretty high cost. A bit like living in a ghetto, and having to consider your personal safety every time you go out, versus living in a nice, safe, pleasant community.

      Freedom is having the choice to live in the nice, safe community but also being allow to choose which community you live in, and also what communities you might want to visit -- maybe that ghetto has a great restaurant and a cool club, and you know that it's safe to visit them under certain conditions.

      Fascism (Apple) is being told that only one community exists, and by the way, here is the homeowner's contract with all the ridiculous conditions. "Oh, you don't want to pay for the pool? Oh, you want to put a pink flamingo in your yard? Sorry. There isn't anywhere else for you to go. You have to live here. Oh, and by the way, our community is safe, but we also have cameras up to spy on you all the time, even in your bathroom. Oh, and if you press the wrong button in the bathroom, those camera feeds can be viewed by a lot of other people too."

      Really... buying an app is like going anywhere and buying anything. When you buy from your local Mom and Pop retail store, you might trust them to have products that work correctly, don't break easily, etc. But you have to build up that trust by having a relationship with the store. On the internet, things are much worse, because the products aren't vetted by the local store. Hence, most people read a bunch of reviews on Amazon or whatever before they make a purchase, because there are a lot of crap products out there. The only difference with apps seems to be that they are so cheap that people don't think they should have to vet them.

      Really, it's like going anywhere on the internet, where you're likely to have cookies and scripts and requests from all sorts of third parties doing all sorts of things with your data (unless you install a battery of browser plugins and police everything in detail).

      Are these models perfect? No. But if you're going out anywhere on the internet without a "bulletproof vest" in the form of plug-ins that basically make the internet non-functional, you're already visiting a ghetto far worse than a lot of malware. And if you install anything on any device without understanding what it is, there's a similar problem.

      The solution to the app problem is easy, and it has been around for a long time. Freeware and shareware have existed on the internet for decades now, and within a few years after the start of the WWW, some websites became trusted repositories for getting "clean" applications. If you went outside those trusted places, you'd better know what you're doing.

      What the iStore does is a good service, but the problem is that you shouldn't be locked into relying on their terms and conditions (which may be more restrictive than some people would like in some ways, but much more lax than people would like in other ways). If I choose to use a different repository with different standards, I should be able to, and I can build up my feeling of trust with them, just as I would with my local Mom and Pop retail store. If I just download an app from some random place I've never heard of, I'd better vet it thoroughly first.

    18. Re:Freedom has it's risks by Anonymous Coward · · Score: 0

      You can't expect people to have to audit every bit of software that they install on their smartphone.

      With my blackberry, I don't need to.

      My blackberry lets me easily set permissions on applications so that I can grant or deny access to my email, sms, contacts, etc. I can selectively allow or deny internet connects by ip address & port.

      Isn't this kind of thing common on iphone & android?

    19. Re:Freedom has it's risks by BasilBrush · · Score: 1

      As classy as the username implies.

    20. Re:Freedom has it's risks by BasilBrush · · Score: 1

      The choice that you desire is exactly what you get with Android, with the result of lots of malware - including on the official stores(s).

      The safe app store plus the possibility of switching to ghetto stores if you desire it doesn't exist. As least not officially. The closest you can get to it is the iOS App Store + Jailbroken phone.

    21. Re:Freedom has it's risks by Anonymous Coward · · Score: 0

      Freedom has little risks compared to looking to be "taken care of".

      What risk are you taking by using apps that are not malware?

    22. Re:Freedom has it's risks by tlhIngan · · Score: 1

      You'll notice that "auditing every bit of software (you) install" is ridiculously easy. The installer tells you what rights the app needs when you install it. It's pretty easy to determine that a game does not need to capture your keystrokes, and if a cool tool to change the wall paper needs "access to your Google account" then there's obviously something odd going on.

      FAIL.

      That's an awful security measure, actually. For geeks, it might be OK, but it's as useful as the UAC dialog on Windows.

      This is known as Dancing Pigs (or bunnies) - given a choice between dancing pigs and security, they'll choose dancing pigs a vast majority of the time.

      On Android, people keep saying "third party market, meh" without analyzing WHY people use third party markets (hint: pirated apps). That laundry list of permissions? I just want the app dammit. (See: a user's PC infested with malware - probably from installing all those "codecs" to view their pr0n videos.).

      By comparison, as I understand it, I only have Apple's (and a developer's) word that a particular tool for iOS doesn't contain malware. I'm not going to be told what parts of the system it needs to access, I just get a straight "Do you want the advertised features or not?" choice.

      The flaw here is on Apple's side. Both systems require you audit the apps you install. Only Android actually lets you do that.

      On Apple's side, they have a developer's billing account and address - a developer writing malware has his name and address attached to the app. At worst, the address information is a year old (because they have to renew after a year). Just knowing that Apple can trace you down already cuts out a lot of malware. (It's the basis of the "verified developer ID" thing in the next OS X).

      As for apps like Path, are they malware? I mean, your Facebook app probably does the same thing, so how do you know it didn't take all your info? Hell, on Android, you can have pre-installed apps - see Carrier IQ.

      Also - even on Android, knowing a social network app can access contacts and the internet - it doesn't mean a single thing since most people expect that for social networking.

      So yeah, you can tell with Android what resources an app uses. But I can also bet that most users not only don't know what these resources do, but more importantly, no one knows why. And given that there are fake apps in there, it can be hard to tell if the legit app is the one requesting the resources or the fake one.

    23. Re:Freedom has it's risks by Truedat · · Score: 1

      Guess what?! Freedom comes with risks!

      And that is the most insightful comment so far, one that mentions freedom and risk are fip sides of the same coin. I know you say this in defence of android but it doesn't matter. Too many comments here try to argue that their chosen platform has all of the freedom without any of the risks or that the other teams platform has all of the risks without any of the freedom. But the truth is there are absolutely pros and cons to both sides and each person has to decide where they want to be in the scale.

    24. Re:Freedom has it's risks by nahdude812 · · Score: 1

      Contacts also makes sense because in combination with the phone, it allows the app to send a text message if you have no internet connectivity or simply choose to use SMS instead of its internet-based chat functionality.

      You didn't mention that it can send SMS in the permissions you listed, so the app is not able to.

      The ability to send texts is a separate permission (separate from reading texts and separate from placing calls or reading phone state). The SMS and Place Calls permissions are listed under a heading, "Things which may cost you money."

      If I was installing a chat app, as you suggest, which wants to be able to send texts, I would not install that app. There'd have to be a clear and compelling reason an app can send texts or place calls before I would approve it. The only times I've done so is when the app has been by a large and respected publisher (such as Google themselves), and even then I think about whether this is something I really would find much value out of.

    25. Re:Freedom has it's risks by marcello_dl · · Score: 1

      There's no such thing as saying "there's no such thing" in personal computing. You should know by now. The full story:

      -XP laptop's disk goes full, XP displays helpful dialog with options to compress stuff et al.
      -Apparently (I tend to avoid windows so I dunno) one of the options was to uninstall programs.
      -User sees a lot of programs never heard before and starts happily to uninstall.
      -User is happy because apparently he had removed some bloat and XP is way faster.
      -Later, user tries to launch iTunes. iTunes says "Quicktime not found, please reinstall iTunes".
      -User goes F#!@%KKKKK and phones me.
      -I get to the laptop and try to install quicktime. No backup of system files available, only documents (and a snapshot too old to be usable). Quicktime says: I'll install but you'll need to upgrade iTunes. Older versions of iTunes are available from third-party sites, I might as well put the laptop on rent as botnet node if I install from them.
      - So I go F#!@%KKKKK and upgrade
      - New version makes laptop swap sooner than usual. Playing mp3 playlists used to be done by my 166mhz mac, one could expect a 10x more powerful cpu with 5x the RAM to do the same 15 years laters huh?
      Of course that's not iTunes fault, but iTunes+XP+average user's, or who knows, mine since I didn't spend enough time looking for a solution. The upgrade was still forced.
      And they say linux is difficult. archive.debian.org FTW

      --
      ---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
    26. Re:Freedom has it's risks by Anonymous Coward · · Score: 0

      Guess what?! Freedom comes with risks! I don't make any decision until I weigh the pros and cons and do a bit of research, and yes, this includes any and all apps I may want to use.

      Hasn't it been said, "The price of freedom is eternal vigilance"?

      I will happily pay that price.

  6. Accountability by Anonymous Coward · · Score: 1

    Who is accountable for using wait instead of weight?

  7. Stats among rooted or jailbroken phones? by poity · · Score: 1

    Would the ability to run unapproved software make the infection rates in both of these subgroups near equal? I wonder how many out of all android device are rooted, and how many out of all ios devices are jailbroken. If a higher ratio of droid phones are rooted, with all else equal, then that could also push up the infection rates.

    --
    your thin skin doesn't make me a troll
    1. Re:Stats among rooted or jailbroken phones? by poity · · Score: 1

      Ah sorry I didn't rtfa. They focused on the availability of malware within each marketplace, which is another good measurement, though totally different from what I was thinking. Post rescinded.

      --
      your thin skin doesn't make me a troll
  8. Is this Covert Advertising for Apple's Ecosystem? by dryriver · · Score: 4, Informative

    Last time I checked, there were plenty of reports of malicious iOS apps clandestinely hoovering up your private data/contacts, and sending that bundle to the app's developers, who will use it for Lord-knows-what-nefarious-purpose. With this being the case, how can anyone possibly claim that iOS is "secure & malware free". The malware doesn't have to be a Trojan or Virus. It can also be a nasty little app that secretly sends your private data to a server somewhere that you don't even suspect exists. ----- I don't understand why Apple fans need to maintain a strange belief into the "infallibility" of Apple's ecosystem. Apple is plenty fallible in my humble opinion. And this is just another snide attempt to advertise the "Extra-Special-Specialness" of using Apple products.

    --
    Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
  9. Not a complete shock by darkonc · · Score: 2

    Most malware authors prefer anonymity. If we know who you are, you're not going to get much more than one shot at selling malware on our platform.

    --
    Sometimes boldness is in fashion. Sometimes only the brave will be bold.
  10. Time is precious by Anonymous Coward · · Score: 2, Funny

    the competing Android platform strains under the wait of repeated malicious code outbreaks

    Yeah, it's the waiting that I can't stand.

  11. Apple Fanboi article by Bysshe · · Score: 2

    For some reason I doubt Boeing would build a super secure phone on a flawed platform. Neither platform is inherently more secure than the other.

    --
    Read what I mean, not what I wrote.
    1. Re:Apple Fanboi article by Sponge+Bath · · Score: 3, Insightful

      I would not be so quick to label it Apple Fanboy.

      FTA: "despite accounting for <strike>more than 40%</strike> 30% of the same market."

      Seems like a jab at falling market share. I think the real motivation behind the article is inflammatory statements to get views.

  12. Begging the question by thePowerOfGrayskull · · Score: 1

    Thursday about an empirical analysis of existing malicious programs for the Android and iOS platforms shows that Google is losing the mobile security contest badly — every piece of malicious code the two identified was for the company's Android OS, while Apple's iOS remained free of malware,.

    Wait, what?

    An empirical analysis of existing malicious iOS and Android programs (which the article claims do not exist for iOS) shows that no malicious apps exist for iOS.

    Begging the question much?

  13. A price I'm willing to pay? by aoty · · Score: 2

    Of course a walled garden is safer than the wild west. I bought into Apple's ecosystem for my phone, because reliability and stability are very important qualities to me for that type of device. And I haven't been disappointed with my choice. Where this approach suffers is with my newly acquired iPad. The iPad is quickly becoming my laptop replacement; I do way more with it than is practical with my phone. I've started to bump my head on the roof of Apple's iOS. The limitations can be irritating. I'd be willing to sacrifice a little safety for more options. Perhaps that will come with time.

    1. Re:A price I'm willing to pay? by cyber-vandal · · Score: 2

      Yeh right because Apple want to lower their profits. You still won't be able to upgrade the storage either (unless you pay a lot of money for the crippled Apple solution or even more money for an 8GB flash add-on).

    2. Re:A price I'm willing to pay? by RyuuzakiTetsuya · · Score: 1

      Expandable storage isn't going to hurt apple's bottom line one bit. I mean, apple already sells an sd card and USB host socket for the iPad. Not only that but Dropbox and other cloud storage APIs can be used across the system. That's not the problem. The problem is data presentation.

      --
      Non impediti ratione cogitationus.
  14. waiting for a clue by 1u3hr · · Score: 4, Funny
    Slashdot: "the competing Android platform strains under the wait of repeated malicious code outbreaks."

    From TFA: "the competing Android platform strains under the weight of repeated malicious code outbreaks"

    It takes a determined idiot to make a spelling mistake when copying and pasting from a website.

    1. Re:waiting for a clue by Anonymous Coward · · Score: 2, Informative

      'Cept that if you read the comments in TFA, the original article had "wait" in it and was corrected.

    2. Re:waiting for a clue by Anonymous Coward · · Score: 0

      It takes a determined idiot to make a spelling mistake when copying and pasting from a website.

      Me thinks this might just be case of posting to slashnot from an iphone with auto-correct on!

  15. This just in by GameboyRMH · · Score: 4, Insightful

    Crushing authoritarianism leads to lower crime, worth the misery? Film at 11.

    --
    "When information is power, privacy is freedom" - Jah-Wren Ryel
    1. Re:This just in by Lehk228 · · Score: 3, Informative

      There already is a secure and fairly libertarian phone out there, blackberry. You can only load signed RIM OS's however you can loa any signed RIM image compatable with your phone, there are betas in the wild to play with, and you can install apps from the browser or the PC software that comes with it. You also have a detailed list of what you will and will not allow. You can allow wifi and bluetooth but block mobile, you can allow SD card but block email and contacts

      --
      Snowden and Manning are heroes.
    2. Re:This just in by BasilBrush · · Score: 2

      Reality check: it's a phone, not your life.

    3. Re:This just in by Microlith · · Score: 1

      fairly libertarian

      You can only load signed RIM OS's

      That's pretty authoritarian for a "libertarian" platform.

    4. Re:This just in by Microlith · · Score: 0

      Oh no, someone disagrees with Apple's control freakery, I should attack them!

    5. Re:This just in by Lehk228 · · Score: 1

      app and file loading is unrestricted, it is more libertarian than apple but vastly more secure than android. not sure how it compares to windows phone because nobody gives a shit about windows phone except people who invested a lot in their zune library

      --
      Snowden and Manning are heroes.
  16. Re:But the Apple factor? by flyneye · · Score: 2, Informative

    Don't you remember being a lil kid? Anything you want to do is safe as long as you have someone to blame.
    Accountablility=safety.
    Oh a security breach! It's Norms fault, Fire him!
    Problem solved, you're all safe now that Norm isn't coding for us anymore.
    For Security, just think different.

    --
    *Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
  17. Re:Is this Covert Advertising for Apple's Ecosyste by Clsid · · Score: 2, Insightful

    Call it whatever you want, but we just got the first major malware outbreak in OS X recently after so many years. On the iPhone that is unheard of. Much as in the Windows world and the much hated Vista security system that kept asking you, do you want to do this, or allow that?, that security model is fail since regular users will start saying yes to everything and then end up with a problem. Call Apple what it is, an overpriced hardware/software company that likes to keep the lid closed, but as far as their products running trouble free in general, I will have to agree with the article. But hey, everybody is free to think whatever they want.

  18. Re:"has kept Apple's iOS ecosystem free of viruses by flyneye · · Score: 1

    Well , I'm certainly not going to pay for it.

    --
    *Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
  19. Ooops!!! by Anonymous Coward · · Score: 1

    "We looked for iOS malware, but there is none to collect," he said. "It's amazing that there's just none out there."
    Ooops! They forgot about FinFisher, the publicly available targeted rootkit for iOS:

    http://krebsonsecurity.com/2011/11/apple-took-3-years-to-fix-finfisher-trojan-hole/

    1. Re:Ooops!!! by Anonymous Coward · · Score: 1

      That exploit is for iTunes the PC/Mac program, not iOS. Ooops!

  20. Re:iOS programmers are superior by flyneye · · Score: 4, Funny

    Telepathy= Salt flats
    C.B. Radio= Nascar
    Twitter= lemmings jogging

    --
    *Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
  21. Ridiculous by Anonymous Coward · · Score: 0

    Why do they always make it sound like it's completely saturated the play store and other things like that? It is not true at all, if you install apps from some alternative market or some chinese website where you're trying to get some $2 app for free, then you DESERVE a virus for even attempting to use those stupid sites. Get a clue and a life and stop wasting our time with these stupid articles. This is all common sense as far as I'm concerned. If you don't know how to drive, don't get behind the wheel of a car. If you aren't smarter than an electronic device you're using, go read a book.

  22. Fanboid rage...activate! by Anonymous Coward · · Score: 1

    This should be good...

  23. Re:But the Apple factor? by wvmarle · · Score: 5, Insightful

    Being accountable does help keeping people honest. Knowing you will get away with taking a fistful of dollars from the cash register versus knowing that the management will realise that there is money missing from your cash register makes a big difference.

    Security is all about layers. Accountability is just one of them, and it is an important one.

  24. SEE? by idbeholda · · Score: 0

    This is proof that Flashback is nothing more than an exercise in fantasy. How dare these security companies speak ill of Steve Job's creations!

    1. Re:SEE? by kthreadd · · Score: 1

      Flashback targets Java for OS X, not iOS.

    2. Re:SEE? by Anonymous Coward · · Score: 0

      And OS X don't include java anymore.

    3. Re:SEE? by kthreadd · · Score: 1

      Correct. But Apple distributes Java 6 upon request. Java 7 will however be on Oracle's responsibility.

  25. Re:Is this Covert Advertising for Apple's Ecosyste by wvmarle · · Score: 1

    And another big difference: Windows/OS-X malware are usually worms that spread themselves over the network (including drive-by downloads). I haven't heard of any such malware with Android or iOS, instead it was always linked to a certain app that contained some "extra functionality".

  26. Re:Is this Covert Advertising for Apple's Ecosyste by BasilBrush · · Score: 0

    It's only malware if it's doing it for malevolent purposes. If an app is uploading your contacts for the purposes of matching up social graphs within the app to deliver the features the app promises, then that's not malware.

    It's poor app design... that is better done by uploading hashes of email addresses rather than actual addresses. But it's not malware.

    It's also unacceptable and is against specific App Store rules that now require explicit approval, each time before an app does such a thing. But its still not malware.

    What there isn't on iPhone is apps that covertly send premium rate SMS messages. But there is on Android.

  27. Android vs iOS by Anonymous Coward · · Score: 0

    âoeAny society that would give up a little liberty to gain a little security will deserve neither and lose both.â

    Down with Apple's model of controlling everything, it's toxic and evil.

  28. Re:"has kept Apple's iOS ecosystem free of viruses by kthreadd · · Score: 3, Informative

    Flashback is a trojan, not a virus. And it only affects OS X, not iOS. If someone knows of an actual virus for iOS (and for OS X too by the way) I'm very interested to know about it.

  29. Re:waiting 4 clue: Better causes by geohump · · Score: 1

    > "under the wait of repeated malicious"
    > "under the weight of repeated malicious "
    >
    > "It takes a determined idiot to make a spelling mistake when copying and pasting from a website."

    No, All it takes is someone using a Speech Recognition (SR) system.
    "wait" and "weight" are pronounced exactly the same way and so identifying the actual word intended by the speaker is harder for the software. The software converts speech to text so quickly these days that most people cant keep up with it and hence miss the chance to proof read whats been produced. Yes, they could make the time to do so after each utterance, but that destroys the flow of how people use SR so it falls by the wayside.

    As the price of NaturallySpeaking (From DragonSystems, now owned by Nuance) has dropped to a very low levels (especially around holidays), many more people are using it (and saving themselves from carpal tunnel problems, and/or being able to type a lot faster. 100+ wpm ). Add to that the inclusion of Microsoft's Speech Recognition with Windows, and you have a situation where you are going to have tons of these "speako"s . (Speako is the term which SR users created to label situations where the SR software has generated the wrong text in response to an utterance.)

    So something in ewe may want to criticize other peoples work on Slashdot. Eye believe that comes from the lesser part in ewe and ewe should ignore that impulse. It only adds to the noise and generates no extra value or information.

    If ewe want to attack this problem, I suggest ewe work on redesigning English as its inconsistencies and lack of word uniqueness are the core of the problem. A long time ago Germany actually past sum loss two fix sum of the tissues with the German language and those changes were successful. The English speaking population of the world could make changes that wood (OK, I'll stop doing that now :-) improve the usability of English. First and foremost would be to normalize spelling around the phonetics of words. Now that we have speech recognizing computers, phonetic drift will slow down and may even stop, just as spelling drift (mostly) stopped when enough of the people in a given population learned to read and write. So a fixed phonetic spelling could become stable and (mostly) unchanging.

    Item number two would be simplifying and standardizing punctuation. Each punctuation symbol should have only 1 use, and the use should be a standard and formal one. Example an apostrophe should only be used to show ownership. Contractions dont need an apostrophe so they are simply dropped from cant, dont, its, wont etc.. (So how did "will not" become the contraction "won't" anyway? Thats not a contraction. If it were a contraction it would be "wil'nt" or "willn't". )

    Then consider the problem of words that sound the same but have different meanings. These have to be fixed. examples: read, reed, and to two and too. And red and read.

    Then there are words that are spelled the same and sound different, examples read and read: "I will read the book." "I have read the book." etc.. Also normalizing verbs. Add "ed" to all verbs for past tense: climbing - climbed is the standard pattern so how about: reading - readed, sleeping - sleeped, sweeping - sweeped, etc..

    OK, Thats the basic idea. Go tuit. :)
    Sincerely yours,
    George Humphrey, founder of the Society for Apostrophe Conservation Solutions. ( SAPS ).

    (send any corrections to 1uehr, 'cause I dont char. :) )

  30. On the other hand, Apple hadrware sucks.... by gweihir · · Score: 0

    And I doubt that the security advantage will keep after all. Give it a bit more time and iOS will be just as virus plagued as Android is. That is to say, not at all for the careful user that realizes these devices are full computers with permanent network connections. I highy doubt iOS is fundamentally more secure than Android, I believe malware authors just need a bit more time, as attacking iOS is harder (but not really hard) and the whole smart-phone ecosystem is pretty new.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    1. Re:On the other hand, Apple hadrware sucks.... by ninetyninebottles · · Score: 1

      And I doubt that the security advantage will keep after all. Give it a bit more time and iOS will be just as virus plagued as Android is.

      Why would more time matter? For OS X, sure it is slowly gaining market share and becoming a more and more attractive target. For iOS though, it has dominated as the biggest single target for a long time.

      I highy doubt iOS is fundamentally more secure than Android...

      The article makes no such claim. Rather, it claims the difference is the ecosystem in which each is released. The claim is not that iOS is more secure, but that the distribution model locked to the Apple store and the accountability of people submitting to the iTunes App store is the determining factor. It's sort of like saying people in Vegas aren't more honest, rather the lack of petty crime in casinos is because there are cameras everywhere and sometimes they call the cops and others they take you out back and some guys beats the snot out of you. iOS is not more secure, but iOS devices end up being more so given the environment.

  31. Re:Is this Covert Advertising for Apple's Ecosyste by hot+soldering+iron · · Score: 3, Interesting

    I've told people for several years that Apple, Windows, and Linux are for totally different philosophies. Apple seems to be more for the creative content producers, that don't really want to know how the computer works, or play with it, they just want to focus on whatever it is that they want to do. They may pay a premium, and have a severely limited selection, but they are getting what they want. Windows seems to appeal to the largest percentage of the consumer market and industry. It's got everything under the sun available for it, and is fairly well locked down, but with some work you can dig into it and do some limited customizing.

    You didn't think I was going to leave out Linux/Android, did you? My personal favorites, but I don't recommend them for everyone. They seem to appeal to the tinkerers and hackers, not afraid to get their fingers burned or let the magic smoke out. Linux does run most of the Internet though, and most smartphones, and a lot of tablets now, and Google and Yahoo! and Ebay, and 9 out of 10 financial institutions, and is embedded in most home routers and god-knows-what-all. Just not most desktops.

    --
    When you want something built, come see me. If you want correct grammar and spelling, get a F*ing liberal arts student.
  32. Re:"has kept Apple's iOS ecosystem free of viruses by hot+soldering+iron · · Score: 0

    Thanks for the clarification. So, Flashback isn't malware? Or are you just splitting hairs?

    --
    When you want something built, come see me. If you want correct grammar and spelling, get a F*ing liberal arts student.
  33. Re:"has kept Apple's iOS ecosystem free of viruses by kthreadd · · Score: 1

    No I just wanted to clarify it since there is a huge difference between a trojan and a virus.

  34. we get back to the misplaced notion of money = tru by davydagger · · Score: 1
    This article is full of shit, there HAVE been malware on iOS, its been reported here before. Macs also crash too. Its just suspense of disbelief. Mac users are so stuck up and bough so far into the cult they cannot admit failure.

    Then we get back to the concept we have as a society that money == automatic quality. We have this misplaced notion that paying money to a strict central authority makes something either better or more secure.

  35. Re:"has kept Apple's iOS ecosystem free of viruses by youn · · Score: 1

    My thought exactly... it is not necessarily because a platform is currently less plagued that it is more secure and I won't be splitting hairs w/ you... part of the reason is I am not really sure how I would go about splitting hairs anyway :p

    --
    Never antropomorphize computers, they do not like that :p
  36. You can configure individual permissions by Anonymous Coward · · Score: 0

    I have no problems with my Android and feel fairly safe. It is true that by default you cannot define which permissions to allow, the OS still doesn't have that option (4.0.3) but it can easily be solved if you have even a bit of knowledge.

    I use LBE Security, an app that allows you to configure which permissions an application can use. You can for instance allow a wallpaper to use your GPS to determine location for weather reports, and network, but deny its permissions to read SMS and access contacts. And that's if you REALLY wanted to use it, because otherwise just reading the permissions list would show you that some would not make sense.

    These days more and more developers are careful about not using permissions they dont need, because Android users give them some flak for that.

    Another must have tool is DroidWall, just start with a Deny All and configure your iptables rules when an app needs Wifi or 3G access, so you get fairly decent firewalling.

  37. Re:iOS programmers are superior by Sponge+Bath · · Score: 1

    Don't be surprised to see that text show up next to dancing silhouettes on a colorful background in an advertisement.

  38. Re:we get back to the misplaced notion of money = by Anonymous Coward · · Score: 0

    You touched the important thing here. There HAVE been malware on iOS. The difference toward Android is that Apple actually takes responsibility and ships updates to fix these issues. Google, the handset manufacturers and the carriers all blame each other with the result that an Android phone in general does not receive patches at all, ever.

    Oh, but you can always root your device and trust some dude called Cyanogen to have the same thing on Android. Exactly the same thing.

  39. Rampant Fanboyism by Thumper_SVX · · Score: 3, Informative

    Wow... the last time I saw such rampant fanboyism is when I badmouthed the original iPad here on Slashdot on the day of release. Of course, every one of my comments was completely on the mark... and this from someone who still has an original iPad that gets used when I take business trips and almost no other time in my life. But I digress.

    Seriously? I had to do a doubletake when I read the summary, and had to take a few more when I read the article. I have run an Android phone for over a year now and I am seriously happy with it. It's not failing under the "crushing weight of viruses" any more than my aging but still useful iPhone 3GS is (I use it as an iPod because I bought into the iTunes ecosystem years ago and it happens to integrate beautifully with my car). I install apps on both depending on my utilization and needs, and neither has been unduly burdened with malware. Of course, my Android phone actually tells me what an application wants to do while I install it, thus providing the knowledgeable user some modicum of security. And yes, every app I install I read those and make a decision whether the app is asking for appropriate rights or not. And yes, I've refused some apps because of it. Of course, I AM a knowledgeable user and that kind of security doesn't help Joe Schmoe with his free smartphone with a 2 year contract and no lube... but one of the central tenets of security is that people are the weakest link in any security chain and that will never change.

    So far I've found my only complaint with Android is that it fails under the crushing weight of battery technology that can't cash the check the manufacturers of the device wrote. But at least with Android I can have a second battery hanging around that I can swap in at any time... can't do that with an iPhone unless you're a really determined hardware hacker. Yes, I can improve it slightly by turning off all my antennae but then I am running a dumb phone with games on it... I have a smartphone so it can be connected anywhere at any time. Of course, many of the apps I install probably don't help... but that's a choice I make. Because the charging port is completely standard I just took my charger and left it at work; I use my Kindle's charger at home to keep my phone charged at night because really... how often do I need my Kindle?

    As a past and current iOS user (sometimes), AND an Android user I find the article FUD. Actually, can I mod it trollbait?

  40. Re:we get back to the misplaced notion of money = by Thumper_SVX · · Score: 1

    Some Mac users are stuck up and bought into the cult. I am a Mac user, but I'm also an Android smartphone user. I have had iOS devices and my iPhone 3GS still does sterling duty as a portable music box mostly used in my car.

    I like the Mac because it's UNIX. I like the Mac because my 13" Macbook Pro is one of the nicest designed and manufactured laptops I've used in the last few years. I like the Mac because most of the time the OS gets the hell out of my way and lets me get my work done. For two years I tried to be a pure Linux user and failed because I spent (in my opinion) far too much time fiddling with the OS to get it to do what I wanted that I got less work done. And this from someone who has come from a background admin'ing AS/400's and Mainframes, through Solaris, HP-UX and even AT&T Unix at one job... now admin'ing VMware, Windows, Linux and still some Solaris stuff here and there (though mostly a storage guy these days).

    Don't tar all Mac users with the same brush, mate; I use it because it's what works for me. If it doesn't work for you or you have some political bias against it then power to you... but for my needs I have used plenty of other platforms and returned to the Mac because for me... well... it just works.

    However, I will say for the record that I don't for a second buy into the "secure by default" idea. The Mac's security is good, but so is Windows 7's. Pick you poison but in any large codebase there WILL be holes... and with a compelling desire to make money and/or steal ideas there will ALWAYS be malware for any platform.

  41. Re:Is this Covert Advertising for Apple's Ecosyste by Nemyst · · Score: 3, Funny

    Funny. Everybody I know of who runs Windows can be slotted in one of two categories:
    -Runs the computer with a modicum of common sense. Doesn't click "free cat wallpaper" links on ihaxyou.com. Lets Windows run its updates.
    -Does everything in his/her power to wreck the computer.

    The few that are in the second category deserve to be hacked, really. It's like complaining that your car sucks because you didn't do your oil change for five years and used summer tires in winter.

  42. Re:"has kept Apple's iOS ecosystem free of viruses by Entrope · · Score: 4, Informative

    That is a distinction that the study apparently did not make, because it talks about "malicious code" rather than viruses. In fact, most of the malicious apps that one hears about are spyware or trojans rather than viruses.

  43. Re:"has kept Apple's iOS ecosystem free of viruses by the+agent+man · · Score: 1

    The real issue here is the Flashback is a Java exploit pretending to be a Flash install. Neither of these technologies even exist in iOS.

  44. Re:"has kept Apple's iOS ecosystem free of viruses by iamgnat · · Score: 1

    If someone knows of an actual virus for iOS (and for OS X too by the way) I'm very interested to know about it.

    It only effected morons that didn't know changing the default password after jail breaking was a good idea, but there was the ikee worm. More a flaw in the fleshy bag of water holding the phone than it's OS, but still a self replicating piece of malware all the same.

  45. phooey by johnwerneken · · Score: 1

    one supposes that 'accountability' might work so long as one is dealing just with people trying to earn a living. try that in rl, away from software: no way. and anyway, accountability is not worth the cost it imposes, regardless of what the benbefits might be. death to apple and unending torture to accountability!

  46. summary FTW! by Anonymous Coward · · Score: 0

    for the most convoluted, grammar-challenged, nonsensical summary of the year! Who on God's green Earth writes this crap?

  47. So many threads... by thefixer(tm) · · Score: 1

    On how you can actually audit the security on any app installed on an Android, or how apple should add more options to let users review permissions for installed apps on iOS. I'm sorry, but this is BS. My Mom will NEVER understand what is appropriate and what isn't, nor should she have to. Apple is attempting to make that safe for her to do with something simple and easy to understand without overwhelming her with tons of things that she has no clue about anyway.

    And guess what, my mom is about as tech savvy as 99% of the folks out there with iPhones. It's all well and good to talk about what we developers (who know all the ins and outs, and who stay current by spending hours of our time every week reading about what's new) would like, but shouldn't we be thinking along the lines of how do we protect those not in the know from those with malicious intent?

    Isn't that what Apple is doing? (I'm not saying their approach is without flaws, but doesn't it seem like they're continually marching towards that end?)

  48. There are tons of Android phones which can't by Brannon · · Score: 1

    upgrade to ICS--I suppose that is coercion?

  49. special sauce? by l3v1 · · Score: 1

    while Apple's iOS remained free of malware, despite owning 30% of the mobile smartphone market in the U.S.

    Really? That number in that question? Do you think malware takes the US market share into consideration? Don't you think the global market share would be the only relevant number if citing share percentage numbers related to global malware proliferation? Or malware is only written and distribute themselves in the US? If so tell us, so we can disconnect the rest of the world, just to be on the safe side.

    And oh, yes, please don't leave iOS's superiority out of the paragraph either, since it's so quite obvious that is must be its superiority, since it's so... superior and all.

    --
    I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
  50. Re:we get back to the misplaced notion of money = by oobayly · · Score: 1

    I bet there are people who have read this and wish there was an interesting (-1) mod!

  51. Re:But the Apple factor? by Tore+S+B · · Score: 2, Insightful

    Actually, human beings are social animals, and accountability can actually worsen security if it weakens a perception of a bond of trust, which might very well be more effective. Accountability can be circumvented, expectations of honesty cannot. In terms of the cash register, keeping the balance is probably a good idea, but there are other situations and I just wanted to nuance this very American notion that interpersonal trust is equal to weakness.

    --
    toresbe
  52. Re:"has kept Apple's iOS ecosystem free of viruses by Zero__Kelvin · · Score: 1

    "It only effected morons ..."

    It is true that a lot of iPhone users have children of exceedingly low intelligence, but I'm not convinced that the correlation is indicative of causation in this case.

    --
    Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  53. Re:But the Apple factor? by DrStoooopid · · Score: 1

    Wow...how times have changed. Back in the day, it was anything you do is safe, because you did what you told. If not, you were somewhere you shouldn't have been, or doing something you shouldn't have been doing...it's probably your fault. Long gone are the days of personal responsibility.

    --
    There are 2 groups of people you can make fun of on the Internet without fear of attack. The illiterate, and the Amish.
  54. Yea yea yea by Anonymous Coward · · Score: 0

    What a load of old rotten apples .. Of course what they are actually saying is iOS is a pile of crap but if we shout load enough about how good it is then the apple fanboys will sing it's parise (cus they been brain scrubbed by the hyperbole that is apple) and thats all apple is hyperbole pure and simple .

  55. Re:But the Apple factor? by Cute+Fuzzy+Bunny · · Score: 2

    I'm sure there will be plenty of hair splitting by the apple afficionado's but just about every app I load, whether ios or android, all wants access to data they dont need and many transfer stuff like my name, phone number and who knows what else. I've had quite a few that broke my device or gave it some real problems, again on both platforms. I call that malware. It steals my stuff (although I agree to the theft because if I didnt, I'd have no apps) and often eats my battery life or gives me operational problems requiring an uninstall and reboot.

    Sure seems like badware to me!

  56. Re:iOS programmers are superior by Anonymous Coward · · Score: 0

    IOS = Formula 1 Droid = Demolition Derby

    Microsoft Phone = a hobo standing by the Interstate with his thumb out

  57. The flaw in your flaw by SuperKendall · · Score: 1

    You'll notice that "auditing every bit of software (you) install" is ridiculously easy. The installer tells you what rights the app needs when you install it.

    Aha!!!

    THAT IS THE FLAW.

    That is my biggest problem with Android. At the time you are asked for permission you have NO CONTEXT as to what it is asking you for.

    Wants contacts? Could be just to email friends. Who knows? You have not run it yet.

    Furthermore by presenting a laundry list MOST people cannot really comprehend you are simply guaranteeing people will accept without a second thought, leaving a handful of people who actually audit the apps that they run.

    This is the most asinine possible approach to security on mobile devices, simply a kind of continuation of the same "the user needs to be a sysadmin, sounds reasonable to me" kind of think that has kept the PC world in the dark ages for so long.

    iOS asks for permission at the time the app wants to use a protected resource (like location). You can do that without having a Vista-esque nightmare, and it means when you answer the question you know what you did to trigger it.

    Only iOS lets the user make an INFORMED choice.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  58. Fascism is ignoring the screams of your neighbor. by SuperKendall · · Score: 1

    I would argue true fascism is to give people only one choice, the unprotected path under which those not fully aware can suffer mightily.

    Under iOS, you can have the protected path (default), or for the knowledgeable the FULLY unprotected path of Jailbreaking.

    This is a far better system. Those who can understand what they are doing get full access; those who cannot get the help they need to keep malware off their phones and not have to "maintain" them.

    The proof of this assertion is ongoing and right in front of you simply as noted in the fact that Android has malware and iOS does not.

    To claim all is roses is your land while the citizens lay dying all around you is either high comedy or high ignorance.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  59. Nope. by SuperKendall · · Score: 1

    Last time I checked, there were plenty of reports of malicious iOS apps clandestinely hoovering up your private data/contacts

    Wrong. Name even two apps.

    The facts are, NO app can "hoover" any private data.

    SOME apps were gathering contact details (most famously Path). That has been corrected in the next update, it will ask for permission as for location services.

    With that action there is no path an app can take to "hoover" your data unbeknownst to you, and many forms of data there's no path to get to in any way (for app store apps) unlike Android.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  60. Re:PLZ by garote · · Score: 1

    Please define "misery" in this case?

  61. To be fair by SuperKendall · · Score: 1

    Wow! What a fair and unbiased comparison! A year old iOS version

    To be fair he's an Android user, he doesn't realize people with phones older than six months have an option to upgrade under other OS's.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  62. Why do that? by SuperKendall · · Score: 1

    Seriously. I have an iPhone 3GS which I want to jailbreak to use with another phone carrier,

    Well there's your first problem, jailbreaking and unlocking are different things.

    But just call AT&T and tell them to unlock it, they'll do that for free (they just started allowing unlocks).

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  63. Re:Fascism is ignoring the screams of your neighbo by Anonymous Coward · · Score: 0

    (Shrug) At the end of the day you can't fight Darwin. The right to destroy yourself through your own stupidity is perhaps the most fundamental of all. Apple tries to take this right away from its users.

  64. Re:PLZ by GameboyRMH · · Score: 1

    Incompatibility with GPL licenses, disincentive to release gratis software, inability to freely run and distribute custom apps, inability to compete with native apps, app content censorship, app functionality censorship (tethering)...I think that's enough for now.

    --
    "When information is power, privacy is freedom" - Jah-Wren Ryel
  65. Still don't like the "walled garden" by mschaffer · · Score: 1

    I still don't like walled gardens. I will stick to Android or even Windows Phone.

  66. a better method by cas2000 · · Score: 2

    Here's a much better method for optimising security on your smartphone or tablet:

    DON'T INSTALL WORTHLESS SHIT

    Apple's App Store and Google's Marketplace make Sturgeon's Law seem like hopelessly naive pollyanna-ish optimism. They each may have a few hundred thousand apps, but less than one in ten thousand or so are worth even looking at, let alone installing.

  67. Re:Is this Covert Advertising for Apple's Ecosyste by Anonymous Coward · · Score: 0

    I would like to remind all the naysayers about Charlie Miller's little experiment. He specifically put a Command and Control background process inside of a stock ticker app, and the ONLY reason he got "caught" is because he announced it was malware specifically. The command and control server, if I recall correctly, abused a browser bug (to accelerate the browser, JS code was executed in unsandboxed, which is a very stupid decision) and was able to access far more than what a normal app would have access to.

    Mind you, he didn't DO anything with it... However, any number of devs could be doing the same thing. If they don't announce it and keep it on the down-low (i.e. used for DDOS, email spams, and not messing with the user's device, who's going to know? Nobody else can scan for malware.

    So just because you decide to stick your head in the ground and hold your hands to your ears doesn't make it the way you want.

  68. Re:"has kept Apple's iOS ecosystem free of viruses by Anonymous Coward · · Score: 1

    Charlie Miller's Stock ticker. Whitehat command and control exploiting a browser bug for much wider access than the default sandbox allows.
    Storm8. They "accidentally" accessed your phone number and transmitted it to their servers, when apps are not permitted to access your number by default.

    Lord knows what else is out there, since the only reason why Charlie Miller was caught was because he announced it publicly. Remember, nobody else can do an effective virus scan, because mass application downloads are not permitted.

  69. Android Hijack by backspaces · · Score: 2

    Unfortunately, Android has been hijacked by the carriers and handset manufacturers. There is no "Android" phone any more, only handset manufacturers (who screw up Android) and the carriers (who have no regard for Android security). Consider ..

    Much of the Android vs iDevice confusion is based on the new Mobile Market:
    1 - Carrier: Verizon, ATT, etc
    2 - Handset Mfgr: Apple, Samsung, etc
    3 - OS: Android & iOS
    Notice that Apple controls 2 out of 3. Google controls 0 out of 3.

    Zero? WTF? Think about it. You get a Samsung phone (2). They "improve" Android, leaving you with a big unknown in terms of OS (3). Carrier: Apple imposes HUGE restrictions on the carriers .. they act as a middle man between the consumer and the carrier. Google, OTOH, has zero control over the carrier.

    We may not like it, but Apple has huge advantage over the security of their devices.

  70. Re:iOS programmers are superior by Taco+Cowboy · · Score: 1

    IOS = Formula 1 Droid = Demolition Derby

    Microsoft Phone = a hobo standing by the Interstate with his thumb out

    What about "WebOS" or "Palm" or "Meego" ???

    --
    Muchas Gracias, Señor Edward Snowden !
  71. Re:PLZ by garote · · Score: 1

    Sorry; you must have mistaken me for an iOS developer. I am an end-user.

    Nothing on your list gets within shooting distance of "misery" for me, except perhaps tethering, which is now a non-issue since Verizon changed their data plans. Now I tether effortlessly.

    The non-Apple apps that I use the most are Fandango, Flickr, Zillow, Facebook, Kayak, and VLC. These were all free. You claim there is a disincentive to releasing free software, and though it's not apparent to me, I'm willing to take your word for it.

    On the other hand, I understand developers like to get paid, and given that my nephews have had more than five hours of fun playing "So Long Oregon" on the iPad, I'm don't begrudge the author the two dollars they were asking for. I remember when all they wanted was Nintendo DS games and those cost thirty dollars each. Even now - today.

    No competition with Apple apps? Look at it from my point of view: I don't care that there aren't ten different apps for playing music, seven for chatting, five for browsing the web, and three for reading email. To me, it's a challenge and an accomplishment to just get ONE DAMN SONG onto the thing, from my computer to the iPad, and get it to play. And hey! It turns out I don't have to. If I bought it on the computer, now it just shows up on the phone.

    Do you understand my point of view? I am far from miserable. Maybe the traditional car metaphor will help. Playing music on this thing is as essential and obvious as a steering wheel is in a car. You're saying I should be miserable, because there isn't a thriving market for installing a second steering wheel in my car. I just do not care. And there are millllllliiions of me.

  72. Re:iOS programmers are superior by jaymemaurice · · Score: 1

    IOS = Formula 1 Droid = Demolition Derby

    Microsoft Phone = a hobo standing by the Interstate with his thumb out

    What about "WebOS" or "Palm" or "Meego" ???

    They overdosed at the shelter.

    --
    120 characters ought to be enough for anyone
  73. Monthly fee for a payment method by tepples · · Score: 1

    Banks charging $12 per month to have a checking account (and thus a reloadable debit card) unless you keep a $1,500 minimum balance is bad enough. Cellular carriers charging $30 more for a smartphone than for a dumbphone (source: virginmobileusa.com) is even worse.

  74. Lifetime sub vs. expiring sub by tepples · · Score: 1

    The $25 is a lifetime subscription, while the $99 runs out after a year. This difference is important to students and hobbyists, especially in countries that aren't among the richest.

  75. What a tool by Anonymous Coward · · Score: 0

    "as the competing Android platform strains under the weight of repeated malicious code outbreaks"

    Really.....

  76. Re:But the Apple factor? by flyneye · · Score: 1

    Back in any day, if you did what you were told, you turned into a nice drone and were assimilated with the sheeple.
    When you did what you pleased and bothered none, you found the world opened up and you were its master.
    Personal responsibility is for all, not just the mamas boys.

    --
    *Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
  77. Re:But the Apple factor? by DrStoooopid · · Score: 1

    I disagree. Sheeple are those who do what they're told, believe every rumor, and don't question anything. There has to be a small measure of order at the foundation so you have a frame of reference to pull back from the chaos when it gets out of hand. To be able to think for one's self and be a responsible individual. Moderation in everything, including moderation. There are just as many sheeple on one side of the fence as there are the other. Critical thinking and personal responsiblity is almost non-existent.

    --
    There are 2 groups of people you can make fun of on the Internet without fear of attack. The illiterate, and the Amish.
  78. Re:we get back to the misplaced notion of money = by davydagger · · Score: 1
    I run linux mint on my desktop everyday all day. I don't know when the last time you ran a linux desktop is, but modern ones are very good, and very stable, and for the most part it does plug and play better than windows (read most drivers baked into kernels).

    Setup was easy with a GUI installer, that you could just kinda click through, either replacing your main OS, or installing it side by side. Setup automaticly installs LightDM Desktop manager(GUI login screen), and boots to a gnome 3 desktop.

    no configuration was needed to get the sound working, to print, and three years before Apple had the "app store" Ubuntu had the "software center" for one click installs, which is present in mint, a derrivative. It even scans for, and prompts you if you want to install propretary drivers automaticly, and both nVidia, and AMD both have good native drivers for linux.

    Its far easier to use and setup than windows XP, and I have no idea about vista or 7 because I never installed them on a machine.

    I'll make a further point, my technologically incompetant friend not only runs linux mint, but installed it himself on his computer, by himself. He cannot install windows though. He can't put together a webber grill (one screw, three legs). Now, if you'd said you needed mainstream application support like Photoshop, AVID, or those other applications that only run native in on MAC/Windows, I'd understand, but I don't want to hear from anyone configuring a linux box is too much of a pain, or even hard, herin 2012 AD