Item — HN Reader

There is plenty of software written in memory-unsafe languages that interacts with untrusted input: browsers are the most prominent example, but also email clients, media players, PDF viewers, archivers, IRC clients, torrent clients... not to mention all the network stack and firmware involved. iPhones and Pixels have many defense layers, both on software (sandboxing, JITCage...) and hardware (Secure Boot backed by root of trust, IOMMU for hardware isolation, PAC, PPL, MTE soon on Armv9...). The Linux desktop stack, including Linux phones, has none of this.

Linux phones might be good as a hackable/tinkering-friendly gadget, but they are definitely not secure.

1 comments

I suppose we can give credit to Pixels, but iPhones and their 0 clicks are so prevalent that I don't think they are a good comparison for 'good' security in this conversation. Everything you mentioned is still optional, where as iMessage is not.

I'm not sure of ANY linux 0 clicks found in the wild.

>I'm not sure of ANY linux 0 clicks found in the wild.

Some sizable fraction of that is because there is not as big of an audience, so there's less money and attention on developing exploits targeting that OS.

I half believe this because we see that Apple was never actually good at security, but they could claim they had few 'viruses' back in the day because few people used this.

But also FOSS doesn't rely on security by obscurity. We'd see way way more linux based server hacking. Right now, it seems like these are almost exclusively social engineering attacks.