Most OS have some level of penetration, but it is so clearly not the same with windows. Even with the latest exploits free spreading viruses on android are rare but hook a windows machine up to the Internet without a router or firewall and get a virus in seconds.

Android easily outnumbers windows, by some counts 5 to 1, yet it has a smaller percentage and absolute level of malware installation.

The old truism of computer security arms race is bullshit. Computers that are secure from general mass spreading infections it not even all that hard (securing from governments is much harder). Simply ignore all incoming connections and don't execute downloaded data (or give to untrusted executables. The only hard part about this is making sure that network card drivers can be trusted, this isn't hard on most operating systems, but most windows users are totally at the mercy of some low budget buggy vendor.

Windows is well positioned to fail at computer security and they have done a great job at leveraging their position.

> Even with the latest exploits free spreading viruses on android are rare but hook a windows machine up to the Internet without a router or firewall and get a virus in seconds.

I don't buy this at all. Unless you are comparing Android with Windows XP?

First of all, you'd have to go out of your way to disable the firewall on a modern Windows install.

Secondly, there have been tons of Android infections: http://arstechnica.com/security/2016/07/virulent-auto-rootin...

I'm sure the percentage is lower than "all infected Windows machines" but I very much doubt it's lower than "all Windows 10 installations" or even "all Windows XP SP2 + Windows 7 + Windows 10 installations with updates enabled".

Nonetheless, it's definitely the case that an app sandboxing model provides some defence in depth, at the cost of reduced flexibility w.r.t. e.g. a real generic filesystem, ability to distribute/install without an app store, etc.

The Windows Security Development Lifecycle material is worth reading: https://en.wikipedia.org/wiki/Microsoft_Security_Development... https://www.microsoft.com/en-us/sdl/

Ultimately, if you were to allow Android devices to by default, open and run arbitrary native code that users download from the internet, you'd see the same host of problems (probably much worse for the average Android device given the fragmented OS patching nightmare).

>First of all, you'd have to go out of your way to disable the firewall on a modern Windows install.

There is a screen that pops up everytime you plug in a network cable or connect to a wifi network for the first time. It asks what kind of network you are on, personal, work, public. Depending on what you answer here it does stuff to the firewall.

Then there are the multitude of AV products that disable the firewall with their own suboptimal garbage. These wouldn't have been made if they weren't once necessary. Windows should have had a firewall when it got its own networking stack, but it went a couple of decades without one, so people got used to needing to add one.

Even if that article is correct it is Android off of windows by an order of magnitude.

> Ultimately, if you were to allow Android devices to by default, open and run arbitrary native code that users download from the internet

But they aren't setup that way. That is part of why they are more secure.