Re:It's your device, you should be able to repair it
by zepto on Saturday May 01, 2021 @12:05PM
(#27007371)
That’s a fair point, but easily addressed. The base OS and Browser are arguably the two platforms on which software runs, and for which security updates are important. There could be 2 numbers.
I realize there are other runtimes, but for a general indication for cross comparison this would do.
This isn't that simple because it depends on _which_ software. This gets glossed over a lot in these discussions.
An iPhone gets ~5 years of iOS updates. Importantly, these updates are the only place where the only permitted web viewer on the platform gets updated. An android phone gets 2-3 years, if it's very lucky, of android updates. However, the _browser_ you use on that device is updated entirely independently of the OS, and while it isn't obvious how far back Chrome supports, android Firefox runs on android 5.0 devices (i.e. at least 7 years, probably more?)
These are two different security scenarios - an iOS device is fully patched against OS-level exploits for longer. True. But an android device will have a safer browser for a lot longer. In my threat model the latter is a lot more important - I don't think I'm unusual in that my web browser is by far my largest attack surface.
(disclaimer: i work at google, but i work on iOS stuff and like iOS a lot. more than android for sure. but i'm very salty that i can't have a browser updated independently from the OS)