The problem is that Apple doesn't position iOS as 'open'. Google does. That's been one of their big selling points for years.

As another poster said, we should be taking this up with the Samsungs who ship devices with non-unlockable bootloaders.

The remark about the script-kiddie able to find vulnerabilities is ridiculous for a wide variety of reasons. Script-kiddies are not able to find vulnerabilities in any kind of system. Computer hackers obsessed with security do that and (most of the times) it's not easy by any means, i.e. Saurik.

In addition, I'm not sure what Saurik, the creator of Cydia, has to do with this discussion at all.

Finally, and most importantly, you don't seem to understand the current mobile market. Most users are the end-all-be-all of end users. Many people I know think that most of the apps on the iOS App Store are developed by Apple. People install apps without thinking. Tons of personal information is stored on your phone and in these apps, such as contacts and banking information.

Google/Android is open in the sense that Android is open source, so hypothetically anyone can hack on it.

You are the person who is half-pregnant. You want the normal end user experience, where you don't have to worry about compiling the operating system yourself, but you want it to be "hackable". That is not the definition of open. That is the definition of insecure. Because most Android users are not sophisticated computer users like yourself, a hackable operating system is just a bad idea.

If you want an OS that you can do whatever you want with, and is incredibly insecure, then fork Android and have at it. Do that, instead of complaining whenever Google makes changes that you don't understand and affect your somewhat specific and not very common use case.

He has found various security bugs in Android (most recent example: http://www.saurik.com/id/19 from the other day) and he is also the developer of http://www.cydiaimpactor.com

atmosx's point was that it isn't 'skiddies' who are finding these security holes, it's experienced developers and security researchers.

What utter piffle.

That's ridiculous. Openness, unlike pregnancy, is a spectrum. And intent matters.

The remark about the script-kiddie able to find vulnerabilities is ridiculous

Script kiddie, random malicious hacker person, whatever. Yes, people like Saurik and other white hats are capable of finding these sorts of vulnerabilities, but certainly other kinds of black hats are capable as well.

Not really sure what you're trying to say here... seems like you're just spouting nonsense and nitpicking.

But I think a middle ground can be created between super open/fragmented/anyone can fork and do whatever they want with it and super-closed/nobody can do anything with it except its vendor. However, Google could probably achieve the same thing, if they treated Android, like they do with Chromium and Chrome. Keep Chrome/some version of Android for themselves - while keeping Chromium/AOSP as open as possible.

As for this rooting issue, I don't really see what it has to do with being "open". They're just trying to secure it. And as I said, they can still allow bootloaders to be unlocked by the user. It's up to companies to do so, or they can take Samsung's route and try to lock them down as much as possible, even at the region level (which I disagree with, because in this case, there's zero benefit for both consumers and hackers. The benefit is only for the company).

The problem is not "we" -- we are the ones who buy the unlocked devices already. The problem is that people who don't know any better end up buying millions of devices that they only later discover have unreasonable restrictions and become landfill shortly after the manufacturer stops issuing new updates (which is often immediately).

What we should be demanding is that Google not allow the Google apps to be installed on devices with a locked boot loader.

Company 1 has a history of monopoly abuse (including giving OEMs financial incentives to not ship computers with competing OSes pre-installed).

Company 2 has let at least two (probably more) new mobile OSes bootstrap themselves using parts of its ecosystem.

Which company do you think is going to get the benefit of the doubt when introducing security features that make device modification more difficult?

That being said, I think the biggest issue with UEFI secure boot isn't the idea, it's the implementation. People have reported things like confusing, hard-to-use key enrollment interfaces (that sometimes don't work or even don't exist at all) and other crazy, undocumented restrictions (e.g. only allowing OSes with certain names). And there's a lot of concern that these issues won't be fixed in a timely fashion, because installing an alternative OS is a corner case use for most OEMs. And then there's the issue that there's no shared authority (across most OEMs) for signing off on bootloaders other than Microsoft. Add past history into all of that...

Meanwhile, on the Android side, there's a clear, standard unlocking process, implemented on the Nexus devices of each generation (worth noting that the Nexus 5 support was added to a well-known rooting tool within minutes of the tools developer getting the device). Yes, there's still potential for problems and abuse (e.g. bootloaders locked by manufacturers, usually by carrier request), but the issues and pitfalls are relatively well-understood, including ways of avoiding them (buy from manufacturers that offer a bootloader unlock process, avoid AT&T and Verizon-specific devices and so on). And these issues need to be balanced against the security benefits. There are certainly still issues to watch out for, but past history suggests that they will be balanced appropriately.