iOS vs. Android vs. WP

Citat:
Uporabnik Steve pravi:
samo marketing in dizajn jim gre dobro od rok

Klikni za razširitev

Citat:
Uporabnik map pravi:
Moj prastari SE live with walkman (WT 19i) je mel že stereo zvočnike. Ne vem, kaj bi bilo novega. So bili pa vsi stereo zvočniki v GSM za en k..c. Mogoče pa kej novega pogruntajo, kako recimo na 0,5cm membrano naredit zvok 30 cm membrane. To bi rad videl.

Klikni za razširitev

Citat:
Uporabnik rawr pravi:

Citat:
Uporabnik R0KY pravi:
vec kot ocitno nisi nikol uporablju slusalk za 100 eur in vec...

Klikni za razširitev

Očitno.

Govoril sem za udobnost navadnih plastičnih slušalk, ki jih daš v uho. Ne in-ear in ne naglavnih, ki pokrijejo celo uho.

Klikni za razširitev

Citat:
I was at the Mobile Pwn2Own last year and specifically spoke to various challengers about WP (nobody at all tried it last year).

Contrary to general snark on various forums, Microsoft is widely recognized throughout the security industry as having the most comprehensive Secure Development Lifecycle in the world (of all commercial, government, OSS organizations.). It may be some orgs do as much or more, but none of them are as transparent about it (Google, Amazon, and Apple certainly aren't as open about their own SDLs). All MS software is completely Threat Modelled, has static and dynamic tools run against it, and all unmanaged parsers (including NFC/Bluetooth/Wifi protocol parsers) are fairly extensively fuzzed. None of this insures perfect software (it doesn't look like they are good at catching use after free vulns in IE for example, but if you look at the security updates for Chrome and Firefox, neither of them are any good at catching those vulns either), but looking at MS security bulletins its pretty obvious that they have a much lower vuln rate in newer code vs older code (The big bulletins this month in schannel and OLE were both in code well over 15 years old).

Because of that, every single researcher I talked to basically said the same thing. If they spend a week of effort against Android they KNOW they will find something, but if they do it against WP they don't have any such surety. That basically informs where they will direct their time, because they only get paid if they succeed. So in some ways the fact that WP didn't fall was because there really was a lot less effort trying, but almost in the same vein they can thank their security efforts for that.

Still, the general design of the chambers in WP make them a whole heck of a lot less porous than Androids sandbox. You can do way more with Android apps (replace the keyboard for example, which is a pretty invasive operation), which means the sandbox simply has way more exit points that need to be protected than the more restrictive WP Chambers. Its basic security truth that it is easier to protect things with smaller attack surfaces, and Android by virtue of being more permissive has a larger attack surface for someone to look for vulnerabilities on.

Klikni za razširitev