I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic [LWN.net]

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 21, 2016 11:59 UTC (Thu) by PaXTeam (guest, #24616)
In reply to: I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic by dunlapg
Parent article: Dutch consumer group sues Samsung over Android updates (OSNews)

maybe my question was ambiguous, but by 'the public' i meant those who would be potential targets, not threat actors. you were describing the latter, not the former, so let me rephrase my question: why would a phone be secure on those days when the potentially victimized/targeted public doesn't know about a particular vulnerability?

to post comments

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 21, 2016 15:04 UTC (Thu) by dunlapg (guest, #57764) [Link] (3 responses)

I think I answered that in my post.

You're insisting on using the word "secure" like it's a binary thing. It's not. Do you lock the door to your house? Probably. Do you put bars on your windows? Probably not, unless you live in a particularly bad area. So if you lock your doors but don't have bars on your windows, are you "secure"? Well, that's the wrong question; the question is, "What is your level of risk, and is it acceptable?"

On days when a vulnerability exists, but it has not been made public, the risk to the average member of the public is fairly low (for reasons I cover in my previous post). On a day when a vulnerability exists but has been made public, the risk is pretty high. The proposed metric says, "What percentage of days in the last year have you been at high risk?"

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 28, 2016 1:10 UTC (Thu) by nix (subscriber, #2304) [Link] (2 responses)

Of course, for houses there are extra rules. I'd be very happy indeed to throw out the (known-horribly-vulnerable) front door lock on my house and replace it with something tied to a Yubikey Neo's near-field one-time passwords, talking to an authentication server in an embedded box attached to the inside of the door or something like that. But even if I had the skills to do that, I couldn't: my mortgage is tied to house insurance, and no insurer on the planet will insure a house that uses some advanced techie thing rather than a lock.

(But then, it fundamentally doesn't matter that front door locks are insecure -- an attacker who actually wanted to break in could just wait until you go out and go in through the window, and more or less nobody bars their windows to prevent this attack because not feeling like you're living in a prison is generally more important than security against such determined bad actors, particularly given that your stuff probably *is* insured, so a robbery, while very unpleasant, is unlikely to be devastating. I guess the analogue of this for computing is backups to protect against wiping and encryption to protect against theft of secrets -- but this doesn't work very well because with computers the bad guy can lurk over your shoulder, undetected, and steal/wipe all your stuff as soon as you unlock it, something very unlikely to happen in the physical world until they invent invisible burglars.)

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 28, 2016 20:17 UTC (Thu) by johannbg (guest, #65743) [Link] (1 responses)

"something very unlikely to happen in the physical world until they invent invisible burglars."
Those are called ninjas and have been around since sometime between the 12th and 15th centuries ;)

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Feb 10, 2016 20:11 UTC (Wed) by nix (subscriber, #2304) [Link]

That's only relevant if ninjas rob houses often enough for insurance companies to consider them in their policies. If they do where you live, I don't think I want to live there. :)