Hacker News Reader

Comment by smrtinsert | Hacker News Reader

I have a better idea, how about we just kill ChromeOS and call it an Android device.

Why? ChromeOS is so much better. This is coming from an ardent Android user. Just curious why you would want to see Android instead?

ChromeOS has potential to become a productive platform. I don't really see Android ever becoming that. They are two different beasts.

Nothing about the ecosystem attracts me. What is the value proposition again?

Simple, elegant, fast, secure, and cheap laptop.

Completely hogtied and forced to use nothing but "apps" running in chrome?

Many people use browsers for the vast majority of their computing tasks (email, facebook, word processing, etc). Chrome handles this easily without the burden of general OS maintenance.

You mean like your iPhone which is "hogtied" to "apps" only running in iOS?

An iPhone is not billed as a replacement for a laptop (which ChromeOS devices most definitely are). Also, they can run the vast majority of web apps in addition to native iOS apps.

iPhone development shares first party language support (albeit with some different frameworks) with a major desktop OS, and has third party support for a number of other languages.

I think most people buying it know that it is not a full OS like Windows or Linux but sure my experience is with developers mostly.

Personally, I use my Chromebook for everything but serious dev work and photos & video work. Some of the things that I could not do on my phone/iPad that I use my Chromebook for are serious research, taking notes, watching movies in bed, using Google's Spreadsheets, minor dev via ssh and vim, and loaning it to guests and friends without a worry.

And replace one of the most secure operating systems with one of the most insecure... :(

Okay, do it the other way around then. Or, at least make the two compliment each other, like iOS and OSX.

As it is, the two products seem like they are competing for resources at Google. Maybe that's because they are, I don't know. But from a consumer perspective it is a wasted opportunity.

And yet the number of CVE's raised against Android is far below that of iOS or Windows.

The fact that you're being downvoted just shows how many Apple zealots unwilling to accept Apple recent (last few years) across-the-board failings in software security there are still here at HN.

Your reply is factually correct and rather than attempt to rebut it in any way, they just downvote you.

A quick search indeed seems to agree with the statement the number of CVE's raised against Android is below that of iOS.

Numbers from cvedetails.com: Android 245, iOS 857

I guess it is not a direct proof something is more insecure? There are other factors that push the numbers up or down. Project popularity, the type of CVE,...

And projects depend on each-other too (Linux kernel -> Chrome OS and Android).

Am I missing anything? Can any of the downvoters please elaborate?

This isn't a good metric unfortunately. A much more realistic metric is % of devices with unpatched CVEs. With iOS updates and Windows updates, most devices get their vulnerabilities patched (assuming the vendor addresses it at all), unless specific action is taken not to update them. However, most android devices are not updated past a few minor Android versions, and once the carrier no longer provides patches, there is often no way for a normal user to patch the OS at all.

So Windows could theoretically have 100x the number of vulnerabilities over time, but if they are fixed and autopatched, then those systems can still be more secure than a system that doesn't get patches past the first year.

This seems irrelevant because if ChromeOS machines became Android ones, Google would still control the updates and so they be like Nexus devices and would always get updates.

Nexus devices are getting updates for just around 2 years. All the older devices (including my dear Galaxy Nexus) are left behind. Imagine if your newly bought windows 10 PC would get security updates for only 2 years

How did you determine this?

Comparing the list at CVEDetails.com [1] [2] would seem to support this at first blush, but this is because the iOS list contains Safari and WebKit vulnerabilities, while the Android one does not include Chrome, Blink, or WebBrowser/WebKit vulnerabilities.

If you include Chrome [3] they look to be about even.

[1] http://www.cvedetails.com/product/19997/Google-Android.html?...

[2] http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html...

[3] http://www.cvedetails.com/product/15031/Google-Chrome.html?v...

Are Android apps running on Chrome OS actually going to be more secure, or does the platform inherently require things that are hard to secure?

(And, conversely, if it doesn't require that, what prevents Google from adding CrOS-style isolation to Android?)

Android already has superior isolation to Chrome OS. The permission system is much more broad and flexible than that offered by browsers and in 6.0 it gives even more direct control.

AFAIK Android Runtime for Chrome is running on NaCl meaning it's properly isolated.

Right, if you can do that, why not stick NaCl + Android Runtime for Chrome on everyone's cell phone? NaCl is designed to be very low-overhead, and low-end Chromebooks are probably as underpowered as low-end phones.

NaCl is a very good isolation layer, but it's certainly possible that to make Android apps work / interoperate the way you'd expect (e.g., one app can broadcast an intent that another app can receive), you have to open up holes that are too big to secure. It's sort of like how the CPU-level distinction between kernel-mode and user-mode code is a very good isolation layer, but when you run actual operating systems that need their processes to communicate, it gets much harder to secure.

I personally imagine that when all that hype came out recently about merging chrome and android, that's what they're trying to do. Security of chrome and usability of android would be perfect, and hopefully also allow underlying OS pushes independent of manufacturer or carrier.

That's what I'd like to know, too. Is ChromeOS + Android still much more secure than just Android?

A second question would be: what is the performance penalty for running Android apps that already reside in an VM on top of Chrome OS? Is it 2%? 10%? 25%? It is more like running Bluestacks on Windows or like running Android natively on the hardware? I hope Google answers these questions at I/O or whenever it announces this merger.

If they did it "right" there'll be no performance penalty. It should be executing the apps the same way Android does. I imagine they've ported the runtime to Chrome OS.

Android always has a performance penalty because software runs in a JVM....

There is no JVM in Android. Android uses the ART runtime that compiles apps to native ARM, x86, MIPS, etc code.

We're talking about the performance penalty compared to normal Android. Baseline performance penalties (compared to ...?) are present in both environments.

Besides, the JVM is a very good optimizer, and a good choice for certain types of high-performance tasks, especially since it can continually re-optimize the program as needed. It beats C in one of the anecdata on the Benchmarks Game, and is competitive in a few others:

http://benchmarksgame.alioth.debian.org/u64q/java.html

What "beats C" is a "custom counted hash set".

Reply on news.ycombinator.com