Or maybe there's a reason why the mainline Android OEMs don't ship that allocator by default.

The fairly obvious answer here is "OEMs don't care about security because very few people will pay for it, either with $ or time". Benchmaxxing sells better.

▲

izacus 2 hours ago | parent [-]

That's trivially provable as false.

▲

nvme0n1p1 2 hours ago | parent [-]

If so, I'd love to know which OEM you're thinking of who ships an Android distro more secure than GrapheneOS.

▲

izacus 2 hours ago | parent [-]

Let's first start with y'all providing any proof that it was "benchmaxxing" that causes OEMs not to ship hardened allocators (and not - for example - breaking compatibility with users' software).

And then we can move the goalposts to "more secure distro with GrapheneOS" which isn't part of the conversation until you dragged it out.

▲

nvme0n1p1 an hour ago | parent | next [-]

If you're expecting some leaked internal document that says "priorities: 1. benchmarks, 2. security", no, that probably doesn't exist. But their priorities are revealed by their actions.

GrapheneOS typically ships security updates within a day. But most of Samsung's phones get quarterly security updates[1]. There will never be a primary source with a Samsung insider saying "we're fine with our customers being vulnerable to widely exploited security bugs for the next 89 days, in order to save our massive corporation a few thousand dollars a month." But their priorities are revealed by their actions.

If the statement "OEMs don't care about security" is trivially proven false, as you said, then you should be able to prove it trivially by naming even just a single OEM whose update cadence matches GrapheneOS's.

[1]: https://security.samsungmobile.com/workScope.smsb

	▲	Groxx an hour ago \| parent [-]
		Also look at their advertising. Endless "X% faster" mentions that often get significant visual space, but when was the last time you saw "security updates 7 days earlier" or "tagged memory for better safety"? Even a single mention of "security" on a phone's manufacturer page is uncommon, and that's usually just mentioning a normal Android feature, or something like Knox or Secure Folder and not "we made choices that make a common class of attacks much more difficult or impossible". The numbers aren't zero, certainly. Nor does it imply directly proportional levels of effort. But they are incredibly obviously given wholly different levels of attention on nearly all phones, by nearly all phone manufacturers.

▲

pessimizer 6 minutes ago | parent | prev [-]

> Let's first start with y'all providing any proof

Your trivially proving things can't involve asking other people to prove the opposite of things. You've instantly backed down.

> And then we can move the goalposts

Why? You haven't done anything except ask others to do things. You've moved the goalposts from trivially falsifiable, and started begging.

▲

pjmlp 3 hours ago | parent | prev | next [-]

Because they cut costs on hardware and not all ship MTE enabled ARMs.

▲

palata 2 hours ago | parent | prev [-]

Maybe... legacy?