Hi there, Vincent!
Others have pointed out that there is a difference between ‘security’ and ‘privacy’, and while there is an overlap between the two, they are separate concepts, and each has different levels of concern for each user.
Whenever the topic comes up, I link to this academic paper that does an incredible job of comparing and contrasting the two concepts (and their derivatives) in greater detail, but here’s a simplified example: “security” is the protection of your data against someone who is attempting to access your data, by the use of some sort of exploit. Whether it’s physical theft of your phone, or leveraging some kind of software vulnerability, or hacking into your Murena account and downloading the data replicated there…that’s the sort of thing where “security” is the idea of how your data is kept safe.
By contrast…there is “privacy”…and “privacy” isn’t a matter of a security exploit. If you text someone a document or photo intended “for their eyes only”, and they show it to a friend on their phone…that was a breach of privacy. In this example, you know the recipient. Nobody else accessed the data, but there was a breach of privacy because the recipient who had permission to access the data, shared it with someone who didn’t. Most of us who run an aftermarket ROM of any kind, are not here because we necessarily believe that the data Google has will be accessed through some illicit means, or because we believe Google’s services are riddled with vulnerabilities that allow some North Korean hacker to gain access to data they shouldn’t. On the contrary, I think many of us would acknowledge that Google is pretty good at keeping data secure…but either shares that data with people we would not want our data shared with, or is using it internally for tasks we would prefer they did not use are data to perform.
Over the years, I’ve heard lots of back-and-forth about how /e/OS isn’t as adamant about security updates as other ROM projects. There may well be some truth to that. I won’t dispute that possibility - in fact, I’ll even grant the argument. The problem, as I see it, is that that the argument rings a bit hollow for me. I have yet to read a case study, a blog post, a forum thread, or even a tweet about a phone running /e/OS, which was remotely exploited and had data exfiltrated, due to a vulnerability present on the /e/OS phone that already had a patch released for it, but was delayed due to /e/OS. Perhaps such a scenario did happen, and I’m open to a link for it…but thus far, I’ve seen a LOT of hand-wringing over update cadence, but purely as a matter of principle.
As far as I’m concerned though, the thing /e/OS has that no one else has available, is /e/Cloud Server. Now sure, I know I’m one of an extreme minority who uses it, but none of the projects who sling mud over security updates even have it as an option. They all get real quiet when it comes to any sort of data syncing or browser-based functionality (“just use Proton!”), but Murena handles that side as well, and even if I have my own complaints on that front…I’m still waiting for any of the other ROM projects address that side of the equation. Maybe it’s not as safe as commercial services, but it’s at least a choice…and those other projects would do well to make some headway on that side, before arguing that /e/OS is inferior because they’re not quite as fast with patches.
