Earlier quoted context omitted.
Malware is less of a problem for Android now than any point in Windows' history except for possibly the past few years, so I think that sandboxing has succeeded rather well, given that Windows has had 34 years to evolve defenses and Android has only had 11. Even early on in its life, Android was still better off than Windows at the time, and what do you know - Android has allowed sideloading and alternative app store…
That's not exactly a ringing endorsement, is it? Sure, the malware situation on Android is better than Windows. It's still far worse compared to iOS. https://arstechnica.com/information-technology/2020/02/resea... (Note the date. This is an ongoing problem.) https://www.theverge.com/2019/7/10/20688885/agent-smith-andr... https://securelist.com/skygofree-following-in-the-footsteps-... https://arstechnica.com/informati…
> If you believe this has "worked out well" for Android, you and I must have very different definitions of the phrase.
Yes, it's a ringing endorsement. Android is good enough - actually, better than good enough. I've seen at least five cases of Windows malware from friends and family over the years, and zero Android cases.
As the article you listed above shows, xHelper has had 33K detected cases. That's literally two decimal orders of magnitude less than Conficker, which had over 9M cases, in 2008, when there were, if anything, fewer Windows devices than there are Android devices now.
iOS is only better than Android because it sacrifices a lot of user freedom for a little security - which is not an acceptable tradeoff. If I pay for a device, I (should) own it - not the company. If you, personally, are not going to check the box that says "let me install third-party apps" then you, personally, are at no risk of infection, and you have absolutely no right to tell me that you think that I should not have the right to check that box.
> Don't you think there's a direct correlation between the ability to install APKs from random shady internet sources and the spread of malware on Android? Even macOS has a worse malware situation than iOS for the exact same reason.
Yes, there's a direct correlation. If you give users sharp tools, the dumb ones will stab themselves. This is normal, and good. Users deserve the sharp tools. Put a sheath around them, but device makers intentionally restricting users from things that they might reasonably want to do, for the sake of their own profit, is borderline theft.
> You also didn't address my other point, which is sandboxing is only meant to address operating system level security, not developer abuse of legitimate APIs.
Yes, because developer abuse of legitimate APIs is irrelevant to what we're talking about here, which is whether or not to allow third-party app stores. Why? Because (a) both Apple and Google's app store review processes have let malware through before and (b) sandboxing, which doesn't necessarily prevent developers from abusing legitimate APIs, is necessary for it - and both iOS and Android take advantage of sandboxing to make it harder for devs to do bad things. For instance, iOS (now) gives you a notification if an application accesses the clipboard. Even better, there are modifications for Android that allow you to intercept and fake API data (so that an application doesn't refuse to work if you deny it access to an API) - which is significantly better than anything you can get on iOS.