No, I'm explicitly stating that it doesn't. The LineageOS security patch level is explicitly dishonest. They set it to the latest value across devices even when shipping only shipping a fraction of the security fixes required by the latest patch level. AOSP patches aren't enough.
Conversation
This Tweet was deleted by the Tweet author. Learn more
Non-Pixel devices also don't have comparable security at a firmware and hardware level. It can't be addressed with another OS. Also, only Pixels (and the Nexus 5X / 6P before them) support all the hardware security features like verified boot with alternate operating systems.
1
This Tweet was deleted by the Tweet author. Learn more
You should be avoiding Android as a whole if you think they deliberately put in backdoors, because backdoors can be hidden in open source code as bugs. The same applies to other software where Google plays a substantial role including the Linux kernel and many other projects.
1
This Tweet was deleted by the Tweet author. Learn more
It's worth keeping in mind that desktops and laptops have similar issues. They have huge numbers of components, many with their own complex firmware like HDDs/SSDs, Wi-Fi, etc. It's even rarer to have proper firmware updates on those than phones.
1
Replying to
AOSP offers much better privacy and security than a traditional operating system without a strong security model and strong exploit mitigations too. LineageOS hinders some of that, but most is still intact. Most devices not having full security updates is a huge issue though.
1
This Tweet was deleted by the Tweet author. Learn more
Having the AOSP security updates doesn't mean you're receiving most of the critical security vulnerability fixes. A disproportionately large number of the security issues are in device-specific code, lots of it closed source. Having most fixed wouldn't really help much anyway.
1
Replying to
An attacker doesn't need hundreds of vulnerabilities available, although there are hundreds of serious unfixed vulnerabilities after a year of not receiving updates from the vendors and only applying AOSP security fixes and upstream kernel fixes (and the latter is not a given).
Replying to
An attacker only needs a few good vulnerabilities to have a working exploit chain. It makes sense for them to target SoC vendor code portable across millions of devices but harder to update than AOSP code. Shipping the AOSP updates alone leaves many critical gaping holes open.
1
Replying to
For example, vulnerabilities in the GPU driver can often be exploited from a web browser. A vulnerability in audio / video handling can be even more exposed. These areas involve huge amounts of closed source vendor code in driver libraries / firmware requiring updates from them.
1
Show replies