10 ms·

Most of ChromeOS's safety "features" come at the expense of not being able to do anything; ChromeOS can't run arbitrary malicious code because it can't really r

by cwyers 11y ago

Most of ChromeOS's safety "features" come at the expense of not being able to do anything; ChromeOS can't run arbitrary malicious code because it can't really run ANY arbitrary code. Yes, yes, Emscripten, the birth and death of Javascript, etc. -- the fact is that security through uselessness isn't a recipe for adoption.

ZenPsycho 11y ago
why do you consider running in a sandbox "useless" ? that's pretty extreme. you really can't think of any use at all for code running in a context where its ability to take power away from the user, and do things without the users permission is greatly reduced? Is your primary goal and idea of utility about doing those sorts of things? ..Or maybe you simply have a deficient imagination?
mehrdada 11y ago
JavaScript is not the only way to do things; cf. Native Client[1]. [1]: https://developer.chrome.com/native-client/overview https://developer.chrome.com/native-client/overview
- iofj 11y ago
  Things that all software on the planet is compatible with if you would just redesign and recompile and ... * chromebooks * web browsers * a turing machine implemented by having a grad student a car drive around on a long street * https://xkcd.com/505/ https://xkcd.com/505/ Of course it might be a bit slower, it might take a bit more effort, time and imagination on the part of the user. But seriously: it needs to run existing programs without recompilation.
  - mehrdada 11y ago
    That's beside the point made in the OP, which attributed Chrome's great security to its lack of functionality, which is just false. You argument is a valid one with respect to its lack of popularity. That said, while compatibility helps adoption, it is not absolutely necessary. If it were, we would all be stuck with Windows computers in our pockets running on Atom processors having 1:30 hours battery life.
tracker1 11y ago
There's also pnacl, not to mention the fact that a LOT of what people actually do online is all done/doable in the browser alone. A modern browser is the most full-featured application platform that has ever existed in terms of what comes "in the box". I'm all for allowing native applications a place to run, however that doesn't mean that ChromeOS was not able to do anything... both my parents and grandparents are all on ChromeOS laptops now... why? It's all they need, secure and I haven't had to remotely clear out any malware in over a year.
- vezzy-fnord 11y ago
  A modern browser is the most full-featured application platform that has ever existed in terms of what comes "in the box". Except for an operating system, of course.
  - cwyers 11y ago
    I'm not even sure it's more full-featured than non-OS application platforms, like Java. Mostly what it has is a large install base.
    - tracker1 11y ago
      I'm not sure that I could create/style a Java based application nearly as easily as HTML markup and CSS though.
      - deleted 11y ago
        [deleted]
      - cwyers 11y ago
        That may be true, depending on how you look at it? JavaScript was the language that, as Eric Lippert put it, was designed to "make the monkey dance.[1]" HTML and CSS and JavaScript are all designed around this ethos of try to figure out what was meant and throw SOMETHING on the screen. It's very forgiving, and it's really easy to get up and running with it quick. I'm not sure that's the same as full-featured; it makes a lot of things more accessible than Java or .NET or Win32 or Cocoa. But it doesn't have the width of functionality they do (it is catching up, admittedly, but they're not required to stay static either) and it makes more complicated tasks more difficult, especially if you need them to be performant. http://programmers.stackexchange.com/questions/221615/why-do-dynamic-languages-make-it-more-difficult-to-maintain-large-codebases http://programmers.stackexchange.com/questions/221615/why-do...
joosters 11y ago
ChromeOS can do most of the tasks that an everyday Internet user might want. There are lots of people who are content with its restrictions. It's far from useless. The update system on Chrome is wonderful, in that it just happens. No strange dialog boxes, popup messages or confusing options for the computer-illiterate. It just goes ahead and does it. A power user might not like that, but it is a great system for a huge userbase. How many insecure ChromeOS devices are there out there? Very few, I'd expect. Not many other operating systems can claim this.
- zensavona 11y ago
  Why doesn't anyone buy them then?
  - mehrdada 11y ago
    In the last couple years at least, Chromebooks have often topped Amazon best-sellers. Technically, a lot of people buy them. It's just that compared to mobile devices, laptops as a whole are a small category. Admittedly, most Chromebooks are bought because they are inexpensive (what virtually no one buys is Chromebook Pixel, which I have never seen outside Google except the ones folks got for free at I/O).
    - scholia 11y ago
      I suspect that's a factor of there being very few models. A Windows laptop that sells millions is probably available in 20 versions, each of which is counted separately. Try searching for the current Amazon.com best seller in laptops, the Toshiba Satellite C55.
    - pjmlp 11y ago
      That is an US phenomenon. The only place I saw them in Europe was garage/discount sales trying to get rid of them.
  - yoran 11y ago
    They're very popular in education (http://blogs.edweek.org/edweek/marketplacek12/2015/05/sixty_percent_of_us_chromebook_sales_are_for_education.html http://blogs.edweek.org/edweek/marketplacek12/2015/05/sixty_...). Mainly because they are inexpensive, a lot more versatile and better suited than iPads, the previous hype in education (see for instance the LA iPad debacle http://www.wired.com/2015/05/los-angeles-edtech/ http://www.wired.com/2015/05/los-angeles-edtech/). Also, many schools are already using Google services: Gmail, Drive, Calendar, and now Google Classroom is becoming huge.
geofft 11y ago
As a developer, an unjailbroken Chromebook is my preferred local terminal, because all my work involves SSHing to servers anyway. The Secure Shell and Mosh apps work great (and I even use the Mosh app in Chrome on "real" OSes, because it's simpler). Before Chrome OS, I ran homegrown minimal Linux installations with a separate user account to run Firefox. It was way too much overhead for me to be excited about maintaining, and paying $200 for a secure architecture and security updates by the most competent people in the industry was super attractive. I can do servers very well; I don't also need to do desktops, let alone my personal desktop.
- iso8859-1 11y ago
  You should try Qubes. It's not very hard to use.
  - snsr 11y ago
    Thanks for the heads-up, hadn't heard to Qubes before.
- bruceboughton 11y ago
  You mean as a server-side developer...
  - geofft 11y ago
    Not really; my previous job was maintaining a commercial Linux-based desktop. For that one I had a powerful local machine so I could run some desktops in virtualization; I hardly wanted to use my own machine as a guinea pig, because I needed that machine for actually getting work done. I did in fact have a desktop Linux machine on my desk, but in practice I just ran shells and Firefox on it, and half the time I was connected to my screen remotely. A CrOS-like OS with the ability to run VMs would be pretty great. (And yes, I should check out Qubes.)
eli 11y ago
Couldn't you make a very similar argument for most smartphones and tablets? Their adoption seems to be going pretty well.

by cwyers 11y ago

ZenPsycho 11y ago

why do you consider running in a sandbox "useless" ? that's pretty extreme. you really can't think of any use at all for code running in a context where its ability to take power away from the user, and do things without the users permission is greatly reduced? Is your primary goal and idea of utility about doing those sorts of things? ..Or maybe you simply have a deficient imagination?

mehrdada 11y ago

JavaScript is not the only way to do things; cf. Native Client[1]. [1]: https://developer.chrome.com/native-client/overview https://developer.chrome.com/native-client/overview

iofj 11y ago
Things that all software on the planet is compatible with if you would just redesign and recompile and ... * chromebooks * web browsers * a turing machine implemented by having a grad student a car drive around on a long street * https://xkcd.com/505/ https://xkcd.com/505/ Of course it might be a bit slower, it might take a bit more effort, time and imagination on the part of the user. But seriously: it needs to run existing programs without recompilation.
- mehrdada 11y ago
  That's beside the point made in the OP, which attributed Chrome's great security to its lack of functionality, which is just false. You argument is a valid one with respect to its lack of popularity. That said, while compatibility helps adoption, it is not absolutely necessary. If it were, we would all be stuck with Windows computers in our pockets running on Atom processors having 1:30 hours battery life.

tracker1 11y ago

There's also pnacl, not to mention the fact that a LOT of what people actually do online is all done/doable in the browser alone. A modern browser is the most full-featured application platform that has ever existed in terms of what comes "in the box". I'm all for allowing native applications a place to run, however that doesn't mean that ChromeOS was not able to do anything... both my parents and grandparents are all on ChromeOS laptops now... why? It's all they need, secure and I haven't had to remotely clear out any malware in over a year.

vezzy-fnord 11y ago
A modern browser is the most full-featured application platform that has ever existed in terms of what comes "in the box". Except for an operating system, of course.
- cwyers 11y ago
  I'm not even sure it's more full-featured than non-OS application platforms, like Java. Mostly what it has is a large install base.
  - tracker1 11y ago
    I'm not sure that I could create/style a Java based application nearly as easily as HTML markup and CSS though.
    - deleted 11y ago
      [deleted]
    - cwyers 11y ago
      That may be true, depending on how you look at it? JavaScript was the language that, as Eric Lippert put it, was designed to "make the monkey dance.[1]" HTML and CSS and JavaScript are all designed around this ethos of try to figure out what was meant and throw SOMETHING on the screen. It's very forgiving, and it's really easy to get up and running with it quick. I'm not sure that's the same as full-featured; it makes a lot of things more accessible than Java or .NET or Win32 or Cocoa. But it doesn't have the width of functionality they do (it is catching up, admittedly, but they're not required to stay static either) and it makes more complicated tasks more difficult, especially if you need them to be performant. http://programmers.stackexchange.com/questions/221615/why-do-dynamic-languages-make-it-more-difficult-to-maintain-large-codebases http://programmers.stackexchange.com/questions/221615/why-do...

joosters 11y ago

ChromeOS can do most of the tasks that an everyday Internet user might want. There are lots of people who are content with its restrictions. It's far from useless. The update system on Chrome is wonderful, in that it just happens. No strange dialog boxes, popup messages or confusing options for the computer-illiterate. It just goes ahead and does it. A power user might not like that, but it is a great system for a huge userbase. How many insecure ChromeOS devices are there out there? Very few, I'd expect. Not many other operating systems can claim this.

zensavona 11y ago
Why doesn't anyone buy them then?
- mehrdada 11y ago
  In the last couple years at least, Chromebooks have often topped Amazon best-sellers. Technically, a lot of people buy them. It's just that compared to mobile devices, laptops as a whole are a small category. Admittedly, most Chromebooks are bought because they are inexpensive (what virtually no one buys is Chromebook Pixel, which I have never seen outside Google except the ones folks got for free at I/O).
  - scholia 11y ago
    I suspect that's a factor of there being very few models. A Windows laptop that sells millions is probably available in 20 versions, each of which is counted separately. Try searching for the current Amazon.com best seller in laptops, the Toshiba Satellite C55.
  - pjmlp 11y ago
    That is an US phenomenon. The only place I saw them in Europe was garage/discount sales trying to get rid of them.
- yoran 11y ago
  They're very popular in education (http://blogs.edweek.org/edweek/marketplacek12/2015/05/sixty_percent_of_us_chromebook_sales_are_for_education.html http://blogs.edweek.org/edweek/marketplacek12/2015/05/sixty_...). Mainly because they are inexpensive, a lot more versatile and better suited than iPads, the previous hype in education (see for instance the LA iPad debacle http://www.wired.com/2015/05/los-angeles-edtech/ http://www.wired.com/2015/05/los-angeles-edtech/). Also, many schools are already using Google services: Gmail, Drive, Calendar, and now Google Classroom is becoming huge.

geofft 11y ago

As a developer, an unjailbroken Chromebook is my preferred local terminal, because all my work involves SSHing to servers anyway. The Secure Shell and Mosh apps work great (and I even use the Mosh app in Chrome on "real" OSes, because it's simpler). Before Chrome OS, I ran homegrown minimal Linux installations with a separate user account to run Firefox. It was way too much overhead for me to be excited about maintaining, and paying $200 for a secure architecture and security updates by the most competent people in the industry was super attractive. I can do servers very well; I don't also need to do desktops, let alone my personal desktop.

iso8859-1 11y ago
You should try Qubes. It's not very hard to use.
- snsr 11y ago
  Thanks for the heads-up, hadn't heard to Qubes before.
bruceboughton 11y ago
You mean as a server-side developer...
- geofft 11y ago
  Not really; my previous job was maintaining a commercial Linux-based desktop. For that one I had a powerful local machine so I could run some desktops in virtualization; I hardly wanted to use my own machine as a guinea pig, because I needed that machine for actually getting work done. I did in fact have a desktop Linux machine on my desk, but in practice I just ran shells and Firefox on it, and half the time I was connected to my screen remotely. A CrOS-like OS with the ability to run VMs would be pretty great. (And yes, I should check out Qubes.)

eli 11y ago

Couldn't you make a very similar argument for most smartphones and tablets? Their adoption seems to be going pretty well.