4 ms·

In another comment, he says "user/process/thread security in UNIX/POSIX/etc. is bullshit weak sauce, sadly." Geofft expounds some more: On Android, questionabl

by andreyf 11y ago

In another comment, he says "user/process/thread security in UNIX/POSIX/etc. is bullshit weak sauce, sadly." Geofft expounds some more: On Android, questionable apps have direct access to the entire kernel system call interface, as well as to other OS features. Personally, I'm not so much upset because Android is uncommonly bad (it's like any other system that gives untrusted users non-root access to Linux: you can probably get away with it, but eh), but because CrOS is uncommonly good. I'm not sure if these are related, nor how iOS avoids it. The answer is probably in here: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf FWIW, I've heard Googlers familiar with it refer to Android as a pile of crap, as well.

scintill76 11y ago
> he says "user/process/thread security in UNIX/POSIX/etc. is bullshit weak sauce, sadly." Android's security indeed relies on UNIX's (filesystem permissions, separate UIDs for each app), but he praised OSX and iOS (I think) for starting from UNIX[0], so it would be inconsistent to also damn Android for it (which I don't think he necessarily did, since dissing UNIX security was in a different context.) From skimming the iOS security guide (and having no iOS dev experience) it looks like it's similar: "The majority of iOS runs as the non-privileged user “mobile,” as do all third-party apps" -- although being BSDish vs Android's Linux could mean that's quite different. > On Android, questionable apps have direct access to the entire kernel system call interface, as well as to other OS features... because CrOS is uncommonly good. So CrOS has the advantage because I guess it does not allow running untrusted native code at all, containing things entirely in interpreted/JIT'd VMs. That would be a good point... except every other OS 'rdl esteems higher than Android (Windows, OSX, iOS, Blackberry) probably also runs native code with full access to syscalls (making some assumptions here, but I think it's reasonable that to whatever extent 'geofft's statement about Android is true, it applies fairly uniformly to the rest.) So, why are they good or even just OK, but Android is horribad? I'm not sure I'm actually addressing arguments 'rdl would have made about Android -- but that's the point, he didn't really say anything that can be argued! > FWIW, I've heard Googlers familiar with it refer to Android as a pile of crap, as well. Yeah, it's probably true -- I wasn't saying "Google made it, so it must be good", but underlining the fallacy in relying on a prestigious company association as proof of merit. Android probably didn't have the best talent when it started in 2003 and is now painted into a corner of backwards-compatibility and a huge codebase that would be risky to revamp all at once. I guess my favorite aspect of Android is really just that it's open-source-ish and has enough critical mass to be useful (as opposed to Firefox OS and Ubuntu at the moment) -- so if ChromiumOS were to become the new AOSP as some are speculating, sounds good to me. [0] https://news.ycombinator.com/item?id=10476099 https://news.ycombinator.com/item?id=10476099
- andreyf 11y ago
  Good points. I think bullshit weak sauce is busllshit weak sauce regardless of context. If you don't trust it on a server, why should you on your phone? The comparison between Android and iOS is especially curious, in part because it's such a competitive space, and also because rdl's opinions varied so extremely. Both OS X and iOS are based on Darwin, which also suggests vulnerabilities in kernel calls are not what rdl had in mind. When his latest startup was acquired, the blog post [1] described a part of it as: > Beyond the company’s work in VPNs, CryptoSeal applied Trusted Computing technology to commodity servers, protecting them from compromise by outsider attackers or insider subversion, and guaranteeing the integrity of server-side applications to remote end users. Perhaps something about the hardware iOS runs on is what impressed him so? 1. https://blog.cloudflare.com/cloudflare-acquires-cryptoseal/ https://blog.cloudflare.com/cloudflare-acquires-cryptoseal/
- digi_owl 11y ago
  To speculate a bit, he seem to favor iOS above all else because: A) its BSD (Torvalds have offended a sizable part of the -sec community by not highlighting security updates in release notes) B) it is locked down by default, to the point that there is not even a common storage area for files (this "blew up" in Android a while back because some big name messaging app was dumb enough to put unencrypted user data in exactly such a common area).
bitmapbrother 11y ago
>FWIW, I've heard Googlers familiar with it refer to Android as a pile of crap, as well. Have you see the CVE iOS database? If "Android is a pile of crap" then I can only imagine what iOS must be.
- andreyf 11y ago
  "There are security bugs" does not mean "pile of crap". Everything has security bugs. The question is how bad they are and how much it costs to buy a zero-day / the use of a zero-day.
  - bitmapbrother 11y ago
    I agree that everything has security bugs. It's pretty much inevitable. But, one platform has nearly 5.5 times the security issues of the other. So, if you're using security issues to correlate what a "pile of crap" is than you need not look further than iOS. iOS: 749 Vulnerabilities http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html?vendor_id=49 http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html... Android: 138 Vulnerabilities http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224 http://www.cvedetails.com/product/19997/Google-Android.html?...
    - andreyf 11y ago
      Oh, interesting stats. Thanks for linking those!

by andreyf 11y ago

scintill76 11y ago

> he says "user/process/thread security in UNIX/POSIX/etc. is bullshit weak sauce, sadly." Android's security indeed relies on UNIX's (filesystem permissions, separate UIDs for each app), but he praised OSX and iOS (I think) for starting from UNIX[0], so it would be inconsistent to also damn Android for it (which I don't think he necessarily did, since dissing UNIX security was in a different context.) From skimming the iOS security guide (and having no iOS dev experience) it looks like it's similar: "The majority of iOS runs as the non-privileged user “mobile,” as do all third-party apps" -- although being BSDish vs Android's Linux could mean that's quite different. > On Android, questionable apps have direct access to the entire kernel system call interface, as well as to other OS features... because CrOS is uncommonly good. So CrOS has the advantage because I guess it does not allow running untrusted native code at all, containing things entirely in interpreted/JIT'd VMs. That would be a good point... except every other OS 'rdl esteems higher than Android (Windows, OSX, iOS, Blackberry) probably also runs native code with full access to syscalls (making some assumptions here, but I think it's reasonable that to whatever extent 'geofft's statement about Android is true, it applies fairly uniformly to the rest.) So, why are they good or even just OK, but Android is horribad? I'm not sure I'm actually addressing arguments 'rdl would have made about Android -- but that's the point, he didn't really say anything that can be argued! > FWIW, I've heard Googlers familiar with it refer to Android as a pile of crap, as well. Yeah, it's probably true -- I wasn't saying "Google made it, so it must be good", but underlining the fallacy in relying on a prestigious company association as proof of merit. Android probably didn't have the best talent when it started in 2003 and is now painted into a corner of backwards-compatibility and a huge codebase that would be risky to revamp all at once. I guess my favorite aspect of Android is really just that it's open-source-ish and has enough critical mass to be useful (as opposed to Firefox OS and Ubuntu at the moment) -- so if ChromiumOS were to become the new AOSP as some are speculating, sounds good to me. [0] https://news.ycombinator.com/item?id=10476099 https://news.ycombinator.com/item?id=10476099

andreyf 11y ago
Good points. I think bullshit weak sauce is busllshit weak sauce regardless of context. If you don't trust it on a server, why should you on your phone? The comparison between Android and iOS is especially curious, in part because it's such a competitive space, and also because rdl's opinions varied so extremely. Both OS X and iOS are based on Darwin, which also suggests vulnerabilities in kernel calls are not what rdl had in mind. When his latest startup was acquired, the blog post [1] described a part of it as: > Beyond the company’s work in VPNs, CryptoSeal applied Trusted Computing technology to commodity servers, protecting them from compromise by outsider attackers or insider subversion, and guaranteeing the integrity of server-side applications to remote end users. Perhaps something about the hardware iOS runs on is what impressed him so? 1. https://blog.cloudflare.com/cloudflare-acquires-cryptoseal/ https://blog.cloudflare.com/cloudflare-acquires-cryptoseal/
digi_owl 11y ago
To speculate a bit, he seem to favor iOS above all else because: A) its BSD (Torvalds have offended a sizable part of the -sec community by not highlighting security updates in release notes) B) it is locked down by default, to the point that there is not even a common storage area for files (this "blew up" in Android a while back because some big name messaging app was dumb enough to put unencrypted user data in exactly such a common area).

bitmapbrother 11y ago

>FWIW, I've heard Googlers familiar with it refer to Android as a pile of crap, as well. Have you see the CVE iOS database? If "Android is a pile of crap" then I can only imagine what iOS must be.

andreyf 11y ago
"There are security bugs" does not mean "pile of crap". Everything has security bugs. The question is how bad they are and how much it costs to buy a zero-day / the use of a zero-day.
- bitmapbrother 11y ago
  I agree that everything has security bugs. It's pretty much inevitable. But, one platform has nearly 5.5 times the security issues of the other. So, if you're using security issues to correlate what a "pile of crap" is than you need not look further than iOS. iOS: 749 Vulnerabilities http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html?vendor_id=49 http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html... Android: 138 Vulnerabilities http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224 http://www.cvedetails.com/product/19997/Google-Android.html?...
  - andreyf 11y ago
    Oh, interesting stats. Thanks for linking those!