5 ms·

You can not trust the user. Never.

by felipelemos 9y ago

blowski 9y ago
How does that work in parallel with "It's my device, I'll do what I want with it"?
- AnIdiotOnTheNet 9y ago
  It doesn't. We've had user-based permissions in the mainstream on personal devices ever since XP, and they have totally failed to protect us from anything. It is an utterly broken, worse than useless, backwards model of security for this class of device. If you think I'm wrong, by all means tell me why instead of just downvoting like some reddit user. I'll happily provide you with a list of all the ransomware that didn't require even a single elevated permission to ruin someone's day.
  - blowski 9y ago
    From the guidelines: > Please don't comment about the voting on comments. It never does any good, and it makes boring reading. Better to provide that list without complaining about the downvotes. Even better would be suggesting how you would improve the system.
    - AnIdiotOnTheNet 9y ago
      Even better would be if I just left this hellhole I think. The only difference between this place and the cesspool of reddit seems to be that people here think they're better than redditors while behaving exactly the same way.
      - jsjohnst 9y ago
        > Even better would be if I just left this hellhole I think. If that’s what you think about it, then yeah, I agree you should, at least until you cool off anyway.
- eli 9y ago
  Make dangerous things hard to do, but not impossible
  - mantas 9y ago
    So someone could make a script simplifying them :)
- pas 9y ago
  Ask the user what kind of device it wants. (And then when the user says give me the developer hyper bleeding edge pro X, because my mom needs 4K cat videos, then maybe try to persuade the user that the regular non-devkit version would be the sane choice.) And in the dev version protect the dev mode by some small ritual (like the 7-times tapping on About in Android).
- Feniks 9y ago
  Oh man the hoops I had to jump through to get full admin control over windows 10. I understand the necessity of hiding power options but that was excessive.
carlosrg 9y ago
I'm an user too and I'd like to be treated like an adult by my operating system.
- abritinthebay 9y ago
  You’re not the general case.
  - throwaway2048 9y ago
    Does that mean that he shouldn't care about his own experience? Maybe he should just watch American idol, listen to the top 20 pop hits and eat at McDonalds too, because obviously if he isn't in the majority, his opinion dosen't matter.
    - abritinthebay 9y ago
      Good lord that was a hell of a leap of logic you just made. You must be tired after jumping to conclusions and attacking straw men. Meanwhile, here in reality, the general case is what is design something for (you, btw, were describing lowest common denominator programming - a very different thing with a different, tho related, focus). Understanding what niche you occupy is key to understanding what products and services are designed for you & which are not. Complaining that you are not catered to as a uncommon case in general purpose product is not only fruitless it’s also foolish.
snowwrestler 9y ago
This is essentially the mindset of iOS, which I think most folks would agree is more secure than macOS. It's much easier to secure a device when you can take this for granted. Unfortunately, a lot of people still use computers instead of iOS devices explicitly because they want more control and power over what the machine is doing. Security is a lot harder to do in this case. Ultimately, you can't protect a machine from an empowered user. The best you can hope for is to provide guide rails that make it easier to do the right thing, and harder to do the wrong thing.

You can not trust the user. Never.

blowski 9y ago

How does that work in parallel with "It's my device, I'll do what I want with it"?

AnIdiotOnTheNet 9y ago
It doesn't. We've had user-based permissions in the mainstream on personal devices ever since XP, and they have totally failed to protect us from anything. It is an utterly broken, worse than useless, backwards model of security for this class of device. If you think I'm wrong, by all means tell me why instead of just downvoting like some reddit user. I'll happily provide you with a list of all the ransomware that didn't require even a single elevated permission to ruin someone's day.
- blowski 9y ago
  From the guidelines: > Please don't comment about the voting on comments. It never does any good, and it makes boring reading. Better to provide that list without complaining about the downvotes. Even better would be suggesting how you would improve the system.
  - AnIdiotOnTheNet 9y ago
    Even better would be if I just left this hellhole I think. The only difference between this place and the cesspool of reddit seems to be that people here think they're better than redditors while behaving exactly the same way.
    - jsjohnst 9y ago
      > Even better would be if I just left this hellhole I think. If that’s what you think about it, then yeah, I agree you should, at least until you cool off anyway.
eli 9y ago
Make dangerous things hard to do, but not impossible
- mantas 9y ago
  So someone could make a script simplifying them :)
pas 9y ago
Ask the user what kind of device it wants. (And then when the user says give me the developer hyper bleeding edge pro X, because my mom needs 4K cat videos, then maybe try to persuade the user that the regular non-devkit version would be the sane choice.) And in the dev version protect the dev mode by some small ritual (like the 7-times tapping on About in Android).
Feniks 9y ago
Oh man the hoops I had to jump through to get full admin control over windows 10. I understand the necessity of hiding power options but that was excessive.

carlosrg 9y ago

I'm an user too and I'd like to be treated like an adult by my operating system.

abritinthebay 9y ago
You’re not the general case.
- throwaway2048 9y ago
  Does that mean that he shouldn't care about his own experience? Maybe he should just watch American idol, listen to the top 20 pop hits and eat at McDonalds too, because obviously if he isn't in the majority, his opinion dosen't matter.
  - abritinthebay 9y ago
    Good lord that was a hell of a leap of logic you just made. You must be tired after jumping to conclusions and attacking straw men. Meanwhile, here in reality, the general case is what is design something for (you, btw, were describing lowest common denominator programming - a very different thing with a different, tho related, focus). Understanding what niche you occupy is key to understanding what products and services are designed for you & which are not. Complaining that you are not catered to as a uncommon case in general purpose product is not only fruitless it’s also foolish.

snowwrestler 9y ago

This is essentially the mindset of iOS, which I think most folks would agree is more secure than macOS. It's much easier to secure a device when you can take this for granted. Unfortunately, a lot of people still use computers instead of iOS devices explicitly because they want more control and power over what the machine is doing. Security is a lot harder to do in this case. Ultimately, you can't protect a machine from an empowered user. The best you can hope for is to provide guide rails that make it easier to do the right thing, and harder to do the wrong thing.