6 ms·
A variant of the 'single non-root user' problem on Unix systems. A non-root user (hopefully) can't root the system or rm -rf /root. But everything interesting
by raise_throw 9y ago
A variant of the 'single non-root user' problem on Unix systems.
A non-root user (hopefully) can't root the system or rm -rf /root.
But everything interesting is stored in that user's home folder with implicit RW permissions anyway.
On Android apps just request everything. I imagine (without explicit knowledge) that an app given permissions could rewrite, erase, or pull down over the network contacts / photos / etc in the background.
- hoppa_liza 9y ago> On Android apps just request everything That was true up to Marshmallow (Android 6), when finer grained permissions were added.
- duxup 9y agoI remember learning Unix on my school's big Unix system. Lots of talk about how important root was. I understood it from a system standpoint sure. Yet I was confused, because as a user all I cared about was my stuff that was ... right there in a non root account. As you say all the stuff I was concerned about was right there, but nobody talked about how important that was.
- mikeryan 9y agoOn a large multi user system there’s a big difference between “your stuff” and “everyone’s stuff” on a single user system like a phone - not so much.
- c22 9y agoAlthough you can leverage multiuser capable systems for more security by, say, using different user accounts for playing games and banking, or whatever.
- dredmorbius 9y agoThe point is that your trust envelope extends to the authors of software, which are frequently not acting in the best interests of the user, and have their own goals and incentives (including competing goals with other software authors). On my Linux systems, particularly under Debian, there's some assurance provided through the Debian Project, its guiding documents (social contract, constitution, policy), and debian developers. The project explicitly serves the users. This doesn't prevent bugs and occasional malice, but tends to tremendously reduce incentives for it. Smartphones ... are a mess, and Android rather particularly so. I've suggested entirely rethinking how app development is performed, particularly for basic utilities, closer to the Debian model. I have little hope of this occurring.
- michaelt 9y ago"If someone steals my laptop while I'm logged in, they can read my e-mail, take my money, and impersonate me to my friends... but at least they can't install drivers without my permission" https://xkcd.com/1200/ https://xkcd.com/1200/
- mirimir 9y agoOK, but doesn't AppArmor protect against that? And it looks like it's been ported to Android and iOS. But it's not default, I guess. But neither is AppArmor in Linux. So why haven't we heard about apps stealing stuff from /home/user/? Is it just that distros do a better job of policing their repos? Or that the userbase is too small to attract malicious app developers?
- Larrikin 9y agoHow many years after Android permissions changed for the better will users who have never owned an Android phone complain about a problem that no longer exist.
- pjmlp 9y agoWell, because there is this thing called lack of updates. On German consumer shops, most "deal of the day" are still a mix of 4.4 and 5.1.
- saagarjha 9y agoUntil Google finally matches the permission model that iOS has had for years, and until the changes roll out to the majority of users instead of the few that own Pixel phones?
- KozmoNau7 9y agoIt has been there since Android 6.0.
- pjmlp 9y agoOnly available to around 60% of Android users.
- microtheo 9y agoIt doesn't change the fact that it is there. :D
- jackson1way 9y agoIt is NOT there for at least 40% of android users.
- spease 9y ago> rm -rf /root I don’t think this will do much besides blow away the root user's home directory, which probably doesn't have much in it anyway. But I get what you mean.
- MayeulC 9y agoI learned quite recently that Android was using one user ID per installed app, effectively isolating them one from another. However, I am not sure I understood what you meant by > On Android apps just request everything Well, this is as true as with any other operating system, isn't it? Nowadays, I try to use F-droid as much as I can, applications there ask for reasonable permissions, and are open source, which makes it easier to trust them.