4 ms·

> Nobody wants to remove all security policies etc from iOS. I'm not sure what gave you that idea in this thread. I think you misunderstood me there. Of course

> Nobody wants to remove all security policies etc from iOS. I'm not sure what gave you that idea in this thread. I think you misunderstood me there. Of course permission systems are going to stay, who in their right mind would give up this crucial innovation? But free-as-in-freedom implies that I, the owner and user, can do whatever I want, including triggering all sorts of footguns – if I get tricked into installing CriminalBankrobberApp and giving it all sorts of permissions because I believe it legitimately needs those and won't abuse them, it's game over. A non-free iOS can simply make this impossible or so inconvenient that I'll never bother – an app that actively attacks banking apps on my device wouldn't even get on the App Store I guess – but I don't think a free-as-in-freedom iOS could possibly keep that sort of tight control, not with a 30%-of-revenue economic incentive for everyone else to normalize arbitrary distribution channels. > That doesn't mean that it shouldn't be possible to install through different avenues as well (still requiring the users permission). How does the user know what avenues are safe and what aren't? Isn't this just a rehash of downloading software from arbitrary websites, just with lots of app stores instead? > but the apple store quality would probably increased significantly, because they could deny significantly more apps And lots and lots of others, big names too, would decide to forgo the App Store entirely (even assuming some loss of visibility, those are some really easily-earned (30-x)% in revenue!), so you'd end up with an Epic store and a Steam store and a EA store and a Facebook store and an app store for each media outlet (NYT Recipes now at the NYT App Store!) and possibly for each bank and national app stores and regional app stores and a CoolBeansAppStore with neat UI tweaks and skins and a SuperDuperAppStore with all sorts of small indy apps and a SuperSecureAppStore that distributes copies of other apps with added tracking and tons of Indydev Inc App Stores, and FreeXXXAppStore that has some well-known copyright-agnostic porn apps and absolutely no rules at all and all kinds of malware and scams... pretty much like the internet back then, but with much leakier sandboxes, because there are lots of things apps must be able to do if allowed to that websites pretty much never need(ed?) to do ... And good luck with crafting a permission system that makes all of this really transparent and clear and actionable and still isn't a huge hassle that everyone just clicks through and works even for disinterested, impatient laypeople ... That's reducing the depth of security to pretty much this single thing that people hate in its current form already. I mean, really, I am sometimes struggling to tell what's safe and what isn't on the web, and I should tell, I'm building some of the stuff that's on the web – how is someone who's busy being a lawyer, or is elderly and kinda struggling with the latest generation of gadgets, or a stressed-out parent with zero time for ITSec studies on top, or 15 years old, etc. pp. supposed to make that call that in a similarly confusing environment, on similarly bad data – possibly worse data. The only reason this works on Android so far is probably that the UX of using other stores or sideloading is so bad; some have tried to establish their own, but churn is just too brutal for next to everyone. I'm not saying free and open mobile platforms cannot be done, or that there's absolutely no way to open up iOS without wreaking havoc, and I'm definitely not saying that wouldn't be really worthwhile, because I think it would be absolutely fantastic to have an open and free mobile platform – but I believe that's going to be much, much more difficult than just throwing out all the restrictions and calling it a day, because we've been there in the early internet and security-wise it was an absolute nightmare.

stale2002 6y ago
> if I get tricked into installing Do you think that people are incapable of using personal computers then? Just the regular old PC. This argument falls flat on its face, because it is blatantly obvious, that, for some reason, people are capable of using PCs, and don't explode from the confusion of doing so. Every single argument that you are making, could apply to the PC. But people still do alright using PCs. Phones should not be any different. > good luck with crafting a permission system How are they doing that on the PC? PCs work fine. > how is someone who's busy being a lawyer Thats an interesting question. Which has an answer. How does a lawyer use a PC, right now? So thats how they'll do it. > pretty much like the internet back then Why do we have to talk about the internet from a long time ago? Just talk about the current internet. Which people use. On the PC. Right now. > t there's absolutely no way to open up iOS without wreaking havoc Just do it the same way that PCs currently work. Right now. Because PCs work, right now, and society is not falling apart. > because we've been there in the early internet and security-wise it was an absolute nightmare. We don't need to talk about the early internet. Just make the iPhone the same as modern day PCs. Which people are already capable of using just fine.
- dividedbyzero 6y ago
  > How are they doing that on the PC? PCs work fine. > Just make the iPhone the same as modern day PCs. Which people are already capable of using just fine. Ransomware attacks are absolutely rampant, though you'll never hear about the vast majority of incidents of course, and pretty much all of those start with someone running thingycorp_salaries_full_list.xlsx.exe, enabling macros for a fishy .docx, opening an infected .pdf, downloading and running infected installers, plugging in random USB keys, and so on. Then there's lots and lots of phishing attacks going on, and that's with most companies already clamping down on attack vectors really hard — if people used private PCs as much as they use their private smartphones, for sensitive things like banking, without an IT department to shield them from the worst of it, I guess consumer Windows would get a lot more locked down really quickly. > people are capable of using PCs, and don't explode from the confusion of doing so. People may not explode from confusion, but if they had a better idea of how complex IT security has become, they might at least feel somewhat uneasy. Even people in IT roles screw up and get pwned, or build systems in a way that lets them get pwned easily, all the time really. Bad actors have become pretty sophisticated over the last decade as well, and Covid-19 is only making things worse as lots of unsavory individuals with money and resources find that real-world crime doesn't quite deliver the returns it used to, and everyone and their mother now conduct large parts of their lives through their smartphone and move lots of money through those devices. Personally, I've definitely noticed both attack volume and sophistication going up few notches already. > How does a lawyer use a PC, right now? So thats how they'll do it. The vast majoriy will depend on IT people to keep them safe, and their devices will be quite thoroughly locked down, and their email pretty aggressively filtered. Incidents definitely still happen, though. Same with medicine. I really don't think it's a stretch to imagine people getting socially engineered en masse to install shady apps in a world where each app store and each app requires an entirely new security assessment on little to no data by end users, or apps getting compromised and not get pulled, or whatever. It's possible to solve that quandary, but it's not going to be as easy as just throwing out all restrictions without devising some other mechanism to take their place in protecting users. > Because PCs work, right now, and society is not falling apart. Society isn't falling apart from lots and lots of issues I'd consider quite severe. I'd rather not let anything get to that point if it can be prevented.

stale2002 6y ago

> if I get tricked into installing Do you think that people are incapable of using personal computers then? Just the regular old PC. This argument falls flat on its face, because it is blatantly obvious, that, for some reason, people are capable of using PCs, and don't explode from the confusion of doing so. Every single argument that you are making, could apply to the PC. But people still do alright using PCs. Phones should not be any different. > good luck with crafting a permission system How are they doing that on the PC? PCs work fine. > how is someone who's busy being a lawyer Thats an interesting question. Which has an answer. How does a lawyer use a PC, right now? So thats how they'll do it. > pretty much like the internet back then Why do we have to talk about the internet from a long time ago? Just talk about the current internet. Which people use. On the PC. Right now. > t there's absolutely no way to open up iOS without wreaking havoc Just do it the same way that PCs currently work. Right now. Because PCs work, right now, and society is not falling apart. > because we've been there in the early internet and security-wise it was an absolute nightmare. We don't need to talk about the early internet. Just make the iPhone the same as modern day PCs. Which people are already capable of using just fine.

dividedbyzero 6y ago
> How are they doing that on the PC? PCs work fine. > Just make the iPhone the same as modern day PCs. Which people are already capable of using just fine. Ransomware attacks are absolutely rampant, though you'll never hear about the vast majority of incidents of course, and pretty much all of those start with someone running thingycorp_salaries_full_list.xlsx.exe, enabling macros for a fishy .docx, opening an infected .pdf, downloading and running infected installers, plugging in random USB keys, and so on. Then there's lots and lots of phishing attacks going on, and that's with most companies already clamping down on attack vectors really hard — if people used private PCs as much as they use their private smartphones, for sensitive things like banking, without an IT department to shield them from the worst of it, I guess consumer Windows would get a lot more locked down really quickly. > people are capable of using PCs, and don't explode from the confusion of doing so. People may not explode from confusion, but if they had a better idea of how complex IT security has become, they might at least feel somewhat uneasy. Even people in IT roles screw up and get pwned, or build systems in a way that lets them get pwned easily, all the time really. Bad actors have become pretty sophisticated over the last decade as well, and Covid-19 is only making things worse as lots of unsavory individuals with money and resources find that real-world crime doesn't quite deliver the returns it used to, and everyone and their mother now conduct large parts of their lives through their smartphone and move lots of money through those devices. Personally, I've definitely noticed both attack volume and sophistication going up few notches already. > How does a lawyer use a PC, right now? So thats how they'll do it. The vast majoriy will depend on IT people to keep them safe, and their devices will be quite thoroughly locked down, and their email pretty aggressively filtered. Incidents definitely still happen, though. Same with medicine. I really don't think it's a stretch to imagine people getting socially engineered en masse to install shady apps in a world where each app store and each app requires an entirely new security assessment on little to no data by end users, or apps getting compromised and not get pulled, or whatever. It's possible to solve that quandary, but it's not going to be as easy as just throwing out all restrictions without devising some other mechanism to take their place in protecting users. > Because PCs work, right now, and society is not falling apart. Society isn't falling apart from lots and lots of issues I'd consider quite severe. I'd rather not let anything get to that point if it can be prevented.