5 ms·

A lot of this is just trying to decide what is best for other people, though; whenever we've managed to make it easy for people to quickly jailbreak their devic

by saurik 6y ago

A lot of this is just trying to decide what is best for other people, though; whenever we've managed to make it easy for people to quickly jailbreak their devices, we got a very large number of users installing complex system modifications so they can get something as inane as wallpaper or themed icons. People who don't know how to jailbreak their devices themselves see their friends phones and ask them for help or even bring their phone to phone repair shops to get them jailbroken and customized (in the same manner that you don't have to be a mechanic to modify your car: you simply need to have the money to pay a body shop for whatever you want; I gave a TEDx talk on this topic a while back called "Even Software Should Have Screws" https://www.youtube.com/watch?v=ReKCp9K_Jqw https://www.youtube.com/watch?v=ReKCp9K_Jqw). Honestly, I am not sure if I've ever heard an "end user" ask to be prevented from doing something they actually wanted to do... the only people who seem to have that particular kink are developers attempting to justify the bondage and control ecosystem they are a part of maintaining; everyone else either finds out after it is too late, had to accept it for some other reasonable (but entirely unrelated) tradeoff such as "I wanted a phone with a good camera and both of the top options from Apple/Samsung were locked down", or are "stuck" due to ecosystem lock-in and networking effects (it doesn't just cost you a new phone to escape the jail you are in: you will have to re-purchase all of the software you already own and even lose access entirely to some unique services... and again, all of this is entirely unrelated to the actual issue in question).

eyelidlessness 6y ago
I don’t think it’s that end users explicitly ask to be prevented from doing things they want to do with their devices. I think it’s that they feel safer in a restricted environment that’s relatively free of the dangers of unrestricted environments, and they’re willing to accept that some lack of control is likely tied to that relative safety. Heck, I’ll just speak for myself. I’m a software engineer. I pride myself on being able pull things apart, understand how they work, and put their pieces together in unintended ways. There are aspects of Apple’s control over their devices that I’ve accepted grudgingly... because even being familiar with the tradeoffs they’ve largely benefited me, and all that I’ve given up has been either moot (UI hacks that are better served with other apps or just not available anywhere anymore) or not a hindrance for my actual usage (it turns out blocking system modification has made clever things I use be more respectful of the integrity of my system!). The biggest thing I’ve lost as an Apple customer has been due to third party developers turning my whole computer into a web browser. Glad it isn’t full of security holes!
- saurik 6y ago
  Yeah, but you aren't an "end user". I've never met an end user who, when presented with something they want to do--like change the Safari icon to a picture of a dog--who is like "I'm glad I'm not allowed to do that because X"... they pretty much couldn't possibly say that as they aren't in a position to understand X. It is only some vocal minority of admittedly-informed software developers attempting to analyze the tradeoffs of how all this stuff works that are making that decision, and to be a bit frank about it, it just seems like they (you) are either being a bit snooty about the feature in question (being able to have a photo of something you care deeply about as your wallpaper can bring someone immense joy, and to just discount that feels weird) or a bit unimaginative (as there are just so many things you could get: in the jailbreak community we would routinely take suggestions and throw something together for small handfuls of people because it brought us and them joy to do so) with respect to "what they are losing" :/. Even if you can't just can't fathom anyone like yourself benefiting, how about this: we had a blind high school student get involved in jailbreaking as a developer who then built a bunch of software to make his ability to live his life more practical... should we just say that people with niche problems can only get them solved if they are important enough to hit Apple's radar, because no one is ever allowed to solve problems for themselves "for their own good"? :/
  - eyelidlessness 6y ago
    How am I not an end user? I buy Apple products, and I use them daily. I described ways I have accepted the limitations Apple has put on my usage of them. I could describe more? I can’t swap out RAM or storage, I’m no longer willing to risk the damage of swapping out batteries. I can’t install hacks that let me switch Safari tabs with my mouse wheel. These are my daily devices, I use them both for work and life. How am I not the end user? I don’t get it.
    - kbenson 6y ago
      I think what's meant is that you aren't representative of an end user. That seems a sane interpretation of what saurik was trying to convey when put into the context of his other statements.
dmix 6y ago
I think what the OP is asking for in practice is clearly targeted at a niche hacker market which is very much a market which has not matured and is essentially sidelined as a matter of practice - to the OS vendors detriment (hear me out). There are security implications of such freedoms which should be avoided of course for the regular users. The phones should be locked down as much as possible. But that doesn't have to be the only option. This is way GrapheneOS [1] exploits Android flexibility and customization to try to improve fundamental OS security to the most modern standards and attempts to break the closesed walls of Google WHILE still shipping a fully locked down phone at the bootloader and OS levels [2]. The ideal world is Apple and Android does their normal security lockdowns for standard endusers for security's sake. Then they offer a separate hackable version where research and those crazy UI/UX hobbyists can do their thing. In all technical senses this is entirely possible for a vendor to do. So it becomes a product question. And I'm convinced they will get ancillary benefits from the hackers doing expimentation in both security and UIs and whatever,\ from which to draw inspiration for their IRL produdcts. And possibly just as important - talent (developers, developers, ...) there are people who care about this stuff who just want to hack on their devices. These can be talented individuals and who knows some future leader within Google et al, the way the Napster guys are SV celebrities now. I'm convinced there's enough ROI (yes commercially) for every OS platform to support this niche. They shouldn't be relegated to the ruffians and pirates on the fringes using risky circumvention techniques to achieve their goals. [1] https://grapheneos.org/ https://grapheneos.org/ [2] https://attestation.app/ https://attestation.app/
- AnthonyMouse 6y ago
  > The ideal world is Apple and Android does their normal security lockdowns for standard endusers for security's sake. Then they offer a separate hackable version where research and those crazy UI/UX hobbyists can do their thing. I'm not sure that this works, because you can't draw the line so easily. If there was an easily obtained unlocked device, more people would choose it than currently jailbreak. More people would make improvements and share them. The ecosystem would improve. There would be more things you can only do with an unlocked device. Which would attract more people, and polynomially more developers to the growing market. You get a feedback loop that ends with everybody buying the open devices. The only way you get a walled garden is by successfully suppressing open alternatives, because otherwise the benefits of openness outweigh the costs and people start to move. AOL loses to the web. Proprietary Unix loses to GNU/Linux. Windows RT loses to actual Windows. You can't get everybody to choose something where the only difference is that it prevents them from doing something they want to do. They only choose that if the choice is bound up in several other things they want and they're really choosing the other things. But the underlying question here is not actually whether to have curation or not. Linux package managers are curated. If you create an environment in which all the good things are in the store and none of the bad things are, ordinary people have no reason to install anything from outside the store, and can then be trained to look with suspicion at anything that isn't, even if it's still technically possible. The problem we have right now is that the assumption is false. The platform stores reject things the user actually wants, or would drive them out with high fees if there was some viable alternative installation method available. Which then drives users to uncurated installation methods, if they exist, which the platforms consequently then try to stamp out. The better solution is to have first class competing stores. The competition solves the problem. Stores that charge excessive fees lose developers to ones that don't. Stores that reject good apps or allow bad apps lose users to ones that don't. You end up with a couple of stores that have low fees and high quality apps, giving people no incentive to leave the garden even if there is no lock on the gate. But you have to leave the gate unlocked or the user's ability to leave doesn't cause the garden to improve to the point that the user has no desire to exercise that ability.
spideymans 6y ago
>Honestly, I am not sure if I've ever heard an "end user" ask to be prevented from doing something they actually wanted to do... I don't believe that typical end users are knowledgable enough about computers to know that they can or should ask for this in the first place. Anecdotal example: My computer illiterate mother wants to download some random unscrupulous DMG onto her Mac, claiming to be a file conversion app. I catch her in the act, and tell her no, don't do download that. Now did my mother ever ask to be prevented from doing this? No. Does she even understand why me preventing her from doing this was a good thing? No. But was it in her best interests overall? Yes. I view the gatekeeping functionality of iOS as largely replicating my role in this scenario.
- saurik 6y ago
  I appreciate that; and yet, it isn't our place as software developers to just assume we are smarter and know more than everyone else in the entire world--including other competing software developers--and both build and cheer on the usage of technological locks that prevent people from taking control of their own destiny. Claiming that people are opting into this because it is for their own good is disingenuous, as it was forced on them as a tradeoff they didn't understand.
  - lol768 6y ago
    > and yet, it isn't our place as software developers to just assume we are smarter and know more than everyone else in the entire world 100x this - and Hacker News is really guilty of doing this. How about we focus on making understanding the risks more accessible to users if we think there's a legitimate problem with users "not knowing what's good for them"?
    - freeone3000 6y ago
      Educating users on any topic not relevant to their immediate task flow is not going to have any traction. Safety controls in industries where accidents kill people are frequently bypassed, because it made their operations slower. If we want to protect users at all, we need to make security so transparent it doesn't get in the way of the user and so omnipresent it can't be bypassed - because once we put in toggles, those toggles get flipped for trivialities. Imagine disabling application integrity signing for a wallpaper.
dkonofalski 6y ago
I feel like I'm talking to royalty right now so let me express my gratitude and appreciation for everything you've done before I, respectfully, disagree with a major point of yours. >I am not sure if I've ever heard an "end user" ask to be prevented from doing something they actually wanted to do ...until what they wanted to do exposed them to malware or an app that they didn't know how to use or put them in a situation where their phone was randomly restarting the springboard over and over. Of course no one would ever ask to be prevented from doing what they want to do but most people using these devices don't know exactly what "what they want to do" entails and the consequences of that. It's the same thing as Internet Explorer and all those toolbars that it's now known for in meme history. Of course people would want a toolbar that lets them automatically search for coupons or whatever it is they want to be notified of. Do they know that the same toolbar is also injecting ads or collecting data and keystrokes? Probably not. I agree with your sentiment 100% (and my issues may be addressed in your TED talk which I'm going to watch right now) but there needs to be some way to acknowledge what the consequences of those actions are and, for me, I think a technical barrier or entry is the only realistic way to do that. Anything simpler will be taken advantage of.
mraza007 6y ago
Wait you are the creator of Cydia I just want to take a moment and appreciate your work. I really loved Cydia and the way It allowed me to customize my first iPhone 2G

by saurik 6y ago

eyelidlessness 6y ago

I don’t think it’s that end users explicitly ask to be prevented from doing things they want to do with their devices. I think it’s that they feel safer in a restricted environment that’s relatively free of the dangers of unrestricted environments, and they’re willing to accept that some lack of control is likely tied to that relative safety. Heck, I’ll just speak for myself. I’m a software engineer. I pride myself on being able pull things apart, understand how they work, and put their pieces together in unintended ways. There are aspects of Apple’s control over their devices that I’ve accepted grudgingly... because even being familiar with the tradeoffs they’ve largely benefited me, and all that I’ve given up has been either moot (UI hacks that are better served with other apps or just not available anywhere anymore) or not a hindrance for my actual usage (it turns out blocking system modification has made clever things I use be more respectful of the integrity of my system!). The biggest thing I’ve lost as an Apple customer has been due to third party developers turning my whole computer into a web browser. Glad it isn’t full of security holes!

saurik 6y ago
Yeah, but you aren't an "end user". I've never met an end user who, when presented with something they want to do--like change the Safari icon to a picture of a dog--who is like "I'm glad I'm not allowed to do that because X"... they pretty much couldn't possibly say that as they aren't in a position to understand X. It is only some vocal minority of admittedly-informed software developers attempting to analyze the tradeoffs of how all this stuff works that are making that decision, and to be a bit frank about it, it just seems like they (you) are either being a bit snooty about the feature in question (being able to have a photo of something you care deeply about as your wallpaper can bring someone immense joy, and to just discount that feels weird) or a bit unimaginative (as there are just so many things you could get: in the jailbreak community we would routinely take suggestions and throw something together for small handfuls of people because it brought us and them joy to do so) with respect to "what they are losing" :/. Even if you can't just can't fathom anyone like yourself benefiting, how about this: we had a blind high school student get involved in jailbreaking as a developer who then built a bunch of software to make his ability to live his life more practical... should we just say that people with niche problems can only get them solved if they are important enough to hit Apple's radar, because no one is ever allowed to solve problems for themselves "for their own good"? :/
- eyelidlessness 6y ago
  How am I not an end user? I buy Apple products, and I use them daily. I described ways I have accepted the limitations Apple has put on my usage of them. I could describe more? I can’t swap out RAM or storage, I’m no longer willing to risk the damage of swapping out batteries. I can’t install hacks that let me switch Safari tabs with my mouse wheel. These are my daily devices, I use them both for work and life. How am I not the end user? I don’t get it.
  - kbenson 6y ago
    I think what's meant is that you aren't representative of an end user. That seems a sane interpretation of what saurik was trying to convey when put into the context of his other statements.

dmix 6y ago

I think what the OP is asking for in practice is clearly targeted at a niche hacker market which is very much a market which has not matured and is essentially sidelined as a matter of practice - to the OS vendors detriment (hear me out). There are security implications of such freedoms which should be avoided of course for the regular users. The phones should be locked down as much as possible. But that doesn't have to be the only option. This is way GrapheneOS [1] exploits Android flexibility and customization to try to improve fundamental OS security to the most modern standards and attempts to break the closesed walls of Google WHILE still shipping a fully locked down phone at the bootloader and OS levels [2]. The ideal world is Apple and Android does their normal security lockdowns for standard endusers for security's sake. Then they offer a separate hackable version where research and those crazy UI/UX hobbyists can do their thing. In all technical senses this is entirely possible for a vendor to do. So it becomes a product question. And I'm convinced they will get ancillary benefits from the hackers doing expimentation in both security and UIs and whatever,\ from which to draw inspiration for their IRL produdcts. And possibly just as important - talent (developers, developers, ...) there are people who care about this stuff who just want to hack on their devices. These can be talented individuals and who knows some future leader within Google et al, the way the Napster guys are SV celebrities now. I'm convinced there's enough ROI (yes commercially) for every OS platform to support this niche. They shouldn't be relegated to the ruffians and pirates on the fringes using risky circumvention techniques to achieve their goals. [1] https://grapheneos.org/ https://grapheneos.org/ [2] https://attestation.app/ https://attestation.app/

AnthonyMouse 6y ago
> The ideal world is Apple and Android does their normal security lockdowns for standard endusers for security's sake. Then they offer a separate hackable version where research and those crazy UI/UX hobbyists can do their thing. I'm not sure that this works, because you can't draw the line so easily. If there was an easily obtained unlocked device, more people would choose it than currently jailbreak. More people would make improvements and share them. The ecosystem would improve. There would be more things you can only do with an unlocked device. Which would attract more people, and polynomially more developers to the growing market. You get a feedback loop that ends with everybody buying the open devices. The only way you get a walled garden is by successfully suppressing open alternatives, because otherwise the benefits of openness outweigh the costs and people start to move. AOL loses to the web. Proprietary Unix loses to GNU/Linux. Windows RT loses to actual Windows. You can't get everybody to choose something where the only difference is that it prevents them from doing something they want to do. They only choose that if the choice is bound up in several other things they want and they're really choosing the other things. But the underlying question here is not actually whether to have curation or not. Linux package managers are curated. If you create an environment in which all the good things are in the store and none of the bad things are, ordinary people have no reason to install anything from outside the store, and can then be trained to look with suspicion at anything that isn't, even if it's still technically possible. The problem we have right now is that the assumption is false. The platform stores reject things the user actually wants, or would drive them out with high fees if there was some viable alternative installation method available. Which then drives users to uncurated installation methods, if they exist, which the platforms consequently then try to stamp out. The better solution is to have first class competing stores. The competition solves the problem. Stores that charge excessive fees lose developers to ones that don't. Stores that reject good apps or allow bad apps lose users to ones that don't. You end up with a couple of stores that have low fees and high quality apps, giving people no incentive to leave the garden even if there is no lock on the gate. But you have to leave the gate unlocked or the user's ability to leave doesn't cause the garden to improve to the point that the user has no desire to exercise that ability.

spideymans 6y ago

>Honestly, I am not sure if I've ever heard an "end user" ask to be prevented from doing something they actually wanted to do... I don't believe that typical end users are knowledgable enough about computers to know that they can or should ask for this in the first place. Anecdotal example: My computer illiterate mother wants to download some random unscrupulous DMG onto her Mac, claiming to be a file conversion app. I catch her in the act, and tell her no, don't do download that. Now did my mother ever ask to be prevented from doing this? No. Does she even understand why me preventing her from doing this was a good thing? No. But was it in her best interests overall? Yes. I view the gatekeeping functionality of iOS as largely replicating my role in this scenario.

saurik 6y ago
I appreciate that; and yet, it isn't our place as software developers to just assume we are smarter and know more than everyone else in the entire world--including other competing software developers--and both build and cheer on the usage of technological locks that prevent people from taking control of their own destiny. Claiming that people are opting into this because it is for their own good is disingenuous, as it was forced on them as a tradeoff they didn't understand.
- lol768 6y ago
  > and yet, it isn't our place as software developers to just assume we are smarter and know more than everyone else in the entire world 100x this - and Hacker News is really guilty of doing this. How about we focus on making understanding the risks more accessible to users if we think there's a legitimate problem with users "not knowing what's good for them"?
  - freeone3000 6y ago
    Educating users on any topic not relevant to their immediate task flow is not going to have any traction. Safety controls in industries where accidents kill people are frequently bypassed, because it made their operations slower. If we want to protect users at all, we need to make security so transparent it doesn't get in the way of the user and so omnipresent it can't be bypassed - because once we put in toggles, those toggles get flipped for trivialities. Imagine disabling application integrity signing for a wallpaper.

dkonofalski 6y ago

I feel like I'm talking to royalty right now so let me express my gratitude and appreciation for everything you've done before I, respectfully, disagree with a major point of yours. >I am not sure if I've ever heard an "end user" ask to be prevented from doing something they actually wanted to do ...until what they wanted to do exposed them to malware or an app that they didn't know how to use or put them in a situation where their phone was randomly restarting the springboard over and over. Of course no one would ever ask to be prevented from doing what they want to do but most people using these devices don't know exactly what "what they want to do" entails and the consequences of that. It's the same thing as Internet Explorer and all those toolbars that it's now known for in meme history. Of course people would want a toolbar that lets them automatically search for coupons or whatever it is they want to be notified of. Do they know that the same toolbar is also injecting ads or collecting data and keystrokes? Probably not. I agree with your sentiment 100% (and my issues may be addressed in your TED talk which I'm going to watch right now) but there needs to be some way to acknowledge what the consequences of those actions are and, for me, I think a technical barrier or entry is the only realistic way to do that. Anything simpler will be taken advantage of.

mraza007 6y ago

Wait you are the creator of Cydia I just want to take a moment and appreciate your work. I really loved Cydia and the way It allowed me to customize my first iPhone 2G