4 ms·

> On the other hand, I don't think it's a healthy situation if companies need to own the entire hardware platform to be safe from another company's whims. What

> On the other hand, I don't think it's a healthy situation if companies need to own the entire hardware platform to be safe from another company's whims. What about users? What do I need to own to be safe from the whims of a company like Facebook?

amelius 6y ago
It's a separate issue. But actually owning your hardware would be a good start.
- jolux 6y ago
  “Actually owning” my hardware is no protection against that, though. Sure, it means I can audit what apps are doing, but if I don’t feel like doing that, I’m basically trusting the author not to do things I don’t want them to do. Apple does a lot of the lifting for me on iOS.
  - amelius 6y ago
    I was thinking of Oculus Quest, and how owning the actual hardware would be preferred over being tethered to Facebook through your FB account. Also, you don't have to audit apps yourself if there's an entire community of volunteers doing it for you, and perhaps even writing alternative FOSS apps.
    - jolux 6y ago
      In a lot of cases with software I trust the iOS platform security model more than I trust a community of volunteers to consistently protect privacy and security. My desktop system is technologically wide open, versus my phone. I don't have to trust that apps aren't doing certain things because the APIs don't allow it. On the desktop I have to trust a community of volunteers, and the authors, and so on.
      - colejohnson66 6y ago
        In theory, the “web of trust” would solve the trust issue. You trust Dev A who trusts Dev B. Therefore, you implicitly trust Dev B. In practice, bad actors and “rouge” developers make it harder than that.
        amelius 6y ago
        At least a web of trust could to some extent address the issue of loss of trust. At some point Apple, being just a company with shareholders, could start behaving like Microsoft, Amazon, Google or even Facebook. Where would you go then?
        jolux 6y ago
        Their business incentives are currently more aligned with my desires and needs than any other company. If they started behaving like those other companies, I wouldn't really have anywhere to go. I would probably end up using desktop Linux, but mobile is an open question.
        drawkbox 6y ago
        Interestingly the sandboxed web + web browser provided and provides much more trust and security than apps/binaries. The web browser sandbox was created to solve lots of problems with security of executables, it didn't solve all of them but it did make content by third parties more secure. Granted the web probably tracks you as much as mobile, but it will need permission to use your camera/mic/etc and you can more easily see what is being tracked, at least the scripts and states. All Apple is doing it creating a similar security sandbox to the web and they should.
      - mlboss 6y ago
        I hope Apple comes out with a good VR/AR platform. The only reason I am not buying the new Oculus is the mandatory FB login.
        amelius 6y ago
    - colejohnson66 6y ago
      > Also, you don't have to audit apps yourself if there's an entire community of volunteers doing it for you, and perhaps even writing alternative FOSS apps. Didn’t OpenSSL with Heartbleed show that the “many eyes” argument for FOSS doesn’t hold water?
      - amelius 6y ago
        Imho it only showed that many eyes cannot find all bugs, just like corporations cannot guarantee their software is 100% free from security bugs.
        colejohnson66 6y ago
        That is true. The big problem is that employees are paid to find and fix bugs, but unpaid volunteers aren’t. The flip side is that there may be more volunteers than a corporation would hire as employees. The best of both worlds would be being paid to work on open source software (such as Linux).
        jolux 6y ago
        There were almost no eyes on the OpenSSL codebase, and it was a giant pile of spaghetti for many years with nobody batting an eyelash.
        amelius 6y ago
        There's an entire infosec community with white hat hackers that would love to find holes in openssl and talk about them at conferences. Perhaps they gave up on openssl because it has been impenetrable for so long?
        jolux 6y ago
        As far as I know it was mostly just conventional neglect like you’d expect. Everyone assumed someone else was dealing with it until it was too late to fix. It’s much improved since then though. Huge portions audited and rewritten.
  - stale2002 6y ago
    > Apple does a lot of the lifting for me on iOS. Thats fine if you trust Apple to do that. All you'd have to do is continue to only use the Apple app store. The issue is when you want to take away my right to install different app stores.
- diveanon 6y ago
  Point me towards a mobile device I can actually own that has a healthy ecosystem of apps and I'm there. Librem and Purism sound interesting, but without apple and ios there would be literally no hope in getting away from the toxic business model the ad-tech giants are shoving down our throats.

amelius 6y ago

It's a separate issue. But actually owning your hardware would be a good start.

jolux 6y ago
“Actually owning” my hardware is no protection against that, though. Sure, it means I can audit what apps are doing, but if I don’t feel like doing that, I’m basically trusting the author not to do things I don’t want them to do. Apple does a lot of the lifting for me on iOS.
- amelius 6y ago
  I was thinking of Oculus Quest, and how owning the actual hardware would be preferred over being tethered to Facebook through your FB account. Also, you don't have to audit apps yourself if there's an entire community of volunteers doing it for you, and perhaps even writing alternative FOSS apps.
  - jolux 6y ago
    In a lot of cases with software I trust the iOS platform security model more than I trust a community of volunteers to consistently protect privacy and security. My desktop system is technologically wide open, versus my phone. I don't have to trust that apps aren't doing certain things because the APIs don't allow it. On the desktop I have to trust a community of volunteers, and the authors, and so on.
    - colejohnson66 6y ago
      In theory, the “web of trust” would solve the trust issue. You trust Dev A who trusts Dev B. Therefore, you implicitly trust Dev B. In practice, bad actors and “rouge” developers make it harder than that.
      - amelius 6y ago
        At least a web of trust could to some extent address the issue of loss of trust. At some point Apple, being just a company with shareholders, could start behaving like Microsoft, Amazon, Google or even Facebook. Where would you go then?
        jolux 6y ago
        Their business incentives are currently more aligned with my desires and needs than any other company. If they started behaving like those other companies, I wouldn't really have anywhere to go. I would probably end up using desktop Linux, but mobile is an open question.
      - drawkbox 6y ago
        Interestingly the sandboxed web + web browser provided and provides much more trust and security than apps/binaries. The web browser sandbox was created to solve lots of problems with security of executables, it didn't solve all of them but it did make content by third parties more secure. Granted the web probably tracks you as much as mobile, but it will need permission to use your camera/mic/etc and you can more easily see what is being tracked, at least the scripts and states. All Apple is doing it creating a similar security sandbox to the web and they should.
    - mlboss 6y ago
      I hope Apple comes out with a good VR/AR platform. The only reason I am not buying the new Oculus is the mandatory FB login.
      - amelius 6y ago
  - colejohnson66 6y ago
    > Also, you don't have to audit apps yourself if there's an entire community of volunteers doing it for you, and perhaps even writing alternative FOSS apps. Didn’t OpenSSL with Heartbleed show that the “many eyes” argument for FOSS doesn’t hold water?
    - amelius 6y ago
      Imho it only showed that many eyes cannot find all bugs, just like corporations cannot guarantee their software is 100% free from security bugs.
      - colejohnson66 6y ago
        That is true. The big problem is that employees are paid to find and fix bugs, but unpaid volunteers aren’t. The flip side is that there may be more volunteers than a corporation would hire as employees. The best of both worlds would be being paid to work on open source software (such as Linux).
      - jolux 6y ago
        There were almost no eyes on the OpenSSL codebase, and it was a giant pile of spaghetti for many years with nobody batting an eyelash.
        amelius 6y ago
        There's an entire infosec community with white hat hackers that would love to find holes in openssl and talk about them at conferences. Perhaps they gave up on openssl because it has been impenetrable for so long?
        jolux 6y ago
        As far as I know it was mostly just conventional neglect like you’d expect. Everyone assumed someone else was dealing with it until it was too late to fix. It’s much improved since then though. Huge portions audited and rewritten.
- stale2002 6y ago
  > Apple does a lot of the lifting for me on iOS. Thats fine if you trust Apple to do that. All you'd have to do is continue to only use the Apple app store. The issue is when you want to take away my right to install different app stores.
diveanon 6y ago
Point me towards a mobile device I can actually own that has a healthy ecosystem of apps and I'm there. Librem and Purism sound interesting, but without apple and ios there would be literally no hope in getting away from the toxic business model the ad-tech giants are shoving down our throats.