4 ms·

“Actually owning” my hardware is no protection against that, though. Sure, it means I can audit what apps are doing, but if I don’t feel like doing that, I’m ba

by jolux 6y ago

“Actually owning” my hardware is no protection against that, though. Sure, it means I can audit what apps are doing, but if I don’t feel like doing that, I’m basically trusting the author not to do things I don’t want them to do. Apple does a lot of the lifting for me on iOS.

amelius 6y ago
I was thinking of Oculus Quest, and how owning the actual hardware would be preferred over being tethered to Facebook through your FB account. Also, you don't have to audit apps yourself if there's an entire community of volunteers doing it for you, and perhaps even writing alternative FOSS apps.
- jolux 6y ago
  In a lot of cases with software I trust the iOS platform security model more than I trust a community of volunteers to consistently protect privacy and security. My desktop system is technologically wide open, versus my phone. I don't have to trust that apps aren't doing certain things because the APIs don't allow it. On the desktop I have to trust a community of volunteers, and the authors, and so on.
  - colejohnson66 6y ago
    In theory, the “web of trust” would solve the trust issue. You trust Dev A who trusts Dev B. Therefore, you implicitly trust Dev B. In practice, bad actors and “rouge” developers make it harder than that.
    - amelius 6y ago
      At least a web of trust could to some extent address the issue of loss of trust. At some point Apple, being just a company with shareholders, could start behaving like Microsoft, Amazon, Google or even Facebook. Where would you go then?
      - jolux 6y ago
        Their business incentives are currently more aligned with my desires and needs than any other company. If they started behaving like those other companies, I wouldn't really have anywhere to go. I would probably end up using desktop Linux, but mobile is an open question.
    - drawkbox 6y ago
      Interestingly the sandboxed web + web browser provided and provides much more trust and security than apps/binaries. The web browser sandbox was created to solve lots of problems with security of executables, it didn't solve all of them but it did make content by third parties more secure. Granted the web probably tracks you as much as mobile, but it will need permission to use your camera/mic/etc and you can more easily see what is being tracked, at least the scripts and states. All Apple is doing it creating a similar security sandbox to the web and they should.
  - mlboss 6y ago
    I hope Apple comes out with a good VR/AR platform. The only reason I am not buying the new Oculus is the mandatory FB login.
    - amelius 6y ago
      If it follows similar guidelines as the App Store, you won't be able to use it to watch pr0n, though. It's either privacy or not being parented. Perhaps you don't care but many people think it's pretty ridiculous.
- colejohnson66 6y ago
  > Also, you don't have to audit apps yourself if there's an entire community of volunteers doing it for you, and perhaps even writing alternative FOSS apps. Didn’t OpenSSL with Heartbleed show that the “many eyes” argument for FOSS doesn’t hold water?
  - amelius 6y ago
    Imho it only showed that many eyes cannot find all bugs, just like corporations cannot guarantee their software is 100% free from security bugs.
    - colejohnson66 6y ago
      That is true. The big problem is that employees are paid to find and fix bugs, but unpaid volunteers aren’t. The flip side is that there may be more volunteers than a corporation would hire as employees. The best of both worlds would be being paid to work on open source software (such as Linux).
    - jolux 6y ago
      There were almost no eyes on the OpenSSL codebase, and it was a giant pile of spaghetti for many years with nobody batting an eyelash.
      - amelius 6y ago
        There's an entire infosec community with white hat hackers that would love to find holes in openssl and talk about them at conferences. Perhaps they gave up on openssl because it has been impenetrable for so long?
        jolux 6y ago
        As far as I know it was mostly just conventional neglect like you’d expect. Everyone assumed someone else was dealing with it until it was too late to fix. It’s much improved since then though. Huge portions audited and rewritten.
stale2002 6y ago
> Apple does a lot of the lifting for me on iOS. Thats fine if you trust Apple to do that. All you'd have to do is continue to only use the Apple app store. The issue is when you want to take away my right to install different app stores.

by jolux 6y ago

amelius 6y ago

I was thinking of Oculus Quest, and how owning the actual hardware would be preferred over being tethered to Facebook through your FB account. Also, you don't have to audit apps yourself if there's an entire community of volunteers doing it for you, and perhaps even writing alternative FOSS apps.

jolux 6y ago
In a lot of cases with software I trust the iOS platform security model more than I trust a community of volunteers to consistently protect privacy and security. My desktop system is technologically wide open, versus my phone. I don't have to trust that apps aren't doing certain things because the APIs don't allow it. On the desktop I have to trust a community of volunteers, and the authors, and so on.
- colejohnson66 6y ago
  In theory, the “web of trust” would solve the trust issue. You trust Dev A who trusts Dev B. Therefore, you implicitly trust Dev B. In practice, bad actors and “rouge” developers make it harder than that.
  - amelius 6y ago
    At least a web of trust could to some extent address the issue of loss of trust. At some point Apple, being just a company with shareholders, could start behaving like Microsoft, Amazon, Google or even Facebook. Where would you go then?
    - jolux 6y ago
      Their business incentives are currently more aligned with my desires and needs than any other company. If they started behaving like those other companies, I wouldn't really have anywhere to go. I would probably end up using desktop Linux, but mobile is an open question.
  - drawkbox 6y ago
    Interestingly the sandboxed web + web browser provided and provides much more trust and security than apps/binaries. The web browser sandbox was created to solve lots of problems with security of executables, it didn't solve all of them but it did make content by third parties more secure. Granted the web probably tracks you as much as mobile, but it will need permission to use your camera/mic/etc and you can more easily see what is being tracked, at least the scripts and states. All Apple is doing it creating a similar security sandbox to the web and they should.
- mlboss 6y ago
  I hope Apple comes out with a good VR/AR platform. The only reason I am not buying the new Oculus is the mandatory FB login.
  - amelius 6y ago
    If it follows similar guidelines as the App Store, you won't be able to use it to watch pr0n, though. It's either privacy or not being parented. Perhaps you don't care but many people think it's pretty ridiculous.
colejohnson66 6y ago
> Also, you don't have to audit apps yourself if there's an entire community of volunteers doing it for you, and perhaps even writing alternative FOSS apps. Didn’t OpenSSL with Heartbleed show that the “many eyes” argument for FOSS doesn’t hold water?
- amelius 6y ago
  Imho it only showed that many eyes cannot find all bugs, just like corporations cannot guarantee their software is 100% free from security bugs.
  - colejohnson66 6y ago
    That is true. The big problem is that employees are paid to find and fix bugs, but unpaid volunteers aren’t. The flip side is that there may be more volunteers than a corporation would hire as employees. The best of both worlds would be being paid to work on open source software (such as Linux).
  - jolux 6y ago
    There were almost no eyes on the OpenSSL codebase, and it was a giant pile of spaghetti for many years with nobody batting an eyelash.
    - amelius 6y ago
      There's an entire infosec community with white hat hackers that would love to find holes in openssl and talk about them at conferences. Perhaps they gave up on openssl because it has been impenetrable for so long?
      - jolux 6y ago
        As far as I know it was mostly just conventional neglect like you’d expect. Everyone assumed someone else was dealing with it until it was too late to fix. It’s much improved since then though. Huge portions audited and rewritten.

stale2002 6y ago

> Apple does a lot of the lifting for me on iOS. Thats fine if you trust Apple to do that. All you'd have to do is continue to only use the Apple app store. The issue is when you want to take away my right to install different app stores.