7 ms·

General purpose computing is not secure, and can most likely never be made secure.

danShumway 6y ago
Why did we move away from flip phones? Like seriously, what are people even arguing here? General purpose computing was a mistake? Is that seriously an argument that anyone is making in good faith as they type into their web browser on an Internet forum? Just wait until you find out that app stores are always going to have fundamentally imperfect moderation. Forget running unsigned/unapproved code, we should get rid of 3rd-party code entirely. General purpose everything is insecure. Self-published books spread lies, open markets have bad products, computers get infected, and people burn and poison themselves cooking their own food in stoves. If your goal is 100% security, then you will very likely never build any platform or product that's worth using. We have other ways to improve security beyond turning smartphones back into flip phones.
- pksebben 6y ago
  so much this. I don't want to be forced into sacrificing what's possible to keep myself safe, thank you very much. I'm more than capable of performing my own risk assessments, and the further we go down the "secure the hell out of everything" road the closer we get to industrial capture of essential tech. I think it was a piece by stallman I read recently, about the concept of hardware signature-key application whitelisting. kept me up for a week.
- themacguffinman 6y ago
  Lay off implications about bad faith, please. The argument is not that general purpose computing was a mistake, but that general purpose computing is not necessary and is to some extent counterproductive for the majority of consumers. Consumers moved away from flip phones because they wanted more capable phones, that doesn't mean they largely want capability to the extent of general purpose computing. Consumers will be the judge of whether a platform or product is worth using. Given the unparalleled success of iOS and Apple's locked down ecosystem, it's pretty clear that many find this level of security is very much worth using regardless of imperfect moderation.
  - danShumway 6y ago
    > Lay off implications about bad faith You're right, I crossed a line there. From a market perspective, the problem is that in the short term it might be feasible to build a closed, tightly controlled market that rivals open alternatives, but in the long term general purpose computing acts as a safeguard against market capture and anti-consumer behavior -- and to a certain extent, consumers and markets in general are very bad at optimizing for long-term consequences. The movement of both iOS and Android in this direction would not be as concerning if they didn't hold a duopoly over the entire smartphone market. Apple in particular has faced significant antitrust criticism in this area. Open markets that empower consumers (and I mean that generally -- not just general computing but also home cooking, self-publishing, self-repair and hardware DIY) are the reason why closed-down markets don't degrade and become awful over time. Almost every capability on the modern locked-down iPhone started out as a 3rd-party proof of concept that Apple was later forced to offer in-house alternatives to in order to remain competitive. It benefits even normal users who don't care about general-purpose computing that there be at least one mainstream option on the market where users can fix their own problems without asking a company for permission. And I don't think it's an accident that as Android and iOS have both moved away from that role, that we are now seeing increased calls for antitrust, increased criticisms from developers, and general outright rejection from these companies of new innovations like game streaming. > Given the unparalleled success of iOS and Apple's locked down ecosystem, it's pretty clear that many find this level of security is very much worth using regardless of imperfect moderation I do think it's slightly problematic to assume that users are conscious enough of security to make an educated decision to opt into a locked-down platform, but are not educated enough to avoid flipping a switch in the settings that turns that environment off and on. I don't think that users temporarily become security conscious only when they're in the act of purchasing a phone. The more likely reality is that most users don't think about security or 'openness' at all beyond reputation/advertising, and the vast majority of iPhone users have probably never thought about the tradeoff between open access and security at any point during any of their purchase decisions for any computing device.
    - themacguffinman 6y ago
      General purpose computing is one possible safeguard, it also has pretty big and clear downsides for many consumers and isn't obviously the right choice for most. And again, the proof is in the pudding. If closed-down markets degrade and become awful over time, the market will eventually reflect and account for that in the future. Long-term consequences eventually materialize into immediate consequences after all. In fact, the market exists to validate lofty claims like yours because history is filled with failed attempts to dictate what people should produce, by minorities like you who believe they know better than the people who buy them. > I do think it's slightly problematic to assume that users are conscious enough of security to make an educated decision to opt into a locked-down platform, but are not educated enough to avoid flipping a switch in the settings that turns that environment off and on. This seems pretty obviously true to me. It's quite easy to realize you suck at security, all you need to do is suffer a security breach or know of one. For example, the Windows era taught many users just how insecure they could be, the lessons were pretty simple. Knowing when to disable security guardrails, however, requires actual security knowledge that most users don't have. We know users usually don't have them because Windows tested this with UAC, which users happily and quickly disabled to allow malicious programs that they didn't really evaluate at all; A long and painful case study in "how to let your users choose to fuck themselves". Of course users don't think about a tradeoff between open access and security, the choice is obvious to them. Security matters and open access doesn't. On the one hand you have the tangible risk of getting your stuff or info stolen, and on the other you have danShumway's nebulous & unproven prophecies of a day that will soon(tm) come where the lack of open access causes stuff to degrade and become awful. I don't personally make the same tradeoff because open access matters more to me personally, but I think the majority of consumers have made legitimate choices for themselves. They know what they want and have made choices to support their desires, same as you or I, and frankly no one should be able to violate their choices.
fsflover 6y ago
"Freedom and democracy are not safe and can most likely never be made safe. Let's have a totalitarian state."
rubatuga 6y ago
It's called a sandbox.

Why did we move away from flip phones? Like seriously, what are people even arguing here? General purpose computing was a mistake? Is that seriously an argument that anyone is making in good faith as they type into their web browser on an Internet forum? Just wait until you find out that app stores are always going to have fundamentally imperfect moderation. Forget running unsigned/unapproved code, we should get rid of 3rd-party code entirely. General purpose everything is insecure. Self-published books spread lies, open markets have bad products, computers get infected, and people burn and poison themselves cooking their own food in stoves. If your goal is 100% security, then you will very likely never build any platform or product that's worth using. We have other ways to improve security beyond turning smartphones back into flip phones.

pksebben 6y ago
so much this. I don't want to be forced into sacrificing what's possible to keep myself safe, thank you very much. I'm more than capable of performing my own risk assessments, and the further we go down the "secure the hell out of everything" road the closer we get to industrial capture of essential tech. I think it was a piece by stallman I read recently, about the concept of hardware signature-key application whitelisting. kept me up for a week.
themacguffinman 6y ago
Lay off implications about bad faith, please. The argument is not that general purpose computing was a mistake, but that general purpose computing is not necessary and is to some extent counterproductive for the majority of consumers. Consumers moved away from flip phones because they wanted more capable phones, that doesn't mean they largely want capability to the extent of general purpose computing. Consumers will be the judge of whether a platform or product is worth using. Given the unparalleled success of iOS and Apple's locked down ecosystem, it's pretty clear that many find this level of security is very much worth using regardless of imperfect moderation.
- danShumway 6y ago
  > Lay off implications about bad faith You're right, I crossed a line there. From a market perspective, the problem is that in the short term it might be feasible to build a closed, tightly controlled market that rivals open alternatives, but in the long term general purpose computing acts as a safeguard against market capture and anti-consumer behavior -- and to a certain extent, consumers and markets in general are very bad at optimizing for long-term consequences. The movement of both iOS and Android in this direction would not be as concerning if they didn't hold a duopoly over the entire smartphone market. Apple in particular has faced significant antitrust criticism in this area. Open markets that empower consumers (and I mean that generally -- not just general computing but also home cooking, self-publishing, self-repair and hardware DIY) are the reason why closed-down markets don't degrade and become awful over time. Almost every capability on the modern locked-down iPhone started out as a 3rd-party proof of concept that Apple was later forced to offer in-house alternatives to in order to remain competitive. It benefits even normal users who don't care about general-purpose computing that there be at least one mainstream option on the market where users can fix their own problems without asking a company for permission. And I don't think it's an accident that as Android and iOS have both moved away from that role, that we are now seeing increased calls for antitrust, increased criticisms from developers, and general outright rejection from these companies of new innovations like game streaming. > Given the unparalleled success of iOS and Apple's locked down ecosystem, it's pretty clear that many find this level of security is very much worth using regardless of imperfect moderation I do think it's slightly problematic to assume that users are conscious enough of security to make an educated decision to opt into a locked-down platform, but are not educated enough to avoid flipping a switch in the settings that turns that environment off and on. I don't think that users temporarily become security conscious only when they're in the act of purchasing a phone. The more likely reality is that most users don't think about security or 'openness' at all beyond reputation/advertising, and the vast majority of iPhone users have probably never thought about the tradeoff between open access and security at any point during any of their purchase decisions for any computing device.
  - themacguffinman 6y ago
    General purpose computing is one possible safeguard, it also has pretty big and clear downsides for many consumers and isn't obviously the right choice for most. And again, the proof is in the pudding. If closed-down markets degrade and become awful over time, the market will eventually reflect and account for that in the future. Long-term consequences eventually materialize into immediate consequences after all. In fact, the market exists to validate lofty claims like yours because history is filled with failed attempts to dictate what people should produce, by minorities like you who believe they know better than the people who buy them. > I do think it's slightly problematic to assume that users are conscious enough of security to make an educated decision to opt into a locked-down platform, but are not educated enough to avoid flipping a switch in the settings that turns that environment off and on. This seems pretty obviously true to me. It's quite easy to realize you suck at security, all you need to do is suffer a security breach or know of one. For example, the Windows era taught many users just how insecure they could be, the lessons were pretty simple. Knowing when to disable security guardrails, however, requires actual security knowledge that most users don't have. We know users usually don't have them because Windows tested this with UAC, which users happily and quickly disabled to allow malicious programs that they didn't really evaluate at all; A long and painful case study in "how to let your users choose to fuck themselves". Of course users don't think about a tradeoff between open access and security, the choice is obvious to them. Security matters and open access doesn't. On the one hand you have the tangible risk of getting your stuff or info stolen, and on the other you have danShumway's nebulous & unproven prophecies of a day that will soon(tm) come where the lack of open access causes stuff to degrade and become awful. I don't personally make the same tradeoff because open access matters more to me personally, but I think the majority of consumers have made legitimate choices for themselves. They know what they want and have made choices to support their desires, same as you or I, and frankly no one should be able to violate their choices.

fsflover 6y ago

"Freedom and democracy are not safe and can most likely never be made safe. Let's have a totalitarian state."

rubatuga 6y ago

It's called a sandbox.