5 ms·

Your argument presumes apps get capabilities by default. OSes have been invented where apps get nothing implicitly (the object-capability model); it's a design

Your argument presumes apps get capabilities by default. OSes have been invented where apps get nothing implicitly (the object-capability model); it's a design problem to install mass-market apps with usable security in that paradigm, and it might be a difficult one. But there's been a little work on it and it's worth pursuing.

simonh 5y ago
Sure, but when you grant capabilities you can't be sure what is being done with them. That's why you need static analysis, behavioural analysis and the whole test regime of App Store review to catch these sorts of activities. That's why Apple has an app store review process, otherwise they could bake all the restrictions into the OS itself. With permissioning for side loaded apps you can't know or enforce activities with the granted services. Yet people like framecowbird will still blame Apple for not producing a "good OS" that protects them anyway.
- abecedarius 5y ago
  The capability you give an app for X doesn't have to be the raw system X. It can interpose some policy or tracking-of-use, or let you revoke just the X, or fake the whole X to begin with, etc. This is one of the things distinguishing the object capability model from basic sandboxing. Another is that the set of kinds of X's is open-ended -- anyone can make up higher-level abstractions like an advertising server with a defined protocol, so that users who've gotta have a free ad-supported app can use one without giving it unlimited and unaudited network access. I'd expect the store to come with standardized packages of capabilities for common kinds of apps.
  - simonh 5y ago
    Do you really think that companies lobbying for side-loading of their apps, and getting legislation through to force it on Apple, would be satisfied with heavily locked down access to subsets of functionality? To more restricted access than App Store apps? Somehow I don't see that being acceptable to the side-loading lobby. An App Store App can be granted low level network access etc because it can be vetted and censured if found in violation of policies. Side loaded app developers will demand the same access.
    - abecedarius 5y ago
      Every hardware capability is potentially available in this kind of framework. It's ultimately up to the user whether an app can get at it, or with what limits. This is an inevitable source of problems for sufficiently reckless users, but it should be possible for reasonable users to keep reasonable control -- not just hacker types. A "side-loading lobby" wouldn't have grounds to demand more. (The overenthusiastic copyright lobby would probably have better luck in getting their demands wired in, going by history, but that's another issue.)
paulmd 5y ago
If there is no app-store review process then all apps will demand full permissions, which means apps effectively get everything by default. If it's a choice between permissions and not using the app then users will give them the permissions, and that is the choice app developers will give users, if they are sufficiently large to get away with it (Facebook, Fortnite, etc).
- abecedarius 5y ago
  See my other replies. Standard bundles of caps by app type; limited/fake caps in place of system cap; yes it's a problem that needs work to demonstrate success at scale; ultimately it's up to the user who owns the device -- we can only design to support their judgement, not replace it. Replacing individual judgement with one central emperor of all phone software leaves everyone vulnerable to the emperor, as the recent and unsurprising news about iCloud in China should highlight. It's not that I expect Apple to jump right on redesigning their OS. It's the claim that usable security is incompatible with universal computation, requiring a locked-down app store, that I'm objecting to. We have promising ideas about how to do better. We have actual experience of a handful of mass-market OSes, none using those ideas. If we had a lot of diverse experience of mass-market OSes and none of them worked, that would be a powerful argument from experience. But I think in our reality it's just status-quo bias. (Fuchsia apparently is capability-based.)

simonh 5y ago

Sure, but when you grant capabilities you can't be sure what is being done with them. That's why you need static analysis, behavioural analysis and the whole test regime of App Store review to catch these sorts of activities. That's why Apple has an app store review process, otherwise they could bake all the restrictions into the OS itself. With permissioning for side loaded apps you can't know or enforce activities with the granted services. Yet people like framecowbird will still blame Apple for not producing a "good OS" that protects them anyway.

abecedarius 5y ago
The capability you give an app for X doesn't have to be the raw system X. It can interpose some policy or tracking-of-use, or let you revoke just the X, or fake the whole X to begin with, etc. This is one of the things distinguishing the object capability model from basic sandboxing. Another is that the set of kinds of X's is open-ended -- anyone can make up higher-level abstractions like an advertising server with a defined protocol, so that users who've gotta have a free ad-supported app can use one without giving it unlimited and unaudited network access. I'd expect the store to come with standardized packages of capabilities for common kinds of apps.
- simonh 5y ago
  Do you really think that companies lobbying for side-loading of their apps, and getting legislation through to force it on Apple, would be satisfied with heavily locked down access to subsets of functionality? To more restricted access than App Store apps? Somehow I don't see that being acceptable to the side-loading lobby. An App Store App can be granted low level network access etc because it can be vetted and censured if found in violation of policies. Side loaded app developers will demand the same access.
  - abecedarius 5y ago
    Every hardware capability is potentially available in this kind of framework. It's ultimately up to the user whether an app can get at it, or with what limits. This is an inevitable source of problems for sufficiently reckless users, but it should be possible for reasonable users to keep reasonable control -- not just hacker types. A "side-loading lobby" wouldn't have grounds to demand more. (The overenthusiastic copyright lobby would probably have better luck in getting their demands wired in, going by history, but that's another issue.)

paulmd 5y ago

If there is no app-store review process then all apps will demand full permissions, which means apps effectively get everything by default. If it's a choice between permissions and not using the app then users will give them the permissions, and that is the choice app developers will give users, if they are sufficiently large to get away with it (Facebook, Fortnite, etc).

abecedarius 5y ago
See my other replies. Standard bundles of caps by app type; limited/fake caps in place of system cap; yes it's a problem that needs work to demonstrate success at scale; ultimately it's up to the user who owns the device -- we can only design to support their judgement, not replace it. Replacing individual judgement with one central emperor of all phone software leaves everyone vulnerable to the emperor, as the recent and unsurprising news about iCloud in China should highlight. It's not that I expect Apple to jump right on redesigning their OS. It's the claim that usable security is incompatible with universal computation, requiring a locked-down app store, that I'm objecting to. We have promising ideas about how to do better. We have actual experience of a handful of mass-market OSes, none using those ideas. If we had a lot of diverse experience of mass-market OSes and none of them worked, that would be a powerful argument from experience. But I think in our reality it's just status-quo bias. (Fuchsia apparently is capability-based.)