3 ms·
> And the PinePhone does absolutely nothing whatsoever to deal with that threat, while iOS has a huge amount of security built to prevent this. Huh? Most mobi
by Seirdy 5y ago
> And the PinePhone does absolutely nothing whatsoever to deal with that threat, while iOS has a huge amount of security built to prevent this.
Huh?
Most mobile-optimized distros offer apps through Flatpak, which gives much stronger sandboxing protections than iOS through Bubblewrap. You can block access to the network, Bluetooth, filesystem (outside the app's sandbox), GPU, accelerometer, webcam, etc. Most distros also offer SELinux and AppArmor for protections outside the sandbox. Accessing stuff from outside the sandbox (like files) is done through portals, similar to the iOS "share" dialog or file-choosing modals.
For non-technical users, all of this is enabled by default. Programs like FlatSeal let them toggle permissions on and off. Technical users can override permissions, spoof fake information, and dive into SELinux rules.
With iOS, users can't block network access from specific apps, spoof sensor data, block GPU access, etc. You're only as private as Apple thinks you need to be.
- goodpoint 5y agoMobian provides tenths of thousands of packages through the Debian repositories. The amount of spyware and trackers allowed into Debian in the first place is very close to zero. Also it provides firejail. There is no need for flatpak.
- Seirdy 5y agoI agree that sandboxing should be decoupled from the distribution platform. Unfortunately, normal users aren't going to use bubblewrap or firejail directly until better GUI wrappers are made. I also think that sandboxing is still a worthwhile pursuit for many FLOSS packages, since many programs--from moddable games to web browsers--run untrusted code. It also mitigates damage done by some forms of user and developer error (can't accidentally wipe a homedir if you can't access it). It's similar to the rationale for not logging in as root unless necessary.