4 ms·

I think development of mobile OS heads into a completely wrong direction. The "curation" effect of proprietary stores is only good for censorship and mobile OS

I think development of mobile OS heads into a completely wrong direction. The "curation" effect of proprietary stores is only good for censorship and mobile OS have the most aggressive applications that border on malware. At least you don't have the browser toolbar classical systems were infected with? For productivity I don't want iron curtains between my applications or between application and system. Hell, it would actually be nice to be able to directly interface the hardware without all the loops. We have a deeply flawed security model for mobile OS that relies on dogma that won't lead to additional safety. As safety issue is data exfiltration and by that standard a mobile devices are vastly more dangerous than the average work station. Comes with the nature of the device to a significant degree, but I think mobile OS have ridden of a cliff somewhere. And now they want to push apps into a VM? Why not just buy a device per app at this point...

himinlomax 5y ago
Walled gardens have many problems, but one of the reason they exist is that they offer some security benefits. Virtualization allows for stronger containment of apps and make walled gardens less necessary.
colechristensen 5y ago
Anybody making money off of phone apps should not be trusted, they can and still take every piece of data they can to figure out how to monetize it. I want and need phone app security to protect me from the companies that want me as a product to be sold.
- withinboredom 5y ago
  I think where they are going with that is that this sounds suspiciously like a “people problem” and not a technical one though it is attempting to solve it via technology. For some reason desktops let software do whatever and they don’t seem to have near as much an issue as mobile OSes. IMHO, it’s the fact that there’s a (basically, by default) a single market driven by (basically, by default) a single search engine to locate software. The desktop market, is largely NOT driven by a single market or search engine. With the “single market” if a malicious actor can game the search engine for even a day, they can install on (potentially) millions of devices. However, with the ‘ole distribution model, it’s much harder to game.
  - pjmlp 5y ago
    Which is why the desktop market has tons of garbage anti-virus and PC cleaning software, trying to fix the cowboy land it turned into.
  - vlovich123 5y ago
    There's reasons to be suspicious but it's also important to remember that mobile phones see much deeper penetration. About 84% of the world's population has a smartphone. Annually, ~1.6 billion phones are shipped vs 275 million PCs. With scale comes new challenges and attack vectors.
    - tentacleuno 5y ago
      > Annually, ~1.6 billion phones are shipped vs 275 million PCs. This is most likely because people do not have to buy a PC every 3 years. Phones are treated as disposable items, whereas with a desktop, you can open it, clean it, change parts etc. I can even change the CPU in my laptop if I wanted to.
      - vlovich123 5y ago
        That’s one theory but one that doesn’t hold up by virtue of the fact that 83% of all humanity has a phone. The penetration for laptops/desktops never reached that high. We can assume both as having reached steady state and that’s mostly replacement rate (not quite but almost). Cell phones are more popular for obvious reasons: full access to internet at all times, TCO is drastically smaller across the board (upfront cheaper, cheaper internet, etc), and entire structures are built around them (many critical services go app first if not even app only). I think you’re applying a very western bias in your analysis.
      - pjmlp 5y ago
        Most people also don't buy a smartphone every three years, they use them until they either die, or get stolen.
        5y ago
- Dma54rhs 5y ago
  This sounds awfully similar to Microsoft anti open source textbook that no one can be trusted besides them, you always need their platform and services between. The only difference is that now people are shilling Apples fake corpo security propaganda talking points and sadly they are often developers themselves.
  - McWobbleston 5y ago
    I've definitely been surprised by the sentiment here lately that iOS devices are more secure. I don't know enough about iOS to evaluate that claim, but my impression of phone security is to basically assume it's been unlocked by someone even if most apps are successful sandboxed
    - colechristensen 5y ago
      Google sells advertisements, Apple sells... access to its store involving a hefty 30% tax. Goggle's interests are aligned with the surveillance capitalists, Apple is either competitive (see Facebook) or ambivalent. Apple can differentiate itself by trying to sell the security angle and hurting the surveillance of people in their app ecosystem doesn't hurt them. Comparatively, I would say Apple has a nontrivial advantage in security, though I wouldn't make a broad statement that iOS is "secure".
kllrnohj 5y ago
This has nothing to do with apps. It's instead about things like the biometrics or DRM handling code. The stuff that regularly runs on its own dedicated CPU or in specialized sandboxes like ARM's TrustZone. This is about moving that to instead be in a VM on the "primary" CPU, implemented in open source Linux kernel code instead of who-knows-what ARM microcode. Or to compare against an ecosystem that has more love around here, imagine if everything that Apple runs on the T2 was instead run in a VM with an equivalent level of security. That's the goal.

himinlomax 5y ago

Walled gardens have many problems, but one of the reason they exist is that they offer some security benefits. Virtualization allows for stronger containment of apps and make walled gardens less necessary.

colechristensen 5y ago

Anybody making money off of phone apps should not be trusted, they can and still take every piece of data they can to figure out how to monetize it. I want and need phone app security to protect me from the companies that want me as a product to be sold.

withinboredom 5y ago
I think where they are going with that is that this sounds suspiciously like a “people problem” and not a technical one though it is attempting to solve it via technology. For some reason desktops let software do whatever and they don’t seem to have near as much an issue as mobile OSes. IMHO, it’s the fact that there’s a (basically, by default) a single market driven by (basically, by default) a single search engine to locate software. The desktop market, is largely NOT driven by a single market or search engine. With the “single market” if a malicious actor can game the search engine for even a day, they can install on (potentially) millions of devices. However, with the ‘ole distribution model, it’s much harder to game.
- pjmlp 5y ago
  Which is why the desktop market has tons of garbage anti-virus and PC cleaning software, trying to fix the cowboy land it turned into.
- vlovich123 5y ago
  There's reasons to be suspicious but it's also important to remember that mobile phones see much deeper penetration. About 84% of the world's population has a smartphone. Annually, ~1.6 billion phones are shipped vs 275 million PCs. With scale comes new challenges and attack vectors.
  - tentacleuno 5y ago
    > Annually, ~1.6 billion phones are shipped vs 275 million PCs. This is most likely because people do not have to buy a PC every 3 years. Phones are treated as disposable items, whereas with a desktop, you can open it, clean it, change parts etc. I can even change the CPU in my laptop if I wanted to.
    - vlovich123 5y ago
      That’s one theory but one that doesn’t hold up by virtue of the fact that 83% of all humanity has a phone. The penetration for laptops/desktops never reached that high. We can assume both as having reached steady state and that’s mostly replacement rate (not quite but almost). Cell phones are more popular for obvious reasons: full access to internet at all times, TCO is drastically smaller across the board (upfront cheaper, cheaper internet, etc), and entire structures are built around them (many critical services go app first if not even app only). I think you’re applying a very western bias in your analysis.
    - pjmlp 5y ago
      Most people also don't buy a smartphone every three years, they use them until they either die, or get stolen.
      - 5y ago
Dma54rhs 5y ago
This sounds awfully similar to Microsoft anti open source textbook that no one can be trusted besides them, you always need their platform and services between. The only difference is that now people are shilling Apples fake corpo security propaganda talking points and sadly they are often developers themselves.
- McWobbleston 5y ago
  I've definitely been surprised by the sentiment here lately that iOS devices are more secure. I don't know enough about iOS to evaluate that claim, but my impression of phone security is to basically assume it's been unlocked by someone even if most apps are successful sandboxed
  - colechristensen 5y ago
    Google sells advertisements, Apple sells... access to its store involving a hefty 30% tax. Goggle's interests are aligned with the surveillance capitalists, Apple is either competitive (see Facebook) or ambivalent. Apple can differentiate itself by trying to sell the security angle and hurting the surveillance of people in their app ecosystem doesn't hurt them. Comparatively, I would say Apple has a nontrivial advantage in security, though I wouldn't make a broad statement that iOS is "secure".

kllrnohj 5y ago

This has nothing to do with apps. It's instead about things like the biometrics or DRM handling code. The stuff that regularly runs on its own dedicated CPU or in specialized sandboxes like ARM's TrustZone. This is about moving that to instead be in a VM on the "primary" CPU, implemented in open source Linux kernel code instead of who-knows-what ARM microcode. Or to compare against an ecosystem that has more love around here, imagine if everything that Apple runs on the T2 was instead run in a VM with an equivalent level of security. That's the goal.