4 ms·

I think that happens as soon as someone writes "Hope one day the norm is that users can get root". The quote is from upthread. I have a phone on my hand, no pro

by Arnt 4y ago

I think that happens as soon as someone writes "Hope one day the norm is that users can get root". The quote is from upthread. I have a phone on my hand, no proof of purchase, no proof of ownership, no traceable path of transactions back to the manufacturer, should I be able to get root?

car_analogy 4y ago
That is a spectacularly, obtusely uncharitable interpretation of that statement. I didn't need proof of purchase, ownership, or a traceable path of transactions to the manufacturer when I got root on the PC I built. Or on my phone, for that matter. Yet somehow, it's now secure, and anyone else that gets their hands on it, won't be able to get root. This is the exact kind of amnesia I was talking about. Are you really unfamiliar with default passwords that one changes at boot, such as every consumer router has?
- Arnt 4y ago
  Those passwords don't grant root access, they don't even grant access to execute general programs, far less to execute anything as root. Would you be happy if Google granted access to run Google-supplied programs as root, but not programs from anyone else? No?
  - cowtools 4y ago
    You're using an overly specific definition of the word "root access". "root access" in the context of this conversation just means the paramount ability to decide what runs on the computer (ownership secure boot keys, ability to modify OS, ability to change or remove userspace programs).
    - Arnt 4y ago
      In other words, root access does not require being able to run Total Commander as root, or SimpleSSHd? I have a NAS at home, "root access" doesn't mean that I would be able to back up the entire phone to that NAS?
      - cowtools 4y ago
        Within this context, "root access" is "root" in the sense that it refers to whatever the highest level of privilege is (the root of the trust chain). It's like a tree where each program/agent can spawn subprograms/subagents with privileges that are a subset of its parents. With root access, you have the ultimate ability to decide what runs on the computer. Including programs that do not have root access or programs that prevent other programs from running with root access. If the highest level of privilege is secure boot (the ability to decide what OS runs on the device), then you can run an OS that lets you read everything off the filesystem, sure. But you can also run an OS that doesn't let you read everything off the filesystem. What matters is that if you have root, you (as a person) are at the top of the trust chain. It doesn't matter if the root permissions trickle down to seated users because you can change that if you're at the top.
wly_cdgr 4y ago
Yes
josephcsible 4y ago
The requirement to get root on it should be that you know the password to it, which thieves won't.
hulitu 4y ago
Yes. When you have physical access all bets are off.
Arnt 4y ago
Come to think of it, I think this is another instance of the "cause miracles" thing. No user ever gets root. What gets root is a process. "Grant root access to the owner" while blocking malware means that the OS kernel must distinguish whether a process is acting on behalf of the owner of the device, and has not deceived the owner about what the process will do. If the OS developer (Google in this case) does not do that, clearly the OS developer is evil or horribly incompetent, and anyone who thinks that what the OS currently does is reasonable is an apologist who comes creeping out of the woodwork. https://astralcodexten.substack.com/p/book-review-the-revolt-of-the-public https://astralcodexten.substack.com/p/book-review-the-revolt...
- josephcsible 4y ago
  If granting me root access is incompatible with blocking malware, then I don't want my phone to block malware.
  - Arnt 4y ago
    Custom Android ROMs exist for you and me. Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned. If a smartphone vendor wants to give a wide audience access to apps and the net, then the vendor has to cater to people like that neighbour. And that, in turn, means that it must be very, very, very difficult to social-engineer that neighbour into granting another app access to the data in the banking app. To my mind, protecting most people's savings is much more important than catering to people like you and me. You may disagree.
    - cowtools 4y ago
      >Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned. Let me guess, bank transfers? Maybe we should think about improving banking security and informing users before we try locking down nearly every piece of consumer electronics on the market. There is no need for these "banking apps" to exist in the first place. What happened to online banking over the web? Where is the accountability of these banks here? Where is the personal accountability from these users? I really don't buy this argument. If you can't practice basic security and due diligence, you shouldn't have an online banking account, let alone a computer, you should be in a nursing home.

by Arnt 4y ago

car_analogy 4y ago

That is a spectacularly, obtusely uncharitable interpretation of that statement. I didn't need proof of purchase, ownership, or a traceable path of transactions to the manufacturer when I got root on the PC I built. Or on my phone, for that matter. Yet somehow, it's now secure, and anyone else that gets their hands on it, won't be able to get root. This is the exact kind of amnesia I was talking about. Are you really unfamiliar with default passwords that one changes at boot, such as every consumer router has?

Arnt 4y ago
Those passwords don't grant root access, they don't even grant access to execute general programs, far less to execute anything as root. Would you be happy if Google granted access to run Google-supplied programs as root, but not programs from anyone else? No?
- cowtools 4y ago
  You're using an overly specific definition of the word "root access". "root access" in the context of this conversation just means the paramount ability to decide what runs on the computer (ownership secure boot keys, ability to modify OS, ability to change or remove userspace programs).
  - Arnt 4y ago
    In other words, root access does not require being able to run Total Commander as root, or SimpleSSHd? I have a NAS at home, "root access" doesn't mean that I would be able to back up the entire phone to that NAS?
    - cowtools 4y ago
      Within this context, "root access" is "root" in the sense that it refers to whatever the highest level of privilege is (the root of the trust chain). It's like a tree where each program/agent can spawn subprograms/subagents with privileges that are a subset of its parents. With root access, you have the ultimate ability to decide what runs on the computer. Including programs that do not have root access or programs that prevent other programs from running with root access. If the highest level of privilege is secure boot (the ability to decide what OS runs on the device), then you can run an OS that lets you read everything off the filesystem, sure. But you can also run an OS that doesn't let you read everything off the filesystem. What matters is that if you have root, you (as a person) are at the top of the trust chain. It doesn't matter if the root permissions trickle down to seated users because you can change that if you're at the top.

wly_cdgr 4y ago

Yes

josephcsible 4y ago

The requirement to get root on it should be that you know the password to it, which thieves won't.

hulitu 4y ago

Yes. When you have physical access all bets are off.

Arnt 4y ago

Come to think of it, I think this is another instance of the "cause miracles" thing. No user ever gets root. What gets root is a process. "Grant root access to the owner" while blocking malware means that the OS kernel must distinguish whether a process is acting on behalf of the owner of the device, and has not deceived the owner about what the process will do. If the OS developer (Google in this case) does not do that, clearly the OS developer is evil or horribly incompetent, and anyone who thinks that what the OS currently does is reasonable is an apologist who comes creeping out of the woodwork. https://astralcodexten.substack.com/p/book-review-the-revolt-of-the-public https://astralcodexten.substack.com/p/book-review-the-revolt...

josephcsible 4y ago
If granting me root access is incompatible with blocking malware, then I don't want my phone to block malware.
- Arnt 4y ago
  Custom Android ROMs exist for you and me. Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned. If a smartphone vendor wants to give a wide audience access to apps and the net, then the vendor has to cater to people like that neighbour. And that, in turn, means that it must be very, very, very difficult to social-engineer that neighbour into granting another app access to the data in the banking app. To my mind, protecting most people's savings is much more important than catering to people like you and me. You may disagree.
  - cowtools 4y ago
    >Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned. Let me guess, bank transfers? Maybe we should think about improving banking security and informing users before we try locking down nearly every piece of consumer electronics on the market. There is no need for these "banking apps" to exist in the first place. What happened to online banking over the web? Where is the accountability of these banks here? Where is the personal accountability from these users? I really don't buy this argument. If you can't practice basic security and due diligence, you shouldn't have an online banking account, let alone a computer, you should be in a nursing home.