3 ms·

I worry so much more about the dumb hardware locks and secure enclaves, OS features etc. I find the risk of a compromised machine to be so much less of an impac

I worry so much more about the dumb hardware locks and secure enclaves, OS features etc. I find the risk of a compromised machine to be so much less of an impact on my life than my computer telling me I am not allowed to do something. This is my computer, let me tell it what to do. I hate how much of my time is wasted by all this security stuff. Infinitely more so than had been wasted by actual malware over the last decade or so. I don't want to have to spend 10hrs figuring out how to hide root from Android pay every time something upgrades. Please just let me have root on devices I own. Ever since I started doing a lot of work in C where all the foot guns are intentionally left in I've had my eyes opened to how beautiful and fun computers can be when they aren't your fucking adversary. "Security" that can't be disabled by the device owner is tyranny.

hsbauauvhabzb 4y ago
Root detection is about reducing risk to companies, presumably sideloading results in substantially increased risk. It’s not about you, it’s about their bottom line, but it can also help prevent grandma from losing their life savings. I’m a security engineer and know what I’m doing and agree there’s some level of security theatre, but it you’re not worried about losing Crown Jewels from a compromise you’re most probably uneducated or arrogant.
- thot_experiment 4y ago
  Of course I'm worried, I just attempt to understand my threat model, my vulnerability surface and act accordingly. I understand why security exists. I just want to be able to turn it off without having to resort to hours of research of security tech in order to control the devices I own. Obviously I wouldn't give access to an account with my life savings to my rooted phone. It is about their bottom line, but largely not to protect me or grandma, it's about justifying control and divorcing people from the power of the supercomputer in their pocket. There's more money in making it hard for me to edit my hosts file etc. than there is in preventing the potential loss of my money/data through these restrictions.

hsbauauvhabzb 4y ago

Root detection is about reducing risk to companies, presumably sideloading results in substantially increased risk. It’s not about you, it’s about their bottom line, but it can also help prevent grandma from losing their life savings. I’m a security engineer and know what I’m doing and agree there’s some level of security theatre, but it you’re not worried about losing Crown Jewels from a compromise you’re most probably uneducated or arrogant.

thot_experiment 4y ago
Of course I'm worried, I just attempt to understand my threat model, my vulnerability surface and act accordingly. I understand why security exists. I just want to be able to turn it off without having to resort to hours of research of security tech in order to control the devices I own. Obviously I wouldn't give access to an account with my life savings to my rooted phone. It is about their bottom line, but largely not to protect me or grandma, it's about justifying control and divorcing people from the power of the supercomputer in their pocket. There's more money in making it hard for me to edit my hosts file etc. than there is in preventing the potential loss of my money/data through these restrictions.