3 ms·

Do you have any more information on this issue, what you mean, and the topic? I think I'm getting this but want to read more to understand. Are you saying mode

Do you have any more information on this issue, what you mean, and the topic? I think I'm getting this but want to read more to understand. Are you saying modern Operating systems are inherently insecure in what is allowed to use those spaces? You mentioned the dollar analogy. Someone else mentioned Androids storage access service. I'm understanding it like this. Youre saying systems of access control within the kernel space are a known and used resource, but practices like this are ignored in the infosec world. Am I getting it? I read HN partially to learn about cybersecurity is why I ask.

mikewarot 4y ago
Current operating systems allow the program to directly access files, which is the way they've worked historically. This means that if the program is compromised, all the files the user is allowed to access on the system are at risk. A better way to deal with this is to use an operating system that doesn't trust applications with access to files by default, and instead uses it's own dialogs to allow the user to select files for access, and only give capabilities/handles to those files to the application.
throwawaaarrgh 4y ago
technically you can severely limit what an app can see and do on a modern OS (inc. limiting it to only specific files), but it's so complicated nobody does it. definitely not as convenient as 'here program, please read only this file right now' (fwiw HN is not a great place to learn security, but I don't have better recs either)
mac-chaffee 4y ago
Not sure if this is exactly what the person you replied to is talking about, but I recently looked through a list of tools for restricting the permissions of programs: https://www.macchaffee.com/blog/2023/hacking-myself/ https://www.macchaffee.com/blog/2023/hacking-myself/ Spoiler: they're all kinda bad, but macOS sandboxing is promising

mikewarot 4y ago

Current operating systems allow the program to directly access files, which is the way they've worked historically. This means that if the program is compromised, all the files the user is allowed to access on the system are at risk. A better way to deal with this is to use an operating system that doesn't trust applications with access to files by default, and instead uses it's own dialogs to allow the user to select files for access, and only give capabilities/handles to those files to the application.

throwawaaarrgh 4y ago

technically you can severely limit what an app can see and do on a modern OS (inc. limiting it to only specific files), but it's so complicated nobody does it. definitely not as convenient as 'here program, please read only this file right now' (fwiw HN is not a great place to learn security, but I don't have better recs either)

mac-chaffee 4y ago

Not sure if this is exactly what the person you replied to is talking about, but I recently looked through a list of tools for restricting the permissions of programs: https://www.macchaffee.com/blog/2023/hacking-myself/ https://www.macchaffee.com/blog/2023/hacking-myself/ Spoiler: they're all kinda bad, but macOS sandboxing is promising