31 ms·

I see where you are coming from here; but aren't the stakes a bit different here? A games console is for games. Although there are probably some tiny fraction

I see where you are coming from here; but aren't the stakes a bit different here? A games console is for games. Although there are probably some tiny fraction of people who have installed other apps on there, the overwhelmingly vast majority of people are just going to use it for games. A smartphone is likely to have address books, email, your photos, maybe sync with your e-health devices, banking applications ... from my point of view, it's an entirely different risk profile.

flohofwoe 4y ago
There must be a way by now to stash this critical stuff away safely in one half of the phone, while the other half runs all the untrusted stuff. If there would be a will (by Apple) there would be a way.
- NovemberWhiskey 4y ago
  Sure, you stick things into sandboxes and only allow specific permissions to access outside the sandbox. In which case, users habituate to allowing any permissions that anything they install requests (c.f. Android). So then maybe you say "no permissions are allowed for sideloaded applications", but then you're back here with people complaining that the platform owner is crippling the independent ecosystem because it doesn't allow access to the camera or the mic or the address book or whatever.
  - OkayPhysicist 4y ago
    Or, you take the more extreme step, and obfuscate from the application whether or not permissions have been granted. The reason why people default to granting excess permissions is that many applications simply will refuse to run without them. If instead of "overtly deny permission" there existed the option to "covertly deny permission (by opting to feed plausible random data instead)" and making that the easier to select "deny" then you have the best of both worlds: well-behaved applications start asking for fewer unnecessary permissions, because the data they're gathering is being poisoned, poorly-behaved applications have their harm reduced, and users who want to build programs that actually need high-level permissions can do so.
  - flohofwoe 4y ago
    It's not much of a sandbox if permissions exist to escape the sandbox. All "secure" apps (mail, pay, banking, chat, ...) need to live in a special compartment which they cannot escape, and no installed apps are allowed in this compartment, only builtin apps. Everything else lives in a more relaxed compartment which cannot access the "secure" compartment at all. Essentially two devices, one completely locked up, the other completely open.
izacus 4y ago
A smartphone does nothing what a desktop computer (with ubiquitous root access) doesn't and apocalypse still hasn't happened. Your literal argument was used for game consoles as well (Oh egads, what will happen if we allow freedom to infest our DRM protected systems?!) until Valve proved everyone wrong. Maybe instead of spewing the same corporate profiteering arguments here, perhaps think on how we could design our software for freedom AND security and whether defending megacorp monopolies is worth the small improvement in security you're getting in return?
- NovemberWhiskey 4y ago
  >apocalypse still hasn't happened. The anti-virus and anti-malware markets are each multi-billion dollar industries; end-point protection is a top-five information security concern for any enterprise; new and exciting ransomware incidents fill the news every week; millions of PCs contribute to botnets that deliver DDoS attacks for pay... It might not be the apocalypse but it's pretty goddamn terrible.
  - izacus 4y ago
    > It might not be the apocalypse but it's pretty goddamn terrible. In what way and why are you (well, actually a corporation with monetary interest) making a decision to lockout users because of those industries? (Also multi-billion? Strongly doubt that.)
    - mysterydip 4y ago
      > (Also multi-billion? Strongly doubt that.) McAfee was taken private in 2021 for $14B https://www.theverge.com/2021/11/8/22769910/mcafee-private-investor-group-acquisition-software https://www.theverge.com/2021/11/8/22769910/mcafee-private-i... And had quarterly revenue of $500M at the time: https://www.nasdaq.com/articles/mcafee-corp.-mcfe-surpasses-q3-earnings-and-revenue-estimates https://www.nasdaq.com/articles/mcafee-corp.-mcfe-surpasses-... For one endpoint security example, unless I misunderstood.
    - deleted 4y ago
      [deleted]

flohofwoe 4y ago

There must be a way by now to stash this critical stuff away safely in one half of the phone, while the other half runs all the untrusted stuff. If there would be a will (by Apple) there would be a way.

NovemberWhiskey 4y ago
Sure, you stick things into sandboxes and only allow specific permissions to access outside the sandbox. In which case, users habituate to allowing any permissions that anything they install requests (c.f. Android). So then maybe you say "no permissions are allowed for sideloaded applications", but then you're back here with people complaining that the platform owner is crippling the independent ecosystem because it doesn't allow access to the camera or the mic or the address book or whatever.
- OkayPhysicist 4y ago
  Or, you take the more extreme step, and obfuscate from the application whether or not permissions have been granted. The reason why people default to granting excess permissions is that many applications simply will refuse to run without them. If instead of "overtly deny permission" there existed the option to "covertly deny permission (by opting to feed plausible random data instead)" and making that the easier to select "deny" then you have the best of both worlds: well-behaved applications start asking for fewer unnecessary permissions, because the data they're gathering is being poisoned, poorly-behaved applications have their harm reduced, and users who want to build programs that actually need high-level permissions can do so.
- flohofwoe 4y ago
  It's not much of a sandbox if permissions exist to escape the sandbox. All "secure" apps (mail, pay, banking, chat, ...) need to live in a special compartment which they cannot escape, and no installed apps are allowed in this compartment, only builtin apps. Everything else lives in a more relaxed compartment which cannot access the "secure" compartment at all. Essentially two devices, one completely locked up, the other completely open.

izacus 4y ago

A smartphone does nothing what a desktop computer (with ubiquitous root access) doesn't and apocalypse still hasn't happened. Your literal argument was used for game consoles as well (Oh egads, what will happen if we allow freedom to infest our DRM protected systems?!) until Valve proved everyone wrong. Maybe instead of spewing the same corporate profiteering arguments here, perhaps think on how we could design our software for freedom AND security and whether defending megacorp monopolies is worth the small improvement in security you're getting in return?

NovemberWhiskey 4y ago
>apocalypse still hasn't happened. The anti-virus and anti-malware markets are each multi-billion dollar industries; end-point protection is a top-five information security concern for any enterprise; new and exciting ransomware incidents fill the news every week; millions of PCs contribute to botnets that deliver DDoS attacks for pay... It might not be the apocalypse but it's pretty goddamn terrible.
- izacus 4y ago
  > It might not be the apocalypse but it's pretty goddamn terrible. In what way and why are you (well, actually a corporation with monetary interest) making a decision to lockout users because of those industries? (Also multi-billion? Strongly doubt that.)
  - mysterydip 4y ago
    > (Also multi-billion? Strongly doubt that.) McAfee was taken private in 2021 for $14B https://www.theverge.com/2021/11/8/22769910/mcafee-private-investor-group-acquisition-software https://www.theverge.com/2021/11/8/22769910/mcafee-private-i... And had quarterly revenue of $500M at the time: https://www.nasdaq.com/articles/mcafee-corp.-mcfe-surpasses-q3-earnings-and-revenue-estimates https://www.nasdaq.com/articles/mcafee-corp.-mcfe-surpasses-... For one endpoint security example, unless I misunderstood.
  - deleted 4y ago
    [deleted]