6 ms·

As someone who is a somewhat new to web technologies, can someone really explain why this is bad? I saw the techical discussions in the PRs made to the WEI repo

As someone who is a somewhat new to web technologies, can someone really explain why this is bad? I saw the techical discussions in the PRs made to the WEI repo but it was all super technical that I was not able to understand the arguments made for and against it.

mplewis 3y ago
WEI turns non-compliant browsers into second-class citizens. You’re perfectly free to use whatever compliant browser engine and OS combo you like today – but in a world with WEI, you’ll have to use Approved Chrome on an Approved OS on Approved Hardware with Approved Signing Keys, or you won’t be able to sign into your bank.
- netdur 3y ago
  isn't this good? banks can raise security while we can still use any browser to check hackers news! or this 3 cows story?
  - thesuperbigfrog 3y ago
    >> isn't this good? banks can raise security while we can still use any browser to check hackers news! Are you okay with buying a new computer running the operating system and browser someone else wants to access your bank's web site? You can still use you current computer and bowser to access HN.
    - icoder 3y ago
      Like many others in this thread you stack so many assumptions on top of each other. Why? I don't think that helps. Will this person's bank implement WEI in such a way that none of this person's devices (computer, phone) are supported and will this person not be willing or able to switch banks, only then buying a new computer comes into view. Without knowing anything about this person, assuming average, the chances for this must be low or the bank will have no happy customers left. I fully agree with the underlying worries you and others in this thread have, but to extrapolate that without any nuance into a world where we all become privacy-less, ad consuming, eye tracked zombies on newly bought computers is not helping the case (in my view).
      - mordae 3y ago
        I have talked to government officials responsible for my country's digital security policy and they have explicitly told me that they want remote attestation to lock out devices not running big corporate systems and they do not care about freedom. The same ministry is responsible for police. If they could, they would forbid you doing anything that is not explicitly legal just to be safe.
      - mindslight 3y ago
        It's called looking ahead to the straightforward results of the obvious power dynamic, to know what it will lead to when that dynamic gets entrenched enough to be taken for granted. It's like how all these "free" websites coasted along for years being quite user friendly, but have recently switched to extraction mode. Anybody who thought about the incentives knew what was coming down the line eventually.
      - nulld3v 3y ago
        > Will this person's bank implement WEI in such a way that none of this person's devices (computer, phone) are supported and will this person not be willing or able to switch banks, only then buying a new computer comes into view. Yes, they will, because it has already happened. On Android many many banking apps block rooted phones and custom OSes by using Play Integrity and Safetynet. And then games started doing it too, you can't play Pokemon GO unless your phone's OS passes Safetynet. And then restaurants joined in. Sorry, you can't order from McDonald's unless you pass Safetynet. When does it stop?
    - im3w1l 3y ago
      I already today have a phone dedicated to "important stuff" like accessing banks. I think it's actually a decent solution, and a low-end phone doesnt cost that much either.
  - loeg 3y ago
    Not great if your bank arbitrarily decides Linux isn't a supported operating system, for example.
    - YPCrumble 3y ago
      Wouldn’t this just mean I should change my bank?
      - anshumankmr 3y ago
        That would be difficult to do, if say all banks decide to only support Windows/MacOs. My bank that I use is a bit wonky on Firefox but works fine on Chrome. Some banks even refuse to run on Firefox. Also, switching banks might be more difficult than switching an OS. And you would lose the reward points if any if you switch a bank, not to mention, if you use autopay that is configured to withdraw from a certain card, you would need to go and reconfigure that everywhere. It is not technically impossible, it's just going to arduous.
      - _xivi 3y ago
        Are you going to make your own bank too when enough banks do it?
      - loeg 3y ago
        I just believe that imposing this cost and inconvenience on Linux users (in this example) would be a bad thing.
      - plagiarist 3y ago
        Does that seem easier for people to do than buying a Windows or MacOS device? If your oldest credit cards are through your bank it could wreck your FICO for quite a while.
      - hellojesus 3y ago
        Or ultimately fund your own if all banks adopt this under a regulatory recommendation.
      - OfSanguineFire 3y ago
  - XzAeRosho 3y ago
    The problem is that this feature can and will be used to restrict the users, it doesn't offer any real benefit to you. This will not increase security for the user either, it's just a new barrier at the risk of higher fingerprinting. Why should you care how your bank handles security? It's their responsibility, not yours to handle.
    - nfw2 3y ago
      Because they have my money?
      - mordae 3y ago
        OK, then legislate that this shit can only ever be opt-in and then we can talk.
      - nehal3m 3y ago
        Technically they don't. They incur a debt to you when you give them your money. The money at the bank is not your money.
        nfw2 3y ago
        Fine then because they owe me money
  - yborg 3y ago
    In what way does this increase the security of my bank account? A criminal can use credentials it obtained via a hack, etc. using an approved platform to access my account. My own approved platform can be compromised by malware and used to access my account. This class of problems is addressed by physical ID tokens, not attestation.
    - mordae 3y ago
      Corporate world currently sells attestation as a way to create secure token out of everyone's phone to the public sector worldwide. They obviously want it for the walled gardens and to fight ad-blocking, but public sector really wants to "deal with the cyber criminality" and they are clueless.
    - kccqzy 3y ago
      Presumably a criminal now no longer can install a piece of malware that looks into the memory of your browser to steal credentials in the first place. They will now have to use old fashioned social engineering to make you cough up that credential to steal.
  - helen___keller 3y ago
    This is good as a user story if you are using a blessed OS/browser/device in that you can avoid CAPTCHA or whatever This is bad as a user story if you are not blessed and get likely locked out because the web operator doesn’t recognize you as valid This is worse in the second order effects in that it can be leveraged to fight against ad blockers, paywall bypassers, YouTube video downloaders, and so on, by forcing all those user-friendly software under the umbrella of being unblessed. Hence the moniker of “web DRM”
  - bryanrasmussen 3y ago
    one example of a non-compliant browser would be something crawling the web and building up some sort of search index of things because I don't think we want anyone to be allowed to do that.
  - ulkesh 3y ago
    No, it isn't good. Despite what some on the political spectrum try to say, the Internet has become a basic human right. It is required in schools in America. In many cases, it is required to even interact with certain government entities. Allowing governments and corporations to force users to a specific browser on a specific operating system just to interact with their site goes against everything the web is supposed to be -- an open platform for the free exchange of ideas. This proposal is a slap in the face to all of that and basically allows governments and corporations to force users to use what those governments and corporations choose. This is net neutrality all over again, just in a different vein. I, for one, will continue supporting Mozilla and Firefox and will never again use Chromium-based browsers, or any browser which supports this. I just hope I can keep browsing the sites I need to.
- anshumankmr 3y ago
  Approved Signing Keys -> Will this require for the end user to do it? If so, then this might be a short lived change, cause for a lot of people having a username and password is already super complicated.
  - mordae 3y ago
    Nothing special. Just use preinstalled system and don't even think about using anything else.
- minsc_and_boo 3y ago
  Is there any way around this, like spoofing headers or OS specs?
  - burkaman 3y ago
    No, Google has plenty of skilled engineers that can make spoofing an attestation extremely difficult. It will probably rely on hardware that you cannot modify. See details of a plausible implementation here: https://news.ycombinator.com/item?id=36859465 https://news.ycombinator.com/item?id=36859465
- rochak 3y ago
  Oh fuck no. This is bad. Google wtf.
javajosh 3y ago
It's a change to the browser that gives site-owners the ability to require a positive attestation of non-modification before running. The stated goal of this change is to make it more difficult for end-users to block ads. As the spec states, blocking ads violates the deal you make with content creators to use your attention to ads as a form of payment. In practice, this will make it harder, but not impossible, to run ad blockers. Now instead of just finding and installing a plugin, you'll have to first find and install a forked browser that implements the attestation as something like 'return true'. This will predictably decrease the number of people blocking ads. Personally, I don't object to this. The easy solution for most people is simply: don't consume the content. Or pay money instead of watching ads. Content creators, it must be said, also have the option of self-hosting and/or creating content as a hobby rather than a career. As someone who has grown more and more despairing of any paid-for speech, especially by ads, I welcome this change. Far more troubling is the possibility of attestation for "important apps" like banking or government. In general this mechanism gives the org a way to prevent you from doing what you want with your data. For example, they can prevent you from scraping data and automating end-user tasks. This takes away your degrees-of-freedom, and using a modified browser will certainly become an actionable offense. In my view this is by far the more troubling aspect of this change, since it take away significant aspects of user autonomy in a context where it matters most. Technically sophisticated users will note that it's not possible to secure a client, and foolish to try. This misses the point. These changes stochastically change behaviors "in the large", like a shopping center that offers two lanes in and one lane out, or two escalators in and one out. This represents a net transfer of power from the less powerful to the more powerful, and therefore deserves to be opposed. EDIT: please don't downvote, but rather reply with your objection.
- mindslight 3y ago
  This has been litigated to hell on HN, but no, there is no implicit contract when loading a webpage that your user agent will display ads or any other content as envisioned by the publisher. A user agent has always been intended to be something that displays content according to the wishes of the user. Even this "modest proposal" phrases itself in terms of user desires (albeit completely disingenuously). Ads have become prevalent because most users go with the default and don't install content filters to block them, but this does not create some obligation for all users to display ads. Rather, the core dynamic remains that ads essentially display at the pleasure of users. There is no option to "implements the attestation as something like 'return true'". There is a chain of verification from the hardware manufacturers building in software surveillance, through OS developers treating the device owner as an attacker, this proposal of carrying the same user-hostile dynamic through browsers, and finally to the website that by verifying the signatures can force a user to only use software that enforces all of the above. You should very much object to this! Today, "unsupported browser" is a CYA term that doesn't really mean much besides that the website has limited testing budget (and who doesn't?). With this proposal it would become a hard blocker. Goodbye Linux/BSDs/etc. Goodbye `make install`. Goodbye virtual machines. Goodbye computers that last longer than the rapid e-waste treadmill of mobile phone land. You will of course be able to keep running user-representing operating systems, old computers, "jail" breaking them, etc. You just won't be able to access banking websites, followed by web stores, then general sites. Basically anywhere today that hassles users with CAPTCHAs will be looking to implement these restrictions eventually (which is basically everywhere).
thurn 3y ago
Like any technology, there are both positive and negative aspects of it. The positive take would probably be that this technology is already widely used by iOS and Android apps. People use Apple's AppAttest to e.g. ensure that high scores submitted for a game are from a legitimate copy of the game and not just someone calling the SubmitHighScore API. But it's absolutely fair to argue that the web operates on a different set of expectations than the Play Store/App Store, and I think the concerns that this will create a second-class citizen status for browsers are totally valid. There's a huge difference in character between "in order to prevent piracy and ensure ad revenue we are only releasing our app on the Play Store" and "we are only releasing our web app for Chrome".
- awesomeMilou 3y ago
  > People use Apple's AppAttest to e.g. ensure that high scores submitted for a game are from a legitimate copy of the game and not just someone calling the SubmitHighScore API. But that's for Apps. Native Apps, not websites. If we argue this way, then this becomes a solution seeking an issue, since the first thing you learn in web programming is to never trust the client. I don't even see how this changes here, given that it won't mitigate any bugs, except giving me proof that the only bugs present on the client side system are the ones written by me. The reason Google actually want's to implement this, is because they risk loosing huge amounts of revenue due to adblocking, something they can control on mobile (since they control the software supply chain there) but cannot do in the browser (since I have access to the DOM).
peter422 3y ago
It’s like having the “I’m not a robot” button embedded in your web browser.
mordae 3y ago
To put it simple, it makes it possible for service provider to reject providing service to clients not running corporate-owned white-listed clients. Thus making it virtually impossible to create independent clients for such services. It will be swiftly adopted by well meaning but clueless bank and government clerks who will accidentally use to lock all open hardware, open operating system, open browser users out and mandate you need to purchase at least one locked down corporate device to exist. It's the trusted computing story all along. Eventually you will need permission to run your code on your own device and such "unlocked" device will be blocked from accessing any digital infrastructure because it might be otherwise used to breach ToS.
- sir_brickalot 3y ago
  Isn't this already the reality in the mobile space? I own a rooted Samsung device and have to jump through 100 hoops to be able to use my banking app or Netflix or some rando game (which I don't actually play). SafetyNet broken, hardware fuse blown, Magisk Hide + some other havks just to still be able to do online banking. I just want to be able to ssh into my own device or install a real ad blocker, like Adaway without losing access to real world applications. This is all very depressing.
  - dvngnt_ 3y ago
    it is the reality for mobile. on iphone you can't even install software that apple doesn't explicitly allow. they would love to extend this to all computing devices to remove control
    - awesomeMilou 3y ago
      > they would love to extend this to all computing devices to remove control That's not really true. Apple is encroaching freedom of software choice on their devices, but they know that they can't extend the same kind of security policies to the desktop. You can disable secure boot on Macs and even run Linux if you like. Additionally, it's a bit difficult but if you disable SIP you do get access to the entire systems file system. They're a shitty company when it comes to repair-ability and their walled garden, but they know they can't extend this to the desktop, or else they would disqualify themselves from the developer market (where they are quite popular).

mplewis 3y ago

WEI turns non-compliant browsers into second-class citizens. You’re perfectly free to use whatever compliant browser engine and OS combo you like today – but in a world with WEI, you’ll have to use Approved Chrome on an Approved OS on Approved Hardware with Approved Signing Keys, or you won’t be able to sign into your bank.

netdur 3y ago
isn't this good? banks can raise security while we can still use any browser to check hackers news! or this 3 cows story?
- thesuperbigfrog 3y ago
  >> isn't this good? banks can raise security while we can still use any browser to check hackers news! Are you okay with buying a new computer running the operating system and browser someone else wants to access your bank's web site? You can still use you current computer and bowser to access HN.
  - icoder 3y ago
    Like many others in this thread you stack so many assumptions on top of each other. Why? I don't think that helps. Will this person's bank implement WEI in such a way that none of this person's devices (computer, phone) are supported and will this person not be willing or able to switch banks, only then buying a new computer comes into view. Without knowing anything about this person, assuming average, the chances for this must be low or the bank will have no happy customers left. I fully agree with the underlying worries you and others in this thread have, but to extrapolate that without any nuance into a world where we all become privacy-less, ad consuming, eye tracked zombies on newly bought computers is not helping the case (in my view).
    - mordae 3y ago
      I have talked to government officials responsible for my country's digital security policy and they have explicitly told me that they want remote attestation to lock out devices not running big corporate systems and they do not care about freedom. The same ministry is responsible for police. If they could, they would forbid you doing anything that is not explicitly legal just to be safe.
    - mindslight 3y ago
      It's called looking ahead to the straightforward results of the obvious power dynamic, to know what it will lead to when that dynamic gets entrenched enough to be taken for granted. It's like how all these "free" websites coasted along for years being quite user friendly, but have recently switched to extraction mode. Anybody who thought about the incentives knew what was coming down the line eventually.
    - nulld3v 3y ago
      > Will this person's bank implement WEI in such a way that none of this person's devices (computer, phone) are supported and will this person not be willing or able to switch banks, only then buying a new computer comes into view. Yes, they will, because it has already happened. On Android many many banking apps block rooted phones and custom OSes by using Play Integrity and Safetynet. And then games started doing it too, you can't play Pokemon GO unless your phone's OS passes Safetynet. And then restaurants joined in. Sorry, you can't order from McDonald's unless you pass Safetynet. When does it stop?
  - im3w1l 3y ago
    I already today have a phone dedicated to "important stuff" like accessing banks. I think it's actually a decent solution, and a low-end phone doesnt cost that much either.
- loeg 3y ago
  Not great if your bank arbitrarily decides Linux isn't a supported operating system, for example.
  - YPCrumble 3y ago
    Wouldn’t this just mean I should change my bank?
    - anshumankmr 3y ago
      That would be difficult to do, if say all banks decide to only support Windows/MacOs. My bank that I use is a bit wonky on Firefox but works fine on Chrome. Some banks even refuse to run on Firefox. Also, switching banks might be more difficult than switching an OS. And you would lose the reward points if any if you switch a bank, not to mention, if you use autopay that is configured to withdraw from a certain card, you would need to go and reconfigure that everywhere. It is not technically impossible, it's just going to arduous.
    - _xivi 3y ago
      Are you going to make your own bank too when enough banks do it?
    - loeg 3y ago
      I just believe that imposing this cost and inconvenience on Linux users (in this example) would be a bad thing.
    - plagiarist 3y ago
      Does that seem easier for people to do than buying a Windows or MacOS device? If your oldest credit cards are through your bank it could wreck your FICO for quite a while.
    - hellojesus 3y ago
      Or ultimately fund your own if all banks adopt this under a regulatory recommendation.
    - OfSanguineFire 3y ago
- XzAeRosho 3y ago
  The problem is that this feature can and will be used to restrict the users, it doesn't offer any real benefit to you. This will not increase security for the user either, it's just a new barrier at the risk of higher fingerprinting. Why should you care how your bank handles security? It's their responsibility, not yours to handle.
  - nfw2 3y ago
    Because they have my money?
    - mordae 3y ago
      OK, then legislate that this shit can only ever be opt-in and then we can talk.
    - nehal3m 3y ago
      Technically they don't. They incur a debt to you when you give them your money. The money at the bank is not your money.
      - nfw2 3y ago
        Fine then because they owe me money
- yborg 3y ago
  In what way does this increase the security of my bank account? A criminal can use credentials it obtained via a hack, etc. using an approved platform to access my account. My own approved platform can be compromised by malware and used to access my account. This class of problems is addressed by physical ID tokens, not attestation.
  - mordae 3y ago
    Corporate world currently sells attestation as a way to create secure token out of everyone's phone to the public sector worldwide. They obviously want it for the walled gardens and to fight ad-blocking, but public sector really wants to "deal with the cyber criminality" and they are clueless.
  - kccqzy 3y ago
    Presumably a criminal now no longer can install a piece of malware that looks into the memory of your browser to steal credentials in the first place. They will now have to use old fashioned social engineering to make you cough up that credential to steal.
- helen___keller 3y ago
  This is good as a user story if you are using a blessed OS/browser/device in that you can avoid CAPTCHA or whatever This is bad as a user story if you are not blessed and get likely locked out because the web operator doesn’t recognize you as valid This is worse in the second order effects in that it can be leveraged to fight against ad blockers, paywall bypassers, YouTube video downloaders, and so on, by forcing all those user-friendly software under the umbrella of being unblessed. Hence the moniker of “web DRM”
- bryanrasmussen 3y ago
  one example of a non-compliant browser would be something crawling the web and building up some sort of search index of things because I don't think we want anyone to be allowed to do that.
- ulkesh 3y ago
  No, it isn't good. Despite what some on the political spectrum try to say, the Internet has become a basic human right. It is required in schools in America. In many cases, it is required to even interact with certain government entities. Allowing governments and corporations to force users to a specific browser on a specific operating system just to interact with their site goes against everything the web is supposed to be -- an open platform for the free exchange of ideas. This proposal is a slap in the face to all of that and basically allows governments and corporations to force users to use what those governments and corporations choose. This is net neutrality all over again, just in a different vein. I, for one, will continue supporting Mozilla and Firefox and will never again use Chromium-based browsers, or any browser which supports this. I just hope I can keep browsing the sites I need to.
anshumankmr 3y ago
Approved Signing Keys -> Will this require for the end user to do it? If so, then this might be a short lived change, cause for a lot of people having a username and password is already super complicated.
- mordae 3y ago
  Nothing special. Just use preinstalled system and don't even think about using anything else.
minsc_and_boo 3y ago
Is there any way around this, like spoofing headers or OS specs?
- burkaman 3y ago
  No, Google has plenty of skilled engineers that can make spoofing an attestation extremely difficult. It will probably rely on hardware that you cannot modify. See details of a plausible implementation here: https://news.ycombinator.com/item?id=36859465 https://news.ycombinator.com/item?id=36859465
rochak 3y ago
Oh fuck no. This is bad. Google wtf.

javajosh 3y ago

It's a change to the browser that gives site-owners the ability to require a positive attestation of non-modification before running. The stated goal of this change is to make it more difficult for end-users to block ads. As the spec states, blocking ads violates the deal you make with content creators to use your attention to ads as a form of payment. In practice, this will make it harder, but not impossible, to run ad blockers. Now instead of just finding and installing a plugin, you'll have to first find and install a forked browser that implements the attestation as something like 'return true'. This will predictably decrease the number of people blocking ads. Personally, I don't object to this. The easy solution for most people is simply: don't consume the content. Or pay money instead of watching ads. Content creators, it must be said, also have the option of self-hosting and/or creating content as a hobby rather than a career. As someone who has grown more and more despairing of any paid-for speech, especially by ads, I welcome this change. Far more troubling is the possibility of attestation for "important apps" like banking or government. In general this mechanism gives the org a way to prevent you from doing what you want with your data. For example, they can prevent you from scraping data and automating end-user tasks. This takes away your degrees-of-freedom, and using a modified browser will certainly become an actionable offense. In my view this is by far the more troubling aspect of this change, since it take away significant aspects of user autonomy in a context where it matters most. Technically sophisticated users will note that it's not possible to secure a client, and foolish to try. This misses the point. These changes stochastically change behaviors "in the large", like a shopping center that offers two lanes in and one lane out, or two escalators in and one out. This represents a net transfer of power from the less powerful to the more powerful, and therefore deserves to be opposed. EDIT: please don't downvote, but rather reply with your objection.

mindslight 3y ago
This has been litigated to hell on HN, but no, there is no implicit contract when loading a webpage that your user agent will display ads or any other content as envisioned by the publisher. A user agent has always been intended to be something that displays content according to the wishes of the user. Even this "modest proposal" phrases itself in terms of user desires (albeit completely disingenuously). Ads have become prevalent because most users go with the default and don't install content filters to block them, but this does not create some obligation for all users to display ads. Rather, the core dynamic remains that ads essentially display at the pleasure of users. There is no option to "implements the attestation as something like 'return true'". There is a chain of verification from the hardware manufacturers building in software surveillance, through OS developers treating the device owner as an attacker, this proposal of carrying the same user-hostile dynamic through browsers, and finally to the website that by verifying the signatures can force a user to only use software that enforces all of the above. You should very much object to this! Today, "unsupported browser" is a CYA term that doesn't really mean much besides that the website has limited testing budget (and who doesn't?). With this proposal it would become a hard blocker. Goodbye Linux/BSDs/etc. Goodbye `make install`. Goodbye virtual machines. Goodbye computers that last longer than the rapid e-waste treadmill of mobile phone land. You will of course be able to keep running user-representing operating systems, old computers, "jail" breaking them, etc. You just won't be able to access banking websites, followed by web stores, then general sites. Basically anywhere today that hassles users with CAPTCHAs will be looking to implement these restrictions eventually (which is basically everywhere).

thurn 3y ago

Like any technology, there are both positive and negative aspects of it. The positive take would probably be that this technology is already widely used by iOS and Android apps. People use Apple's AppAttest to e.g. ensure that high scores submitted for a game are from a legitimate copy of the game and not just someone calling the SubmitHighScore API. But it's absolutely fair to argue that the web operates on a different set of expectations than the Play Store/App Store, and I think the concerns that this will create a second-class citizen status for browsers are totally valid. There's a huge difference in character between "in order to prevent piracy and ensure ad revenue we are only releasing our app on the Play Store" and "we are only releasing our web app for Chrome".

awesomeMilou 3y ago
> People use Apple's AppAttest to e.g. ensure that high scores submitted for a game are from a legitimate copy of the game and not just someone calling the SubmitHighScore API. But that's for Apps. Native Apps, not websites. If we argue this way, then this becomes a solution seeking an issue, since the first thing you learn in web programming is to never trust the client. I don't even see how this changes here, given that it won't mitigate any bugs, except giving me proof that the only bugs present on the client side system are the ones written by me. The reason Google actually want's to implement this, is because they risk loosing huge amounts of revenue due to adblocking, something they can control on mobile (since they control the software supply chain there) but cannot do in the browser (since I have access to the DOM).

peter422 3y ago

It’s like having the “I’m not a robot” button embedded in your web browser.

mordae 3y ago

To put it simple, it makes it possible for service provider to reject providing service to clients not running corporate-owned white-listed clients. Thus making it virtually impossible to create independent clients for such services. It will be swiftly adopted by well meaning but clueless bank and government clerks who will accidentally use to lock all open hardware, open operating system, open browser users out and mandate you need to purchase at least one locked down corporate device to exist. It's the trusted computing story all along. Eventually you will need permission to run your code on your own device and such "unlocked" device will be blocked from accessing any digital infrastructure because it might be otherwise used to breach ToS.

sir_brickalot 3y ago
Isn't this already the reality in the mobile space? I own a rooted Samsung device and have to jump through 100 hoops to be able to use my banking app or Netflix or some rando game (which I don't actually play). SafetyNet broken, hardware fuse blown, Magisk Hide + some other havks just to still be able to do online banking. I just want to be able to ssh into my own device or install a real ad blocker, like Adaway without losing access to real world applications. This is all very depressing.
- dvngnt_ 3y ago
  it is the reality for mobile. on iphone you can't even install software that apple doesn't explicitly allow. they would love to extend this to all computing devices to remove control
  - awesomeMilou 3y ago
    > they would love to extend this to all computing devices to remove control That's not really true. Apple is encroaching freedom of software choice on their devices, but they know that they can't extend the same kind of security policies to the desktop. You can disable secure boot on Macs and even run Linux if you like. Additionally, it's a bit difficult but if you disable SIP you do get access to the entire systems file system. They're a shitty company when it comes to repair-ability and their walled garden, but they know they can't extend this to the desktop, or else they would disqualify themselves from the developer market (where they are quite popular).