3 ms·

Through security enhancing features in the operating system, like not allowing processes to access other's memory spaces. Or prompting users to allow an applica

by jocaal 3y ago

Through security enhancing features in the operating system, like not allowing processes to access other's memory spaces. Or prompting users to allow an application to use potentially harmful api's. What do you think is the role of an operating system?

ben_w 3y ago
Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". And for web browsers, which are basically an inner-OS, making sure that plug-ins can't read arbitrary content from the pages you visit. And given that "phone" is an app, that it can't wiretap all your calls. Also, one of the fights between Apple and Facebook was basically stuff which, by my reading, was stuff Facebook wanted to do which was illegal under GDPR: https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-privacy-change-will-cost-10-billion-this-year.html https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-priv... There's also stuff which is bad for the device, but I'm not sure if it really ought to be Apple's responsibility to prevent, like crypto miner libraries running on-device as an income stream for the developer.
- dns_snek 3y ago
  > Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". And what makes you think Apple can stop these apps on their own app store before they cause harm? I sense this pervasive belief on HN that Apple's reviews are infallible, or that they magically catch malware, when in reality it's just some low ranking person installing the app and navigating through it to spot obvious flaws, usability issues, rule breaches, and ensure that the developer doesn't try to direct users to their website to purchase a subscription for cheaper, the usual anti-competitive stuff. Unless you can point out a step in the review process where a security expert sits down and reverse engineers the app, and every subsequent update, to verify that it doesn't steal user data? It's only when someone raises the suspicion that things get looked into, reported and taken off the store. At least web extensions have the benefit of being written in Javascript which is easier to inspect. At no point does Apple ask you to hand over source code.
  - ben_w 3y ago
    > I sense this pervasive belief on HN that Apple's reviews are infallible Our language makes booleans easier to communicate than nuances. For example, I absolutely do not consider their reviews infallible, I just didn't think it would come across that way when I wrote the comment you're responding to.
- jocaal 3y ago
  > Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". "This keyboard app requires access to network resources, do you want to allow this?" Or better yet, let the operating system block apps from using both network resources and keyboard api's. > And for web browsers, which are basically an inner-OS, making sure that plug-ins can't read arbitrary content from the pages you visit. My web browser allows me to choose when I want an extension to have access to a web page. > "And given that "phone" is an app, that it can't wiretap all your calls." I'm gonna guess it does this with a man-in-the-middle attack. "The operating system has detected that this phone app always calls the same number. We have disabled it for security reasons." Also if you buy a phone, it might be reasonable to let there only be one phone app. I'm kind of tired of people claiming the hand-holding argument, that apple helps people who do not understand technology. My sister uses apple devices exclusively, but at her work, her employer regularly does tests for phishing and she always fails. It is time people get educated about how to use their computing devices. These devices have been around long enough that people who fall for obvious scams should be considered incompetent.
  - ben_w 3y ago
    > "This keyboard app requires access to network resources, do you want to allow this?" Or better yet, let the operating system block apps from using both network resources and keyboard api's. So, either a "we want this for analytics" message on the popup for fakers, or no analytics for legit developers. Now sure, I personally don't think app development benefits all that much from analytics and would be happy if analytics were outlawed in entirety by the EU, but 95% of websites have been howling about how important they are since they were forced to request consent for that with the GDPR. > My web browser allows me to choose when I want an extension to have access to a web page. So does mine. Why do you think this is a counter-argument? It's a well-known security issue, it's still on the HN front page: https://news.ycombinator.com/item?id=39620060 https://news.ycombinator.com/item?id=39620060 And every time I set up a new computer, I have to check very carefully to make sure I'm installing a well-recognised ad blocker rather than one of the huge number of look-alike scams — I have to be right every time, the scammers only have to fool me once. > I'm gonna guess it does this with a man-in-the-middle attack. "The operating system has detected that this phone app always calls the same number. Why? I was thinking "record message, upload to website". Same deal as with keyboard, except the permission popup can also say "VoIP". > I'm kind of tired of people claiming the hand-holding argument, that apple helps people who do not understand technology. My sister uses apple devices exclusively, but at her work, her employer regularly does tests for phishing and she always fails. It is time people get educated about how to use their computing devices. These devices have been around long enough that people who fall for obvious scams should be considered incompetent. Congratulations, that's at least 94.6% of the population you've just described there: https://www.weforum.org/agenda/2017/02/a-quarter-of-adults-can-t-use-a-computer/ https://www.weforum.org/agenda/2017/02/a-quarter-of-adults-c... To put it another way, your standards are too high. I don't know much chemistry, so I need the chemicals in my daily life to be regulated; I don't know much law, so I need governments to deem that certain contractual clauses are invalid on my behalf; I don't know much biology, so I need the government to prevent snake oil salesmen selling snake oil for all potential ills. Should private companies be the regulator? Sometimes the law requires it, sometimes the law forbids it. I'm comfortable (if not happy) letting the governments decide what Apple must and must not do, for the exact same reason that I have been comfortable (if not happy) letting Apple decide what developers can do. I do know computers, and I like messing around with them much as StyroPyro likes messing with terrifyingly high powered lasers[0], much as The Thought Emporium likes messing with terrifying man-made horrors beyond comprehension[1], much as Colin Furze liked making a hoverbike with "no steering, it has no brakes, it's got two accelerators and not even a seat"[2]… asking everyone to take on that responsibility just because I'd like more freedom, isn't as good as you think it is. [0] https://www.youtube.com/watch?v=xNmbvaUzC8Q https://www.youtube.com/watch?v=xNmbvaUzC8Q [1] https://www.youtube.com/watch?v=Z_ZGq8Tah0k https://www.youtube.com/watch?v=Z_ZGq8Tah0k [2] https://www.youtube.com/watch?v=soxxPyaAT1k https://www.youtube.com/watch?v=soxxPyaAT1k
- rekoil 3y ago
  None of the things you mention is the responsibility of Apple to decide. They are all choices I get to make as the device owner. Apple can decide what ships on the device, and what is for sale in their very reputable store, but not outside of it.
ankit219 3y ago
I combined both OS and manufacturers since in this case they are from the same company.

by jocaal 3y ago

ben_w 3y ago

Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". And for web browsers, which are basically an inner-OS, making sure that plug-ins can't read arbitrary content from the pages you visit. And given that "phone" is an app, that it can't wiretap all your calls. Also, one of the fights between Apple and Facebook was basically stuff which, by my reading, was stuff Facebook wanted to do which was illegal under GDPR: https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-privacy-change-will-cost-10-billion-this-year.html https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-priv... There's also stuff which is bad for the device, but I'm not sure if it really ought to be Apple's responsibility to prevent, like crypto miner libraries running on-device as an income stream for the developer.

dns_snek 3y ago
> Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". And what makes you think Apple can stop these apps on their own app store before they cause harm? I sense this pervasive belief on HN that Apple's reviews are infallible, or that they magically catch malware, when in reality it's just some low ranking person installing the app and navigating through it to spot obvious flaws, usability issues, rule breaches, and ensure that the developer doesn't try to direct users to their website to purchase a subscription for cheaper, the usual anti-competitive stuff. Unless you can point out a step in the review process where a security expert sits down and reverse engineers the app, and every subsequent update, to verify that it doesn't steal user data? It's only when someone raises the suspicion that things get looked into, reported and taken off the store. At least web extensions have the benefit of being written in Javascript which is easier to inspect. At no point does Apple ask you to hand over source code.
- ben_w 3y ago
  > I sense this pervasive belief on HN that Apple's reviews are infallible Our language makes booleans easier to communicate than nuances. For example, I absolutely do not consider their reviews infallible, I just didn't think it would come across that way when I wrote the comment you're responding to.
jocaal 3y ago
> Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". "This keyboard app requires access to network resources, do you want to allow this?" Or better yet, let the operating system block apps from using both network resources and keyboard api's. > And for web browsers, which are basically an inner-OS, making sure that plug-ins can't read arbitrary content from the pages you visit. My web browser allows me to choose when I want an extension to have access to a web page. > "And given that "phone" is an app, that it can't wiretap all your calls." I'm gonna guess it does this with a man-in-the-middle attack. "The operating system has detected that this phone app always calls the same number. We have disabled it for security reasons." Also if you buy a phone, it might be reasonable to let there only be one phone app. I'm kind of tired of people claiming the hand-holding argument, that apple helps people who do not understand technology. My sister uses apple devices exclusively, but at her work, her employer regularly does tests for phishing and she always fails. It is time people get educated about how to use their computing devices. These devices have been around long enough that people who fall for obvious scams should be considered incompetent.
- ben_w 3y ago
  > "This keyboard app requires access to network resources, do you want to allow this?" Or better yet, let the operating system block apps from using both network resources and keyboard api's. So, either a "we want this for analytics" message on the popup for fakers, or no analytics for legit developers. Now sure, I personally don't think app development benefits all that much from analytics and would be happy if analytics were outlawed in entirety by the EU, but 95% of websites have been howling about how important they are since they were forced to request consent for that with the GDPR. > My web browser allows me to choose when I want an extension to have access to a web page. So does mine. Why do you think this is a counter-argument? It's a well-known security issue, it's still on the HN front page: https://news.ycombinator.com/item?id=39620060 https://news.ycombinator.com/item?id=39620060 And every time I set up a new computer, I have to check very carefully to make sure I'm installing a well-recognised ad blocker rather than one of the huge number of look-alike scams — I have to be right every time, the scammers only have to fool me once. > I'm gonna guess it does this with a man-in-the-middle attack. "The operating system has detected that this phone app always calls the same number. Why? I was thinking "record message, upload to website". Same deal as with keyboard, except the permission popup can also say "VoIP". > I'm kind of tired of people claiming the hand-holding argument, that apple helps people who do not understand technology. My sister uses apple devices exclusively, but at her work, her employer regularly does tests for phishing and she always fails. It is time people get educated about how to use their computing devices. These devices have been around long enough that people who fall for obvious scams should be considered incompetent. Congratulations, that's at least 94.6% of the population you've just described there: https://www.weforum.org/agenda/2017/02/a-quarter-of-adults-can-t-use-a-computer/ https://www.weforum.org/agenda/2017/02/a-quarter-of-adults-c... To put it another way, your standards are too high. I don't know much chemistry, so I need the chemicals in my daily life to be regulated; I don't know much law, so I need governments to deem that certain contractual clauses are invalid on my behalf; I don't know much biology, so I need the government to prevent snake oil salesmen selling snake oil for all potential ills. Should private companies be the regulator? Sometimes the law requires it, sometimes the law forbids it. I'm comfortable (if not happy) letting the governments decide what Apple must and must not do, for the exact same reason that I have been comfortable (if not happy) letting Apple decide what developers can do. I do know computers, and I like messing around with them much as StyroPyro likes messing with terrifyingly high powered lasers[0], much as The Thought Emporium likes messing with terrifying man-made horrors beyond comprehension[1], much as Colin Furze liked making a hoverbike with "no steering, it has no brakes, it's got two accelerators and not even a seat"[2]… asking everyone to take on that responsibility just because I'd like more freedom, isn't as good as you think it is. [0] https://www.youtube.com/watch?v=xNmbvaUzC8Q https://www.youtube.com/watch?v=xNmbvaUzC8Q [1] https://www.youtube.com/watch?v=Z_ZGq8Tah0k https://www.youtube.com/watch?v=Z_ZGq8Tah0k [2] https://www.youtube.com/watch?v=soxxPyaAT1k https://www.youtube.com/watch?v=soxxPyaAT1k
rekoil 3y ago
None of the things you mention is the responsibility of Apple to decide. They are all choices I get to make as the device owner. Apple can decide what ships on the device, and what is for sale in their very reputable store, but not outside of it.

ankit219 3y ago

I combined both OS and manufacturers since in this case they are from the same company.