4 ms·

This is bone-headed, as are the restrictions on WinRT... Makes me more likely to focus on other platforms.

by gfosco 14y ago

cooldeal 14y ago
Why are restrictions on WinRT boneheaded? Windows on the desktop and Android on mobile shows us how spyware and viruses are a very big problem without those restrictions, compared to, say iOS. Not to mention battery life and security.
- myko 14y ago
  What's with the Android FUD? Care to back up your assertion that Android is inherently less secure than say, iOS?
  - Spearchucker 14y ago
    Can't comment on whether it's more or less secure than iOS. What I can say is that it's openness is not only it's biggest strength, but also weakness. Quite simply because a network operator or handset manufacturer (often both) make their own changes to what is, I imagine, a relatively secure base platform. That requires users to trust the NetOp and manufacturer's intentions and, assuming that's all good, users must trust that the NetOp and manufacturer's code is secure. My trust, like my respect, is earnt. It's not handed away on a silver platter.
  - cooldeal 14y ago
    Too easy. How about this news from an hour ago? http://www.informationweek.com/news/security/attacks/240000992 http://www.informationweek.com/news/security/attacks/2400009... Or this posted 6 hours ago? http://www.cbronline.com/news/uk-regulator-shuts-down-android-malware-network-240512 http://www.cbronline.com/news/uk-regulator-shuts-down-androi... This was posted yesterday. http://www.forbes.com/sites/andygreenberg/2012/05/23/researchers-say-they-snuck-malware-app-past-googles-bouncer-android-market-scanner/ http://www.forbes.com/sites/andygreenberg/2012/05/23/researc... Let me know if you need more references. Note, I didn't say Android is inherently less secure than iOS. Apps policy is the difference and the topic of discussion. What's up with the needless FUD accusations?
    - myko 14y ago
      You said: > Android on mobile shows us how spyware and viruses are a very big problem without those restrictions, compared to, say iOS Which I took as saying Android is inherently less secure, but I agree after your clarification that isn't what you were actually saying. That said, this doesn't show Android is more susceptible to viruses than iOS devices, and iPhones are not immune to botnets either (http://nakedsecurity.sophos.com/2010/03/09/8000-iphone-android-users-duped-joining-smartphone-botnet/ http://nakedsecurity.sophos.com/2010/03/09/8000-iphone-andro... - though this only affected jailbroken iPhones). Previous jailbreak exploits that worked through Safari could have been disastrous as well - it's not that iOS is more secure, but I do agree it seems to be less targeted. As the popularity of iOS seems to be on the rise I believe this will change.
  - cooldeal 14y ago
    Too easy. How about this news from an hour ago? http://www.informationweek.com/news/security/attacks/240000992 http://www.informationweek.com/news/security/attacks/2400009... Or this posted 6 hours ago? http://www.cbronline.com/news/uk-regulator-shuts-down-android-malware-network-240512 http://www.cbronline.com/news/uk-regulator-shuts-down-androi... Note, I didn't say Android is inherently less secure than iOS. Apps policy is the difference and the topic of discussion. What's up with the needless FUD accusations?
  - Xuzz 14y ago
    Sure. iOS has full W^X (aka DEP), Android does not. This prevents JITs on iOS, but it also makes exploits more complex. iOS also has full ASLR (even kernel-level ASLR likely coming in 6.0), Android doesn't to the same extent. iOS also has a more restrictive an low-level sandbox, which denies access to many kernel interfaces; Android has a sandbox, but less restrictive. iOS also has app review; with Android, malware could (and has) easily enter the user-facing market. All code that runs on iOS must be signed by Apple, this significantly hurts exploit development as all code must be written using "gadgets" from existing, signed code. Android will run anything. Android also has the issue of updates: most Android 2.x phones are not going to ever get the improvements in later versions. More technical info: http://www.trailofbits.com/resources/mobile_eip-04-19-2012.pdf http://www.trailofbits.com/resources/mobile_eip-04-19-2012.p...
- beagle3 14y ago
  > Windows on the desktop and Android on mobile shows us how spyware and viruses are a very big problem without those restrictions, compared to, say iOS. But then, OSX and Linux don't have quite as many spyware and viruses, so the lack of restrictions is NOT the problem. (yes, OSX has recently seen a surge in malware - the vast majority of it predicated on exploiting Java. Java might be a problem. Lack of restrictions isn't)
  - jwoah12 14y ago
    In August 2011, Gartner estimated Apple's PC market share in US as 10.7% for Q2 2011. Apple's worldwide market share is not listed, because it is not in the list of top 5 computer manufacturers, and is inferred to be 5% or lower. http://en.wikipedia.org/wiki/Usage_share_of_operating_systems http://en.wikipedia.org/wiki/Usage_share_of_operating_system...
  - cooldeal 14y ago
    Popularity seems to a better gauge. OS X was not very popular till recently and now it is getting the attention of malware writers. The fake antivirus malware for OS X didn't even target Java or Flash, it just plain got people to download an executable. To sum it up, my assertion is: Popular and lack-of-restrictions implies malware is made. And what you said does not contradict that assertion.
    - beagle3 14y ago
      > Popular and lack-of-restrictions implies malware is made. That's a more reasonable assertion (but isn't what your original post said, nor was popularity implied). And while it is reasonable, I don't think there's really a way to draw a conclusion here; e.g. in the early 2000s, Apache had something like 6 times the market share of IIS and about 1/30 of the exploits; product design DOES make a difference here. I don't know how easy it is to get someone to run an OSX executable, but a linux virus spreading by email would have to include instructions to the user along the lines of save this file as really_innocent_file, drop into a shell, run chmod a+x really_innocent_file && exec really_innocent_file and you'll see a naked picture of $CELEBRITY.
- CrazedGeek 14y ago
  Why should Microsoft or Apple decide what software I can run on my device? Right now, one of the top stories on HN is Rogue Amoeba's Airfoil Speakers Touch iOS app being removed from the App Store (http://news.ycombinator.com/item?id=4019660 http://news.ycombinator.com/item?id=4019660). If the devices I use subscribed to the "user must be totally protected from themselves" philosophy, then I'd be totally unable to use their product. However, that's thankfully not the case -- I can still purchase and use Airfoil for Mac and Windows, two (currently) mostly open platforms (http://rogueamoeba.com/airfoil/ http://rogueamoeba.com/airfoil/). Mountain Lion's Gatekeeper, iOS, and the WinRT restrictions make me wary of the future.
  - jeremyarussell 14y ago
    Why should Microsoft or Apple decide what software I can run on my device? I believe their argument is to allow them to retain a semblance of control on their respective platforms. Something about people always blaming the maker of their operating system for the glitches which may or may not actually be the OS's fault, and can tend to be the programmers fault. That's what they say anyways.

This is bone-headed, as are the restrictions on WinRT... Makes me more likely to focus on other platforms.

by gfosco 14y ago

This is bone-headed, as are the restrictions on WinRT... Makes me more likely to focus on other platforms.

Why are restrictions on WinRT boneheaded? Windows on the desktop and Android on mobile shows us how spyware and viruses are a very big problem without those restrictions, compared to, say iOS. Not to mention battery life and security.

myko 14y ago
What's with the Android FUD? Care to back up your assertion that Android is inherently less secure than say, iOS?
- Spearchucker 14y ago
  Can't comment on whether it's more or less secure than iOS. What I can say is that it's openness is not only it's biggest strength, but also weakness. Quite simply because a network operator or handset manufacturer (often both) make their own changes to what is, I imagine, a relatively secure base platform. That requires users to trust the NetOp and manufacturer's intentions and, assuming that's all good, users must trust that the NetOp and manufacturer's code is secure. My trust, like my respect, is earnt. It's not handed away on a silver platter.
- cooldeal 14y ago
  Too easy. How about this news from an hour ago? http://www.informationweek.com/news/security/attacks/240000992 http://www.informationweek.com/news/security/attacks/2400009... Or this posted 6 hours ago? http://www.cbronline.com/news/uk-regulator-shuts-down-android-malware-network-240512 http://www.cbronline.com/news/uk-regulator-shuts-down-androi... This was posted yesterday. http://www.forbes.com/sites/andygreenberg/2012/05/23/researchers-say-they-snuck-malware-app-past-googles-bouncer-android-market-scanner/ http://www.forbes.com/sites/andygreenberg/2012/05/23/researc... Let me know if you need more references. Note, I didn't say Android is inherently less secure than iOS. Apps policy is the difference and the topic of discussion. What's up with the needless FUD accusations?
  - myko 14y ago
    You said: > Android on mobile shows us how spyware and viruses are a very big problem without those restrictions, compared to, say iOS Which I took as saying Android is inherently less secure, but I agree after your clarification that isn't what you were actually saying. That said, this doesn't show Android is more susceptible to viruses than iOS devices, and iPhones are not immune to botnets either (http://nakedsecurity.sophos.com/2010/03/09/8000-iphone-android-users-duped-joining-smartphone-botnet/ http://nakedsecurity.sophos.com/2010/03/09/8000-iphone-andro... - though this only affected jailbroken iPhones). Previous jailbreak exploits that worked through Safari could have been disastrous as well - it's not that iOS is more secure, but I do agree it seems to be less targeted. As the popularity of iOS seems to be on the rise I believe this will change.
- cooldeal 14y ago
  Too easy. How about this news from an hour ago? http://www.informationweek.com/news/security/attacks/240000992 http://www.informationweek.com/news/security/attacks/2400009... Or this posted 6 hours ago? http://www.cbronline.com/news/uk-regulator-shuts-down-android-malware-network-240512 http://www.cbronline.com/news/uk-regulator-shuts-down-androi... Note, I didn't say Android is inherently less secure than iOS. Apps policy is the difference and the topic of discussion. What's up with the needless FUD accusations?
- Xuzz 14y ago
  Sure. iOS has full W^X (aka DEP), Android does not. This prevents JITs on iOS, but it also makes exploits more complex. iOS also has full ASLR (even kernel-level ASLR likely coming in 6.0), Android doesn't to the same extent. iOS also has a more restrictive an low-level sandbox, which denies access to many kernel interfaces; Android has a sandbox, but less restrictive. iOS also has app review; with Android, malware could (and has) easily enter the user-facing market. All code that runs on iOS must be signed by Apple, this significantly hurts exploit development as all code must be written using "gadgets" from existing, signed code. Android will run anything. Android also has the issue of updates: most Android 2.x phones are not going to ever get the improvements in later versions. More technical info: http://www.trailofbits.com/resources/mobile_eip-04-19-2012.pdf http://www.trailofbits.com/resources/mobile_eip-04-19-2012.p...
beagle3 14y ago
> Windows on the desktop and Android on mobile shows us how spyware and viruses are a very big problem without those restrictions, compared to, say iOS. But then, OSX and Linux don't have quite as many spyware and viruses, so the lack of restrictions is NOT the problem. (yes, OSX has recently seen a surge in malware - the vast majority of it predicated on exploiting Java. Java might be a problem. Lack of restrictions isn't)
- jwoah12 14y ago
  In August 2011, Gartner estimated Apple's PC market share in US as 10.7% for Q2 2011. Apple's worldwide market share is not listed, because it is not in the list of top 5 computer manufacturers, and is inferred to be 5% or lower. http://en.wikipedia.org/wiki/Usage_share_of_operating_systems http://en.wikipedia.org/wiki/Usage_share_of_operating_system...
- cooldeal 14y ago
  Popularity seems to a better gauge. OS X was not very popular till recently and now it is getting the attention of malware writers. The fake antivirus malware for OS X didn't even target Java or Flash, it just plain got people to download an executable. To sum it up, my assertion is: Popular and lack-of-restrictions implies malware is made. And what you said does not contradict that assertion.
  - beagle3 14y ago
    > Popular and lack-of-restrictions implies malware is made. That's a more reasonable assertion (but isn't what your original post said, nor was popularity implied). And while it is reasonable, I don't think there's really a way to draw a conclusion here; e.g. in the early 2000s, Apache had something like 6 times the market share of IIS and about 1/30 of the exploits; product design DOES make a difference here. I don't know how easy it is to get someone to run an OSX executable, but a linux virus spreading by email would have to include instructions to the user along the lines of save this file as really_innocent_file, drop into a shell, run chmod a+x really_innocent_file && exec really_innocent_file and you'll see a naked picture of $CELEBRITY.
CrazedGeek 14y ago
Why should Microsoft or Apple decide what software I can run on my device? Right now, one of the top stories on HN is Rogue Amoeba's Airfoil Speakers Touch iOS app being removed from the App Store (http://news.ycombinator.com/item?id=4019660 http://news.ycombinator.com/item?id=4019660). If the devices I use subscribed to the "user must be totally protected from themselves" philosophy, then I'd be totally unable to use their product. However, that's thankfully not the case -- I can still purchase and use Airfoil for Mac and Windows, two (currently) mostly open platforms (http://rogueamoeba.com/airfoil/ http://rogueamoeba.com/airfoil/). Mountain Lion's Gatekeeper, iOS, and the WinRT restrictions make me wary of the future.
- jeremyarussell 14y ago
  Why should Microsoft or Apple decide what software I can run on my device? I believe their argument is to allow them to retain a semblance of control on their respective platforms. Something about people always blaming the maker of their operating system for the glitches which may or may not actually be the OS's fault, and can tend to be the programmers fault. That's what they say anyways.