3 ms·

Lots of allegations here. Can you share examples with sources of other operating systems following practices which you mention here? I presume Mac allows the sa

Lots of allegations here. Can you share examples with sources of other operating systems following practices which you mention here? I presume Mac allows the same level of access for CRWD through user mode access only and that’s the only way they do it too. Same goes for Linux. I genuinely want to understand this - how everyone else got it right and this entity got it wrong.

mschuster91 2y ago
> Can you share examples with sources of other operating systems following practices which you mention here? Well, both dominant mobile operating systems already enforce a very strict security model. Too strict if you ask me because on neither you as the person actually owning the damn thing can become root without anything in the system throwing wrenches in your way, but hey. The result is, most people don't even need a virus scanner, and the blast radius of a bug in an application is usually limited to whatever data that application can access. It's been ages since I heard about the last major mobile OS malware in the wild that didn't involve one of the world's secret services or their civilian suppliers - and that way, one can argue, all the security theatre actually works: it's driven the price of successful attacks so high that only nation states can afford it, and even these have to restrain themselves to only use these exploits against targets of extremely high value.
- feyman_r 2y ago
  The reason mobile OS don’t have such a problem is because of the ‘walled-garden’ for App Store. Essentially, every binary being run on all Apple and likely most Android has been ‘blessed’ by the manufacturer App Store. Is it possible to rootkit phones? Yes; does a typical user do it - heck no.
  - dagmx 2y ago
    The app store does some pre-checks, yes. But it can’t catch all the security vulnerabilities that might be unknown. It’s only a small piece of the pie. Largely it exists to make sure apps work, don’t have malicious UX patterns and don’t use private APIs. iOS (and to a lesser degree, macOS) use notarization to be able to pull apps found of being risky as needed. Additionally they implement much stricter levels of sandboxing so that even if something slips by all detection, it’s heavily limited in what it can do without a users explicit permission or a catastrophic vulnerability.
  - fulafel 2y ago
    Android supports third party app stores and sideloading out of the box without rooting. There's a separate apk scanning feature that works with sideloading. (There's a big android user population without access to the Android app store at all)

mschuster91 2y ago

> Can you share examples with sources of other operating systems following practices which you mention here? Well, both dominant mobile operating systems already enforce a very strict security model. Too strict if you ask me because on neither you as the person actually owning the damn thing can become root without anything in the system throwing wrenches in your way, but hey. The result is, most people don't even need a virus scanner, and the blast radius of a bug in an application is usually limited to whatever data that application can access. It's been ages since I heard about the last major mobile OS malware in the wild that didn't involve one of the world's secret services or their civilian suppliers - and that way, one can argue, all the security theatre actually works: it's driven the price of successful attacks so high that only nation states can afford it, and even these have to restrain themselves to only use these exploits against targets of extremely high value.

feyman_r 2y ago
The reason mobile OS don’t have such a problem is because of the ‘walled-garden’ for App Store. Essentially, every binary being run on all Apple and likely most Android has been ‘blessed’ by the manufacturer App Store. Is it possible to rootkit phones? Yes; does a typical user do it - heck no.
- dagmx 2y ago
  The app store does some pre-checks, yes. But it can’t catch all the security vulnerabilities that might be unknown. It’s only a small piece of the pie. Largely it exists to make sure apps work, don’t have malicious UX patterns and don’t use private APIs. iOS (and to a lesser degree, macOS) use notarization to be able to pull apps found of being risky as needed. Additionally they implement much stricter levels of sandboxing so that even if something slips by all detection, it’s heavily limited in what it can do without a users explicit permission or a catastrophic vulnerability.
- fulafel 2y ago
  Android supports third party app stores and sideloading out of the box without rooting. There's a separate apk scanning feature that works with sideloading. (There's a big android user population without access to the Android app store at all)