2 ms·

That’s like saying everyone should carry grenades around because trained soldiers do. Linux servers do get compromised by people installing dodgy software but i

by acdha 2y ago

That’s like saying everyone should carry grenades around because trained soldiers do. Linux servers do get compromised by people installing dodgy software but it’s nowhere near the scale of the same thing happening on PCs and phones because servers are mostly operated by people with the discipline and skill not to add some random site to their package manager. Anyone who’s ever supported normal people or even talked with their extended friends and family knows that this is not something you can assume for systems used by the general public. There’s a huge industry social engineering people into installing dodgy software to get deals, porn, games, address scary security threats, etc. and the billions of dollars they made annually means that when your grandfather is on the phone with the call center person walking him through turning off every security measure, he’s probably thinking that they’re more helpful than his actual bank. If normal people ran Linux, they’d be just as prone to run “sudo add-apt-repository“ as they are clicking through the Windows prompts now.

talldayo 2y ago
> There’s a huge industry social engineering people into installing dodgy software to get deals, porn, games, address scary security threats, etc. But that happens everywhere, though. These same social-engineering ads show up in Safari, can manipulate you into giving away your banking details for a Nigerian prince or tossing your SSN and debit card into a little autofill HTML box. Call-center scammers will abuse your iPhone's callerID to make people think they're talking to the IRS or their car dealership. These scams are nothing new, locking out features doesn't "help" users any more than disabling the phone or browser does. Safety is Apple's abusive catchall excuse that they wheel out when they have to make the poison-pill taste like candy. The real kicker is that Apple's own App Store has been caught hosting malware. You can't really claim the open web is some scary harbinger of manipulative software when Apple's own first-party service has been caught hosting fake LastPass apps and abusive weekly-subscription services. Meanwhile on Android, I get my favorite apps off Github and don't have to interact with the enshittification-encumbered Google Play Store.
- acdha 2y ago
  You might want to consider relative scale: yes, there has been malware in the App Store but the questions you should be asking are how long it stays there, how quickly it’s blocked and existing installs removed, and what level of access it had. Look at the product pages for spyware marketed to distrustful parents and abusive spouses, for example, and notice how much less they can do on something like iOS or ChromeOS compared to a full desktop operating system and you’ll understand why this is discussed as a trade off rather than absolute good/bad terms.
  - talldayo 2y ago
    It's not treated as a trade-off, outside Apple's marketing. Anyone that's seen Apple's service revenue relative to their hardware margins knows the score. If this was a conversation about iPhone malware then I should point out that people are being infected by Pegasus with nothing but first-party Apple software. There are active zero-click exploits with various levels of persistence on the market today; you want to talk about relative scale in a post-Pegasus era? Hell, a post-Snowden era? You're echoing Apple's own flawed defense. You can't rob someone in one hand and claim to be paying them back with the other. You're either acting altruistically to actually help users, or you're perpetuating a cycle that benefits only the service-owner. With Apple's complete lack of service-based competition I don't think it's absurd to suggest they're intentionally misrepresenting the only App Store option to try and rescue it from certain regulation.
    - acdha 2y ago
      > It's not treated as a trade-off, outside Apple's marketing It absolute is by anyone working in the field, and it’s not just Apple. A lot of places have been looking at ChromeOS for similar reasons, tons of people are running Kubernetes on trimmed down Linux systems which are far less “serviceable” than traditional servers because it reduces the attack surface massively. > There are active zero-click exploits with various levels of persistence on the market today; you want to talk about relative scale in a post-Pegasus era? Yes, actually. Your emotions are clearly strong on this issue but you really want to get some data and analyze it – for example, how long are users left vulnerable for traditional operating systems versus locked down ones or how hard is recovery? Nobody is saying that there’s a universal optimum here but there’s clearly a trade off which people should consider when deciding what’s better for their situation. If you don’t need to run arbitrary binaries, can meaningfully segregate data between apps, etc. the benefits of breaking with tradition is pretty high and a high percentage of people will never hit a downside.
fsflover 2y ago
> because servers are mostly operated by people with the discipline and skill not to add some random site to their package manager. I have the discipline and skill. I want to be able to run what I want. I don't need "help" from Apple. You will always have a choice of not installing an alternative app store, just like on Android. > If normal people ran Linux, they’d be just as prone to run “sudo add-apt-repository“ as they are clicking through the Windows prompts now. I installed GNU/Linux for my relatives, and they never did that in years.
- acdha 2y ago
  > I have the discipline and skill. This might even be true but that just means you aren’t the target market. Nobody is stopping you from running a full open source stack but I don’t think it should come as a surprise that 99% of the people using computers pick something easier and safer to use when it’s not your job or hobby. My Linux desktop experience goes back to 1994 and while it’s a lot better now I still have zero trouble understanding that trade off. > I installed GNU/Linux for my relatives, and they never did that in years. Again, think mainstream. Where that’s happened historically was most server-side stuff because Linux has much greater share there, but most of the business compromising users is focused on Windows, Android, iOS, and maybe macOS because that’s where almost all of the people they’ll make money from are. If desktop Linux became more popular, attackers would spend time on it and would have comparable success rates – likely even higher due to how far behind the Linux world is compared to macOS on sandboxing and code signing. Free software is a great thing but it doesn’t have magic pixie dust obviating the need to spend time on security like everyone else.
  - fsflover 2y ago
    > Nobody is stopping you from running a full open source stack Where are the instructions how to do it on an iPhone? No, even on Android it's impossible due to closed drivers and specs, making a lot of e-waste and, conveniently for corporations, a lot of sales of new devices every time the support is ended. It seems to me that the duopoly removed any freedom to run what I want from me.

by acdha 2y ago

talldayo 2y ago

> There’s a huge industry social engineering people into installing dodgy software to get deals, porn, games, address scary security threats, etc. But that happens everywhere, though. These same social-engineering ads show up in Safari, can manipulate you into giving away your banking details for a Nigerian prince or tossing your SSN and debit card into a little autofill HTML box. Call-center scammers will abuse your iPhone's callerID to make people think they're talking to the IRS or their car dealership. These scams are nothing new, locking out features doesn't "help" users any more than disabling the phone or browser does. Safety is Apple's abusive catchall excuse that they wheel out when they have to make the poison-pill taste like candy. The real kicker is that Apple's own App Store has been caught hosting malware. You can't really claim the open web is some scary harbinger of manipulative software when Apple's own first-party service has been caught hosting fake LastPass apps and abusive weekly-subscription services. Meanwhile on Android, I get my favorite apps off Github and don't have to interact with the enshittification-encumbered Google Play Store.

acdha 2y ago
You might want to consider relative scale: yes, there has been malware in the App Store but the questions you should be asking are how long it stays there, how quickly it’s blocked and existing installs removed, and what level of access it had. Look at the product pages for spyware marketed to distrustful parents and abusive spouses, for example, and notice how much less they can do on something like iOS or ChromeOS compared to a full desktop operating system and you’ll understand why this is discussed as a trade off rather than absolute good/bad terms.
- talldayo 2y ago
  It's not treated as a trade-off, outside Apple's marketing. Anyone that's seen Apple's service revenue relative to their hardware margins knows the score. If this was a conversation about iPhone malware then I should point out that people are being infected by Pegasus with nothing but first-party Apple software. There are active zero-click exploits with various levels of persistence on the market today; you want to talk about relative scale in a post-Pegasus era? Hell, a post-Snowden era? You're echoing Apple's own flawed defense. You can't rob someone in one hand and claim to be paying them back with the other. You're either acting altruistically to actually help users, or you're perpetuating a cycle that benefits only the service-owner. With Apple's complete lack of service-based competition I don't think it's absurd to suggest they're intentionally misrepresenting the only App Store option to try and rescue it from certain regulation.
  - acdha 2y ago
    > It's not treated as a trade-off, outside Apple's marketing It absolute is by anyone working in the field, and it’s not just Apple. A lot of places have been looking at ChromeOS for similar reasons, tons of people are running Kubernetes on trimmed down Linux systems which are far less “serviceable” than traditional servers because it reduces the attack surface massively. > There are active zero-click exploits with various levels of persistence on the market today; you want to talk about relative scale in a post-Pegasus era? Yes, actually. Your emotions are clearly strong on this issue but you really want to get some data and analyze it – for example, how long are users left vulnerable for traditional operating systems versus locked down ones or how hard is recovery? Nobody is saying that there’s a universal optimum here but there’s clearly a trade off which people should consider when deciding what’s better for their situation. If you don’t need to run arbitrary binaries, can meaningfully segregate data between apps, etc. the benefits of breaking with tradition is pretty high and a high percentage of people will never hit a downside.

fsflover 2y ago

> because servers are mostly operated by people with the discipline and skill not to add some random site to their package manager. I have the discipline and skill. I want to be able to run what I want. I don't need "help" from Apple. You will always have a choice of not installing an alternative app store, just like on Android. > If normal people ran Linux, they’d be just as prone to run “sudo add-apt-repository“ as they are clicking through the Windows prompts now. I installed GNU/Linux for my relatives, and they never did that in years.

acdha 2y ago
> I have the discipline and skill. This might even be true but that just means you aren’t the target market. Nobody is stopping you from running a full open source stack but I don’t think it should come as a surprise that 99% of the people using computers pick something easier and safer to use when it’s not your job or hobby. My Linux desktop experience goes back to 1994 and while it’s a lot better now I still have zero trouble understanding that trade off. > I installed GNU/Linux for my relatives, and they never did that in years. Again, think mainstream. Where that’s happened historically was most server-side stuff because Linux has much greater share there, but most of the business compromising users is focused on Windows, Android, iOS, and maybe macOS because that’s where almost all of the people they’ll make money from are. If desktop Linux became more popular, attackers would spend time on it and would have comparable success rates – likely even higher due to how far behind the Linux world is compared to macOS on sandboxing and code signing. Free software is a great thing but it doesn’t have magic pixie dust obviating the need to spend time on security like everyone else.
- fsflover 2y ago
  > Nobody is stopping you from running a full open source stack Where are the instructions how to do it on an iPhone? No, even on Android it's impossible due to closed drivers and specs, making a lot of e-waste and, conveniently for corporations, a lot of sales of new devices every time the support is ended. It seems to me that the duopoly removed any freedom to run what I want from me.