4 ms·

>You can't have an OS that you can tinker around with and an OS that is secure from cheaters But do these need to be the same OS? Or is it possible to have the

>You can't have an OS that you can tinker around with and an OS that is secure from cheaters But do these need to be the same OS? Or is it possible to have them be partitioned off from each other that way you can have a game run with full integrity and then also be able to have a customized experience for things which don't care about integrity.

mschuster91 2y ago
Dual-booting utterly sucks experience-wise, and the very second you allow any kind of "untrusted" code on a device - even if it's another OS nominally "separate" from the main OS - you multiply the attack vectors that are possible. That's part of the reason why Apple is so against not just jailbreaks for mobile devices but also any kind of non-Apple-sanctioned access to anything they deem safety critical.
- charcircuit 2y ago
  I was referring to virtualization. The experiences doesn't have to be bad. For example on Windows 11 you can double click on a shortcut to a Linux app and when it opens it looks like a regular window like any other program on the computer, but it's actually running on Linux.
  - fc417fc802 2y ago
    This is mostly true. You can run a VM in the trusted OS to do untrusted stuff. For stuff like 3D graphics you will likely need a second GPU to pass through to the guest if you want reasonable performance. That resolves the tinkering vs intrusive vendor issue. However it doesn't address the privacy, autonomy, or user freedom angles. By autonomy I mean (for example) the inability to perform a proper backup on a "secure" android system. By privacy I refer to the fact that the vendor can see everything you do even in the VM. User freedom is only an issue when you can't boot an "insecure" OS on the platform, but if nothing will run when you do that the situation isn't much different. For example, technically I have the freedom to run DOS today but in reality I won't be getting much done if I do. Addressing the privacy issue we've at least got confidential VMs now. However at that point we've just pushed all the issues down a level and the same drama plays out again with the hardware vendor.
    - charcircuit 2y ago
      >For stuff like 3D graphics you will likely need a second GPU to pass through to the guest if you want reasonable performance. No, a single GPU can support virtualization and be shared among multiple visitors. >the inability to perform a proper backup on a "secure" android system. This is by design as a "proper" backup violates Android's security model. Instead a backup system that respects Android's security model was built. Autonomy is given up but in exchange the high level functionality remains the same and there is better security. >By privacy I refer to the fact that the vendor can see everything you do even in the VM. What does this even mean? There is no fundamental reason for spyware to exist and even if there was that is independent to using virtualization. >User freedom is only an issue when you can't boot an "insecure" OS on the platform User freedom and security are orthogonal, but due to Turing completeness almost everything will support booting insecure operating systems. >but if nothing will run when you do that the situation isn't much different. If there is no market demand for running applications on insecure platforms then perhaps that's an okay situation to be in.
      - fc417fc802 2y ago
        > No, a single GPU can support virtualization and be shared among multiple visitors. Do you really think I'm unaware of that? Have you tried it lately? Most (nearly all) consumer level hardware doesn't support it and (I might be wrong about this next bit but IIRC) you won't get full performance because most solutions partition the hardware rather than multiplexing it. > This is by design as a "proper" backup violates Android's security model. I'm aware. That doesn't address the problem. > the high level functionality remains the same Absolutely false. Apple at least built a solution that appears to perform as advertised even if I vehemently disagree with the underlying security model and believe that it is actively making society worse off in the long run. Google has failed miserably at that (at least last I checked, which was a few years ago TBF). > and there is better security. By whose definition? The officially sanctioned security model does not provide anything of value to me (from a technical perspective) relative to having full control over my device. > What does this even mean? It means that if someone else has control over the software on my device then outside of a truly unusual end-to-end code auditing arrangement I can never be confident that I'm not being watched. > There is no fundamental reason for spyware to exist What sort of drugs are you on over there? Ad tech is a massive industry. There are all manner of motivations to hoover up user data from market research to selling it to authoritarian tendencies. > User freedom and security are orthogonal Notice the quotes. By "insecure" I mean not provided by BigTech and system state attested by a whitelisted HSM. > due to Turing completeness almost everything will support booting insecure operating systems. Have you tried customizing the OS on a vendor bootloader locked mobile device lately? > If there is no market demand for running applications on insecure platforms then perhaps that's an okay situation to be in. Sophistry. It's user choice due to a combination of lack of awareness and understanding, a preference for convenience even when that's detrimental to society in the long term, and the resultant network effects.
  - mschuster91 2y ago
    You're still running untrusted code on the same devices. IOMMUs aren't enough, not since side-channel attacks entered the field, not to mention the consistent availability of IOMMU and Secure Enclave bypasses, or exploits for the GPU to access data from other contexts.

mschuster91 2y ago

Dual-booting utterly sucks experience-wise, and the very second you allow any kind of "untrusted" code on a device - even if it's another OS nominally "separate" from the main OS - you multiply the attack vectors that are possible. That's part of the reason why Apple is so against not just jailbreaks for mobile devices but also any kind of non-Apple-sanctioned access to anything they deem safety critical.

charcircuit 2y ago
I was referring to virtualization. The experiences doesn't have to be bad. For example on Windows 11 you can double click on a shortcut to a Linux app and when it opens it looks like a regular window like any other program on the computer, but it's actually running on Linux.
- fc417fc802 2y ago
  This is mostly true. You can run a VM in the trusted OS to do untrusted stuff. For stuff like 3D graphics you will likely need a second GPU to pass through to the guest if you want reasonable performance. That resolves the tinkering vs intrusive vendor issue. However it doesn't address the privacy, autonomy, or user freedom angles. By autonomy I mean (for example) the inability to perform a proper backup on a "secure" android system. By privacy I refer to the fact that the vendor can see everything you do even in the VM. User freedom is only an issue when you can't boot an "insecure" OS on the platform, but if nothing will run when you do that the situation isn't much different. For example, technically I have the freedom to run DOS today but in reality I won't be getting much done if I do. Addressing the privacy issue we've at least got confidential VMs now. However at that point we've just pushed all the issues down a level and the same drama plays out again with the hardware vendor.
  - charcircuit 2y ago
    >For stuff like 3D graphics you will likely need a second GPU to pass through to the guest if you want reasonable performance. No, a single GPU can support virtualization and be shared among multiple visitors. >the inability to perform a proper backup on a "secure" android system. This is by design as a "proper" backup violates Android's security model. Instead a backup system that respects Android's security model was built. Autonomy is given up but in exchange the high level functionality remains the same and there is better security. >By privacy I refer to the fact that the vendor can see everything you do even in the VM. What does this even mean? There is no fundamental reason for spyware to exist and even if there was that is independent to using virtualization. >User freedom is only an issue when you can't boot an "insecure" OS on the platform User freedom and security are orthogonal, but due to Turing completeness almost everything will support booting insecure operating systems. >but if nothing will run when you do that the situation isn't much different. If there is no market demand for running applications on insecure platforms then perhaps that's an okay situation to be in.
    - fc417fc802 2y ago
      > No, a single GPU can support virtualization and be shared among multiple visitors. Do you really think I'm unaware of that? Have you tried it lately? Most (nearly all) consumer level hardware doesn't support it and (I might be wrong about this next bit but IIRC) you won't get full performance because most solutions partition the hardware rather than multiplexing it. > This is by design as a "proper" backup violates Android's security model. I'm aware. That doesn't address the problem. > the high level functionality remains the same Absolutely false. Apple at least built a solution that appears to perform as advertised even if I vehemently disagree with the underlying security model and believe that it is actively making society worse off in the long run. Google has failed miserably at that (at least last I checked, which was a few years ago TBF). > and there is better security. By whose definition? The officially sanctioned security model does not provide anything of value to me (from a technical perspective) relative to having full control over my device. > What does this even mean? It means that if someone else has control over the software on my device then outside of a truly unusual end-to-end code auditing arrangement I can never be confident that I'm not being watched. > There is no fundamental reason for spyware to exist What sort of drugs are you on over there? Ad tech is a massive industry. There are all manner of motivations to hoover up user data from market research to selling it to authoritarian tendencies. > User freedom and security are orthogonal Notice the quotes. By "insecure" I mean not provided by BigTech and system state attested by a whitelisted HSM. > due to Turing completeness almost everything will support booting insecure operating systems. Have you tried customizing the OS on a vendor bootloader locked mobile device lately? > If there is no market demand for running applications on insecure platforms then perhaps that's an okay situation to be in. Sophistry. It's user choice due to a combination of lack of awareness and understanding, a preference for convenience even when that's detrimental to society in the long term, and the resultant network effects.
- mschuster91 2y ago
  You're still running untrusted code on the same devices. IOMMUs aren't enough, not since side-channel attacks entered the field, not to mention the consistent availability of IOMMU and Secure Enclave bypasses, or exploits for the GPU to access data from other contexts.