4 ms·

Its a lost battle not a lost war. You have to adapt for the circumstances of the time. Today that seems to be using a device that is closed but gapped only to g

Its a lost battle not a lost war. You have to adapt for the circumstances of the time. Today that seems to be using a device that is closed but gapped only to get the essentials done(government services, banking etc.) For everything else continue to use and improve the open offerings. In the meantime, keep fighting and supporting organizations to get laws pushed to ensure open devices can access essential services. (Administrations change, whats dire now may be hope tomorrow). I've come to realize that a lot of closed digital services are just fluff and not needed. So I try to accept that I dont need them. Its a journey.

Gigachad 1y ago
Multiple devices is the answer. Otherwise you end up with people having their banking hacked because they installed a game mod.
- Zak 1y ago
  This leads to a massive transfer of power from end users to corporations and governments. User-owned computers and the open web limit the ability of such institutions to place demands on users. Is that worth a slight reduction in the rate of bank fraud?
  - b_e_n_t_o_n 1y ago
    Depends if you ask someone who gets defrauded of their life savings and work and is financially ruined I suppose.
    - Zak 1y ago
      Most of the time, it's the bank that's on the hook for fraud, which is why they're motivated not to trust that the user's device is sufficiently secure.
      - Gigachad 1y ago
        There’s no world where the bank is on the hook for fraud while also not being allowed to prevent it. Personally I’m ok with the bank being on the hook and their app checking there isn’t malware loaded on the OS. I have my raspberry pi and steam deck for full modding without intermingling it with extremely sensitive computing.
        deleted 1y ago
        [deleted]
        antisol 1y ago
        lolwut define "malware".
        beeflet 1y ago
        I'm not okay with owning a cuck device where the bank manages my OS. So we have a problem.
        b_e_n_t_o_n 1y ago
        We? or you :P
        lan321 1y ago
        Is this not a solved problem? I used to have a TAN generator for my bank as a separate device I paid like 5 euros for. If you get provided an authenticator and get forced to use it for transfers essentially even if my device is compromised it doesn't matter unless their device also gets compromised. They are then free to lock it as much as they want.
        Gigachad 1y ago
        If it’s just one of those 2FA code generators, that still won’t help if your phone has malware on it. The malware can just modify the transfer as you are making it and have typed in the code. Users would also lose them far more than they lose their phones.
  - eecc 1y ago
    Careful, recently someone made a similar argument around gun-laws in the US, and it didn't go well for him... /s
- Viliam1234 1y ago
  I am not an expert, but I think this could be improved if the smartphone operating systems had better security models. For example, an application needs "access to your disk storage", because it needs e.g. to save photos. Okay, let's give it access to its own directory. Or maybe to a subdirectory of "my pictures". But it doesn't need the access to the entire disk, right? Yet in Android, it is all or nothing. Perhaps with better system, we wouldn't have to ban installing game mods, only to make sure that those game mods do not have unreasonable access rights. Or maybe the banking operation could state "I can only be installed when no other app has an access to my private data" or something like that.
  - albuic 1y ago
    Most people do not understand any of the authorizations they give to apps and don't want to have to understand it. They will be interested in it only after they got burned. They just want a thing that "works and do x, y and z" without having to worry about it. I think the problem is that big corp got them used to easy security because nobody cared before but now that security is getting harder, big corp has no choice but to gave a sense of security they promised but cannot give anymore.
amlib 1y ago
This may sound silly but I think desktop linux "winning" is of the utmost importance right now. Free software is pretty much shut off from the appliance/mobile computing platforms but if a sizable portion of personal computers remain using free software it will be hard for the big corporations to fully close the web or make platform attestation truly required for everything. Preserving such mindshare into the future might enable us to show people why they should care about free software and perhaps finally obviate how much malfeasance the perpetrators of closed platforms can do contrasted to the remaining open platforms on pcs (assuming people don't just completely abandon pcs...). This may also help push and convince law makers into legislating in favor of free software and open platforms.
- matheusmoreira 1y ago
  Agreed. It's all about leverage. Without huge numbers of users, we have no leverage. Corporations can afford to just drop us because of our software preferences. That would not be the case if there were more of us.
- deleted 1y ago
  [deleted]
- baq 1y ago
  Desktop is still useful, but it doesn’t matter. Everything important to non-techies outside of work life is happening on the smartphone, which has had hardware attestation since forever.
  - gsf_emergency_4 1y ago
    Those are vital points! Mobile is the battleground. No company now or ever working on classical hardware attestation will understand cryptographic engineering at a basic level.. Thus FOSS has plenty of time (decades to centuries) to learn from for-profit tech's mistakes
    - Imustaskforhelp 1y ago
      Mobile is the battleground but you are forgetting how damn easy it is on android (atleast right now before google's attestation) it is to install f-droid and then install open source. People don't even do that. They don't even search for software on f-droid first and try the UI. Nope they go to play store and search software which is going to advocate for closed software because ads/review buying... You really have to expect something from the general populus as well imo. Maybe they don't know about f-droid but people say to me its not about knowledge but rather caring, they don't care and I don't know wtf to say to that. It's a very weird chicken and egg problem.

Gigachad 1y ago

Multiple devices is the answer. Otherwise you end up with people having their banking hacked because they installed a game mod.

Zak 1y ago
This leads to a massive transfer of power from end users to corporations and governments. User-owned computers and the open web limit the ability of such institutions to place demands on users. Is that worth a slight reduction in the rate of bank fraud?
- b_e_n_t_o_n 1y ago
  Depends if you ask someone who gets defrauded of their life savings and work and is financially ruined I suppose.
  - Zak 1y ago
    Most of the time, it's the bank that's on the hook for fraud, which is why they're motivated not to trust that the user's device is sufficiently secure.
    - Gigachad 1y ago
      There’s no world where the bank is on the hook for fraud while also not being allowed to prevent it. Personally I’m ok with the bank being on the hook and their app checking there isn’t malware loaded on the OS. I have my raspberry pi and steam deck for full modding without intermingling it with extremely sensitive computing.
      - deleted 1y ago
        [deleted]
      - antisol 1y ago
        lolwut define "malware".
      - beeflet 1y ago
        I'm not okay with owning a cuck device where the bank manages my OS. So we have a problem.
        b_e_n_t_o_n 1y ago
        We? or you :P
      - lan321 1y ago
        Is this not a solved problem? I used to have a TAN generator for my bank as a separate device I paid like 5 euros for. If you get provided an authenticator and get forced to use it for transfers essentially even if my device is compromised it doesn't matter unless their device also gets compromised. They are then free to lock it as much as they want.
        Gigachad 1y ago
        If it’s just one of those 2FA code generators, that still won’t help if your phone has malware on it. The malware can just modify the transfer as you are making it and have typed in the code. Users would also lose them far more than they lose their phones.
- eecc 1y ago
  Careful, recently someone made a similar argument around gun-laws in the US, and it didn't go well for him... /s
Viliam1234 1y ago
I am not an expert, but I think this could be improved if the smartphone operating systems had better security models. For example, an application needs "access to your disk storage", because it needs e.g. to save photos. Okay, let's give it access to its own directory. Or maybe to a subdirectory of "my pictures". But it doesn't need the access to the entire disk, right? Yet in Android, it is all or nothing. Perhaps with better system, we wouldn't have to ban installing game mods, only to make sure that those game mods do not have unreasonable access rights. Or maybe the banking operation could state "I can only be installed when no other app has an access to my private data" or something like that.
- albuic 1y ago
  Most people do not understand any of the authorizations they give to apps and don't want to have to understand it. They will be interested in it only after they got burned. They just want a thing that "works and do x, y and z" without having to worry about it. I think the problem is that big corp got them used to easy security because nobody cared before but now that security is getting harder, big corp has no choice but to gave a sense of security they promised but cannot give anymore.

amlib 1y ago

This may sound silly but I think desktop linux "winning" is of the utmost importance right now. Free software is pretty much shut off from the appliance/mobile computing platforms but if a sizable portion of personal computers remain using free software it will be hard for the big corporations to fully close the web or make platform attestation truly required for everything. Preserving such mindshare into the future might enable us to show people why they should care about free software and perhaps finally obviate how much malfeasance the perpetrators of closed platforms can do contrasted to the remaining open platforms on pcs (assuming people don't just completely abandon pcs...). This may also help push and convince law makers into legislating in favor of free software and open platforms.

matheusmoreira 1y ago
Agreed. It's all about leverage. Without huge numbers of users, we have no leverage. Corporations can afford to just drop us because of our software preferences. That would not be the case if there were more of us.
deleted 1y ago
[deleted]
baq 1y ago
Desktop is still useful, but it doesn’t matter. Everything important to non-techies outside of work life is happening on the smartphone, which has had hardware attestation since forever.
- gsf_emergency_4 1y ago
  Those are vital points! Mobile is the battleground. No company now or ever working on classical hardware attestation will understand cryptographic engineering at a basic level.. Thus FOSS has plenty of time (decades to centuries) to learn from for-profit tech's mistakes
  - Imustaskforhelp 1y ago
    Mobile is the battleground but you are forgetting how damn easy it is on android (atleast right now before google's attestation) it is to install f-droid and then install open source. People don't even do that. They don't even search for software on f-droid first and try the UI. Nope they go to play store and search software which is going to advocate for closed software because ads/review buying... You really have to expect something from the general populus as well imo. Maybe they don't know about f-droid but people say to me its not about knowledge but rather caring, they don't care and I don't know wtf to say to that. It's a very weird chicken and egg problem.