6 ms·

The biggest "evil" that has been committed (and is still being committed) against computing has been normalizing this idea of not having root access to a device

• a456463 10mo ago
  And a full on fight against ownership of stuff you paid, right to repair something you own with your own money, and general computing access.
  • qwertox 10mo ago
    Phones are no longer ours. A bit like bought ebooks, games, movies,and the like. we just payfor the right to use them. ok the phones we can keep, so we pay a lot for the hardware, but the OS: not. They like to advertise it as part of the phonev but it' not. The little surveillance machines.
    • xeonmc 10mo ago
      If buying is not owning, pirating is not stealing. Piracy isn’t merely a virtue, but a moral imperative, an obligation to uphold civic freedom. It is immoral not to pirate. It is everyone’s duty to do their part in normalizing and encouraging piracy.
      • Sophira 10mo ago
        Pirate... what? A phone? Android? Banking apps? The problem here isn't the money, it's the lack of privacy and control. The best analog I can think of to piracy in this situation would be rooting the phone/installing GrapheneOS. And, yeah, that's definitely something people should do if they want that control, but I really hope people don't put it in the same category as piracy...
        • xeonmc 10mo ago
          This may be a debatable definition, but I think of piracy somewhat as a broad term for anything that can be categorized as counter-anticircumvention. See also this article from Cory Doctorow: https://pluralistic.net/2026/01/01/39c3/ https://pluralistic.net/2026/01/01/39c3/
        • themafia 10mo ago
          What makes a phone a viable consumer device is the baseband controller. The majority of that complexity lies in the software on the controller and not in the hardware the implements it. How many companies even produce these controllers?
        • deleted 10mo ago
          [deleted]
      • somat 10mo ago
        Pirating, I mean actual pirating, is absolutely stealing, But that weak ass crime, that we like to call pirating in order to appear cool, No, that is not theft at all.
• deleted 10mo ago
  [deleted]
• sneak 10mo ago
  It’s not an evil at all. For 99% of people who aren’t “computer people”, when we gave them that, we got the Bonzai Buddy and 47 other malware toolbars installed. Did we forget 2003 already? App sandboxing and system file integrity is one of the most beneficial security features of modern computing, and the vast majority of people have no desire to turn it off. You can buy rootable phones. People overwhelmingly choose iPhones instead. Even if Apple sold the SRD at scale, nobody would buy the weird insecure hacker iPhone except us and maybe kids who realllly want Fortnite.
  • LoganDark 10mo ago
    The problem is mostly that normal people can't be trusted with system-level access but some people can. And it's literally, provably not possible to tell them apart. For the masses, lack of system-level access is a benefit because they won't be able to ruin their device. For hackers and hobbyists, lack of system-level access is a hindrance because they won't be able to control their device.
    • hephaes7us 10mo ago
      In other areas of life, people self-select at their own risk. You can diagnose medical issues yourself, buy power tools you don't know how to use safely, and invest in assets that you don't understand. All other things being equal, we should try to protect people. But we shouldn't force everyone to make the choices that are best for the people with the least comprehension of what they're doing.
      • GabrielHawk 10mo ago
        Have you ever seen government officials talk about tech? I think you'd have to be naive to buy the narrative that they're making such a large policy decision for our security. Of the few people using rooted phones to begin with, there's even fewer that don't know what they're doing. Much more likely is this is a decision to get in line with the well documented and rapidly spreading surveillance laws of the past few years. > But we shouldn't force everyone to make the choices that are best for the people with the least comprehension of what they're doing. You are acting like it's easy to accidentally root your phone
• schmuckonwheels 10mo ago
  Screaming into the void about how your device is so great it could be used for attestation, combined with a small but vocal security industry full of grifting chicken littles, virtually guaranteed this would happen. The real irony here is the use of free software to tear down everything the free software movement stood for.
• graemep 10mo ago
  It is also interesting that yet another government is prepared to increase its reliance on American big tech. I do not know whether Vietnam has any pretence of digital sovereignty, but many countries that do are doing this like this to actively move away from it.
  • chrneu 10mo ago
    isnt europe basically going through this trying to decouple itself from AWS and Azure and other american tech?
    • graemep 10mo ago
      Where in Europe? Some countries are making some efforts to get away from cloud providers like those but all I know of are increasing dependency on Apple and Android.
  • tinfoilhatter 10mo ago
    Lots of American big tech is actually developed in Israel - like Microsoft Azure's cloud services. Israel also has a history of getting caught selling American technical secrets to countries like China. Almost every major VPN is owned and operated by an Israeli company.
• ploxiln 10mo ago
  I think, practically, everyone will need at least a cheap-ish android or iphone, perhaps $300 (and a new one every few years ...), to be their locked-down "agent" for using financial or government services. It's not for you, it's for the government/banks, it is their agent for talking to you. Kinda weird, if you think about it. But that seems to be the way it's heading.
  • thisislife2 10mo ago
    Or ... just don't install the apps and use the browser to do your banking.
    • malux85 10mo ago
      Assuming the browser has feature parity. I was visiting my parents over Xmas and my dad couldn’t make a payment because the number of saved payees was capped to 100. There was literally no option to delete a payee in the website, the only way we found was to install the app, authenticate, and do it in there. It’s happening already.
      • thewebguyd 10mo ago
        I hate that this is happening. I absolutely detest doing any kind of task other than pure content consumption and basic messaging from a smart phone. Anything remotely more advanced than that, please let me use my computer and an app or website with, you know, an interface designed for more advanced operations. Trying to do anything on a smartphone/touchscreen only device is nothing but an effort in pure frustration for me.
    • riedel 10mo ago
      Does not work anymore for many banks in Germany. I have 2 accounts that require me to have different second factor apps installed. For one bank I would have to open a separate account with a debit card to use hw tan generator. For the other AI would have to switch bank account after the regulators banned SMS and indexed paper TANs.
    • 10mo ago
• pc86 10mo ago
  The idea that the government should have the right or ability to do this in the first place is actually insane. Ideally the government doesn't want to do this in the first place, but even if it does it shouldn't have the technical ability to.
• altairprime 10mo ago
  Root access is irrelevant; modification detection is relevant. If your OS was sealed-attested, root wouldn’t matter (Macs have this in shipping production by default and it works fine for everyday users). For modding, go for it; your modded OS will be signed by your own crypto key (or none at all). Unfortunately, the media and the businesses and quite a lot of expert users confuse root-access-enabled as a convenient modification-detection method (presumably Google’s core is more competent than that, has anyone studied it?). Sigh.
  • TeMPOraL 10mo ago
    Put like this, root access is indeed irrelevant. The ability to modify is what we want, i.e. what freedom of general-purpose computation is. The very thing banks and other businesses take away from us.
    • altairprime 10mo ago
      That's not exactly correct, at least in the U.S. Banks don't take away the right to modify, banks discriminate against modification. Businesses, in general, have the right to refuse service to anyone for any reason except when their refusals either explicitly, or implicitly by pattern of behavior, derive from one or more characteristics that are protected from discrimination under law. The characteristic of having rooted, and/or having modified, a device is not currently protected from discrimination, and so businesses — who are self-serving to the extreme and minmaxing risk vs. profit just like any good video game player would — are within their legal rights to discriminate against users who modify their mobile phones. You can see a similar pattern taking effect in the car modification industry; California requires tens of thousands of dollars to assess whether a car modification is "legal" to sell there, due to the intersections of gas vehicle smog laws and the tendency of vehicle owners who modify their vehicle to be likely to, just as businesses do above, selfishly minmax lower-emissions vs. higher-performance behaviors in the car's components and programming. As there exists no categorical protection against undue discrimination for "those who modify their property", one such as myself who modifies their vehicle without intent to reduce or defeat low-emissions behaviors has no recourse to claim that the state's $20,000 test fee is discriminatory against personal use by individuals. I support the societal-level necessity of enforcement in this area, but that doesn't excuse charging $20,000 to a for-profit business and then $20,000 to a personal-use resident. So, the true solution, in a U.S. constitutional context anyways, is to amend the protected categories under the Bill of Rights to include "individuals who modify their own possessions" as a category that is protected from undue discrimination. It's a simple enough change from a written perspective. Perhaps California or the E.U. will enact it first? Note, however, that undue does not mean always. Digital ID checks should be restricted to devices booted into sealed-attested mode for the same reason that notarization apps should — faked/stolen digital IDs carry severe and broad-spectrum risks to an entire society of individuals — but banks simply trying to decrease their fraud reimbursement expenses have insufficient cause to discriminate against account holders accessing their accounts. I would absolutely accepted "not permitted to initiate outbound transfers in excess of $10,000" as a compromise. It becomes more unclear when you consider e.g. Apple Pay, and Apple Music. Both currently deny service to those whose macOS is not sealed and attested. One could make a very convincing case that digital wallets are a case where the benefits of sealed attestations are a necessary case of discrimination against those who modify their devices; financial fraud is a nightmare for both users and banks, after all! But there is no convincing case that being able to listen to music albums with a modified device is somehow a threat both to users and to the music industry, and so Apple would find their demand for sealed+attested to be illegal discrimination by Apple Music. I suspect the outcome here is that we see devices that offer a sealed-attested 'wallet' mode, activated by a hardware switch function of some fashion, that temporarily seizes control of the device in order to create a protected environment — with some sort of indicator that can't be falsified by any other software on the device, i.e. the camera green / mic orange LED — so that users can interact with attestation-critical services like ID checks, NFC payment, and MFA requests without having to reboot their device from modified mode. Those who want to install their own attested environment can do so, with the understanding that a great deal of legwork remains to not only earn the world's trust that third-party environments can be secured, but also that both government and corporate environments detest having to decide who to trust themselves and will do their very best to either reject all parties other than a single corporation (E.U. age checks, I'm looking at you!) or will create arcane bullshit obstacles that make it difficult to DIY a secure wallet. Some of that difficulty is completely appropriate for exactly the reasons that secure attestations are appropriate in specific, narrow cases only (same reason I appreciate paper currency having physical anti-counterfeiting technology, but not the stupid constellation): counterfeiting predates humanity, sealed-attestation environments are an excellent defense against entire categories of attacks, and a reasonable level of bureaucratic slowdown is an excellent defense against opportunistic hit-and-run fraud.
• kome 10mo ago
  we should save the idea of general computing. fuck cell phones.
  • callc 10mo ago
    Cell phones are fine. It’s their locked-down non-open nature and Apple, Google, Samsung that make cell phones not general computing devices. I really hope we can convince enough people to care about general computing.
• xorcist 10mo ago
  > The biggest "evil" No need for the scare quotes. Forcefully removing people's agency over themselves is pretty much the definition of evil. We do not hurt criminals as punishment anymore, in the civilized age, but we still lock them up. Now, of course we should not equate physical prisons and digital prisons in any other way, but we should absolutely call both forms of imprisonment evil, plain and simple.
  • jffhn 10mo ago
    >We do not hurt criminals as punishment anymore, in the civilized age Singapore is quite civilized, and they conduct caning strokes.
    • AlexeyBelov 10mo ago
      No, not civilized, precisely because of this (and other things).
• amelius 10mo ago
  Well it has always been the case with the mobile telephony IC. Way too dangerous to leave it open to hackers.
  • stavros 10mo ago
    What are the dangers that can't be dealt with server-side?
    • rerdavies 10mo ago
      Viruses injecting code into the process of the app that you use to do online banking. obvsly. Or the app you use to do second-factor authentication. You can protect against that by requiring the app to have a valid signature. You cannot guarantee that the signature is valid unless you can guarantee that the kernel has not been modified. You cannot guarantee that the kernel has not been modified if the phone has been rooted. For what it's worth, my banking app for my Canadian bank (and the app which does second-factor authentication for web transactions when doing web-based online banking) will not run on a rooted phone. For good reason, I think. My bank used to use SMS for second-factor authentication, but no longer does so. For good reason. When I do online banking from my desktop, I still have to use the second-factor authentication login on my phone. Or sim-less tablet, interestingly. Whatever the mechanism, is, it is not SMS based.
      • stavros 10mo ago
        That's not the mobile telephony IC. That's just the phone's CPU.
    • amelius 10mo ago
      The main danger is a virus that infects everybody's phones and then takes control of the telephony modem, e.g. like a DDOS attack. That's why you can't have root access to the modem even though you technically own it.
• Roark66 10mo ago
  Exactly. Also the smaller stupidity - inability to add your own root certificates to the system store. In fact this is what led me to unlocking the bootloader, swapping the OS and rooting my phone. The infuriating situation where if you setup so called "corporate owner" (or mdm) during the first login you can add your own certificates, but if you don't... Basically the "corporate owner" of your phone is Google. Yes, literally, you do not own it. Also it is worth noting certain countries where "rooting/bootloader unlocking is illegal" - namely China and the horrible stupidity of people claiming EU Gdpr prevents manufacturers from offering simple bootloader unlocks for their phones. We absolutely need to vote with our walkers. I bought a Samsung before and a Xiaomi recently only because both allow relatively simple unlock (ok the Xiaomi requires you to wait to press "request unlock" exactly at midnight Beijing time", and it only works for non-Chinese phones, but still unlocks fine.
• jmyeet 10mo ago
  [flagged]
  • Paracompact 10mo ago
    So, let root access be opt-in rather than opt-out.
    • jmyeet 10mo ago
      Have you ever listened to any scammers operate? People are, for lack of a better word, stupid. They're far too trusting. Anything from Nigerian prince scams to buying Walmart gift cards and giving some random person the number to whatever. You might say "ah but this is social engineering" and that's true but so is "Hi, this is Brian from tech Support. We need you to change these settings and to install this app on your phone". Let me put it another way: how do you feel about backdoors into crypto? Just the existence of a backdoor creates an attack vector regardless of whether the designated users misuse use it or not. Just the ability to "opt in" to root access for almost everyone creates way more problems than it solves. And this is the key point: what benefit does it give users? Because nobody can really answer that other than some hand-waving about "freedom".
  • VortexLain 10mo ago
    If it's mandated that banking apps must not run in a user-controlled environment for the sake of security, users should have the right to refuse such "protection" by signing a piece of paperwork at the banks office.
  • barnabee 10mo ago
    There's a difference between many people preferring not to have control over the device they own and it being illegal to have such control. Yes, absolutely, most people would be better off not having that control and most of those people are also fine with not having it. But everyone, for better or worse, has the right to demand that control if they want it.
    • jmyeet 10mo ago
• resumenext 10mo ago
  A bigger evil than banking apps themselves? Commerce ruined computing.
• roncesvalles 10mo ago
  I would guess it's because people blamed the device/OS manufacturer for when their device got infected with malware (which is almost always due to user error). Through the 00s, Apple practically built their reputation on being "virus-free" which really just meant they locked out the user from being able to do anything too extreme.
  • lokar 10mo ago
    Aiui, scammers were talking victims through rooting and getting them to install malware.
• tempodox 10mo ago
  This has nothing to do with security and everything with control. In whose interest is it that users have no control over what “their” hardware does or doesn’t do? Those OSs are not a product of Vietnam, they belong to, and are controlled by, Apple and Google. Now all Trump has to do is tell them to make all mobile phones in country X stop working, and they will do it. Now the U.S. government can brick a whole country with the flip of a switch. Cory Doctorow lays it all out in his speech about the Post-American Internet: https://pluralistic.net/2026/01/01/39c3/#the-new-coalition https://pluralistic.net/2026/01/01/39c3/#the-new-coalition
• realusername 10mo ago
  I think in the future I will keep two phones, a secure phone for my data, communication and everything and an insecure old phone for banking and government apps.
• abustamam 10mo ago
  I grew up in the 90s during a time where the only way to get software was from the local computer store. Pop the disk into your computer and you're running the software, warts and all. Now that physical media is all but gone, computer manufacturers (both personal computers and phones) found it behooved them to essentially control the market with regards to what can get installed on your computer. Oh, and conveniently, they charge a fee for developers to use this "service," and take a percentage of what the developer earns by selling software on their "service." And somehow in the late 2000s early 2010s, it just became normalized, and somehow the term for being able to install software on a device you supposedly own became a scary term, "jailbreak." Granted, jailbreaking was often used for piracy, but the fact that there needed to be a process at all confounds me. My mom has an iPhone and she manages to install a bunch of weird things on her phone, like anti-virus software that almost certainly don't scan for viruses, but are all too happy to take your money to make your phone more secure. These are things that the App Store "service" should have guarded against if they were indeed doing their jobs and protecting consumers from bad software. And, I wouldn't be surprised if she'd be locked out of her banking app eventually because [insert entity here] deems her phone too old to update her banking app. She's "following the rules" and still getting screwed over.