zlacker

[parent] [thread] 10 comments
1. nptelj+(OP)[view] [source] 2022-07-26 08:34:01
Yep! Basically, it's safer if you don't own your PC. Think about users with a million toolbars and Bonzi Buddy installed.

Of course, the system for it is rudimentary, and puts a disproportionate amount of control in the hands of providers. And that works very well for them too.

replies(2): >>adev_+2n >>userbi+vA
2. adev_+2n[view] [source] 2022-07-26 12:11:23
>>nptelj+(OP)
> Yep! Basically, it's safer if you don't own your PC. Think about users with a million toolbars and Bonzi Buddy installed.

And it is a pretty terrible solution to the problem.

- It is also keeping the good guys outside too: Anyone that want to analyse and understand the security of the system for good reasons cannot. Excepted if explicitly allowed by the corporation X and that is a terrible security property.

- No root access also means very little control or ability to scan the system itself if your are not the X corporation controlling it. That means no possibility to mandate reviewer corporation Y to check that corporation X is doing the right thing. TPMs currently make that even worst by design, they are undocumented and complex, therefore rely on blind trust that company X do the rthe ight thing. And since the Intel management engine fiasco, we do know they are not doing the right thing.

- Bonzi Buddy and toolbar type of problem can be easily avoided by separating properly the normal user account from any admin account(the unix way). It should be painful to be admin but not impossible, just to make sure your grandma do not install a rootkit by mistake when she want her 20% coupon.

In summary: That is mainly bullshit from company X to keep full control on the entire user device, and not for their own good.

replies(1): >>nptelj+Px
◧◩
3. nptelj+Px[view] [source] [discussion] 2022-07-26 13:19:50
>>adev_+2n
I agree. In a proposal like this, security is basically a byproduct, and sometimes not even that[0]. This is also a domain where the governmental and corporate powers have a similar goal, which is wresting away the control from the public / individual. They basically work in synergy, only to a point of course, but still.

Regarding Bonzi Buddy, I disagree. I think user data is as important, if not more important, than root access - which is why I'm dumbfounded when ancient server security features, like Linux's sudo system, are applied to the consumer device like a PC or a smartphone. These contexts are much better server by a sandboxing, permission-based whatever that seems to pick up steam, like the current permission systems on smartphones. Grandma's logins and bank data will be stolen from her own user account just the same as an admin account. Related XKCD[1]

[0] https://en.wikipedia.org/wiki/Security_theater

[0] https://xkcd.com/1200/

replies(1): >>iggldi+2Z
4. userbi+vA[view] [source] 2022-07-26 13:31:33
>>nptelj+(OP)
Think about users with a million toolbars and Bonzi Buddy installed.

I say let them be. As long as they also have the freedom to remove or not install such software, it's a good thing. Instead we have locked-down devices with the functional equivalent of such unwanted software, protected so that you cannot remove it without somehow getting root.

"Those who give up freedom for security deserve neither."

replies(1): >>lotsof+hE
◧◩
5. lotsof+hE[view] [source] [discussion] 2022-07-26 13:52:48
>>userbi+vA
My parents grew up in a non English speaking developing country, and they cannot be reasonably expected to learn the nuances of malware laden links to figure out which English text link is good or bad.

Do they deserve to not be able to shop online without fear of having their payment information stolen? Or mistyping a URL in their non native language and ending up at a scam website that installs malware? Or simply having a device that comes to a crawl such that they cannot reliably video call their grandkids?

replies(2): >>nptelj+hG >>agileA+OU
◧◩◪
6. nptelj+hG[view] [source] [discussion] 2022-07-26 14:01:57
>>lotsof+hE
I don't mind the lock, but why don't we have the key? There's no reason to centally hold these hostage.
◧◩◪
7. agileA+OU[view] [source] [discussion] 2022-07-26 15:00:59
>>lotsof+hE
The problem you are describing will be irrelevant in a generation or two, as kids grow up on the internet.
replies(1): >>corrra+w01
◧◩◪
8. iggldi+2Z[view] [source] [discussion] 2022-07-26 15:18:14
>>nptelj+Px
> like the current permission systems on smartphones

Ugh, except that one goes overboard in the completely opposite direction, and often doesn't let me properly share data between apps even when I want to.

◧◩◪◨
9. corrra+w01[view] [source] [discussion] 2022-07-26 15:26:11
>>agileA+OU
I can assure you that the upcoming generations aren't much better at any of this, on average.

And no, it's not smartphones' faults. Most people just don't "get" desktop OS paradigms, or how web pages work, or any of that, and they don't really care to.

replies(2): >>userbi+PR2 >>agileA+k84
◧◩◪◨⬒
10. userbi+PR2[view] [source] [discussion] 2022-07-27 04:17:10
>>corrra+w01
Most people just don't "get" desktop OS paradigms, or how web pages work, or any of that, and they don't really care to.

That's because they "won't miss freedom they never had".

◧◩◪◨⬒
11. agileA+k84[view] [source] [discussion] 2022-07-27 15:29:59
>>corrra+w01
Nah dude. Most young people nowadays have an inbuilt sense of which links are sus; it's not exactly rocket science. If it looks sus, it is.
[go to top]