Comment by raxxorrax | Hacker News Reader

Comment by raxxorrax | Hacker News Reader

Parent Full thread

I think development of mobile OS heads into a completely wrong direction. The "curation" effect of proprietary stores is only good for censorship and mobile OS have the most aggressive applications that border on malware. At least you don't have the browser toolbar classical systems were infected with?

For productivity I don't want iron curtains between my applications or between application and system. Hell, it would actually be nice to be able to directly interface the hardware without all the loops.

We have a deeply flawed security model for mobile OS that relies on dogma that won't lead to additional safety. As safety issue is data exfiltration and by that standard a mobile devices are vastly more dangerous than the average work station. Comes with the nature of the device to a significant degree, but I think mobile OS have ridden of a cliff somewhere.

And now they want to push apps into a VM? Why not just buy a device per app at this point...

Anybody making money off of phone apps should not be trusted, they can and still take every piece of data they can to figure out how to monetize it. I want and need phone app security to protect me from the companies that want me as a product to be sold.

I think where they are going with that is that this sounds suspiciously like a “people problem” and not a technical one though it is attempting to solve it via technology. For some reason desktops let software do whatever and they don’t seem to have near as much an issue as mobile OSes.

IMHO, it’s the fact that there’s a (basically, by default) a single market driven by (basically, by default) a single search engine to locate software. The desktop market, is largely NOT driven by a single market or search engine. With the “single market” if a malicious actor can game the search engine for even a day, they can install on (potentially) millions of devices. However, with the ‘ole distribution model, it’s much harder to game.

There's reasons to be suspicious but it's also important to remember that mobile phones see much deeper penetration. About 84% of the world's population has a smartphone. Annually, ~1.6 billion phones are shipped vs 275 million PCs.

With scale comes new challenges and attack vectors.

> Annually, ~1.6 billion phones are shipped vs 275 million PCs.

This is most likely because people do not have to buy a PC every 3 years. Phones are treated as disposable items, whereas with a desktop, you can open it, clean it, change parts etc. I can even change the CPU in my laptop if I wanted to.

That’s one theory but one that doesn’t hold up by virtue of the fact that 83% of all humanity has a phone. The penetration for laptops/desktops never reached that high.

We can assume both as having reached steady state and that’s mostly replacement rate (not quite but almost).

Cell phones are more popular for obvious reasons: full access to internet at all times, TCO is drastically smaller across the board (upfront cheaper, cheaper internet, etc), and entire structures are built around them (many critical services go app first if not even app only).

I think you’re applying a very western bias in your analysis.

Most people also don't buy a smartphone every three years, they use them until they either die, or get stolen.

Both of which happen much more often than with laptops, at least in part because they are treated as being more disposable, but maybe more directly because they are smaller.

> For some reason desktops let software do whatever and they don’t seem to have near as much an issue as mobile OSes.

I think this may be a case of rose-colored glasses. How many PCs were and are a complete mess because Windows both is a free-for-all and is (or was) the largest attack target? Sure, we know how to keep our desktop systems sane, but most people don't.

Then you also need to look at the average persons phone. If you activate any network connection, it supplies the contents of your latest stool sample and sends it to 5 unclosed apps at least. The data exfiltration is not comparable and exposure of personal information also extends to contacts this person has in their phone. It is a much more hostile environment and not really clean at all.

Which is why the desktop market has tons of garbage anti-virus and PC cleaning software, trying to fix the cowboy land it turned into.

This sounds awfully similar to Microsoft anti open source textbook that no one can be trusted besides them, you always need their platform and services between. The only difference is that now people are shilling Apples fake corpo security propaganda talking points and sadly they are often developers themselves.

I've definitely been surprised by the sentiment here lately that iOS devices are more secure. I don't know enough about iOS to evaluate that claim, but my impression of phone security is to basically assume it's been unlocked by someone even if most apps are successful sandboxed

Google sells advertisements, Apple sells... access to its store involving a hefty 30% tax.

Goggle's interests are aligned with the surveillance capitalists, Apple is either competitive (see Facebook) or ambivalent.

Apple can differentiate itself by trying to sell the security angle and hurting the surveillance of people in their app ecosystem doesn't hurt them. Comparatively, I would say Apple has a nontrivial advantage in security, though I wouldn't make a broad statement that iOS is "secure".

This has nothing to do with apps. It's instead about things like the biometrics or DRM handling code. The stuff that regularly runs on its own dedicated CPU or in specialized sandboxes like ARM's TrustZone. This is about moving that to instead be in a VM on the "primary" CPU, implemented in open source Linux kernel code instead of who-knows-what ARM microcode.

Or to compare against an ecosystem that has more love around here, imagine if everything that Apple runs on the T2 was instead run in a VM with an equivalent level of security. That's the goal.

Walled gardens have many problems, but one of the reason they exist is that they offer some security benefits. Virtualization allows for stronger containment of apps and make walled gardens less necessary.

Reply on news.ycombinator.com