Hacker News Reader

Comment by otterley | Hacker News Reader

It’s a useful exercise to visit your infosec teams and see whether they’re carrying an iPhone or an Android phone.

I have interviewed countless infosec workers who have never compiled an operating system from source, or even comfortable installing an OS on their own hardware, let alone any clue how to harden one or how basic Linux syscalls work... these are mostly not people we should be looking to for operating system advice.

As an serial OS architect and infosec worker myself with over two decades of experience in OS hardening, and many critical public finds impacting nearly every fortune 500 company, I do not use Apple or Google products at all. They are both complete shit at security and privacy, among other reasons.

So, what are you using?

I do not carry or use a cell phone at all, and most people are probably better off with a dumb phone or no phone either over the current options, IMO.

I rarely leave home with any electronics at all. Sometimes a portable music player.

My only portable computers are sub 10 inch laptops running QubesOS, but will be replacing that with an OS of my own design soon based on stagex, which I founded.

Any software I absolutely need to -trust- is built with stagex and run in dedicated enclaves, servers, and VMs.

https://stagex.tools

> most people are probably better off with a dumb phone or no phone either over the current options, IMO.

...if you're primarily concerned with security.

Most people are not. They're primarily concerned with convenience, staying connected to people in their lives, and entertaining themselves.

And guess what? The iPhone does a pretty good job at this, while also being very good (not perfect) at security.

In general, if you start thinking of anything in the mode of "most people would be better off doing X the way I do it, but they don't", you need to start thinking about a) in what way they would be better off (because in 99% of cases, it's not going to be "universally, with no tradeoffs"), and b) what differences in understanding and priorities "most people" might have from you that would cause them to make those choices.

> ...if you're primarily concerned with security. Most people are not.

Obviously. Most people also were once not concerned with basic sanitation at hospitals, or with avoiding lead paint, or avoiding giving their kids alcohol to help them sleep.

The evidence these things were really bad came decades before public behavior changes.

Humans are so tribal that most will put fitting in and social norms before objective evidence to the point of killing themselves, and even their kids, so we should never assume the popular choices are the least harmful and well informed ones.

It is an evolutionary advantage that some of us do not weigh social norms so much.

The reason I asked is that knowing which brand used by infosec experts might lend some insight as to which phone has a better reputation for security among experts in the field.

My argument is there actually are very few actual experts in the field because there are very few standards in this industry. Anyone can call themselves an infosec worker and probably even get a job as one if they learned burp suite a few months ago and did a CTF that one time.

But look at people like Bunnie that actually reverse engineer things down to the metal. He made his own mobile device from scratch, from OS to metal, exactly because all existing options are garbage. These are the types people we should be paying attention to IMO.

That’s pretty dismissive and insulting to a wide swath of people who in fact are experts and have decades of professional practice under their belts. I don’t think you get a very good reception if you went to a DefCon or B-Sides and said that aloud.

When I was in DevSecOps all the infosec guys were Android and had a choice to and everyone else was forced into iOS.

Also had the ability to run Linux natively on my work machine, which was nice.

One problem too is theres usually no way to update software on a dumbphone, especially in areas like the baseband.

So what happens when there's a baseband exploit?

Reply on news.ycombinator.com