Comment by barnabee | Hacker News Reader

Comment by barnabee | Hacker News Reader

Most people don't want or need root access to their smartphone but will complain (no matter how much you tell them security is their responsibility when acting as root) when installing random software they found on the internet results in their banking details being stolen followed swiftly by all their money.

There are products you can buy in pretty much every category if you need a general purpose computing device, but most people are better off with a locked down device that reduces significantly the amount of harm they can inadvertently expose themselves too.

(As an aside, I use an iPhone and can perform - with varying degrees of hassle imposed by iOS' restrictions - many of my day to day "creation" activities, with the bigger annoyance coming from small screen size than the locked down nature of the device. In some cases, in fact, the tools available for mobile OSes are far better than those on the desktop/web due to the incentive created by app store ecosystems.)

I always find fantastic how these kinds of arguments can be made blatantly ignoring that they basically are a plea for authoritarian governments.

Do you realize how bad basic freedoms are? Most people are better off without them, because many would harm themselves. And can you imagine the gains if instead of letting people speak for themselves, we has a single entity vetting everyone's discourse? Man, dictatorship is so great, so efficient.

Vote Trump, get a despot - have Americans live with the consequencies of locked down technology, surveillance.

The difference is that you purposefully opt-in to a smartphone, but can't opt-in (at least, not on an individual basis) to a regime. Would a totalitarian state be as objectionable if people had to chose to move there, and could leave as easily as one can change phones?

There are consistently laws to purposefully remove digital rights for the people (think encryption tools). With this argument, you justify that rights should be taken from everybody for the sake of the majority, and there's no opt-in anymore.

I don't understand your point.

People who are born in such a regime usually don't get a (easy) opt-out but I digress.

My feelings towards AAPL was pretty mixed from day 1 and has changed surprisingly little over the past few years. I genuinely applaud their take on many issues such as strong encryption and the ability to side-load your own apps from source. On the other hand I am very alarmed by the fact that backing up apps from iOS device is no longer possible from iOS9. It might be an improvement for security, version control or whatever, but it made me very reluctant to pick up my iPad again knowing that I have less control of the platform than ever before.

Keep in mind that iOS devices must phone home for activation and repeat the process every three years. It is rather unlikely yet not entirely impossible that one day Apple will cease to provide activaton for older devices and render them useless. In that sense I don't really own my iPad but paid a premium for the priviledge to able to use it, only as long as Apple allows me to. Suffice to say I refuse to be subject to the same tyranny again.

People who are born in such a regime usually don't get a (easy) opt-out but I digress.

That's my point - it's not useful to compare the loss of rights in states to the loss of rights in smartphone platforms, because the latter are easily opted-out.

The point people are making is that if it's the only thing on the shelf it's not easy to opt out.

http://www.ubuntu.com/phone/devices

https://shop.goldelico.com/wiki.php?page=GTA04%20Complete

(soon?) http://neo900.org/

Hope springs eternal!

Hope? I'm fine with my Nexus tablet and feature phone.

The argument is "it's an allowable trade off for a hardware product to be locked down and for consumers to decide whether they still want to buy it given the restrictions" not "all hardware must be locked down and all software approved by corporations/government"- the latter is clearly not OK.

You fail to recognize the political implications of individually opting for locked-down solutions. If many people opt-in for a locked solution, they essentially remove the possibility for others to adopt free solutions -university, businesses, have to be able to communicate with the maximal number of people.

The human brain comes with built-in hardware for dealing with social challenges. It is probably not 100% trustworthy for large-scale society because of the recent appearance of such a structure [1], but it exists.

There is obviously no such built-in hardware support for analyzing software-imposed risks. If such hardware existed, it's not actually the consumer's behavior that would change, it would be the software producers, because the software engineers would feel that bit of their brain poking them and produce much less insecure software in the first place.

So, I don't think the argument translates as well as you say in real life.

[1]: Proof: There exist a large number of people who disagree with $YOU about the optimum nature of government. You are self-evidently correct, of course, and they are wrong. So a lot of people are running on self-evidently faulty hardware for large-scale society.

I fail to see how these scenarios are even remotely analogous. Closed systems are what the consumer has happily chosen for their phones, which they vote for with their dollars. Our system of government is what people have chosen -- and you will note that it is not "open". I can't walk up to the Senate floor and present a bill, nor can you. The system for doing that is closed. If you want to be a part of if, you have to be vetted by the people.

I have yet to have a customer bring me an Android or an iOS device that was ridden with browser toolbars, malware popups, or link re-directors. I probably get 4 or 5 customers a week with this problem in Windows 7, 8, or 10. Any random business or small town cop shop I walk into is guaranteed to have at least half of their computers infected with something or other. People practicing law who are totally oblivious that their search has been hijacked by Conduit or one of its clones. This is because Microsoft is much more open than iOS or typical Android installs. Everything most consumers get on smartphones comes from vetted stores owned by the OS developer. While there have been a few things that have snuck under the radar with both Google and Apple, for the most part if you submitted Conduit to the App Store, I'm pretty sure someone from Apple would drive to your place and punch you right in the face. And this is why people prefer the closed ecosystem. They want to get work done in their field and not hassle with doing work in another field they don't care about, like IT.

Windows gets full of malware because "download executables from the internet and run them" is the expected way to install Windows software, so the process for installing Conduit is no different than the process for installing 7zip or Adblock.

What you're making the argument for is a package manager with vetted packages, not a prohibition on advanced users installing anything outside of the package manager using a different method.

You're equalling basic human rights with the freedom to modify a tool (which the computer is). If you step back a bit you'll recognize that computers aren't the only important thing in your life.

Many people own cars and there's lots of proprietary things about them. Does that mean car owners are living in an authoritarian world? If those people just didn't ride cars they would be so much more free! It's the power to tinker with the cars, not the power to use that makes them free!

Electronics generally contain chips that are proprietary and that we can't change. And we usually can't change the firmware of those devices. Nobody seems to be complaining about that (except firmware in computers because that's supposed to be software again or something). Apparently we don't see how we're living in such an authoritarian world.

Computers and smartphones are also tools. Just like with the stuff before, the most important thing is that they do their job in a good way. Being a toy to tinker around with isn't one of them, at least for me. And that's the only thing your so called freedoms really give you.

What does having an ability to gain root access have to do with installing random malware apps?

You can easily have a device with disabled root access and a curated store as a default and make gaining root access an added functionality (similarly how Android Nexus phones require you to issue a fastboot oem unlock command).

Where does this idea that the only alternative to not having some non-technical people install malware is to forbid root access to EVERYONE else?!

A large number of malware sites will walk you through side loading and bypassing your security to install their app which may be a compromised game or app like a Trojan. Not having this access is the only way to deal with this.

No it isn't. Just like random scammers leading people to give them money doesn't mean everyone should be banned from having a bank account or a credit card.

Some minimal level of responsibility of action from a users side isn't unreasonable. Being locked out from your own hardware because there are a few uneducated users out there is absurd.

Not to mention that now there are actually viruses and exploits out there that install themselves through security holes on users devices and the users can't remove them because they're locked out!

Care to provide some examples of iOS Viruses and exploits that install themselves and are un-removable due to restricted user experience? I have never seen any of those before.

No problem: http://blog.binamuse.com/2014/09/coregraphics-memory-corrupt...

If you got an older iPhone, it's best not to open random PDFs anymore.

neat bug, although only the iPhone 4 and earlier would be unpatchable for it, and those devices are pretty much stuffed from a security standpoint anyway as they're vulnerable to the old DFU mode jailbreaks...

I was kind of thinking more of examples of malware where people were actually using the lockdown of the OS to stop users removing it, but hey I said exploits and that's an exploit.

On the other hand: Have you ever heard of examples of malware which told the use to root their phone?

I think CyanogenMods solution, where root access has to be enabled in the Developer Settings, which have to be enabled by tapping the Android version number 6 times, is the perfect solution: My mum would stop immediately doing such a complicated thing if she wanted to install something.

I'm not sure I've seen one that told users to enable root, but from what I've seen of the android malware scene large parts of it rely on users installing software from non-Google sources and their lack of ability in discerning a good app. from malware. (one example of many http://arstechnica.com/security/2015/11/new-type-of-auto-roo...)

That seems to me to illustrate the point of a locked down environment fairly well...

Ah I see. Let's hope Google is going to move the "install apps from 3rd party sources" switch to the Developer Settings in the future.

Yes, actually. My ex, sister, and nephew all got bit. Wan't American netflix on your phone, do x, y and z. Want to play games free, just follow these simple steps. You're not seeing it because you probably have a good BS detector and google/research first. But they very much exist.

Good to know :) Were these steps to enable installing apks from 3rd party sources or really rooting the phone though?

it's because the demographic you're talking about is vanishingly small, and therefore apple does not care about it. do you notice them hurting for customers?

i installed linux when i was 12. i've been working in this field for nearly 20 years. i'm abnormal, as 'techie' as they come, and i really just don't give a shit about having root access on my iphone. in fact i pretty much use it for a handful of things, primarily messaging, and that's it. i view my phone as a fancy microwave oven.

from a business point of view, you might as well ask amazon for root access on their hypervisors, or network switches. some people give you that. others don't, because they just care about the people who want that.

> it's because the demographic you're talking about is vanishingly small, and therefore apple does not care about it. do you notice them hurting for customers?

How do you know?! There are billions of people out there not using Apple devices, how do you just claim that the demographic is vanishingly small? How did you measure it? Apple doesn't even own half of the market.

Apple would rather be profitable on 10% market share than unprofitable on a 90% market share.

I think it would be hard in practice to allow root access but limit it to people who know what they are doing and understand the risk. People will follow arbitrary instructions to modify settings and enter commands (that they don't understand) for the most trivial things and from the most untrusted groups (for example: to install pirated software, to customise their user interface, etc.), and will merrily click past every warning without reading it.

As a result, there will be more malware if you even make enabling root access an option. It isn't surprising that Apple and others are happy just not catering to that small segment of the market.

> I think it would be hard in practice to allow root access but limit it

This is largely solved, I think, by the current system. People who know/want/understand the risks, can have a rooted phone. But it is not trivial for the average layperson.

I would believe (partially) in the argument of security, if locking down phones was not used for what, in my view, is a clear case of planned obsolescence.

Phones are unique devices in generally requiring you to buy new hardware after 2 or 3 years if you want up-to-date software. This is wasteful and infuriating. My 13 year old PC is still able to run the latest version of Ubuntu, and does a pretty good job at it.

I really really wish Nokia had gone the N900/N9 route. Or now that they somehow acquire Jolla. For us, developers, phones are small computers. There's no difference. Locked down devices are simply restricting our ability to do things. We need something different.

> Phones are unique devices in generally requiring you to buy new hardware after 2 or 3 years if you want up-to-date software.

That's totally software's fault. I find it kinda hilarious that my sister is looking for a new smartphone because her few years old Samsung is laggy while all she does is chatting with friends and watching their pics - things people did on dog slow PCs from the '90s.

I think this is ultimately a consequence of locked down hardware.

If manufacturers released drivers for your sister's device, your sister would be able to install a different operating system which would satisfy her needs.

Good argument, except: On Android, currently, we have 3 completely separate "App with no permissions" to "Full bootloader unlock" exploit chains. (in 5.1)

Malicious people always find a way to abuse your system.

Restricting freedom for security means you will get neither.

Most people probably don't need free speech either, but we don't remove the possibility anyway.

There are also plenty of examples of mobile devices being infected even though the user didn't have root access.

We don't remove the possibility of open hardware either, there are options for partially or completely open smartphones (as a quick web search will attest) but the most popular products sold by Samsung, Apple, et al. are not.

Equally, as for free speech, there are options for completely uncensored speech (although fewer than you think, and even then if you say certain things you'd better hope they can't be traced back to you or have an escape plan) but the most popular ways of communicating (whether online or off) are also locked down to a significant extent.

So it's not actually much different for speech vs. access to devices. Feel free to argue for anarchy if that's what you want, but let's not pretend that smartphones represent a special and particularly nefarious restriction of important freedoms.

This is ridiculous. Name ONE option for a "completely open smartphone". I've spent the last 4 years in search of just ONE open phone and the closest we've come is the Neo900 (stalled, out of money) the Freerunner (production run of 100?), OsmocomBB running on an ancient candybar (illegal), and this hobby project [1] that is more toy than anything viable.

The Nokia n900 was the last "openish" phone to come out and they stopped making those in 2011 when, guess what, they were bought by Microsoft.

[1] http://www.seeed.cc/rephone/

Pyra might be the best chance to get a N900-like device. Not too alike though, as it's not really a smartphone. Sad times.

You probably meant GTA04 phones instead of Openmoko Neo Freerunner - the latter was sold in more than 10 000 devices.

Yes, not counting GTA04, N900 was pretty much the last phone out there that you could call "openish". However, I can tell that Neo900 is not quite done yet and even though with time passing by it obviously gets less exciting than when it was announced, I'm still looking forward to it.

I hope you're right Sebastian :( I've been following the progress, Joerg, you, and everyone else pretty religiously and there's nothing I'd love more than that phone! I miss the n900.

Reply on news.ycombinator.com