Hacker News Reader

Comment by mr_overalls | Hacker News Reader

Apple's walled garden has been subjected to criticism from open source advocates. And Windows 10's telemetry triggers a lot of privacy concerns, too.

But in our current security environment, what if these walls become necessary for secure computing? By analogy, there's a reason that many ancient cities were circled by a wall.

View on HN

> By analogy, there's a reason that many ancient cities were circled by a wall.

Walls around cities were likely very poor at stopping small, stealthy groups of infiltrators. They were designed for much more brute force attacks. Apple's walled garden helps quite a bit with the deluge of crap that would be available without it. Without it there would be an order of magnitude more crap (in quantity and quality). That said, there's a vibrant black market for people that can't stand the oppressive policies of Apple.

Additionally, once you have a wall in place, it's easy to make a decision to tax certain types of traffic through it because the capability is now there, whether or not it's in the best economic interest of the people inside. Apple didn't skimp on this area. The wall was erected with tithes and taxation in mind, and collection booths at all the gates.

So, does it help? Well, it prevents roving bands of bandits from riding in, terrorizing and robbing the people unlucky enough to be in their path, and making a hasty exit, so yes, but if you're a tasty enough target, getting past the wall isn't really a problem. There are myriad ways to do that as long as you're careful. For example, the numerous secret tunnels through the wall. They aren't large, and they are constantly being filled in by the city engineers, but there's always some they haven't found if you are willing to ask the right people (or dig your own).

Okay, I believe I've tortured this analogy enough...

I'm not sure that is a good analogy for the wall. Is it a different wall protecting thousands of cities or one of maybe ~10 walls (the main OS's) that is reused? Would it be that hard to build a few good walls? As you said though, there are always alternative ways to be attacked - robbed on the highway (man in the middle?) etc.

The problem with Windows is that it is just a wall made of glass

Devil's advocate, walls and the enablement of taxation also centralized capital and enabled cities to spend it on public works that might not have been built otherwise (and before I get the "then they shouldn't!" retort, I think we can all agree there are shared infrastructure resources that w/couldn't be built by private actors).

In a world where all phones are loosely controlled Android derivates competing on slim profit margins, is anyone going to make the drive for hard hardware-enabled crypto? And even if they wanted to, could they afford it?

> Devil's advocate, walls and the enablement of taxation

Sure. I wasn't making a case that taxation at the wall is bad, but that it has the capability to be bad. We use regulation in (mostly) free markets to greater or lesser success to steer the markets in some manner. If you accept that pure capitalism doesn't necessarily yield an optimally performing system when people are involved, then that ability to influence the market is a useful capability, especially when applied judiciously. A blanket rate isn't necessarily the most efficient form of that, but it is a way to raise revenue.

> In a world where all phones are loosely controlled Android derivates

I think you've already stacked the starting conditions to the point where it's not really worthwhile to consider. That situation would be ripe for disruption in some manner, because I think it's inherently unstable. All it takes is a small niche market for alternatives that do make choices based on privacy, or security, and events that spur interest in those topics, and the larger population of providers will need to respond appropriately or risk ceding a increasingly large portion of the market to those that do.

I think the outcome of the first generation of smartphone OS's has (surprisingly for me at least) shown that there's really only room for a handful of players (Android/AChina, iOS) with sufficient numbers of users to be self-sustaining.

As you note, not sure a unipolar outcome would ever be stable enough to have persisted, but I wouldn't have expected a bipolar arrangement either. And I can imagine a market structure that would have depressed manufacturer profits far enough so as to preclude serious R&D / innovation on their parts.

You know, it's common enough to have one dominant player in a marker, a small few chasing players, and then a bunch of very niche players that I'm there's a lot of economic theory behind it that I'm unaware of. It probably relies quite a bit on how invested in the product you are once you've decided on it, but there are plenty of examples throughout history[1],

1: http://images.dailytech.com/nimage/Smartphone_Market_Share_2...

Let's keep this in mind the next time we get the idea to let market forces regulate, say, school systems or infrastructure.

I suspect your comment will be met harshly here, but I agree for at least a subset of users. If you regularly read HN, you probably can see the clear downsides of the so-called 'walled garden' approach. I can too. Then I have a 10-minute conversation trying to help my mother-in-law with whatever Best-buy recommended cheap PC she purchased 2 years ago, and I am convinced that she needs the walled garden.

There was a pop up which said that there was a virus and I needed to click ok to get it removed

I swear to God I'd put adblock on that laptop to reduce this risk. Not to mention there must have been multiple click throughs for the different hurdles to install the malware. This is not a problem I envisage happening on Mums iPad though, and there's a lot to be said for that piece of mind

I'm definitely an advocate of open source myself, and I never thought I'd be considering the other side's arguments. It's just that I see major data/security breaches increasing in the news, along with stories (like this one) about cyber-offensive capabilities growing more and more powerful. In the InfoSec world, it seems like anything is hackable, and the balance of power firmly lies with offensive tools. I'm just scratching my head about what the appropriate defensive strategies are going to be, given that Chinese and Russian state-sponsored hackers are known to attack civilian targets. I'm not sure how we're supposed to secure our government, financial, and tech companies against these players.

For all of their known (and probable) capabilities, our three-letter agencies don't seem too concerned about encouraging defensive technologies and securing domestic networks.

What do you mean "attack"? Is there some specific harm being done that you want to protect against? Breach of defenses isn't itself an attack. A foreign agent inside your castle isn't an attacker until they start stabbing people, right?

I'm not personally worried about what Chinese and Russian hackers know about me, because none of that information is particularly useful for taking valuables from me. I am curious what your experience is, just so I can understand the context of your concern.

I'm concerned about industrial espionage: http://www.cnbc.com/2015/10/19/china-hacking-us-companies-fo...

Also at personal risk is anyone with a US security clearance: https://www.washingtonpost.com/news/federal-eye/wp/2015/07/0...

How do you assume that the information isn't useful? That implies that all your valuables are fully isolated from the digital world - really? I really have trouble understanding the "I have nothing to hide" attitude. What's the difference to saying "there is this guy always standing in the corner of my living room, but I'll just assume he's benign..."

Well I would notice if something valuable to me is taken.

I know exactly what you are talking about. I'm just really afraid of what the knock-on effects are going to be of starting kids out in walled gardens. I wouldn't be an engineer today if it wasn't for the fact that it was possible for me to play with various languages, or start distro hopping in high school with a 433Mhz PC. These walled gardens make it easy to keep everything working, but come at a high cost of actually learning what the device does.

But what if the wall have holes in it and you don't even know about it? What if the "bad guys" will uncover the holes before you? Or what if you will know but you still can do nothing about them? What if the "bad guys" are the ones who built the wall, not to secure you but to contain you?

The walled garden doesn't mean it lacks hidden doors (intentional or via hacks) for bad actors. It just means you, the user, have less control of your machine than the OS does. It's as likely to wall you in with malware you can't remove, as to wall it out.

How about a FLOSS archive that provides peer-reviewed and signed application from a trusted source only? Automated security updates? A security team that can provide fixes independently from the upstream authors?

...because I just described how Debian worked for the last 20 years.

Reply on news.ycombinator.com