Hacker News Reader

Comment by raise_throw | Hacker News Reader

A variant of the 'single non-root user' problem on Unix systems.

A non-root user (hopefully) can't root the system or rm -rf /root.

But everything interesting is stored in that user's home folder with implicit RW permissions anyway.

On Android apps just request everything. I imagine (without explicit knowledge) that an app given permissions could rewrite, erase, or pull down over the network contacts / photos / etc in the background.

View on HN

I remember learning Unix on my school's big Unix system. Lots of talk about how important root was. I understood it from a system standpoint sure.

Yet I was confused, because as a user all I cared about was my stuff that was ... right there in a non root account.

As you say all the stuff I was concerned about was right there, but nobody talked about how important that was.

On a large multi user system there’s a big difference between “your stuff” and “everyone’s stuff” on a single user system like a phone - not so much.

Although you can leverage multiuser capable systems for more security by, say, using different user accounts for playing games and banking, or whatever.

The point is that your trust envelope extends to the authors of software, which are frequently not acting in the best interests of the user, and have their own goals and incentives (including competing goals with other software authors).

On my Linux systems, particularly under Debian, there's some assurance provided through the Debian Project, its guiding documents (social contract, constitution, policy), and debian developers. The project explicitly serves the users. This doesn't prevent bugs and occasional malice, but tends to tremendously reduce incentives for it.

Smartphones ... are a mess, and Android rather particularly so. I've suggested entirely rethinking how app development is performed, particularly for basic utilities, closer to the Debian model. I have little hope of this occurring.

"If someone steals my laptop while I'm logged in, they can read my e-mail, take my money, and impersonate me to my friends... but at least they can't install drivers without my permission" https://xkcd.com/1200/

> On Android apps just request everything

That was true up to Marshmallow (Android 6), when finer grained permissions were added.

Let me just update to it, oh wait....

Ah, finer-grained permissions, something I've seen on a BlackBerry in 2009.

I learned quite recently that Android was using one user ID per installed app, effectively isolating them one from another. However, I am not sure I understood what you meant by

> On Android apps just request everything

Well, this is as true as with any other operating system, isn't it?

Nowadays, I try to use F-droid as much as I can, applications there ask for reasonable permissions, and are open source, which makes it easier to trust them.

OK, but doesn't AppArmor protect against that?

And it looks like it's been ported to Android and iOS. But it's not default, I guess.

But neither is AppArmor in Linux. So why haven't we heard about apps stealing stuff from /home/user/? Is it just that distros do a better job of policing their repos? Or that the userbase is too small to attract malicious app developers?

> rm -rf /root

I don’t think this will do much besides blow away the root user's home directory, which probably doesn't have much in it anyway. But I get what you mean.

I think that he meant "rm -rf /" :)

Just in case, for a bit of fun:

http://www.marriedtothesea.com/041808/this-is-what-i-get.gif

How many years after Android permissions changed for the better will users who have never owned an Android phone complain about a problem that no longer exist.

Until Google finally matches the permission model that iOS has had for years, and until the changes roll out to the majority of users instead of the few that own Pixel phones?

It has been there since Android 6.0.

Only available to around 60% of Android users.

It doesn't change the fact that it is there. :D

It is NOT there for at least 40% of android users.

Well, because there is this thing called lack of updates.

On German consumer shops, most "deal of the day" are still a mix of 4.4 and 5.1.

Reply on news.ycombinator.com