Hacker News Reader

Comment by worldsavior | Hacker News Reader

Nice, but using root generally is very insecure. The whole concept of superuser is broken and bad. Such privileges shouldn't be given to any user.

View on HN

Bypassing "security" when you as the owner of the device want to is the whole point of root.

This project allows root by default, like it's part of the user experience, which is bad for security.

It does not grant root by default, quote: "Whitelist access control Only App that is granted root permission can access `su`, other apps cannot perceive su."

In this context I meant that it allows root where Android never allows.

But that's the whole point? That you can user your own device as a general-purpose computing device, not only as a media-consumption device limited by arbitrary restrictions the vendor of the device can pose on you?

This kernel is for day to day use. Using insecure features such as root, can potentially cause harm. Do whatever you want, just pointed a fact.

What attack do you see this allowing that wouldn't work without it? Considering that the user has to intentionally add it, and the user has to explicitly give apps root access, the only problem I can see is if a user gives root to an untrustworthy app, but that seems like a good trade.

Incidentally, do you also think that users shouldn't have admin power on, say, laptops, or are phones special?

Those are apps that are granted root can be exploited by other apps.

And yes also on other devices (depends which one, such laptops).

Reply on news.ycombinator.com