[rektide]

Comments like this one[1] that mention having difficulty using Termux to access SD cards keep making me feel like we are radically over-securing devices. More and more it feels like the OS, the browser, are guarding the user not against bad apps, but also against the user. Firefox Mobile only allowing less than a dozen extensions. Chrome mobile supporting no extensions. These are different than the OS, but the same kind of decisions done "for the user" by removing capabilities from the environment.

Even the people not fighting against people in the War on General Purpose Computing keep seceding our sovereign systems away from us. The need for security is real, but I don't see that we are approaching it with balance. We seem to be growing ever more heavyhanded, permitting users less & less, and I don't see a reciprocal respect & empowerment being considered, furthered or advanced.

[1] https://news.ycombinator.com/item?id=24982862

[quicklime]

What worries me most is that our devices are being radically over-secured according to a threat model that doesn't include companies that share my data without my permission, but does include open source developers building general-purpose tools. The former are actively encouraged, and the latter are considered collateral damage.

[anderspitman]

That might have something to do with the fact that the people making the OS are also the people most interested in your data.

[heavyset_go]

> More and more it feels like the OS, the browser, are guarding the user not against bad apps, but also against the user.

This is something Stallman and others have been talking about[1] for more than a decade now.

[1] https://news.ycombinator.com/item?id=24881893

[MarkusWandel]

Well, I approach it from two angles at once. One, a pocket computer running Linux which, using Termux, could be a full Linux machine - in which I can run Perl scripts on my SMS messages, grep my emails, rename and organize my photo library and so on. Which was presumably mostly possible on old, less secure versions of Android. With Android 10 and its exec restriction, sure you can still install precompiled packages as apk's but what about simply compiling a small C program and running it? So the old school tinkerer is sad that I'm locked out of a perfectly good Linux machine that I own.

However the other angle is, this phone is an appliance and I want it to just work. I'm personally competent enough to have that cake (programmability) and eat it too (reliable usability) - after all I've been running Red Hat/Fedora as my primary desktop OS at home for two decades and it works just fine, thank you. But I also remember what a horrible mess the average schmoe's home computer was back in the good old days... remember an outdated version of Internet Explorer with half the screen obscured by a stack of junky toolbars, and the whole thing running at 800x600 on a monitor capable of higher resolutions "because otherwise the letters are too small". Good riddance.

Anyway for the moment, second-hand desktop and laptop machines that can run a full, unencumbered compute environment are still plentiful. Maybe by the time they aren't, I'll be a truly old fart who doesn't care any more.

[rektide]

I agree that there are multiple angles. I think of them as different contexts. What I see is that, at the moment, we're designing, permitting, allowing, creating, constructing, & securing only for one angle, only for the pure-consumerism mode, the mode where we assume the user is in "don't care/don't know" mode.

This mode, however, is such a denigration to humanity. All the spirit of augmenting the human intellect, computing being servant to the human psyche, harnessed by human creativity... it's a way-more-than-tacit admission of defeat, a brazen retreat. It just seems... unaccounted for. We don't talk about this loss, this turning around. We trumpet security & chalk up wins for helping each other, but there's no mainstream dialogue that supports the deeply enriched angle, the immersive, expert computer user, the post-training-wheels life. Everything is centered around the dumb consumer, all of computing focused around a consumerized applicationized "just work" mentality.

I think we've been drinking poison.

[pabs3]

Maybe Android just needs to add support for virtual machines? Then you could have the best of both worlds.

[1vuio0pswjnm7]

Can the user really achieve "security" without having full control. When the user is not the customer of the third party providing "security". (In this case advertisers are the customer.)

Hopefully courts will begin to recognise that this sort of "security" is in fact created for the benefit of the company and its customers, not users. Any benefits to users are incidental.

Users are not soliciting these "security" measures. They are always initiated by the company.

[fogihujy]

This is not a part of the war on general purpose computing; it's a part of the effort to make Eternal September to end by making software that works for everyone.

As it is, this entails limiting the users' freedom to tinker in such a way that they simply cannot screw things up no matter how hard they try. Because, you know, if users have that option, then someone will take advantage of it and screw things up.

This line of thought has powerful political and philosophical backing, as digitalization is seen as the magic bullet that will solve a wide array of issues throughout society, and the general idea seem to be to protect people for their own good. Incidentally, it's often the most profitable route as well, as it's the only way to get non-technical users on-board.

[heavyset_go]

> As it is, this entails limiting the users' freedom to tinker in such a way that they simply cannot screw things up no matter how hard they try.

I've had my parents on Ubuntu Linux for a while now for exactly this reason: no matter what they do, they aren't going to screw things up, even if they tried. It just works.

So far there have been no complaints and no issues.

[fogihujy]

Ditto with my in-laws and Linux Mint. Thing is, they don't really care about tinkering (just like most people) and so they don't care. Allowing them to tinker would benefit them very little, while it would definitely increase the risk of them screwing things up.

[rusk]

That’s the cover story LOL

[fogihujy]

It's the official story, no matter how you put it. I'm not saying it's a good thing (in fact, I find it horrible), but it is what it is and I have no idea on how to turn that tide.

There's a lot to be said about freedom of computing, but the fact remains that given the option to screw things up, then some people will do that. At the same time, we have a culture that incentivize catering to the non-technical users in a way that prevents them from screwing things up.

Long story short: If we want to turn this trend, then we need to:

1) Start telling non-technical users that any damage caused through their freedom of action is their own responsibility.

2) Produce competitive products that not only provide the desired amount of freedom, but which also compete on price, desirability, usability and the impression that the products are secure enough to use.

In many cases, 1 will be seen as a way of avoiding responsibility, and it'll take a tremendous amount of effort to convince users (and consumer protection agencies) that they should be less protected just in case someone else decides to tinker with their product. That alone makes 2 more or less impossible.

[rusk]

I really think this line of thinking is overegged. It is one thing to make a device easy to use, yet quite another to lock them out for creative purposes.

[fogihujy]

It's not about making things easy to use, but about making them harder to break. Creative tinkering is simply not taken into the consideration for most consumer products. Things like support load, RMA rate and consumer protection laws is.

[rusk]

Like I say. It’s a cover story. They could make devices serviceable at the same time but it is more convenient for them not to, and to even push the envelope of what’s acceptable.

[Valkhyr]

Could not agree more.

There should be a "I know what I'm doing" switch that disables a bunch of restrictions and essentially enables full root privileges for your user.

[npsimons]

Stallman was right.

[unicornporn]

> Chrome mobile supporting no extensions.

Kiwi browser does.