Hacker News new | ask | show | jobs
by UncleMeat 1755 days ago
I do not believe it is remotely reasonable to say that our software should be deliberately insecure so that people have the ability to root their own devices. That problem can be solved with other means, without exposing all of our devices to anybody else in the world who can send the same payload.

If I can root my device through an exploit then I am not at the mercy of the company that made the device. But I am now at the mercy of every single criminal or oppressive state that wants to use that exploit to harm me. And given that there is no way to confidently determine which pieces of software do not expose this capability, this cannot be an informed decision made by consumers.
1 comments
userbinator 1754 days ago
That problem can be solved with other means

That's what they always say --- so how about solving that problem first, before thrusting ourselves head-first into advocating for full authoritarianism?

But I am now at the mercy of every single criminal or oppressive state that wants to use that exploit to harm me.

Good. That means power is not centralised. You can defend yourself instead. Besides, do you really want to be "at the mercy of the company that made the device" ? As we have seen multiple times, they do not really act in your interest.

There's also plenty of dystopian sci-fi to show us what attempts at making a "perfect" society in any way will turn out. This applies to making software "perfectly secure" too.

link
UncleMeat 1754 days ago
> That's what they always say --- so how about solving that problem first, before thrusting ourselves head-first into advocating for full authoritarianism?

Expecting more secure applications is "advocating for full authoritarianism"? If anything, security vulnerabilities place individuals at far greater risk to authoritarianism since it exposes them to the people who have guns and can throw them in prison.

And software written in memory-safe languages is very very far from "perfectly secure". It just closes a very common class of vulnerability.

If you really want, you can use FLOSS for everything. Your use case of "I really want the ability to change any piece of code running on my device" is supported. Not well, since few people actually want this, but it is supported.

link