Comment by JoshTriplett
12 hours ago
I remember the days of DOS and getting a direct pointer to video memory. And I've enjoyed the long history of video game exploits and even arbitrary code execution. But at the same time, I'm also glad that era is over. The same bugs that help you jailbreak a phone can also be the bugs that help you gain illicit access to one.
Illicit access as defined by Google / Apple? If the three letter agencies are interested in you, they don't need to exploit any bugs, they can just demand access from those two companies, and get it. To the device that you carry in your pocket 24/7, with GPS, microphone and camera.
In the days of DOS, the BIOS would load the first sector of a floppy disk or hard drive into memory and transfer control to it. You could replace that sector, and not a single line of code that you didn't write yourself would be executed after that. THIS is how it should be on a PERSONAL computer. A virus could do the same, of course, and gain full control of the machine, but that is not an argument against giving control to the user. You could blame DOS for not intercepting attempts to rewrite the boot sector and asking the user for consent, but completely preventing something like this in the name of security would be even worse!
Imagine if back then, there was a "secure boot" mechanism so that only a boot sector with Microsoft's cryptographic signature was allowed, and that boot sector code would in turn verify everything loaded afterwards. Linux wouldn't exist. So, neither would Android, but the situation would be much the same as it is now, only with Microsoft Phone OS instead -- and absolutely no concept of how it could be different, of a computing device controlled by its user instead of a giant corporation.
> Illicit access as defined by Google / Apple?
No, illicit access as defined by a user who doesn't want anyone but themselves to have access.
Remember the iPhone jailbreaks where you visited a website and the website exploited the phone and installed a jailbreak? That was a remote security exploit, and any other site could have done that too and used it less benevolently.
Users should have full control over their devices. They shouldn't have to get it via exploits, and it's a good thing when those exploits are fixed, because they're security holes that can be used to harm the user.
You aren't arguing for jailbreaks, you are arguing for the phone to be in the user's full control.
Ideally, ios and Android would be secure enough that no jailbreaks are possible, but open enough to allow the user to replace the OS with one of their choosing.
Having it locked down and then resorting to exploiting loopholes is the worst of both worlds.