My question to Apple, Microsoft, and the Linux kernel maintainers is this: Why is this even possible? Why is it possible for a running application to read information stored by so many other applications which are not related to the program in question?
Why is isolation between applications not in place by default? Backwards compatibility is not more important than this. Operating systems are supposed to get in the way of things like this and help us run our programs securely. Operating systems are not supposed to freely allow this to happen without user intervention which explicitly allows this to happen.
Why are we even remotely happy with our current operating systems when things like this, and ransomware, are possible by default?
>Why is it possible for a running application to read information stored by so many other applications which are not related to the program in question?
This question has been answered a million times, and thousands of times on HN alone.
Because in a desktop operating system the vast majority of people using their computer want to open files, they do that so applications can share information.
>Why is isolation between applications not in place by default?
This is mostly how phones work. The thing is the phone OS makes for a sucky platform for getting things done.
> Operating systems are supposed to get in the way
Operating systems that get in the way get one of two things. All their security settings disabled by the user (See Windows Vista) or not used by users.
Security and usage are at odds with each other. You have locks on your house right? Do you have locks on each of your cabinets? Your refrigerator? Your sock drawer?
Again, phones are one of the non-legacy places where there is far more security and files are kept in applications for the most part, bug they make terrible development platforms.
Are you suggesting that it's impossible to have a system that is secure by default and be usable by normal people? Because I'm saying that's very possible and I'm starting to get angry that it hasn't happened.
Plan 9 did this and that kernel is 50k lines of code. and I can bind any part of any attached filesystem I want into a location that any running application has access to, so if any program only has access to a single folder of its own by default, I can still access files from other applications, but I have to opt into that by making those files available via mounting them into the folder of the application I want to be able to access them.
I am not saying that Plan9 is usable by normal people, but I am saying that it's possible to have a system which is secure, usable, not a phone, and easy to develop on (as everything a developer needs can be set up easily by that developer.)
>as everything a developer needs can be set up easily by that developer.
So yea, developers are the worst when it comes to security. You put up a few walls and the next thing you know the developer is settings access to ., I know, I make a living cleaning up their messes.
I mean, people leave their cars unlocked and their keys in them FFS. Thinking we're going to suddenly teach more than a handful of security experts operating system security abstractions just has not been what has been occurring. Our lazy monkey brains reach for the easy button first unless someone is pointing a gun at us.
yes, I know, but that doesn't render the entire idea moot. I'm a developer, but I have knowledge of infosec, and I don't do those things. but because some developers do, it shouldn't be done? what kind of logic is that?
everyone who is NOT a developer is now protected by the operating system in a situation like this, and developers that are not, are unprotected by their own hand, instead of being unprotected via the decision of an OS vendor.
By the way, the entire "not protected" situation that you claim developers would put themselves in, is the exact situation that everyone is in today, with very little choice to opt out of that situation.
I want people to opt in to the insecure situation, and opt out of the secure situation, not the reverse, which is the case today. Ransomware can encrypt an entire disk because the OS has no notion that full disk access is bad, or that self-escalation to privileged access should not be granted automatically. MacOS kinda does these things, but not to the point I want to see them done. Not at all.
an OS that isolates everything renders containers completely moot. everything a container does should be provided by default by the operating system, and operating systems that don't provide this should be considered too immature to be useful in any production setting, either by business or by consumers. isolation by default should be table stakes for any OS to even come up for consideration by anyone for any reason.
And you're saying that this shouldn't happen because some developers who don't understand security will make their system look just like wide-open systems today? Come on.
>And you're saying that this shouldn't happen because
You have a strange reversal of causality here.
I'm not saying what should or shouldn't happen.
I am describing what has or has not happened.
I am saying that 'insecure' operating systems dominate the market and can be found everywhere.
I need you to explain to me why secure operating systems are somehow going to get users to move from what they are on to your magical platform?
There is no security police that is writing this secure operating system you're talking about, no one to point guns at them and make people use it. No long line of volunteers open sourcing code to make this secure operating system either.
You're describing an OUGHT, I'm describing an IS.
You have to balance security with utility, so you find obviously safe compromises. You shouldn't allow applications to share completely different file formats. Your text editor doesn't need to be able to open an mp3 file. Even when it's convenient for an application to open a file, as long as it can't execute the file it can't do too much damage. Be sure to consider that interpreting complex file formats is dangerous, since parsers can and are exploited regularly. So be careful about trusting anything but dead-simple text files.
Oh, and by the way, now we'd like to make all written text treated as executable instructions by a tool that needs access to pretty much everything in order to perform its function.
MacOS has some isolation by default nowadays, but in practice when the box pops up asking if you want to let VibecodedBullshit.app access Documents or whatever, everyone just reflexively hits 'yes'.
[dead]