• 0 Posts
  • 16 Comments
Joined 1 year ago
cake
Cake day: June 20th, 2023

help-circle






  • Nobody intentionally creates vulnerabilities, but more complicated software is more error prone and therefore more likely to be vulnerable. Fast release cycles also get in the way of good testing. The most complicated piece of software on most phones is the web browser, and its complexity is imposed by the web and its advertisements, rather than by what the user wants or needs.

    IOS and Android face pretty much the same issues on the OS developer and phone manufacturer sides. Therefore, the IOS and Android worlds could both clean up their acts in about the same way if the incentives were right. That they don’t do so might be a bad situation that we have to cope with, but we shouldn’t pretend that it is a good situation.

    I wonder what apps require IOS 16 in some meaningful way. I know there is a situation with Android apps requiring OS upgrades unnecessarily.

    Why do companies like McDonalds want you to run an app anyway, instead of e.g. using a web page? There are a few sites or products where I currently give up the equivalent of a french-fry discount rather than run their stupid app. It’s just a minor annoyance so far, but it doesn’t make sense to me. Do those apps usuallly keep running the background so they can track you, or what?


  • Those security vulnerabililties are because of buggy old software, and updating the software in the old devices does as good a job of fixing the vulnerabilities as selling you a new device does. A significant e-waste tax on every new device, accompanied by credits for keeping old devices working, might help with that. Anyway, if it’s an app (rather than OS) vulnerability and you can’t fix it with an update because the new version of the app requires a new OS, that’s mostly likely an app that you don’t need to use. I’m getting by ok with F-droid apps instead of Play Store apps, for example.

    Best still would be to debug the software before shipping it, so it wouldn’t have those vulnerabilities in the first place. There are various forces that get in the way of that, but a significant one is that web development is now driven by delivering more advertising rather than useful information to the user.






  • Talks about different developer styles, slightly interesting and not too long winded I guess, but not much about the actual situation.

    I think this is still not such a great look for Rust. I had expected interfacing Rust to C to present fewer problems than it seems to. I had hoped the Rust compiler could produce object code with almost no runtime dependencies, the way C compilers can. So integrating Rust code into the kernel should be fairly painless from the C side, if things were as one would hope.

    It does sound to me in the earlier post that there was some toxicity going on. Maybe it had something to do with the context being a DRM driver.

    I looked at a few Rust tutorials but they seemed to take forever to get to any interesting parts. I will keep looking.