• 2 Posts
  • 93 Comments
Joined 1 year ago
cake
Cake day: June 20th, 2023

help-circle


  • Nobody intentionally creates vulnerabilities, but more complicated software is more error prone and therefore more likely to be vulnerable. Fast release cycles also get in the way of good testing. The most complicated piece of software on most phones is the web browser, and its complexity is imposed by the web and its advertisements, rather than by what the user wants or needs.

    IOS and Android face pretty much the same issues on the OS developer and phone manufacturer sides. Therefore, the IOS and Android worlds could both clean up their acts in about the same way if the incentives were right. That they don’t do so might be a bad situation that we have to cope with, but we shouldn’t pretend that it is a good situation.

    I wonder what apps require IOS 16 in some meaningful way. I know there is a situation with Android apps requiring OS upgrades unnecessarily.

    Why do companies like McDonalds want you to run an app anyway, instead of e.g. using a web page? There are a few sites or products where I currently give up the equivalent of a french-fry discount rather than run their stupid app. It’s just a minor annoyance so far, but it doesn’t make sense to me. Do those apps usuallly keep running the background so they can track you, or what?


  • Those security vulnerabililties are because of buggy old software, and updating the software in the old devices does as good a job of fixing the vulnerabilities as selling you a new device does. A significant e-waste tax on every new device, accompanied by credits for keeping old devices working, might help with that. Anyway, if it’s an app (rather than OS) vulnerability and you can’t fix it with an update because the new version of the app requires a new OS, that’s mostly likely an app that you don’t need to use. I’m getting by ok with F-droid apps instead of Play Store apps, for example.

    Best still would be to debug the software before shipping it, so it wouldn’t have those vulnerabilities in the first place. There are various forces that get in the way of that, but a significant one is that web development is now driven by delivering more advertising rather than useful information to the user.










  • It was ok at the time, and if it isn’t ok now, that means you want to run something that is too bloated for its own good.

    Really though, special hardware for this doesn’t make too much sense. A raspberry pi with two ethernet interfaces would be great, but if you can live with ethernet plus wifi, the current rpi’s will do it. Otherwise there are lots of similar boards that really do have two ethernet.

    I have not really felt much use for self hosted server hardware at home. I use VPS’s for that and it’s less hassle. Maybe it doesn’t count as completely self hosted, but conceptually it’s a miniature colo box.