Post #1791623
2026-04-22 13:44 UTC
Replies (7)
-
@qqq@lemmy.world 2026-04-22 14:05
Security is constantly used as a guise for removing consumer rights and as someone who has been in the security industry for about 9 years I’m so sick of it. First and foremost, everyone please understand: the user should be allowed to opt into your concept of insecurity: you do not know their threat model and you do not know their risk tolerance. Using exploits in low level drivers in the wild is approaching APT level, and even if there were a simple one to use it’d likely be useless without some sort or local access to the device (bar some horror show bug in a Bluetooth or WiFi firmware). The risk is incredibly low for the average person. I’d put it pretty close to 0. Wire transfers aren’t instant and for large sums (your inheritance) the banks will likely require more than just a request from your app. If the bank cares about that then they can also use the attestation APIs which would be more than sufficient, as much as I hate them. This boogey man of the APT going after my technologically illiterate with nation state level exploits needs to die. Long ago we entered a new era of security where it just isn’t worth it to waste exploits. Especially when you can just text people and ask for their bank account and that works plenty well. Security is not a valid reason to soft brick consumer devices at some arbitrary end of life date.
-
@CileTheSane@lemmy.ca 2026-04-22 14:40
That implies any and all FOSS project should be getting exploited constantly, especially those being run by a community of hobbiests, and that is simply not the case.
-
@PlexSheep@infosec.pub 2026-04-23 11:58
I think the worst risk with this would be data leaks from that government database.
-
@unwarlikeExtortion@lemmy.ml 2026-04-24 07:44
If you just give binary blobs and no sources The main point is that you give the source to the blobs, so it’s not a black box anymore - new maintainers knowing what the blob does (and how) saves a HUGE amount of time prodding the black box (blob) to infer its behaviour. And it doesn’t pose a security risk - if anything, more eyes on the code is better. Security through obscurity has been proven a myth since open code has more eyes on it. Security researches have smarter things to do than prod some binary blob when there’s so much code that’s either open source in the first place or at least only they got access to closed code. What obscurity does is limit the eyes on the code, but the share of bad actors hoping to strike gold to researches looking at it outdoes any benefit. Will your technically-challenged great-Aunt switch to post-support build when her phone hits EoL She won’t. But you as her niece/nephew might. And the local repair tech might when she comes to ask. Abd she’s not an idiot, just the technology isn’t mature enough in the societal sense: people don’t think of bringing their phone to a repair shop like they do their cars, which is a fixable issue - even without much advocacy groups time will fix this issue. hackers [will] be able to remote control her banking app and take away your inheritance before the community can even patch it You might be mixing apples and orabnes here: why and how is the community expected to “fix” a banking app? A banking app is a closed blob just like phobes nowadays. It’s a parasitic relationship: blobbed phones are used to justify blobbed apps and vice versa. It’s like saying “well, the foubdation of the building is bad, but to fix it we’d need to also deal with the crumbling walls” - so instead of fixing, it often is better to do a fresh start. But you’re suggesting we should continue making buildings with bad walls and foubdations because we have the wall materials lying around, so why not use them? Then there could also be licensed code This is a recipe for disaster. I hope you’re trolling. The Internet wouldn’t work if DNS were centralized, and the only thing DNS is used for is translating key pairs (basically). Now a single point of failure would have to do code vetting? It’s the totalitarian dream! Oh, and absolutely out of touch with reality.
-
@VieuxQueb@lemmy.ca 2026-04-22 15:10
Security by obscurity is a myth
-
@realitaetsverlust@piefed.zip 2026-04-22 17:47
> security nightmare That is not a corporations problem who's given away the rights to his product. That is my problem as an informed user, deciding that I know well enough about what I'm doing. Security can't be the constant reason for EoLs. Especially when there's no real reason beyond the company needing the next cash cow. > Will your technically-challenged great-Aunt switch to post-support build when her phone hits EoL This isn't for the average user. My grandma isn't gonna learn how to flash a custom firmware on her old phone. But an informed user can. Right now, if your device has no more support, you can use it until something else changes and it becomes incompatible. Then you have a dead box that doesn't do anything anymore, and simply because the company decided to no longer support it. It's about having the OPTION to use it in the future so the community can at least try to fix it.
-
@porcoesphino@mander.xyz 2026-04-23 21:09
I can't believe this is so heavily downvoted for pointing out flaws in the expressed/written stance while still expressing they agree with the general position