Programs From The Ångström Repo

[mindlord]

I'm sorry Jeff but I'm really really confused. Why the heck would you design a system for a handheld that gives 2 hoots about multi-user? If there's multiple users on a single handheld at the same time they're doing it wrong. I mean it's great to fulfill all sorts of crazy use cases; however, that's just a engineering-gasm and not a real-world necessity.

Running in multi-user mode is absolutely essential from the standpoint of security. The necessity of user logins ensures that the system is not running in full root all the time. Simply must be done this way.

 

[skeezix]

torpor, you still here or bailed off?

jeff

 

[likwidoxigen]

Bryce -- why would we do that? we designed it to handle that; we did not design around that, we designed tohandle it, should it happen; obviously multiuser is not likely, but multi-invocation is _very likely_. Consider -- what if someone makes a Firefox pnd, and then yoiu run two copies at the same time? Certainly not an unlikely scenario. In terms of full screen games, sure, but not for other apps. So we take things into consideration .. during designing and system, you figure the expected usage, plus some common other cases.. gotta try to be graceful in handling them, right?

I'm well aware of how uxix/linux works it's just that I keep seeing the pandora as a handheld and largely ignore the fact that it's really just a linux distro dropped on some sweet custom hardware.

I just read through libpnd_hub, and browsed around the libpnd source so it makes a lot more sense now. I didn't realize that you were doing so much leg work with libpnd. Now that I understand better what libpnd is actually doing yes I can see how with it "fusing" storage and other operations you really would need to specifically design it to handle multi-invocation and multi-users.

Running in multi-user mode is absolutely essential from the standpoint of security. The necessity of user logins ensures that the system is not running in full root all the time. Simply must be done this way.

Mindlord, it's a freaking HANDHELD. It doesn't truly need to be multi-user except for convenience. This is not a server with thousands of users. It's a handheld with really only 1 physical user. It could easily be run as root all the time, There is no reason it "must" be done this way, if you think you have a reasonable one I'm all ears. It's simply a choice on the teams part to go with exposing multiple users as a feature.

*I'm reading through the libpnd_hub now. And alot more is coming together, however I really need to mow my lawn and I said I'd do that at 3..."

 

[mindlord]

There is no reason it "must" be done this way, if you think you have a reasonable one I'm all ears. It's simply a choice on the teams part to go with exposing multiple users as a feature.

One reason, and a very good one. Security. It's important, whether you believe me or not.

 

[likwidoxigen]

One reason, and a very good one. Security. It's important, whether you believe me or not.

Security is important. But normal people don't lock closets. Please tell me what you are "securing" on the pandora. It's an enhanced feature above current gaming handhelds, not a necessity. A nintendo DS is not inherently less secure by being single user.

 

[mindlord]

There is no reason it "must" be done this way, if you think you have a reasonable one I'm all ears. It's simply a choice on the teams part to go with exposing multiple users as a feature.

One reason, and a very good one. Security. It's important, whether you believe me or not.

Security is important. But normal people don't lock closets. Please tell me what you are "securing" on the pandora.

The Pandora is Internet capable and thus vulnerable to the same threats that affect Desktops. Without basic root level security you're not just leaving the closet unlocked. You're taking the front door off it's hinges and flashing a neon sign at your house.

 

[SomeGuy99]

There is no reason it "must" be done this way, if you think you have a reasonable one I'm all ears. It's simply a choice on the teams part to go with exposing multiple users as a feature.

One reason, and a very good one. Security. It's important, whether you believe me or not.

You can even get a firewall for the Iphone. Handhelds are little computers now, and that comes with all the security concerns.

 

[likwidoxigen]

The Pandora is Internet capable and thus vulnerable to the same threats that affect Desktops. Without basic root level security you're not just leaving the closet unlocked. You're taking the front door off it's hinges and flashing a neon sign at your house.

Ummmm... the OS is going to be "set" on the nand with hotfixes that come down at user discretion. It doesn't matter worth a damn if you have multi-users if your base os is going to be set at stable versions and thus as an exploit is found it will be usable because it's not getting daily security updates. It's kind of like running a windows box with an out of date anti-virus, you get the Illusion of protection, and no real protection.

 

[mindlord]

Ummmm... the OS is going to be "set" on the nand with hotfixes that come down at user discretion. It doesn't matter worth a damn if you have multi-users if your base os is going to be set at stable versions and thus as an exploit is found it will be usable because it's not getting daily security updates. It's kind of like running a windows box with an out of date anti-virus, you get the Illusion of protection, and no real protection.

/me just stops...

Edit: What I said first was just too harsh...

 

[likwidoxigen]

You can even get a firewall for the Iphone. Handhelds are little computers now, and that comes with all the security concerns.

It really doesn't come with all the security concerns. Physical access makes ANYTHING hackable. With handhelds physical access is SO easy to come by that if you're storing damning information like your social/financial information on there you're asking to get screwed.

Saying that something is "secure" because it's multi-user is nebulous and irrational. Security is such a "hot-button" topic that people don't take the time to really think about "what" they're securing. On a phone you have contact information and many idiots do banking from their phones which is what gives them a NEED to be secured.

Neither of you have come up with ANY reason that a handheld designed for GAMING and possibly some light web-browsing and video watching needs to be secured. If you're going to put personal, financial or other private information on there you have no right to be hawking "security" of the device. It can be stolen and have the information easily pulled. Or if it does happen to get infected (lets say it pulls all firefox saved passwords) you should be smart enough NOT to save online banking passwords. Nothing "user" related stops me from writing a pnd that is nifty and adds a feature that modifies the users Firefox pnd to go though a proxyserver where I capture all the traffic and steal your passwords that way, or one that emails me the firefox password store. Multi-user does not make you inherently safer it just means attacks will be structured differently.

 

[SomeGuy99]

Neither of you have come up with ANY reason that a handheld designed for GAMING and possibly some light web-browsing and video watching needs to be secured.

What about my personal diary? I can't have you find out who I have crushes on... you might tell them, and then things get really awkward.

Seriously though, you can't make assumptions about usage.

Nothing "user" related stops me from writing a pnd that is nifty and adds a feature that modifies the users Firefox pnd to go though a proxyserver where I capture all the traffic and steal your passwords that way, or one that emails me the firefox password store. Multi-user does not make you inherently safer it just means attacks will be structured differently.

Oh! I look forward to this release. When's it out?

 

[likwidoxigen]

This is the last time I will try and help you guys understand.


A virus running as user can delete all your data, all your pnd files and all your settings leaving you with a bare-bones pandora.

A virus running as root can delete everything, leaving you the need to re-flash you pandora.

The effect is the same, the clean-up is different.

The pandora is primarily a single user system and will be run like a single user system and will have all the vulnerabilities of a single user system. Expecting ANY additional security by something as banal as having multiple user CAPABILITY is irresponsible from a security standpoint.

 

[SomeGuy99]

Won't running as non-root prevent a rootkit from installing itself?

What virus actually goes about wiping data? That's hardly profitable. How can your machine DDOS or spam if the OS is broken? Zombies need to have some form of animation.

 

[likwidoxigen]

that's enough for me to avoid being super user

Why? You're running a firmware based system not an installed system. A flash will take maybe a half hour. The only reason people bother "cleaning up" viruses on desktop computers is because they don't want to re-install all their applications and get all their settings back. If there were a virus that deletes all applications and settings leaving you with a base install that would be just as devastating as one that hosed your system.

 

[SomeGuy99]

that's enough for me to avoid being super user

Why? You're running a firmware based system not an installed system. A flash will take maybe a half hour. The only reason people bother "cleaning up" viruses on desktop computers is because they don't want to re-install all their applications and get all their settings back. If there were a virus that deletes all applications and settings leaving you with a base install that would be just as devastating as one that hosed your system.

Or because the virus has turned the host machine into a zombie/spamming machine?

This happened to an entire office I worked at, and the ISP were theatening legal action.

 

[likwidoxigen]

Won't running as non-root prevent a rootkit from installing itself?

What virus actually goes about wiping data? That's hardly profitable. How can your machine DDOS or spam if the OS is broken? Zombies need to have some form of animation.

A rootkit can getinstalled from any system explioit that goes undetected.

If you download a virus as a user it can do all the same things (with regards to stealing user info) it just needs to find an exploit to get root privelages. With a firmware style system you can get far more "mielage" from root exploits that you find.

Handhelds aren't high-uptime systems if they were targeted the most likely vector is nuisance data-delete viruses if it did get infected with a ddos or spam virus that could be done in userspace as easily as root and with some throttling etc could be run in the background continuously as a user and remain unnoticed by the person.

 

[skeezix]

Making it multiuser is because some people may well (and for good normal reasons) want multiuser. Its an edge case, but not to be _that_ uncommon.

Supporting multiple invokcations of same pnd file is expected to occur reasonably common, so had to be supported.

As to security, thats a whole other topic.

We didn't design around such things, we deisgned for the expected use case, and made sure to work with some common edge cases. Makes sense

(but don't let me interupt a good old fashioned internet flamewar!)

jeff

 

[SomeGuy99]

I appreciate there are exploits, but surely running as root is just a free pass? At least requiring an exploit makes it more difficult?

 

[WizardStan]

The Pandora is Internet capable and thus vulnerable to the same threats that affect Desktops. Without basic root level security you're not just leaving the closet unlocked. You're taking the front door off it's hinges and flashing a neon sign at your house.

You can set it to auto-logon locally, but anyone sneaking in through the internet would still need a password. The person playing on it could quite easily run forever as root and never have to worry about outside attacks.
Now, if someone actually got physical access to your Pandora in this case, you're pretty much screwed, but the reality is you'd be screwed even if you were password protected

 

[skeezix]

We do have tiny root-only mini distribution if someone really wants to use it

Likewise, the Gentoo guys have ben at it for a year or more (or did they give up?)

I'm waiting for all the schismed off OSes to appear Its not hard to bring up another OS, sans Pandorification

jeff