10 ms·

Apps? No root? Your device serves others, warns Berners-Lee

192 points by lispython 14y ago

tobylane 14y ago
This is more of the idealistic view that I haven't seen pan out. Android may be more open, in the times when the latest version is open source. But when the carriers modify, lock down the phone it's a hassle. It's still a hassle on a perfect phone, out of reach to the vast majority. So on those 98%+ stock (including carrier mods) you have apps that aren't as jailed as on iOS and (still haven't read anything on this either way) pretty much the only online advertiser supplying you this for free. Real world circumstances render this correct ideal view mostly or entirely not true.
alanctgardner2 14y ago
I don't know if it really matters to the average user to have root on their system; for technical people it certainly implies "true ownership" of the whole stack on the device. What I find bizarre and a bit unsettling is the appification of general purpose computing devices. When it was mobile phones, locking the user out (almost) made sense - the device was being financed by the carrier via subsidy, so they should have a bit of control. Then tablets came along and provided an identical interface in terms of restricting user access, but the user pays the entire cost up front[1]. Now Windows 8 (moreso RT, but even the x64 version) and Mountain Lion are moving to the walled-garden, segregated, impotent app approach. The best reason I can explain why this is terrible is XCode: I don't really develop for Mac, but there was a Linux tool which also shipped a 32-bit Darwin binary. I thought "I'd like to use that on my 64-bit Mac, surely I can just compile it with XCode". Downloaded XCode from the App Store (after giving my mother's maiden name, my blood type, etc.), and it doesn't appear on the PATH, because it can only write to /Applications/XCode. Jesus [2]. My point is, somehow subsidized phones turned into locked-down tablets, turned into a compiler that can't install itself to /usr/local/bin. That seems daft to me. 1. ASUS let me root my tablet for free, no strings. So it's opt in, but not terribly evil. 2. If anyone has a good Mac homebrew tutorial, I was wondering if I could compile with a different toolchain than Xcode? I'm really not up on this stuff, I need to learn.
- anon1385 14y ago
  Open the Xcode preferences and install the command line tools from the 'Components' part of the 'Downloads' section, although it does say this: Before installing, note that from within Terminal you can use the XCRUN tool to launch compilers and other tools embedded within the Xcode application. Use the XCODE-SELECT tool to define which version of Xcode is active. Type "man xcrun" from within Terminal to find out more. Downloading this package will install copies of the core command line tools and system headers into system folders, including the LLVM compiler, linker, and build tools.
  - alanctgardner2 14y ago
    Thanks, that was a real RTFM moment.
  - jonhendry 14y ago
    Yes, if you use the Terminal and cd to /Applications/Xcode.app/Contents/Developer, you'll see drwxr-xr-x 3 root wheel 102 Jan 25 14:52 Documentation drwxr-xr-x 7 root wheel 238 Jan 29 13:33 Library drwxr-xr-x 7 root wheel 238 Jan 29 13:11 Makefiles drwxr-xr-x 5 root wheel 170 Jan 25 14:53 Platforms drwxr-xr-x 3 root wheel 102 Jan 25 14:54 Toolchains drwxr-xr-x 22 root wheel 748 Jan 29 13:12 Tools drwxr-xr-x 7 root wheel 238 Jan 25 14:54 usr Inside ./usr/bin is gcc, git, etc. Basically the developer tools used to live by default in /Developer at the root of the filesystem, now the Developer directory is inside Xcode.
    - mhenr18 14y ago
      And if you install the command line tools they live in /usr/bin.
- AngusH 14y ago
  edit: anon1385 gives the same answer as I did, but wrote faster :-) I agree with you on the locking down issue. I don't like the ways things are going. :-( For Mac command line compiling, You need to install the xcode command line tools package In Xcode 4.5: see Menu->'Xcode'->Preferences->Downloads pane->Components tab. Then click the install button on the "Command Line tools" package This should give you a working compiler and tool chain (llvm or llvm-gcc) Hopefully, anyway. I think the package is actually available separately from the Apple developer tools site, although I don't have a link for it. Links on the ADC site tend to change so often, it's hardly worth quoting them.
anon1385 14y ago
The web is the least free of all platforms from the users point of view* so I find it bizarre that Berners-Lee would use the 'freedom for users' angle to try and convince people to switch to web technologies. I fully support the idea that we should have root on devices we own, it's just a shame he had to dilute that point by pushing his own platform. * nearly always closed source, in the rare cases where you have the source you can't modify the code that actually runs when you use the service, usually no control or even ownership of your data, it runs on a machine you don't control which can make your data subject to mining by foreign governments or advertisers
- deleted 14y ago
  [deleted]
- brudgers 14y ago
  I understand your point. It struggles a bit due to the nature of Javascript and the user's direct access to source code. But "freedom" is a cluster concept [e.g. "game" - see Wittgenstein], and Berner's Lee is pointing to another aspect of what we mean by "free". Again JavaScript is a useful example - the user has the ability to turn it off in their browser if they deem that to be in their interest. Or rather, the user has traditionally had that ability. Smartphones and other appliances increasingly are curtailing or eliminating the user's freedom to do so. And a user might want to do so based on the concerns about data you raise. The FOSS idea of freedom is important. But the problem it solves is of another era when those accessing computers rather than terminals tended to be programmers. Stallman's concern arose at MIT AI lab, not among owners of Atari 2600's or Commodore Vic 20's. Berner's Lee is addressing a world where our game consoles and computers are collecting and transmitting detailed data about what we are doing, and we are not given permission to turn the collection off.
  - jerf 14y ago
    "Stallman's concern arose at MIT AI lab, not among owners of Atari 2600's or Commodore Vic 20's." While I do not deny the unsavory side of Stallman exists, I am intrigued at how smoothly we've moved from his detractors mocking his "The Right to Read" [1], to his detractors ignoring it, to us standing on the precipice of living in it, even as the mockery continues unabated and even the HN zeitgeist seems to be that he's some sort of whacko who should be ignored... some sort of whacko who, I might add, appears to have been a great deal more correct about the future than the people labeling him such. [1]: http://www.gnu.org/philosophy/right-to-read.html http://www.gnu.org/philosophy/right-to-read.html
demallien 14y ago
Not a terribly coherent discourse by Tim B.Lee. On the one hand, he wants you to run apps downloaded off the internet in your browser. On the other hand, he wants the user to have root. There's not even a whelk's chance in a supernova that I will ever run a browser as root. I assume that Tim's OK with that as a security stance, but it then follows that browser apps can't have root, and if you're a non-tech-savvy user, if your apps don't have root, then you don't have root. Focusing a bit more on the whole root access thing, I think it would be well to remember that we tried the open root thing already, and it turned out to be a security disaster for normal users. I think it's a good thing that the mainstream computing platforms (Windows, MacOSX, iOS) are trying a new approach. I also think that it's a very good thing that there are more open solutions, such as Android (which, just to be clear, is also a mainstream choice) and Linux, that allow us to see what can be done with more open access. Then the closed platforms can see how to go about providing that functionality in a more secure manner for less tech-savvy users.
- michaelfeathers 14y ago
  It sounds like he's talking about something different than root - freedom to control access at the level the user cares about. To pun on Bertrand Russell: "It's roots all the way up!"
- jiggy2011 14y ago
  I don't think he's suggesting that you literally run your browser as the root user. The argument seems to be that if you don't have the ability to access whatever is the equivalent to the root account on your device at all then this means that whoever does has more control of your device than you do. This means that you have to trust the device or OS manufacturer. For example if you buy an iPhone there is no way to "untrust" Apple without throwing the device out or doing a jailbreak. With a more open system such as Debian you can decide to untrust the OS vendor by simply replacing the entries in /etc/apt.sources with something else. This kind of model is often used in corporate environments where computers are locked down by the IT dept, therefor the IT dept can make choices on behalf of the users as to what the security settings should be, what software is installed etc.
pjmlp 14y ago
I rather make use of my native applications that know how to take advantage of the underlying hardware and OS. The browser should have stayed a document only thing.
- papsosouid 14y ago
  Could you give me an example of anything other than a game that is actually "taking advantage of the underlying hardware and OS" in some way that the browser can not? Looking at all the apps people use, games are literally the only things I've seen that aren't just poorly re-implemented websites.
  - UnFleshedOne 14y ago
    Interestingly, I consider websites to be poorly reimplemented native applications. They make sense when there is a centralized database at the back, but even then UI and UX usually suffer. For one thing, they often lose input methods available to the underlying system. For example, how many web apps use context menus? How many _can_ use them without breaking browser's own UX?
    - papsosouid 14y ago
      >but even then UI and UX usually suffer Because of bad designers. Most native apps suffer for the same reason. >For one thing, they often lose input methods available to the underlying system. Such as? >For example, how many web apps use context menus? How many _can_ use them without breaking browser's own UX? I have no idea how many do, but they don't break anything unless the designer messes up.
      - UnFleshedOne 14y ago
        I've seen some sites overriding context menus to provide their own copy/paste commands (for unknown reasons, probably to change the look). In doing so, they remove all the options browser puts in there. For example, right now in Opera I have 17 entries in context menu when clicking on a empty spot on the page, 9 entries when clicking on selected text and 15 entries when clicking inside text edit field and yet another set when clicking on a link. Some of the options control behaviour of the browser, some deal with current page, some deal with specific page element. If HN wanted to use context menus for some app-specific reason, all of those options would be wiped out (at least for affected elements) because the app would be in direct conflict with the browser. Touch events are often another casualty -- sometimes they are commands to the OS (swipe to change active desktop), sometimes to the browser (pinch to zoom), sometimes to the app (drag to drag around a map, or maybe pinch to zoom?). Additional layers always introduce problems and cause things at the end of the chain to have worse UX or adapt by using lowest common denominator. A crazy example: gmail running in browser running in windows running in a windows VM running on a mac machine which is remotely connected via VNC from an android tablet. >:D Android -> VNC app -> OSX -> VMWare -> Windows -> IE -> GMail app. Ok, this doesn't illustrate much besides the point that browser _is_ an element of input chain (that makes a disproportionate effect on UX too -- the other links are at least trying to be transparent), I just like the idea. :)
deleted 14y ago
[deleted]
youngerdryas 14y ago
From the comment section: >Trust will disrupt Openness There are a couple of factors that will disrupt the Web architecture. The Web has trained us to build dumb clients and centralize anything of value on the server, at a huge cost and never enough trust. We can safely predict today that light-weight protocols, mediated by the mobile OS (and its Platform) will directly challenge the Web architecture, precisely because we can leverage the platform trust model. That evolution is extremely profound. For instance, apps running on your device can securely and privately share information without requiring a complex temporal integration involving a 3rd party service (such as Google AdSense). The information is produced and consumed on the device or the device of a related end-user. What happens on your device can now stay on your device. Just to be clear, and to show how disruptive that architecture is, the primary key of your private data becomes your phone, not your identity. Merchants no longer need to identify you. They can’t care less about YOU, they just care to know some information about you. The problem with the Web Architecture was that the only way to do that was to associate PII to a primary key on a server and hence merchants needed to identify you to track your every move (and they shamelessly did). The second factor is just as profound: the very open nature of the Web is driving scale over scope. The Web has successfully nurtured the largest Catalog, the largest Search engine, the largest Auction site, the largest Social Network, but I see this as a negative side effect of the Web architecture because it limits the scope of what people can do. In other words, the scope of what Amazon, Google or Facebook offer is limited by the scale (and hence the revenue) they can achieve. I actually argue that a trust-based neutral Platform will support a more vibrant and diverse ecosystem than a truly open model because in essence a Web business couples the leve of trust it can achieve with the functionality it can deliver. The Platform decouples the trust from the functionality and it enables much smaller actors to deliver a lot more scenarios while relying on the trust establish by the Platform. I would be surprised if the Web can resist being disrupted by the Platform. Actually, I think it already is.
- valley_guy_12 14y ago
  Unfortunately, you can't really trust a device, since there is always a chance that it could be rooted. See the long history of rooted game consoles. The best you can do is sort-of trust the device. But that's not much better than not trusting the device in terms of the kind of architectures and products you can build.
brudgers 14y ago
Corey Doctorow explains more fully: "When we turn a computer into an appliance. We're not making a computer that runs only the "appliance" app; we're making a computer that can run every program, but which uses some combination of rootkits, spyware, and code-signing to prevent the user from knowing which processes are running, from installing her own software, and from terminating processes that she doesn't want. In other words, an appliance is not a stripped-down computer -- it is a fully functional computer with spyware on it out of the box." [The Coming War on General Computation] Video: http://www.youtube.com/watch?v=HUEvRyemKSg http://www.youtube.com/watch?v=HUEvRyemKSg Transcript: https://github.com/jwise/28c3-doctorow/blob/master/transcript.md https://github.com/jwise/28c3-doctorow/blob/master/transcrip...
- anigbrowl 14y ago
  More like Cory Doctorow grinds his axe. Most people don't want to know how it works or hack on it, they just want it to operate reliably for the purposes they purchased it. It's not a war on general-purpose computation, it's an unprecedented variety of embedded computers.
  - vy8vWJlco 14y ago
    "it's an unprecedented variety of embedded computers." ... at the expense (decreased availability, and public tolerance) of the general ones. Possessing or promoting general purpose computing might well wind up on the FBI's list of suspicious behaviors, along side such threatening habits as paying cash for gum; "normal" people are still basically terrified of magic/the unknown. Hackers are the new witches. A plethora of embedded devices, where one general purpose computer could have done the same, would be tragic. Of course, all of this is just my humble opinion.
    - anigbrowl 14y ago
      Oh, I remember people worrying about the same thing 20 years ago and general purpose computing is cheaper and more accessible than ever. Embedded devices exist because they serve a purpose well. I like a good Swiss army knife, but I also have a bag of specialized tools. As for hackers being 'the new witches,' people aren't exactly scared of computers. If anything, they take the complexity of the digital age with too much complacency.
bradleyland 14y ago
I don't live here; I just rent. Sometimes it's OK to just rent. If I want to own, I'll move elsewhere.
- crististm 14y ago
  I guess that your landlord can come tonight and check if you are sleeping alone, and you can't tell him it's not his business.
  - bradleyland 14y ago
    No, my landlord and I have an agreement that stipulates the terms under which they can enter the place I rent, and I trust them to honor them. Ultimately, they have a key though. It's a risk I accept. The most valid argument that I can think of is that, in a "device appliance" context, many people aren't aware that they're renting. I don't suspect that they'd change to owning once they understood that they're renting, but it might make them more sensitive to the agreement under which they are renting.
    - papsosouid 14y ago
      >and I trust them to honor them. Except that with renting property you have specific rights clearly defined, and there are people with guns and handcuffs and jails to uphold them. You have no rights at all with your phone, and nobody to keep your "landlord" honest. Nevermind the obvious fact that you are not renting your phone, you purchased the device, it is your sole property.
      - bradleyland 14y ago
        I agree that we need a better set of baseline laws protecting consumers who "rent" devices from unfair practices, but I don't think that's relevant to your second statement. I do own my phone. I have every right to throw it off a cliff if I want to. I do not own the software that runs on it. I license it, and when I bought the phone, I agreed to that license. Apple cannot stop me (legally) from running whatever software I like on my iPhone. The caveat is that they're under no obligation to make that easy. I bought the device knowing what software it runs. Were I to buy the device with the intention of running different software, then caveat emptor applies. Apple does not represent that their mobile devices can run any other software, so I really don't see where there's a valid argument that these "renters" are anything but consensual. I have the right to do whatever I want with the device, but I may not have the ability. When you get down to it, the argument being made is that one should want to own, rather than rent. Go ahead and make that argument, but it's not fair to dress it up under the precept of "rights".
aneth4 14y ago
My iPhone does a pretty darn good job of serving me. In fact, that's why I own it. If it happens to server others collaterally, well, I'm not the jealous type.
snowwrestler 14y ago
I think the best thing the tech community can do in this area is continue to investigate and provide specific criticism of individual apps that are doing nasty things. Great examples include the uproars over Google's data collection, or how Path uploaded the entire address book without asking. These are the sorts of specific nasty things the popular press will cover, and the general public wants to know about. Root access would be very helpful for the tech community in doing this, but on its own, it's probably too esoteric to make much of an impression on the press or general public.
dendory 14y ago
I fully agree about things that require native apps. When I click on a link to a YouTube video or a tweet and instead of showing me the result in the browser, it pulls me out and brings me to the YouTube or Twitter app, it means I can't bookmark it or share it. I hate that.
DenisM 14y ago
I don't have root on my TV and it serves me just fine for what I need from it. There might be good arguments to keep platforms open, but this ain't one of them.
- mrgoldenbrown 14y ago
  OTOH, I would love to root my DVD player so I could fast forward when I want to, not at the mercy of the FBI.
  - DenisM 14y ago
    Good point.
  - erichocean 14y ago
    Hacking the player would be useless. DVDs are programmed and any (and all) limitations that are there are because a programmer put them there. Same with Blu-rays.
    - CamperBob2 14y ago
      This isn't correct. The DVD can only specify that fast-forward and other functions are to be disabled. It's up to the player firmware to enforce or ignore the DVD's user permission flags.
millstone 14y ago
When I clicked on that link, my "device" contacted Facebook, LinkedIn, Twitter, Omniture, and CBS Interactive. These sites attempt to compile information about me, track me, and make that information available to others - I'm assuming. Of course, I don't know because they don't tell me. By using the web, my device is serving others (rather, serving me to others) on a massive scale, every day.
- jiggy2011 14y ago
  At least in such a case you have some control over that tracking, by installing ghostery or whatever. Without root you cannot count on being able to do that.
api 14y ago
It's a terrible trend, but I don't see it as some kind of conspiracy as some people seem to. It's a legitimate market trend being driven by several factors: (1) Operating systems have an outmoded security model. Most focus on multi-user security, which still has its uses, but they fail to focus on application isolation. Applications should be installable by anyone and isolated completely from other apps unless specifically granted permission by a user/administrator. The entire malware problem can be laid at the feet of this. (2) The (related) poor state of installability. Mac has this problem the least with drag-and-drop .app installation, though sometimes even that can be confusing (and .dmg packages are weird beasts... why?). Linux has .rpm or .deb, which applies a massive and complex band-aid to the otherwise awful state of installability on that platform. Windows is absolutely horrible... it's like Linux where you have "installers" that have to do package management instead of a formal package system. The open source world -- and even commercial vendors that want to keep the PC alive -- have to either address this problem or accept the dominion of the locked-down vendor-controlled consumer compute device. This will require abandoning the old fashioned Unix design philosophy (and the similar way Windows works) and thinking seriously about the problems of installability and isolation. It would be worth taking cues from iOS and Android here, though there's also a lot of room for new ideas. Oh, and I forgot to mention. If we don't address these problems, all app vendors will pay a ~30% per-sale tax to Apple, Google, and Microsoft in exchange for the valuable service of a platform that provides installability and application isolation. And you know what? The market will pay it, because for most users those things are that valuable. Point, click, install, with no fear of damaging my system. If I don't like it I click and uninstall. Anything else is completely broken. It's interesting to note that the prevalence of virtualization is also a sign of the failure of operating systems. OSes in a box (whether via complex container overlays like OpenVZ/Virtuozzo or hypervisors) are an ugly hack to fix the fact that the OS security model is broken even for multi-user operation. The fact that everything requires root to install is the deepest issue, along with the lack of permission structures for things like network interfaces. It should be possible to run an OS and sell accounts to the general public, not VMs, and people should be able to run whatever they want from their local account and this should be safe. The fact that this isn't viable is because OSes are broken, thus we have the huge overhead of virtualization as an ugly band-aid to fix it.
- 14y ago
Devlin_Donnelly 14y ago
I have always liked the web as a platform because I can build something once and have it work across many operating systems/browsers/etc... and because the web is built on open standards. One criticism people have of this approach to application development is that web apps aren't as efficient as native apps. This pro/con discussion of web vs native apps reminds me of the C programming language, why it was created and what for. The C Programming language was designed to be a portable language, meaning that it can be compiled on virtually any platform, any operating system. Yet C was also designed to constitute the minimum abstraction away from a given platforms native assembly language. Thus a program written in C can be compiled on almost any machine, and run as efficiently or nearly as efficiently on that machine as a program written in that machine's native assembly language. So perhaps we could use something like the C programming language for the web. A technology which allows us as developers to write our applications once in a portable open format, without needing to sacrifice in terms of performance. Any thoughts?
- tree_of_item 14y ago
  Sounds like http://en.wikipedia.org/wiki/Google_Native_Client http://en.wikipedia.org/wiki/Google_Native_Client is what you're looking for.
gdubs 14y ago
Minor quibble: having to port to multiple devices may be 'boring', but writing native apps can be truly wonderful if you love the platform, framework, etc. My personal experience is largely with audiovisual apps -- and for that, I'm a big fan of iOS. Core Audio in particular may be a tough framework to approach, but what you can achieve with it is very exciting.
padmanabhan01 14y ago
if 'open' wants to compete, it should do so by being better than 'closed'. The argument in the article tries to outlaw being 'closed'. No one stops anyone from making any 'open' system (OS or hardware or whatever) and why should anyone stop someone trying to make a 'closed' system. If someone wants to make a closed system and someone else wants to buy that, sure, by all means..
- keenerd 14y ago
  If "safe" wants to compete, it should do so by being more fun than "dangerous". No one stops anyone from making any "safe" system (automobile or recreational drug or whatever) and why should anyone stop someone from trying to make a "dangerous" system. One of the best uses of law is to place limits, regulations and standards on what businesses are allowed to get away with.
lazyjones 14y ago
Using a task manager on your phone is like analyzing the water coming out from your tap before you drink it, only a little less important for your general well-being. Most people are simply ignorant about the details because they trust an authority to keep things in order (e.g. the FTC). Perhaps trust is more misplaced with Apple and Google than with your water supplier, or perhaps those working in the food or water industry will be as wary about water quality as we are interested in whatever spyware is running on our phones - and we will find it a bit ridiculous.

192 points by lispython 14y ago

This is more of the idealistic view that I haven't seen pan out. Android may be more open, in the times when the latest version is open source. But when the carriers modify, lock down the phone it's a hassle. It's still a hassle on a perfect phone, out of reach to the vast majority. So on those 98%+ stock (including carrier mods) you have apps that aren't as jailed as on iOS and (still haven't read anything on this either way) pretty much the only online advertiser supplying you this for free. Real world circumstances render this correct ideal view mostly or entirely not true.

alanctgardner2 14y ago

I don't know if it really matters to the average user to have root on their system; for technical people it certainly implies "true ownership" of the whole stack on the device. What I find bizarre and a bit unsettling is the appification of general purpose computing devices. When it was mobile phones, locking the user out (almost) made sense - the device was being financed by the carrier via subsidy, so they should have a bit of control. Then tablets came along and provided an identical interface in terms of restricting user access, but the user pays the entire cost up front[1]. Now Windows 8 (moreso RT, but even the x64 version) and Mountain Lion are moving to the walled-garden, segregated, impotent app approach. The best reason I can explain why this is terrible is XCode: I don't really develop for Mac, but there was a Linux tool which also shipped a 32-bit Darwin binary. I thought "I'd like to use that on my 64-bit Mac, surely I can just compile it with XCode". Downloaded XCode from the App Store (after giving my mother's maiden name, my blood type, etc.), and it doesn't appear on the PATH, because it can only write to /Applications/XCode. Jesus [2]. My point is, somehow subsidized phones turned into locked-down tablets, turned into a compiler that can't install itself to /usr/local/bin. That seems daft to me. 1. ASUS let me root my tablet for free, no strings. So it's opt in, but not terribly evil. 2. If anyone has a good Mac homebrew tutorial, I was wondering if I could compile with a different toolchain than Xcode? I'm really not up on this stuff, I need to learn.

anon1385 14y ago
Open the Xcode preferences and install the command line tools from the 'Components' part of the 'Downloads' section, although it does say this: Before installing, note that from within Terminal you can use the XCRUN tool to launch compilers and other tools embedded within the Xcode application. Use the XCODE-SELECT tool to define which version of Xcode is active. Type "man xcrun" from within Terminal to find out more. Downloading this package will install copies of the core command line tools and system headers into system folders, including the LLVM compiler, linker, and build tools.
- alanctgardner2 14y ago
  Thanks, that was a real RTFM moment.
- jonhendry 14y ago
  Yes, if you use the Terminal and cd to /Applications/Xcode.app/Contents/Developer, you'll see drwxr-xr-x 3 root wheel 102 Jan 25 14:52 Documentation drwxr-xr-x 7 root wheel 238 Jan 29 13:33 Library drwxr-xr-x 7 root wheel 238 Jan 29 13:11 Makefiles drwxr-xr-x 5 root wheel 170 Jan 25 14:53 Platforms drwxr-xr-x 3 root wheel 102 Jan 25 14:54 Toolchains drwxr-xr-x 22 root wheel 748 Jan 29 13:12 Tools drwxr-xr-x 7 root wheel 238 Jan 25 14:54 usr Inside ./usr/bin is gcc, git, etc. Basically the developer tools used to live by default in /Developer at the root of the filesystem, now the Developer directory is inside Xcode.
  - mhenr18 14y ago
    And if you install the command line tools they live in /usr/bin.
AngusH 14y ago
edit: anon1385 gives the same answer as I did, but wrote faster :-) I agree with you on the locking down issue. I don't like the ways things are going. :-( For Mac command line compiling, You need to install the xcode command line tools package In Xcode 4.5: see Menu->'Xcode'->Preferences->Downloads pane->Components tab. Then click the install button on the "Command Line tools" package This should give you a working compiler and tool chain (llvm or llvm-gcc) Hopefully, anyway. I think the package is actually available separately from the Apple developer tools site, although I don't have a link for it. Links on the ADC site tend to change so often, it's hardly worth quoting them.

anon1385 14y ago

The web is the least free of all platforms from the users point of view* so I find it bizarre that Berners-Lee would use the 'freedom for users' angle to try and convince people to switch to web technologies. I fully support the idea that we should have root on devices we own, it's just a shame he had to dilute that point by pushing his own platform. * nearly always closed source, in the rare cases where you have the source you can't modify the code that actually runs when you use the service, usually no control or even ownership of your data, it runs on a machine you don't control which can make your data subject to mining by foreign governments or advertisers

deleted 14y ago
[deleted]
brudgers 14y ago
I understand your point. It struggles a bit due to the nature of Javascript and the user's direct access to source code. But "freedom" is a cluster concept [e.g. "game" - see Wittgenstein], and Berner's Lee is pointing to another aspect of what we mean by "free". Again JavaScript is a useful example - the user has the ability to turn it off in their browser if they deem that to be in their interest. Or rather, the user has traditionally had that ability. Smartphones and other appliances increasingly are curtailing or eliminating the user's freedom to do so. And a user might want to do so based on the concerns about data you raise. The FOSS idea of freedom is important. But the problem it solves is of another era when those accessing computers rather than terminals tended to be programmers. Stallman's concern arose at MIT AI lab, not among owners of Atari 2600's or Commodore Vic 20's. Berner's Lee is addressing a world where our game consoles and computers are collecting and transmitting detailed data about what we are doing, and we are not given permission to turn the collection off.
- jerf 14y ago
  "Stallman's concern arose at MIT AI lab, not among owners of Atari 2600's or Commodore Vic 20's." While I do not deny the unsavory side of Stallman exists, I am intrigued at how smoothly we've moved from his detractors mocking his "The Right to Read" [1], to his detractors ignoring it, to us standing on the precipice of living in it, even as the mockery continues unabated and even the HN zeitgeist seems to be that he's some sort of whacko who should be ignored... some sort of whacko who, I might add, appears to have been a great deal more correct about the future than the people labeling him such. [1]: http://www.gnu.org/philosophy/right-to-read.html http://www.gnu.org/philosophy/right-to-read.html

demallien 14y ago

Not a terribly coherent discourse by Tim B.Lee. On the one hand, he wants you to run apps downloaded off the internet in your browser. On the other hand, he wants the user to have root. There's not even a whelk's chance in a supernova that I will ever run a browser as root. I assume that Tim's OK with that as a security stance, but it then follows that browser apps can't have root, and if you're a non-tech-savvy user, if your apps don't have root, then you don't have root. Focusing a bit more on the whole root access thing, I think it would be well to remember that we tried the open root thing already, and it turned out to be a security disaster for normal users. I think it's a good thing that the mainstream computing platforms (Windows, MacOSX, iOS) are trying a new approach. I also think that it's a very good thing that there are more open solutions, such as Android (which, just to be clear, is also a mainstream choice) and Linux, that allow us to see what can be done with more open access. Then the closed platforms can see how to go about providing that functionality in a more secure manner for less tech-savvy users.

michaelfeathers 14y ago
It sounds like he's talking about something different than root - freedom to control access at the level the user cares about. To pun on Bertrand Russell: "It's roots all the way up!"
jiggy2011 14y ago
I don't think he's suggesting that you literally run your browser as the root user. The argument seems to be that if you don't have the ability to access whatever is the equivalent to the root account on your device at all then this means that whoever does has more control of your device than you do. This means that you have to trust the device or OS manufacturer. For example if you buy an iPhone there is no way to "untrust" Apple without throwing the device out or doing a jailbreak. With a more open system such as Debian you can decide to untrust the OS vendor by simply replacing the entries in /etc/apt.sources with something else. This kind of model is often used in corporate environments where computers are locked down by the IT dept, therefor the IT dept can make choices on behalf of the users as to what the security settings should be, what software is installed etc.

pjmlp 14y ago

I rather make use of my native applications that know how to take advantage of the underlying hardware and OS. The browser should have stayed a document only thing.

papsosouid 14y ago
Could you give me an example of anything other than a game that is actually "taking advantage of the underlying hardware and OS" in some way that the browser can not? Looking at all the apps people use, games are literally the only things I've seen that aren't just poorly re-implemented websites.
- UnFleshedOne 14y ago
  Interestingly, I consider websites to be poorly reimplemented native applications. They make sense when there is a centralized database at the back, but even then UI and UX usually suffer. For one thing, they often lose input methods available to the underlying system. For example, how many web apps use context menus? How many _can_ use them without breaking browser's own UX?
  - papsosouid 14y ago
    >but even then UI and UX usually suffer Because of bad designers. Most native apps suffer for the same reason. >For one thing, they often lose input methods available to the underlying system. Such as? >For example, how many web apps use context menus? How many _can_ use them without breaking browser's own UX? I have no idea how many do, but they don't break anything unless the designer messes up.
    - UnFleshedOne 14y ago
      I've seen some sites overriding context menus to provide their own copy/paste commands (for unknown reasons, probably to change the look). In doing so, they remove all the options browser puts in there. For example, right now in Opera I have 17 entries in context menu when clicking on a empty spot on the page, 9 entries when clicking on selected text and 15 entries when clicking inside text edit field and yet another set when clicking on a link. Some of the options control behaviour of the browser, some deal with current page, some deal with specific page element. If HN wanted to use context menus for some app-specific reason, all of those options would be wiped out (at least for affected elements) because the app would be in direct conflict with the browser. Touch events are often another casualty -- sometimes they are commands to the OS (swipe to change active desktop), sometimes to the browser (pinch to zoom), sometimes to the app (drag to drag around a map, or maybe pinch to zoom?). Additional layers always introduce problems and cause things at the end of the chain to have worse UX or adapt by using lowest common denominator. A crazy example: gmail running in browser running in windows running in a windows VM running on a mac machine which is remotely connected via VNC from an android tablet. >:D Android -> VNC app -> OSX -> VMWare -> Windows -> IE -> GMail app. Ok, this doesn't illustrate much besides the point that browser _is_ an element of input chain (that makes a disproportionate effect on UX too -- the other links are at least trying to be transparent), I just like the idea. :)

deleted 14y ago

[deleted]

youngerdryas 14y ago

From the comment section: >Trust will disrupt Openness There are a couple of factors that will disrupt the Web architecture. The Web has trained us to build dumb clients and centralize anything of value on the server, at a huge cost and never enough trust. We can safely predict today that light-weight protocols, mediated by the mobile OS (and its Platform) will directly challenge the Web architecture, precisely because we can leverage the platform trust model. That evolution is extremely profound. For instance, apps running on your device can securely and privately share information without requiring a complex temporal integration involving a 3rd party service (such as Google AdSense). The information is produced and consumed on the device or the device of a related end-user. What happens on your device can now stay on your device. Just to be clear, and to show how disruptive that architecture is, the primary key of your private data becomes your phone, not your identity. Merchants no longer need to identify you. They can’t care less about YOU, they just care to know some information about you. The problem with the Web Architecture was that the only way to do that was to associate PII to a primary key on a server and hence merchants needed to identify you to track your every move (and they shamelessly did). The second factor is just as profound: the very open nature of the Web is driving scale over scope. The Web has successfully nurtured the largest Catalog, the largest Search engine, the largest Auction site, the largest Social Network, but I see this as a negative side effect of the Web architecture because it limits the scope of what people can do. In other words, the scope of what Amazon, Google or Facebook offer is limited by the scale (and hence the revenue) they can achieve. I actually argue that a trust-based neutral Platform will support a more vibrant and diverse ecosystem than a truly open model because in essence a Web business couples the leve of trust it can achieve with the functionality it can deliver. The Platform decouples the trust from the functionality and it enables much smaller actors to deliver a lot more scenarios while relying on the trust establish by the Platform. I would be surprised if the Web can resist being disrupted by the Platform. Actually, I think it already is.

valley_guy_12 14y ago
Unfortunately, you can't really trust a device, since there is always a chance that it could be rooted. See the long history of rooted game consoles. The best you can do is sort-of trust the device. But that's not much better than not trusting the device in terms of the kind of architectures and products you can build.

brudgers 14y ago

Corey Doctorow explains more fully: "When we turn a computer into an appliance. We're not making a computer that runs only the "appliance" app; we're making a computer that can run every program, but which uses some combination of rootkits, spyware, and code-signing to prevent the user from knowing which processes are running, from installing her own software, and from terminating processes that she doesn't want. In other words, an appliance is not a stripped-down computer -- it is a fully functional computer with spyware on it out of the box." [The Coming War on General Computation] Video: http://www.youtube.com/watch?v=HUEvRyemKSg http://www.youtube.com/watch?v=HUEvRyemKSg Transcript: https://github.com/jwise/28c3-doctorow/blob/master/transcript.md https://github.com/jwise/28c3-doctorow/blob/master/transcrip...

anigbrowl 14y ago
More like Cory Doctorow grinds his axe. Most people don't want to know how it works or hack on it, they just want it to operate reliably for the purposes they purchased it. It's not a war on general-purpose computation, it's an unprecedented variety of embedded computers.
- vy8vWJlco 14y ago
  "it's an unprecedented variety of embedded computers." ... at the expense (decreased availability, and public tolerance) of the general ones. Possessing or promoting general purpose computing might well wind up on the FBI's list of suspicious behaviors, along side such threatening habits as paying cash for gum; "normal" people are still basically terrified of magic/the unknown. Hackers are the new witches. A plethora of embedded devices, where one general purpose computer could have done the same, would be tragic. Of course, all of this is just my humble opinion.
  - anigbrowl 14y ago
    Oh, I remember people worrying about the same thing 20 years ago and general purpose computing is cheaper and more accessible than ever. Embedded devices exist because they serve a purpose well. I like a good Swiss army knife, but I also have a bag of specialized tools. As for hackers being 'the new witches,' people aren't exactly scared of computers. If anything, they take the complexity of the digital age with too much complacency.

bradleyland 14y ago

I don't live here; I just rent. Sometimes it's OK to just rent. If I want to own, I'll move elsewhere.

crististm 14y ago
I guess that your landlord can come tonight and check if you are sleeping alone, and you can't tell him it's not his business.
- bradleyland 14y ago
  No, my landlord and I have an agreement that stipulates the terms under which they can enter the place I rent, and I trust them to honor them. Ultimately, they have a key though. It's a risk I accept. The most valid argument that I can think of is that, in a "device appliance" context, many people aren't aware that they're renting. I don't suspect that they'd change to owning once they understood that they're renting, but it might make them more sensitive to the agreement under which they are renting.
  - papsosouid 14y ago
    >and I trust them to honor them. Except that with renting property you have specific rights clearly defined, and there are people with guns and handcuffs and jails to uphold them. You have no rights at all with your phone, and nobody to keep your "landlord" honest. Nevermind the obvious fact that you are not renting your phone, you purchased the device, it is your sole property.
    - bradleyland 14y ago
      I agree that we need a better set of baseline laws protecting consumers who "rent" devices from unfair practices, but I don't think that's relevant to your second statement. I do own my phone. I have every right to throw it off a cliff if I want to. I do not own the software that runs on it. I license it, and when I bought the phone, I agreed to that license. Apple cannot stop me (legally) from running whatever software I like on my iPhone. The caveat is that they're under no obligation to make that easy. I bought the device knowing what software it runs. Were I to buy the device with the intention of running different software, then caveat emptor applies. Apple does not represent that their mobile devices can run any other software, so I really don't see where there's a valid argument that these "renters" are anything but consensual. I have the right to do whatever I want with the device, but I may not have the ability. When you get down to it, the argument being made is that one should want to own, rather than rent. Go ahead and make that argument, but it's not fair to dress it up under the precept of "rights".

aneth4 14y ago

My iPhone does a pretty darn good job of serving me. In fact, that's why I own it. If it happens to server others collaterally, well, I'm not the jealous type.

snowwrestler 14y ago

I think the best thing the tech community can do in this area is continue to investigate and provide specific criticism of individual apps that are doing nasty things. Great examples include the uproars over Google's data collection, or how Path uploaded the entire address book without asking. These are the sorts of specific nasty things the popular press will cover, and the general public wants to know about. Root access would be very helpful for the tech community in doing this, but on its own, it's probably too esoteric to make much of an impression on the press or general public.

dendory 14y ago

I fully agree about things that require native apps. When I click on a link to a YouTube video or a tweet and instead of showing me the result in the browser, it pulls me out and brings me to the YouTube or Twitter app, it means I can't bookmark it or share it. I hate that.

DenisM 14y ago

I don't have root on my TV and it serves me just fine for what I need from it. There might be good arguments to keep platforms open, but this ain't one of them.

mrgoldenbrown 14y ago
OTOH, I would love to root my DVD player so I could fast forward when I want to, not at the mercy of the FBI.
- DenisM 14y ago
  Good point.
- erichocean 14y ago
  Hacking the player would be useless. DVDs are programmed and any (and all) limitations that are there are because a programmer put them there. Same with Blu-rays.
  - CamperBob2 14y ago
    This isn't correct. The DVD can only specify that fast-forward and other functions are to be disabled. It's up to the player firmware to enforce or ignore the DVD's user permission flags.

millstone 14y ago

When I clicked on that link, my "device" contacted Facebook, LinkedIn, Twitter, Omniture, and CBS Interactive. These sites attempt to compile information about me, track me, and make that information available to others - I'm assuming. Of course, I don't know because they don't tell me. By using the web, my device is serving others (rather, serving me to others) on a massive scale, every day.

jiggy2011 14y ago
At least in such a case you have some control over that tracking, by installing ghostery or whatever. Without root you cannot count on being able to do that.

api 14y ago

It's a terrible trend, but I don't see it as some kind of conspiracy as some people seem to. It's a legitimate market trend being driven by several factors: (1) Operating systems have an outmoded security model. Most focus on multi-user security, which still has its uses, but they fail to focus on application isolation. Applications should be installable by anyone and isolated completely from other apps unless specifically granted permission by a user/administrator. The entire malware problem can be laid at the feet of this. (2) The (related) poor state of installability. Mac has this problem the least with drag-and-drop .app installation, though sometimes even that can be confusing (and .dmg packages are weird beasts... why?). Linux has .rpm or .deb, which applies a massive and complex band-aid to the otherwise awful state of installability on that platform. Windows is absolutely horrible... it's like Linux where you have "installers" that have to do package management instead of a formal package system. The open source world -- and even commercial vendors that want to keep the PC alive -- have to either address this problem or accept the dominion of the locked-down vendor-controlled consumer compute device. This will require abandoning the old fashioned Unix design philosophy (and the similar way Windows works) and thinking seriously about the problems of installability and isolation. It would be worth taking cues from iOS and Android here, though there's also a lot of room for new ideas. Oh, and I forgot to mention. If we don't address these problems, all app vendors will pay a ~30% per-sale tax to Apple, Google, and Microsoft in exchange for the valuable service of a platform that provides installability and application isolation. And you know what? The market will pay it, because for most users those things are that valuable. Point, click, install, with no fear of damaging my system. If I don't like it I click and uninstall. Anything else is completely broken. It's interesting to note that the prevalence of virtualization is also a sign of the failure of operating systems. OSes in a box (whether via complex container overlays like OpenVZ/Virtuozzo or hypervisors) are an ugly hack to fix the fact that the OS security model is broken even for multi-user operation. The fact that everything requires root to install is the deepest issue, along with the lack of permission structures for things like network interfaces. It should be possible to run an OS and sell accounts to the general public, not VMs, and people should be able to run whatever they want from their local account and this should be safe. The fact that this isn't viable is because OSes are broken, thus we have the huge overhead of virtualization as an ugly band-aid to fix it.

14y ago

Devlin_Donnelly 14y ago

I have always liked the web as a platform because I can build something once and have it work across many operating systems/browsers/etc... and because the web is built on open standards. One criticism people have of this approach to application development is that web apps aren't as efficient as native apps. This pro/con discussion of web vs native apps reminds me of the C programming language, why it was created and what for. The C Programming language was designed to be a portable language, meaning that it can be compiled on virtually any platform, any operating system. Yet C was also designed to constitute the minimum abstraction away from a given platforms native assembly language. Thus a program written in C can be compiled on almost any machine, and run as efficiently or nearly as efficiently on that machine as a program written in that machine's native assembly language. So perhaps we could use something like the C programming language for the web. A technology which allows us as developers to write our applications once in a portable open format, without needing to sacrifice in terms of performance. Any thoughts?

tree_of_item 14y ago
Sounds like http://en.wikipedia.org/wiki/Google_Native_Client http://en.wikipedia.org/wiki/Google_Native_Client is what you're looking for.

gdubs 14y ago

Minor quibble: having to port to multiple devices may be 'boring', but writing native apps can be truly wonderful if you love the platform, framework, etc. My personal experience is largely with audiovisual apps -- and for that, I'm a big fan of iOS. Core Audio in particular may be a tough framework to approach, but what you can achieve with it is very exciting.

padmanabhan01 14y ago

if 'open' wants to compete, it should do so by being better than 'closed'. The argument in the article tries to outlaw being 'closed'. No one stops anyone from making any 'open' system (OS or hardware or whatever) and why should anyone stop someone trying to make a 'closed' system. If someone wants to make a closed system and someone else wants to buy that, sure, by all means..

keenerd 14y ago
If "safe" wants to compete, it should do so by being more fun than "dangerous". No one stops anyone from making any "safe" system (automobile or recreational drug or whatever) and why should anyone stop someone from trying to make a "dangerous" system. One of the best uses of law is to place limits, regulations and standards on what businesses are allowed to get away with.

lazyjones 14y ago

Using a task manager on your phone is like analyzing the water coming out from your tap before you drink it, only a little less important for your general well-being. Most people are simply ignorant about the details because they trust an authority to keep things in order (e.g. the FTC). Perhaps trust is more misplaced with Apple and Google than with your water supplier, or perhaps those working in the food or water industry will be as wary about water quality as we are interested in whatever spyware is running on our phones - and we will find it a bit ridiculous.