mrsellout | # 11 | 2013-12-15, 00:19 | Report

The dialler/sms app would open up should an android app try to use those means to communicate, and the user would have to physically press the onscreen call/send button to allow the android app to make the call/send text message.


I think you've misunderstood what szopin was referring to with regards the button. As for mer/nemo I don't think you fully understand what each is.

Mer is the core distribution on which the nemo middleware and then the Sailfish UI sits. Whilst the nemo that you may have tried (with the nemo ui) on the n900/n9 might not seem complete, the fact that Jolla have launched their device shows that mer & the nemo middleware is at a pretty well developed stage.

I've read posts of yours in the CSSU thread about how you believe that it's not working for you, but denigrating the efforts of a community is poor form and judgement when unmerited.

Community 'crap' clearly works as shown by the millions if not billions of devices running Linux everywhere you look.

Sticking Sailfish on their device makes sense for those that do, because it's what THEY WANT TO DO.

The point about getting used to a ui applies equally to those buying their first smartphone after years of using a 'dumbphone' or people buying their first tablet.

Leinad | # 12 | 2013-12-15, 09:49 | Report

i future, some kind of ACL for Anroid apps would be great. meaning, you can allow apps individual access outside of the VM.

e.g.
app1 can access internet, location
app2 can access media
app3 can access contacts

... and so on

misterc | # 13 | 2013-12-24, 14:57 | Report

yeah, big brother...
but big brother doesn't need to access your device to get pretty much ALL the info they are interested in, which does, afawk NOT inlcude your CC credentials and what not...
well, correct that... they use CC & all to track your plane, train, bus, ship (did i forget anything... rocket, maybe?) ticket purchases, of course!

they get those informations from Google, Yahoo!, m$, ATT & Co. don't they?
or if that is not available (in savage uncivilized countries where Consumerism doesn't reign almighty (yet)) they simply plug into the cell towers & all directly, from satellites...
no escaping big brother.... John Connor, maybe?

PolyTicks | # 14 | 2014-01-31, 06:35 | Report

You can't really be that naive? Sure, I love security as a layer, but that's because I'm a security consultant and I make some really good money when people **** up with security (in my line of work, security as a layer and **** up isn't even separate phrases). On a device I'm supposed to use for mostly everything, though, security needs to have a central role during development, not when **** hits the fan. Please tell me that you are at least utilizing the linux built in group permission separation. Some kind of control where I have to confirm that app X is allowed to be part of the "phonebook" group, the "read_home_directory" or the "internet" group. I've had such great hopes for Jolla, but this thread was a complete beat down on any interest I had, so please help me build that interest again.

rainisto | # 15 | 2014-01-31, 09:40 | Report

Normal unix security is in place, group gid are used to protect privileged dirs that only Jolla applications can access, system has iptables installed, so you can configure firewalls and control incoming and outgoing tcp/udp packets in fine-grained fashion.

Your business is security consultation, if you think that Unix uid's, gids, and cgroups are not interesting, then I suggest you going back to Android as you can make your earnings in there.

We are improving security on each update, but we are trying to keep the improvements as invisible to end users as possible. As imho if you ever need to ask end user a single security question in dialog, then you have already failed in usability.

So in short we are NOT waiting for stuff hitting the fan, but we are constantly making new improvements and enablers that will hopefully avoid that ever happening.

In some possible update there might even be some settings GUI for turning nagging dialogs on, but there will always be a setting not to nag the end user for question that they dont understand (unless they are system specialists).

Penguin | # 16 | 2014-01-31, 20:10 | Report

There are Qualcomm chipset, modem software, and security enablers in Jolla. There are also NSA backboors and security disablers in the Qualcomm hw&sw in Jolla like in all other Qualcomm based devices.

PolyTicks | # 17 | 2014-02-01, 08:44 | Report

Thanks for a great answer. It still leaves me wondering about one thing though, which android solves with its permission system for users who understands the permissions. I do agree with you observation, though, that it leaves the standard user in the dark.

How do you decide if it's an app that should be able to do actual administrative changes or is simply a game that should have no access to anything in the system if you can't ask the user? Simply put, how do you handle usability vs security if you can't ask the user what kind of app is running? Are all apps equal in system permissions and group belongings?

PolyTicks | # 18 | 2014-03-18, 05:41 | Report

I'm about to choose my next phone, and I would really appreciate an answer to my security concern.

rainisto | # 19 | 2014-03-18, 12:01 | Report

As already answered its handled by unix group security and harbour QA. Store applications doesnt have access to read nor edit privileged group data.

In addition to harbour apps (which has QA), there are openrepos where community pressure takes care the 'security' or 'insecurity'. And Jolla and 2nd party applications can have exceptions to normal gid rules.

In the future there might be more improvements coming.