Slashdot Mirror

← Back to Stories (view on slashdot.org)

Chrome OS Doesn't Trust Apps Or Users

Posted by kdawson on from the for-your-own-good dept.

holy_calamity writes "Google's Chrome OS chiefs explain in Technology Review how most of the web-only OS's features flow from changing one core assumption of previous operating system designs. 'Operating systems today are centered on the idea that applications can be trusted to modify the system, and that users can be trusted to install applications that are trustworthy,' says Google VP Sundar Pichai. Chrome doesn't trust applications, or users — and neither can modify the system. Once users are banned from installing applications, or modifying the system security, usability, and more are improved, the Googlers claim."

18 of 410 comments (clear)

  1. Wait, what? by Monkeedude1212 · · Score: 5, Interesting

    Doesn't that make it even more closed than an iProduct?

    1. Re:Wait, what? by 42forty-two42 · · Score: 5, Informative

      The headline's a bit misleading. Users _can_ replace the OS. However, the BIOS will check signatures on the OS, and offer to restore from a known-good backup on boot (without destroying user data). This ensures that if the OS is infected by a virus or something, it's very, very easy to restore.
      There are specific points in the design docs where they make it clear that they do want to support advanced users installing their own OS, to the extent that that does not cause trouble for less advanced users.

    2. Re:Wait, what? by Microlith · · Score: 5, Insightful

      And I expect that to carry zero weight with 3rd party hardware vendors, who will undoubtedly lock the platforms down and, if they're like Motorola, they'll sign the kernel so you absolutely can't load other OSes.

    3. Re:Wait, what? by natehoy · · Score: 5, Insightful

      I was thinking the same thing. If iOS is a walled garden, this is a walled garden hermetically within a Plexiglas dome and a concrete floor and all the plants in sterilized pots.

      But that might not be a bad thing. For the "my phone/computer is an appliance" crowd, this might be perfect. No fiddling around trying to download plugins or extensions, no overhead of antivirus, and no difference between multiple machines, and most importantly almost no tech support required. If I break something like this, I go out and buy a new one, present one username and password to it, and it's exactly like my old one used to be.

      If you're selling an OS whose primary purpose is to surf da interwebz, it might not be a terribly bad idea to resurrect the concept of the "dumb terminal" in that context. I presume Google will push updates, so if they keep a current list of plugins and/or extensions that can be enabled/disabled by the user as desired, you have machines that are going to be really, really hard to compromise, and really, really easy to use. And really, really inexpensive.

      Well, except by Google, so you'd better trust Google a LOT under this model (much like you have to trust Apple a good deal under the iOS model). If you want your computer to do anything outside what Google had in mind, you're done. If Google gets hacked, your data gets hacked and you might never know about it. And, of course, you'll never be able to do anything without Google knowing about it.

      --
      "This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
    4. Re:Wait, what? by Americano · · Score: 5, Insightful

      The headline isn't really misleading, it's actually quite accurate - Chrome OS doesn't trust apps or users to be safe. That you can replace Chrome OS with something more trusting doesn't mean Chrome OS itself suddenly trusts those apps and users.

    5. Re:Wait, what? by mlts · · Score: 5, Insightful

      Reading the design docs, having an oem-unlock switch is a nice compromise between keeping Joe Sixpack from getting compromised by malware, then blaming it on Google/device maker's lack of security versus allowing a clued user to do what he or she wants.

      With this in mind, one thing that would be nice to have are offline apps. This way, a glitch in Internet connectivity would not mean a corrupted term paper.

      I just have one concern though -- the fact that everything you do is stored in the cloud. This means zero privacy. Even with the lack of privacy now, if an application started sifting through Word documents and uploading them to an ad agency, there would be Hell to pay. However, one can't have any assurance that someone isn't doing this when all the docs are stored remotely. There is a fundamental rule, "don't put anything on the Internet that you don't want everyone, including your worst enemy to know." So, trusting a cloud service with everything you do may have negative ramifications later on.

    6. Re:Wait, what? by phoenix321 · · Score: 5, Interesting

      I can already replace my Windows installation and when the OS is infected by a virus or something, it's very, very easy to restore. Just hit a BIOS switch, reinstall from a truly hidden (and BIOS-protected) partition - or recovery DVD - and reinstall without destroying user data. (All user data is on D:, while reinstall will bomb C:)

      It doesn't work that well, let me tell you. User data is there, but programs need to be reinstalled to access it. System comes back squeaky clean, but everything needs to be changed to my personal liking.

      What it boils down is that a computer will be either vulnerable to users, useless for them or anything in between these extremes. Can't install programs? Useless but secure. Can install any program? Useful, but vulnerable.

      Without settings and mail saved *somewhere*, a mail client is useless. With settings and mail saved *anywhere*, a mail client is potentially vulnerable.

      Replacing the OS with a known-good image only works if someone can truly produce an image that is more useful than say a Windows default installation and still known to be good. Which gets increasingly doubtful the older the OS image is, the more programs are installed and the more data/configuration/specifics are kept in program installations somewhere.

    7. Re:Wait, what? by Dishevel · · Score: 5, Insightful

      3: Autobanning people's Google accounts who have custom ROMs.

      Exactly how do you think that Sony, Samsung, HTC, Sprint, Verizon or even the Evil AT&T will ban your Google account?

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
    8. Re:Wait, what? by yelvington · · Score: 5, Insightful

      So, it's a dumb-terminal that requires me to have constant access to the internet, can't store files, can't have actual programs installed on it.

      Please catch up. It is not what you think.

      It's not a dumb terminal, it doesn't require you to have constant access to the Internet (some apps require it, others don't), it can store data locally, and you can install programs. They're registered in the cloud, and if you log in and one is missing, it's quickly synchronized to the local device.

      http://www.w3.org/TR/html5/offline.html
      http://dev.w3.org/html5/webstorage/
      http://www.html5rocks.com/tutorials/offline/storage/
      http://code.google.com/chrome/apps/

      Understanding the significance of ChromeOS requires that you abandon some old ways of thinking about how a computer should act. Yes, you're "losing" the desktop and the file folders. You're also losing slow boot times, viruses, the risk of losing your data in hard drive crashes or device theft, and the occasional maddening discovery that you left a critically important file on a hard drive at home|school|work.

      This may not be the device for you, but it may be the device for a lot of people. It's worth pointing out that over half a million people buy smartphones every day that also walk away from a mountain of desktop-computer annoyances.

    9. Re:Wait, what? by GWBasic · · Score: 5, Interesting

      With this in mind, one thing that would be nice to have are offline apps. This way, a glitch in Internet connectivity would not mean a corrupted term paper.

      That's what local storage in HTML 5 is for. When I played with Google Gears in 2007, there was a complete Javascript API for an in-browser SQLite database; AND I could specify which files would be served locally. Thus, I could make a web application that would work without an internet connection.

      Google Gears is now depricated because a lot of the lessons are applied to the HTML 5 spec.

      --
      No, I will not work for your startup
  2. A little problem... by DoofusOfDeath · · Score: 5, Insightful

    I trust me more than I trust Google.

    1. Re:A little problem... by mozumder · · Score: 5, Funny

      I don't trust you more than I trust google.

    2. Re:A little problem... by wiredog · · Score: 5, Insightful

      So don't buy one...

      --

      Best Slashdot Co
    3. Re:A little problem... by TheEyes · · Score: 5, Insightful

      It doesn't matter what levels of relative distrust I assign to Google or assign to you personally.

      Google can do a lot more damage to me than you can.

      Well, that rather depends on what volumes you assign to "you."

      Dozens of zombie botnets around the world exist around the world, and consist of millions of compromised machines. All of these exist almost entirely because users are trusted to make the right decision with regard to program installation and access... and they're wrong often enough to get their machines infected.

      The fact is these days even relatively knowledgeable users can't be expected to be able to easily vet the source code of every program they use, even when the source is available. When was the last time one of you audited the code for the entirety of your Linux install--or even just the kernel?--plus your Firefox/Chromium browser and Open/Libre Office? Have you manually combed through all the Javascript from every webpage you've browsed today, to make sure there are no exploits hidden in the code? Are you sure you haven't given a virus a backdoor into your system?

      Maybe not trusting users by default is the right way to go. It's just an extension of the idea to not have everyone log in as Administrator/Superuser all the time, and instead differentiating between regular users and admins; you're just linking the Admin account to a physical switch on the hardware itself.

    4. Re:A little problem... by DrgnDancer · · Score: 5, Insightful

      And for those comparing this to Apple's lockdown, that's ridiculous - Apple actively tries to prevent you from jailbreaking, while anyone can mod the Chrome OS.

      Anyone can modify Linux, that doesn't mean that if you give me a Linux box with locked down guest account access, no alternate boot methods, and don't tell me the root password that I can modify this *particular* Linux installation. The fact that Chrome is Open Source won't help me install applications on my Chrome device. Unless I go out and install my own custom ChromeOS on the device, at which point why did I buy this thing? I could have just bought a conventional laptop and put Fedora on it.

      --
      I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
  3. It makes sense for the business market by lpaul55 · · Score: 5, Insightful

    Companies don't trust their employees and Chrome is a sandbox within a sandbox. This is a good thing in the corporate world where centralized control is valuable.

    Chrome is a very thin client that really works.

    --
    ... now back to the bit mines.
  4. Re:This is what Google means by OPEN by fuzzyfuzzyfungus · · Score: 5, Insightful

    The difference(at least according to design docs, we'll see what happens on release when we come to that) is that ChromeOS devices give one the (advanced; but non-hack) option to tell the command and control system to shove it. Their shipping image, and the one you get if you restore, is built on a no trust model; but if you wish to put a different one on there(including a modified build of the open portions of ChromeOS) that is your call.

    With Apple, by contrast, their portables are their OS or nothing, barring hacks that depend on mistakes they did not intend to make, and do tend to correct over time. What you see is what you are stuck with.

  5. Re:Can't install an ap? That'll slow adoption by Eil · · Score: 5, Insightful

    The whole point of Chrome OS is to shift the application from running natively on the hardware to running in the cloud. You're thinking of the web browser as the application, Google is thinking of GMail as the application.