OSDev.org

Hi,

Sik wrote:

Brendan wrote:Look, this issue extremely simple: The OS doesn't know if access is permitted by the owner of the data; and therefore must either allow access knowing that doing so may be against the owner's wishes (unethical), or deny access to ensure that the owner's wishes have not been disregarded (ethical).

Unless you are able to show that doing something against the owner's wishes is ethical; then it's an irrelevant distraction. Ethics is not about convenience, it's about doing what is right (even when it's inconvenient).

You're completely ignoring my point which is that your idea can lock out the owners themselves from their own data, simply because they weren't using whatever your specific OS instance wants everywhere (which is guaranteed to happen the moment they deal with multiple systems at any time in their lives).

I'm not ignoring your point; I'm saying that your point is irrelevant (nothing to do with ethics), and that the "problems" you point out are insignificant, that there are better ways to avoid the "non-problems", and that it's not an OS's responsibility to shield incompetent users of poorly designed OS's from the consequences they deserve.

Sik wrote:Oh, and on top of that I could just take your data to another system, modify it there carefully and change any permissions without your OS ever suspecting anything (assuming any traces are correct, possibly generating fake logs if needed). So your method isn't even foolproof.

My method is foolproof. If you use one OS to bypass the security/permissions of another OS but neither of those OSs are mine; then it's impossible to accuse me of providing software that behaves in an unethical way, impossible to blame me or my OS for allowing security to be bypassed, and impossible hold me responsible for any data that is taken without permission.

Sik wrote:Your idea doesn't bring in any real good whatsoever and instead has the potential to cause a lot of harm, and not to strangers but to the people who actually are meant to own those files in the first place (let alone anybody they want to share those files with). Please explain me how is that any more ethical than all those arbitrary restrictions.

Even with a poorly designed OS on a system with cheap hardware and an incompetent administrator, the chance of the owner losing their data simply because one OS won't violate the security of another OS is almost zero. The only likely consequence is that the owner of the data (or someone working on their behalf) would need to use a "no permissions file system" like FAT when copying files to a different OS.

Now...

If I can't trust your OS to uphold the security policy of another OS, how can I trust your OS to uphold it's own security policy? Would you mind if I claim that my OS is superior to your OS because my OS has a much stricter security (that even includes upholding the security of other OSs that don't even exist yet)?

If there are 10 different OSs that are not your responsibility and each of those OSs has 2 different types of file system that are not your responsibility; how much time are you going to spend writing, testing and maintaining code to ensure that users that aren't your responsibility are able to use your OS to access files from all these file systems just in case of extremely unlikely problems that aren't your responsibility?

Would you mind if I claimed your OS "has only a limited commercially significant purpose or use, other than to circumvent technological measures" and had your OS banned in multiple countries (due to the WIPO Copyright Treaty that "prohibits circumvention of technological measures for the protection of works")?

Sik wrote:

Brendan wrote:How would you restore data from a backup if you refuse to access any external file system?

Send the data to a trusted system that holds the back-up, and when you need it back you request the data back from said system (which would be explicitly granting you the permissions you need). You aren't touching the filesystems directly at all, you're transferring files between two systems.

The only thing this does is push the problem somewhere else. How do you back up the "trusted system that holds the back-up"?

Sik wrote:This does mean that probably removable media is out of the question, simply because they normally won't tell you whether you should be allowed to touch the files in them. But then ask yourself if allowing that would be ethical.

The majority of removable media uses file systems like ISO9660 and FAT and isn't a problem.

Sik wrote:

Brendan wrote:What about external file systems that are intended for transferring data between systems (e.g. how would you copy files stored on a digital camera's CompactFlash card onto your computer)?

How can you be sure that the original owner of said data has given you permission to access that data?

Either the original owner willingly removed the permissions (by copying/storing the files on a file system that has no permissions); or an OS that is not mine stripped the permissions against the owner's. Either way, my OS is not guilty of violating the owner's permissions.

Sik wrote:Case in point, what if I take a camera (or its memory) from somebody else without their permission and then load it in my computer? How is that any better from me trying to access data from a partition in another OS in one of my own drives? (where I presumably would own most or all of the data there)

Why aren't you able to see that the answer is obvious? If there are no permissions for an OS to disregard the OS can't behave unethically by disregarding permissions. The reasons why there are no permissions is irrelevant because it's beyond the OS's control.

Sik wrote:

Brendan wrote:If someone has the correct key (even though no human was supposed to ever see or obtain the correct key) then you can assume security has been compromised and should erase all the data as soon as possible in an attempt to protect any confidentiality that hasn't already been lost.

How are you sure I wasn't the source of the key? (e.g. by entering a password that feeds the encryption algorithm, or by generating a file with the key instead of a password) The original key must have come from somewhere after all.

If the OS generates the key (like it does in almost all modern disk encryption schemes) then it can be sure that you were not the source of the key.

Sik wrote:The assumption you're making is that once encrypted it shouldn't be decryptable ever anymore since whoever created the key can't be the valid source of it. That completely defeats the point of encryption, may as well just delete the data directly instead of encrypting it.

No; the assumption that I am making is that the OS is secure (and therefore securely generates the key itself, securely stores the key, and securely uses the key for both encryption and decryption).

By assuming a human should have any kind of access to the key, you create this scenario:

Sik wrote:Honestly I think that what ticks me off the most though is how data that is more likely for the user to be allowed to touch (what's in their own systems) gets a lot more of restrictions than data that has absolutely no indications of whether anybody is allowed to touch it (removable media without file permissions). That's completely backwards. Either restrict all or restrict none. Or at least provide an override for when the OS assumption turns out to be wrong.

What ticks you off most is that you've falsely assumed that a typical user would actually notice if an OS didn't allow the security of another OS to be violated.

For example; for my network almost all files come from the Internet without any permissions, and files moving between computers/OSs use networked file systems that uphold the security. I wouldn't know if any of the OS's I use do or don't allow the security of another OS to be violated; except for files that come from things like Steam or Origin (that use an additional DRM system on top of the OS to prevent "copied against owner's permission" executables from correctly executing).


Cheers,

Brendan

It's unethical for an OS to allow

It looks to me like the common "We'll make it hard or impossible for normal users to do what they want, and bad guys will figure a method anyway (by e.g. using a less ethical OS, whatever that means)".

It doesn't work.

Hi,

dozniak wrote:

It's unethical for an OS to allow

It looks to me like the common "We'll make it hard or impossible for normal users to do what they want, and bad guys will figure a method anyway (by e.g. using a less ethical OS, whatever that means)".

It doesn't work.

Then you're mistaken. If you think ethics are are important then ethics should be the only reason you need; and if you don't think ethics are important then you're probably too busy punching stranger's babies to care either way.


Cheers,

Brendan

The point we're all trying to point out to you is that you're barking up the wrong tree, Brendan.

Permissions are for an OS to control access policy while the OS is running and in control of that access. They are a tool. Flags. No more.

If I am running a different OS with physical access to your hard drive (since I am able to mount it), then obviously I have sufficient permission to access that hard drive. The only OS permissions that are significant are the ones of the OS currently running, and in this OS I am root, making ignoring your OS' permissions a non-issue. What does your OS know about the policies of my OS? Nothing. Your flags are invalid. If I shouldn't be able to mount your hard drive, you should have either denied me physical access, or encrypted your drive.

Claiming that exercising my rights as superuser of the currently running OS, which by design includes ignoring access permissions on any volume I can mount physically, would be in some way "unethical", is just ridiculous.

Hi,

Solar wrote:The point we're all trying to point out to you is that you're barking up the wrong tree, Brendan.

Permissions are for an OS to control access policy while the OS is running and in control of that access. They are a tool. Flags. No more.

If I am running a different OS with physical access to your hard drive (since I am able to mount it), then obviously I have sufficient permission to access that hard drive. The only OS permissions that are significant are the ones of the OS currently running, and in this OS I am root, making ignoring your OS' permissions a non-issue. What does your OS know about the policies of my OS? Nothing. Your flags are invalid. If I shouldn't be able to mount your hard drive, you should have either denied me physical access, or encrypted your drive.

Claiming that exercising my rights as superuser of the currently running OS, which by design includes ignoring access permissions on any volume I can mount physically, would be in some way "unethical", is just ridiculous.

Can you state a logical reason for any of these unfounded assertions? Why do you think that "while the OS is running and in control of that access" is the only thing that matters? Why do you think it's "obvious" that the ability to do something implies the right to do something? What makes you think that permissions that don't exist (because that file system does not belong to the OS) are more important than permissions that do exist (and were created by the OS that the file system belongs to)?

So far every argument against it has had no basis in ethics, and has consisted of either opinion without substance, practical considerations without regard to what is right, or vapour; and to be perfectly honest I suspect that if ancient OS developers had a reason to consider it and did what is right instead of merely doing what is easy, then all of you people would be arguing that it's wrong to disregard permissions (without being able to say why) instead of arguing that it's right to disregard permissions (without being able to say why).

If you truly believe that OSs should disregard each other's permissions; prove it by implementing an FTP or HTTP or NFS server for your OS that allows a remote computer to access files without regard to your OS's file permissions.


Cheers,

Brendan

In the original context (technical reason for/against using the GPT partition type field) this whole ethics argument is clearly a red herring: I will use GPT for file system format (technical argument) => That conflicts with existing use of the field and does not yield any benefits (technical argument) => But existing practice is unethical (moral argument).

Can we just stop the ethical bullshit here? It does not seem that an end of the discussion is possible based on the different axioms that anyone has.

For sure I know that I won't use an OS that refuses to unpack .tar for ethical reasons.

Korona wrote:In the original context (technical reason for/against using the GPT partition type field) this whole ethics argument is clearly a red herring: I will use GPT for file system format (technical argument) => That conflicts with existing use of the field and does not yield any benefits (technical argument) => But existing practice is unethical (moral argument).

Can we just stop the ethical bullshit here? It does not seem that an end of the discussion is possible based on the different axioms that anyone has.

For sure I know that I won't use an OS that refuses to unpack .tar for ethical reasons.

You may follow "existing use" adding to disregarding the specification, or you may use it sanely, as it is intended
to be used, but taking into account there are stupid uses alongside (handling them).
I asked about Attributes field, do you agree that that field is intended (by the spec) for the use you so insist on?
If so, why should you continue to abuse the standard even creating something new?
If you are so inclined to take into account "existing use", wouldn't it be more right to chose the second approach?

PS. Most time your OS won't deal with the foreign "existing use", so it's not as terrible to drop that blind aligning with them.

zaval wrote:PS. Most time your OS won't deal with the foreign "existing use", so it's not as terrible to drop that blind aligning with them.

I disagree with that. I'm not interested in implementing custom partition support in parted or in GRUB (and that would be the minimum requirement for using different GPT values). I would cost me quite some time to do that and I'd probably never get such patches upstream. Neither do I want to integrate custom partition support into the Linux kernel as I often mount my OS' flash drive under Linux. Being able to just plug the flash drive into a Linux PC to copy files to/from the drive is incredibly useful. Compatibility with existing tools decreases development effort tremendously. We all wouldn't be able to actually write kernels if we were not using tools that have been written by others.

for this case you might use "interoperabilty mode" - put your OS on the partition marked the way your preferred external tools understand.
But with the reasoning you gave, it would be impossible to add anything, not only a sane use of PartitionTypeGUID, you are forever bound to only what "linux, grub, whatever" are going to take "upstream". it's not like exstensible standards work. if they won't add something new (which is perfectly inline with specs), screw them.

Nonsense. An OS designer must (intentionally or unintentionally) choose between enforcing or bypassing the security policies of other OSs; and the OS is the only entity able to enforce the ethics (or lack of ethics) involved in that choice.

Isn't there another entity who is much better equipped to make these ethical judgements? Yes, there is, namely the human who is using the computer, and who paid for an operating system that should just work. Who needs a rebellious operating system with an attitude?

If there are 2 operating systems on a computer, you are the administrator of one OS and I am the administrator of the other OS; then you should be ignored whenever I want to access data on your OS regardless of how hard you try to use file system permissions to explicitly deny my access to your OS's files?

If I am trying to use file system permissions in my OS expecting to deny you access to my files inside your OS, I must truly be out of my mind. I would definitely not allow another person to run an arbitrary OS on my own computer where I store sensitive data unless I trust them, nor would I store sensitive personal data on someone else's computer that I don't trust.

You are an OS developer, not an administrator; and you have no possible way of guessing what any of the thousands of different administrators have actually done with a variety of different OSs that have nothing to do with you on a huge number of different computers that you will never see.

And why would this matter? We are talking about what devices may be accessed by a non-administrator user on my OS, based on what the administrator of my OS has allowed. I don't see how other OSes enter into the picture here.

A 12 year old steals your Mother's laptop containing her online banking details. They plug her hard drive into their computer which is running your OS, and your OS trusts a 12 year old thief with your Mother's online banking passwords simply because they happen to be the "head janitor" for that computer. When you find out that your Mother's bank accounts have all been emptied and that your Mother has been living as a homeless person for the last 2 weeks (evicted for not being able to pay rent), you tell yourself "Isn't it nice that my OS allowed this!".

Or, I am a kitchen utensils manufacturer, and a 12 year old goes into the kitchen drawer and takes a meat knife. Then they grab a ladder and climb onto the balcony of my mom's apartment, smash the window, step inside and promptly stab her fatally in the neck. Oh god, now she's dead! Isn't it nice that my knife allowed this, like virtually every other meat knife in the world? But hold on, if there were no knives, we would have a difficult time eating without making a mess.

Besides, if it is "their computer", it means they are not merely the "head janitor", but they are its legitimate owner, and can do anything with it, including installing a proper OS such as Windows or Linux whereupon they would go on to steal the exact same banking passwords.

Obviously I meant "legal in the eyes of the OS's security policy" and not "legal in the eyes of the law".

Then, why are you bringing up issues such as who is the lawful owner of the data?

Hi,

Gigasoft wrote:

Nonsense. An OS designer must (intentionally or unintentionally) choose between enforcing or bypassing the security policies of other OSs; and the OS is the only entity able to enforce the ethics (or lack of ethics) involved in that choice.

Isn't there another entity who is much better equipped to make these ethical judgements? Yes, there is, namely the human who is using the computer, and who paid for an operating system that should just work. Who needs a rebellious operating system with an attitude?

The assumption that the admin of one OS has any authority on any other OS is incredibly stupid. For an example (intended only to show how stupid this assumption is); I am the admin of the OS I'm currently using, therefore you should trust me and let me have complete control over every file on all of your OSs (including giving me the ability to prevent the admin of your OSs from being able to log in).

An OS developer is the only one that is able to choose between OS design choices. If the OS designer is incredibly stupid and assumes that the admin of one OS has any authority on any other OS, then the OS designer has decided to allow a potentially malicious attacker (the admin of an OS that was designed by someone incredibly stupid) to access files without permission.

Note that "physical access" is also meaningless (e.g. millions of employees around the world have physical access to work computers but no authority).

Gigasoft wrote:

If there are 2 operating systems on a computer, you are the administrator of one OS and I am the administrator of the other OS; then you should be ignored whenever I want to access data on your OS regardless of how hard you try to use file system permissions to explicitly deny my access to your OS's files?

If I am trying to use file system permissions in my OS expecting to deny you access to my files inside your OS, I must truly be out of my mind. I would definitely not allow another person to run an arbitrary OS on my own computer where I store sensitive data unless I trust them, nor would I store sensitive personal data on someone else's computer that I don't trust.

Neither would I; but only because I know that existing OSs are poorly designed. If the "untrusted admin" is using a well designed OS the only thing they could do is delete partitions (that can be restored from backup); and there'd be no real reason for anyone to worry about (e.g.) the same laptop having a "home OS" (where the admin is the computer's owner who is an employee) and a "work OS" (where the admin is appointed by the company that the computer's owner works for).

Gigasoft wrote:

You are an OS developer, not an administrator; and you have no possible way of guessing what any of the thousands of different administrators have actually done with a variety of different OSs that have nothing to do with you on a huge number of different computers that you will never see.

And why would this matter? We are talking about what devices may be accessed by a non-administrator user on my OS, based on what the administrator of my OS has allowed. I don't see how other OSes enter into the picture here.

It matters because you are/were looking at things from the perspective of an administrator (that trusts himself), and not looking at it from the perspective of an OS designer (that has no reason to trust any administrator). As soon as you drop the false assumption that the admin is trustworthy, "based on what the administrator of my OS has allowed" becomes "based on what an untrustworthy consumer has allowed".

Gigasoft wrote:Besides, if it is "their computer", it means they are not merely the "head janitor", but they are its legitimate owner, and can do anything with it, including installing a proper OS such as Windows or Linux whereupon they would go on to steal the exact same banking passwords.

How can an OS designer know if "admin" is the legitimate owner of the hardware, or if "admin" is just someone employed to keep things running smoothly that own nothing? They can't. An OS designer (and therefore the OS they design) can't assume that "admin" owns anything.

Gigasoft wrote:

Obviously I meant "legal in the eyes of the OS's security policy" and not "legal in the eyes of the law".

Then, why are you bringing up issues such as who is the lawful owner of the data?

Because (based on copyright law) the lawful owner of the data is the only one (legally) able to grant (legal) permission to others, and it's the owner's (legal) permissions that the OS's security system is meant to be designed to uphold. An OS's "file permissions" are just part of the mechanism operating systems provide to (try to) uphold the owner's (legal) permissions. It's just that (for practical and other reasons) an OS security systems have always been extremely bad at the job they're designed to do and the relationship between legal permissions and file permissions hard to discern.


Cheers,

Brendan

It honestly sounds Brendan is more worried about being able to bring up good lawyer excuses on a potential lawsuit than actually caring about the users (and it wouldn't matter anyway because anybody with enough money can easily screw up over you on court no matter how crap are their arguments).

And for the record:

Brendan wrote:Would you mind if I claimed your OS "has only a limited commercially significant purpose or use, other than to circumvent technological measures" and had your OS banned in multiple countries (due to the WIPO Copyright Treaty that "prohibits circumvention of technological measures for the protection of works")?

There's a good (for vendors) reason for the move towards locked down systems. If they could get away with it, they'd have already made it illegal for anybody but the manufacturer of the hardware to develop the software that runs on it. How would that favor users at all is beyond me, only the shareholders of the few privileged companies would gain anything from it when that happens. Especially these days where something like that would mean they practically own your life (given how much data is on our devices and how much we rely on them to communicate and to perform our tasks).

Hi,

Sik wrote:It honestly sounds Brendan is more worried about being able to bring up good lawyer excuses on a potential lawsuit than actually caring about the users (and it wouldn't matter anyway because anybody with enough money can easily screw up over you on court no matter how crap are their arguments).

No; I care about doing what is right (and not what is easy or what is traditional), which includes caring about the security of users of other OSs that might be compromised by users of my OS (instead of being selfish and only caring about the security of users of my OS).

Sik wrote:And for the record:

Brendan wrote:Would you mind if I claimed your OS "has only a limited commercially significant purpose or use, other than to circumvent technological measures" and had your OS banned in multiple countries (due to the WIPO Copyright Treaty that "prohibits circumvention of technological measures for the protection of works")?

There's a good (for vendors) reason for the move towards locked down systems. If they could get away with it, they'd have already made it illegal for anybody but the manufacturer of the hardware to develop the software that runs on it. How would that favor users at all is beyond me, only the shareholders of the few privileged companies would gain anything from it when that happens. Especially these days where something like that would mean they practically own your life (given how much data is on our devices and how much we rely on them to communicate and to perform our tasks).

Without WIPO: A company knows that it's legal for someone to flood the market with devices designed to remove security measures that protect copyrights; so they lock things down extremely hard.

With WIPO: A company knows that it's not legal for someone to flood the market with devices designed to remove security measures that protect copyrights; so they lock things down slightly less hard.

It's the "locking down" part you don't like, but WIPO isn't to blame. Most of "locking down" you're talking about is a cultural difference between "computer and software are 2 different products" (standard practice for general purpose PCs, etc) and "computer+software is a single product" (standard practice for embedded devices including mobile phones).


Cheers,

Brendan

Can we please stick to the technical issues, rather than mire ourselves in inherently unresolvable arguments about 'ethics'? At the very least, let's move this discussion to a separate thread (at least two, actually, since the original side point about GPT wasn't in regards to whether your OS should honor the file permissions of a different OS), and let the original question about user experience and command line arguments stand on its own, please.

Seriously. If you do that, I will refrain from snarky comments about the applicability of either ACL-style file permissions or conventional command-line interpreters in modern OS design (beyond this sentence, and a link to this NSFW discussion on the Daily WTF's forum), OK?

dozniak wrote:

It's unethical for an OS to allow

It looks to me like the common "We'll make it hard or impossible for normal users to do what they want, and bad guys will figure a method anyway (by e.g. using a less ethical OS, whatever that means)".

It doesn't work.

Exactly. It is a good thing to be able to see everything an OS hides. Like you have a Windows system (or a Linux system), you boot it to your own OS that doesn't hide anything, and then you (as a user and owner of the system), can do anything you like, including viewing hidden files and partitions. This was highly useful for me to find out what the hidden EFI partition actually contained, as Windows didn't allow me to inspect it.

Let's face it, most of this hidden stuff is to hinder user control and to lock-down you to specific OSes.