Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Got an old Raspberry Pi spare? Try RISC OS. It is, something else

theregister.com

Post reply on HN
Print view View original

111–120 of 205 posts

Re: Got an old Raspberry Pi spare? Try RISC OS. It is, something else

#111

Post by cess11 »

_akhe wrote: post #42

Raspberry Pi is amazing. Everything from the size and simplicity of hardware to that of Raspbian. Super moddable, modular, surprisingly performant. As a lot of others do, I use one for most of my sites and apps as a home server. 15+ apps, sites, and APIs running on this thing 24/7/365 over WiFi. What would be the benefit of using RISC OS over Raspbian, or even Ubuntu Server? Is it pure nostalgia like running Windows…

It's raw, like if you had a Forth system with a GUI that isn't aggressively obtuse. You can touch everything in it with a BASIC dialect, and at least in some variants drop into assembler and run the hardware somewhat directly.

This allows e.g. interesting graphics programming, and there's very little that gets in the way of immediately testing ideas.

Re: Got an old Raspberry Pi spare? Try RISC OS. It is, something else

#112

Post by mavhc »

rbanffy wrote: post #98
dvdkon wrote: post #96

Earlier quoted context omitted.

Today, the same OS core is used in phones, laptops, desktops and servers. Explicitly making it single-user means giving up on servers and parts of the market for the former three. You could make the case for removing the concept of users from the kernel and forcing the OS to write some security plugin. The OS could then have a tailored security mechanism for every usecase, but they'd probably end up including users a…

One such case is company-issued phones. They require the company-provided apps to be isolated from any user-specific configuration, creating an effective multi-user system where user apps (such as Apple Music) run with different privileges (and network access) than, say, Teams or Outlook.

Every app on your phone runs as a different user

Re: Got an old Raspberry Pi spare? Try RISC OS. It is, something else

#113

Post by pjmlp »

saagarjha wrote: post #90
pjmlp wrote: post #84

Earlier quoted context omitted.

Unless one works for the games industry, does IT at big corp, embedded devices programming.

None of which are particularly sexy, unfortunately.

Given the hoards of candidates for game development and IoT jobs, putting up with the pay and hours, at least two of those are quite sexy.

Re: Got an old Raspberry Pi spare? Try RISC OS. It is, something else

#114

Post by pjmlp »

ptman wrote: post #93
pjmlp wrote: post #80

Earlier quoted context omitted.

OS security always requires a concept of a user, unless you want to run all processes under the same identity.

You could do with some other concept than users. E.g. namespaces or capabilities.

It is another way to call a "user", hence why I used the word indentity instead.

Re: Got an old Raspberry Pi spare? Try RISC OS. It is, something else

#115

Post by mavhc »

eddd-ddde wrote: post #57
mikepurvis wrote: post #50

Earlier quoted context omitted.

Modern multi-user paradigms also have very weird ideas of what’s shared. Like, installing or updating software is the same permission tier as accessing another user’s documents, wtf?

_Technically_ it doesn't have to be. Super user is super user. It can always access anyone's files. Allowing unrestricted access to super user essentially destroys any sense of security. You can very much allow only access to certain commands under super user, e.g. only allow users to run pacman. Of course now you are trusting that said commands won't leak the permissions. I agree that it's a mess. My personal and bi…

https://xkcd.com/1200/

Re: Got an old Raspberry Pi spare? Try RISC OS. It is, something else

#116

Post by pjmlp »

tech2 wrote: post #92
jl6 wrote: post #88

Earlier quoted context omitted.

3rd party apps are written (controlled) by other people, and you are effectively granting that 3rd party permission to run their code on your device, so the user concept isn’t that far off the mark. Since ~nobody reads the source code of 3rd party apps, security vetting is usually a matter of deciding to trust the app’s author, same as how you would trust anyone else that you give a user account to.

You grant them capabilities, a handle which permits access to a particular directory, one which allows network access (or possibly even further limited than that) etc. No user, just a series of object handles which permit them to perform the task and nothing more.

Capabilites are just another way of doing role management in processes, and require identities for administration anyway.

It is yet another way of managing processes identitities.

Re: Got an old Raspberry Pi spare? Try RISC OS. It is, something else

#117

Post by pjmlp »

saagarjha wrote: post #89
pjmlp wrote: post #80

Earlier quoted context omitted.

OS security always requires a concept of a user, unless you want to run all processes under the same identity.

This is a very Android centric viewpoint ;)

Even iOS has different users for all those processes running on the device. :)

Re: Got an old Raspberry Pi spare? Try RISC OS. It is, something else

#118

Post by josephg »

rbanffy wrote: post #98
dvdkon wrote: post #96

Earlier quoted context omitted.

Today, the same OS core is used in phones, laptops, desktops and servers. Explicitly making it single-user means giving up on servers and parts of the market for the former three. You could make the case for removing the concept of users from the kernel and forcing the OS to write some security plugin. The OS could then have a tailored security mechanism for every usecase, but they'd probably end up including users a…

One such case is company-issued phones. They require the company-provided apps to be isolated from any user-specific configuration, creating an effective multi-user system where user apps (such as Apple Music) run with different privileges (and network access) than, say, Teams or Outlook.

I think this is a good idea anyway. I love how if I install some dodgy app on my phone, it can't access the private, stored data of other apps. It can't steal my google or facebook credentials. And it can't cryptolocker my filesystem.

My desktop computers are designed with this old "user security" model that I don't use at all - since I'm the only user anyway. User security protects ... uh, the operating system I suppose, which I could reinstall in 20 minutes anyway. But we're missing a much more important security boundary - which is between one bad program and all my other stuff. Every program you run today on desktop is inexplicably executed with full permission over all of your private files, and, worse, it has full network access. Its an insanely terrible design.

We /could/ retrofit the user security model to help us isolate applications. But personally I think it would be easier to just design and implement something good from scratch.

(For the security people in the room, the threat model is a bad program, or single bad npm package gets pulled into a program you run. How do we limit the blast radius?)

Re: Got an old Raspberry Pi spare? Try RISC OS. It is, something else

#119

Post by josephg »

pjmlp wrote: post #114
ptman wrote: post #93

Earlier quoted context omitted.

You could do with some other concept than users. E.g. namespaces or capabilities.

It is another way to call a "user", hence why I used the word indentity instead.

No its not. There's all sorts of stuff you can do with capabilities that are really awkward to even think about with users. Like, when a database starts, you can hand it the capabilities it needs to access a specific directory, listen on a specific port and append (but not read) a specific log file.

User based security is usually done by the folder being owned by the database, or an ACL or something. But with capabilities, you don't need to make a database user or set any flags on the folder, or make sure the database's configuration matches the filesystem permissions. The capability is basically a pre baked file handle that can be used directly. And capabilities can do lots more stuff! They can be more fine grained - eg, "Whatsapp can only access these specific photos in my camera roll". And a program can pass a subset of its capabilities to a child process.

Re: Got an old Raspberry Pi spare? Try RISC OS. It is, something else

#120

Post by msla »

qwerty456127 wrote: post #47
ajb wrote: post #7

It was ahead of its time in UX, but rather behind in the foundations. It's a single user system with no real security, and there was no system of shared libraries - to share code between applications, it was usual to put the shared code in a kernel module and call the kernel. Even the standard C library worked this way. Amusingly, when you invoked the system console -which was at a lower level than the gui system, ef…

> rather behind in the foundations. It's a single user system with no real security I believe multi-user systems are actually an ancient, outdated rather than a "modern" concept. It made sense when computers were huge, expensive and many users shared one even at work, let alone at home. Nowadays computers are almost never shared. Even when people used to have just one home PC per family (during pre-Win7 days) they mo…

Single-user means I have to trust everything I run.

I mean, some of us here actually remember MS-DOS. It's not a huge secret to us.

Post reply on HN