Hacker News

points by ale42 1 day ago | 0 comments

Of course they pass system integrity. The whole point of the thing is not "it should be secure", it's "the user has not messed with it so we control it".

[–] Borealid 1 day ago

If the device is "insecure", doesn't that mean you - as a user - can exploit one of those insecurities to "mess with" the device without system integrity being aware?

Or are you saying the device is insecure BUT has no local privilege escalations you can take advantage of as a user?

[–] hedora 1 day ago

It means the spyware information flow and Google's ability to remotely modify the device have not been disabled.

[–] Muromec 1 day ago

It could have RCE but not privilige escalation. But I don't buy it, because 5 years without kernel patches is at least 5 escalation exploits being written by the an llm in 5 minutes

[–] Muromec 1 day ago

Well, yes? The law says that the bank should do the thing and the bank does the thing to the best of it's ability, given what people usually work there.

[–] Sayrus 1 day ago

> the bank does the thing to the best of it's ability

No they don't. At best, they do a cost-effective proxy for what should be done.

[–] Muromec 1 day ago

Oh, you have no idea. It's not even about costs. In a 200 year old company the level of corporate disfunction and the average skill level of people is something else entirely. Nothing ever happens unless the regulator holds a blowtorch wired to a timer to the CEO's ass.