Chromebooks had a screw you could remove on the motheboard to fully unlock them to do whatever you want. Something no one would do by accident. This was a reasonable solution from the less-evil Google days.

> I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.

You just described what Samsung does with their phones. You can unlock them, but even if you later switch back to the normal OS, some features are permanently disabled by that fuse.

I've seen malware popups that give detailed steps on how to install the app on Android. You can put up all the scary warnings you want but if someone really wants to install some scam app, they will click past everything.

I really wish we could have a simple "don't bother me, I know what I'm doing" switch on these phones but I can certainly understand the reasons why Apple and Google are putting in as many roadblocks as possible to protect users from themselves.

Maybe we should be specific when we mean “secure”. What you mean is like “secure MDM”, when the adversary is the user. The parent meant “secure against external adversaries”.

Lumping consumer devices with the need for secure business devices and often offloading that to personal devices is the problem.

I wish they stop finding ways to lock down the device in the name of security and/or release different SKUs for the more secure use cases, provided by the organizations themselves if they deem it necessary.

It's true! The EU forced Apple to make it so you can install apps from third parties and every day iPhones are found haunted by malware! That's why root exploits only exist in Europe!

Well, except that one-click PDF persistent root exploit American researchers found, and there not being any sort of iOS malware wave in the EU.

Ah. So Apple -must- take freedoms away from everyone to install any software they want, to protect us. They could not possibly have a "format and void your warranty to unlock all features" switch on the motherboard like chromebooks have. Or the "get a one time warranty-voiding code from manufacturer" code like Samsung and other Android vendors have. Apple must make sure the path to freedom does not exist, for Grandma.

Grandma does not need the freedom to install the DeFlock or ICEBlock to help protect herself and her neighbors, right? Tim Cook is a Trump doner but of course has no political bias, and remains confident ICE and law enforcement always behave ethically so there is nothing to fear.

A corporation takes away basic freedoms of people over the tools they use to communicate with society, and then consumers get on the internet in public forums and -defend- them for it. Unbelievable.

I really hope you do not vote with this type of thinking.

Except “my Mac’s very secure and I can install whatever I want” is a complete fallacy. It isn’t secure - case in point Muse recently trawling through people’s messages. Or Mac cleaner like apps that trick users into installing them and giving liberal access.

I think if you don’t get the point of protecting a device against the user, you’ve not had to help un-tech savvy relatives get out of situations where dark or confusing UI practices have got themselves into a mess.

I have interviewed countless infosec workers who have never compiled an operating system from source, or even comfortable installing an OS on their own hardware, let alone any clue how to harden one or how basic Linux syscalls work... these are mostly not people we should be looking to for operating system advice.

As an serial OS architect and infosec worker myself with over two decades of experience in OS hardening, and many critical public finds impacting nearly every fortune 500 company, I do not use Apple or Google products at all. They are both complete shit at security and privacy, among other reasons.

Skill issue.

I do not own a cell phone, but I build my operating systems from 386 bytes of machine code all the way up to dual hardware anchored remotely attestable servers with memory encryption and hardware anchored disk encryption, and can do whatever I want on them with confidence.

I even rack my own GPUs at home and own my own AI and "Cloud" too for less than the price of a used car.

The motivated and technical can do virtually anything with tech with total sovereignty and privacy. It has never been easier.

So make it kid mode by default, and require technical expertise to unlock it. Stop making excuses for corpos stripping freedoms from everyone because tech illiterate people exist.

> In my case, it is the fact that a secure and free (as in speech) alternative does not exist that leads me to believe that.

I don't think that is a logical statement. Just something doesn't exist, does not prove that it can't exist. You need a stronger proof than that to show that in my opinion. At some point, you have to empower your users and trust them to do the right thing.