But a bunch of the methods we have for securing, say, mobile phones, grew out of user accounts.

Personally I don't know Android innards deeply, but when I was trying to backup and restore a rooted phone I did notice that every app's files have a different owner uid/gid and the apps typically won't launch without that set up correctly. So it would seem they implemented per-app separation in this instance by having a uid per app.

Imagine a world where Google had chosen to build on a kernel that had spent many decades with no filesystem permissions at all. Perhaps they'd have to pay the same app compatibility costs that Microsoft did going from 9x to NT kernel, or changing the default filesystem to ACL'd-down NTFS.

Then you'd maybe get something like iOS, where the POSIX uid practically does not matter at all, and the strong security and separation is provided by other mechanisms like entitlements...

Someone else pointed out that BeOS allegedly had "quality and security" problems in general (I myself have no idea), so that may indeed have led to problems down the line, whereas BSD was pretty solid. But I agree with the OP and don't think POSIX security in particular is much of a factor today.

Yeah. Funny enough, if Apple had skipped OS X and gone directly to iOS, BeOS would have been a superior foundation. No uselessly mismatched security model or crusty legacy API baggage to clog up the new revolution in single-user always-online low-powered mobile devices.

Of course, that was in back in the days when an entire platform from hardware to userland could be exclusively optimized to utterly and comprehensively smash it in just one very specific and precisely targeted market. Which is, of course, exactly what the iPhone was.

Just as the first Apple Macintosh a decade earlier eschewed not only multi-user, multi-process, and even a kernel; every single bit and cycle its being being exclusive dedicated to delivering a revolutionary consumer UI experience instead!

In comparison, NeXTSTEP, which ultimately became iOS, is just one great huge glorious bodge. “Worse is Better” indeed!

..

Honesly, poor Be was just really unlucky in timing: a few years too late to usurp SGI; a few too early to take the vast online rich-content-streaming world all for its own. Just imagine… a BeOS-based smartphone hitting the global market in 2000, complete with live streaming AV media and conferencing from launch! And Oh!, how every Mac OS and Windows neckbeards would’ve screamed at that!:)

On a similar note, I've often wondered what Commodore's OS would have turned into. Not out of some misplaced nostalgia, just curiousity about the Could Have Been.

My guess is that by now in 2020, it would have at some point had an OSX moment where Commodore would have had to chuck it out, since both Apple and Microsoft have effectively done exactly that since then. Still, I'd love to peek into Amiga OS 9 descended from continual usage.

I think AmigaOS 3 could be a nice kernel as it is. And to make it more Unix-y memory protection could be introduced but only for a new userland process with more traditional syscalls.

It's a bit how DragonflyBSD is slowly converging to.

Amiga OS 9 would have looked very different from the Amiga OS that we know (I am talking from a developer's point of view, not about the GUI).

Since inter-process communication in Amiga OS was based on message passing with memory-sharing, it was impossible to add MMU-based memory protection later. As far as I know, even Amiga OS 4 (which runs on PowerPC platforms) is not able to provide full memory protection.

There was also only minimal support for resource tracking (although it was originally planned for the user interface). If a process crashed, its windows etc. would stay open. And nobody prevented a process to pass pointers to allocated system resources (e.g. a window) to other processes.

The API was incomplete and tied to the hardware, especially for everything concerning graphics. This encouraged programmers to directly access the hardware and the internal data structures of the OS. This situation was greatly improved in Amiga OS 3, of course far too late. Amiga OS 3 was basically two or three years too late. As far as I know, Apple provided much cleaner APIs, which greatly simplified later the evolution of their OS without breaking all existing programs.

Finally, the entire OS was designed for single-core CPUs. At several places in the OS, it is assumed that only one process can run at a time. This doesn't sound like a big issue (could be fixed, right?) but so far nobody has managed to port Amiga OS to multi-core CPUs (Amiga OS4 runs on multi-core CPUs, but it can only use one core).

I have been the owner of an Amiga 500 and Amiga 1200, but to be brutally honest, I see Amiga as a one-hit wonder. After the initial design in the mid-1980s, development of the OS and the hardware basically stopped.

> Since inter-process communication in Amiga OS was based on message passing with memory-sharing, it was impossible to add MMU-based memory protection later.

Why can't you do shared memory message passing with MMU protection? There is no reason an application in a modern memory protected OS can't voluntarily share pages when the use case is appropriate. This happens today. You can mmap the same pages, you can use posix shm, X has the shm extension...

Or just take a Docker-like approach, where each app thinks it is the only user and intra-app communication is where you put the security functionality

But the predecessor to containers were features like having daemons chroot into somewhere else and drop their uid to something that can't do much. That very much grew out of the Unix solutions. If Unix daemons were written for decades assuming all processes have equal privilege maybe we wouldn't see that.

I think this sort of thing is a capabilities ladder in an arms race.

If you never evolved account based security, you never built the infra for even evaluating application permissions in the first place.

“Security” is a bit of a misnomer in this context: I think what you actually meant was “multi-user architecture” which, as remarked elsewhere, undergirds the whole notion of keeping processes from promiscuously sharing any and all resources.

yeah i think of it more as multi tenet safety

Yes, in short - users & groups serve as a rudimentary implementation of capabilities. Best example is Android. But there's more to it.

Separating admin user from non admin user always has advantages and I do it even on Windows.

Best counter example to their point is iOS, though, where POSIX permissions don't play much of a role in securing the system and separation applications.

I do like that you have to “sudo” a program to allow it to access certain files. Even if I am the only user, it stops malicious programs from modifying certain files without me noticing.

Obligatory related xkcd: https://xkcd.com/1200/

Posting links to XKCD like this is generally considered to be a low quality post, hence the downvotes. I’m not one of the downvoters, but thought I’d share the reason as nobody else did.

Edit: gotta love HN! I try to be helpful to someone else that was downvoted to heck with an explanation of why that was the case (based on past replies I’ve seen) and now my post is the own with a negative score. Cheers y’all!

First rule about downvotes is we don't talk about downvotes.

Under the hood though there's multiple accounts which different applications use, the user might only log in with one but applications are isolated from each other and the system because of it.

Security from malicious programs or exploits, accidentally altering system files and other device users.

We used to be able to trust intentionally installed programs not to exfiltrate data. It's sad that we still can't.

Wouldn't the median need to be over 1? I get your point but am feeling pedantic today.

If more than 50% of personal computers have 1 or 0 users, then the median would be 1, assuming 0 users is less common than 1, regardless of how many users the remaining computers had.

If more than (or equal to) half of computers are used by only one person, then the median user count is 1, no?

If you have 3 PCs in the world, one with 0 users, one with 1 user and one with 23 users the median is 1.

Median is literally the middle, like a highway.

They're just stating that having more than half of all computers with just 1 user guarantees that the median is 1.

No.

For example, suppose five computers have 1 user, 1 user, 1 user, 3 users, 300 users. The median is 1 user.

The claim of "median 1 user" just means more than half of computers has a single user.