3 ms·
Either you don't understand what arbitrary code is or you're just too angry with Apple to want to understand it. But apps either run static code or use the Safa
by dep_b 8y ago
Either you don't understand what arbitrary code is or you're just too angry with Apple to want to understand it. But apps either run static code or use the Safari JS engine to run code. That's all the flavors you have. Statically compiled Swift code is much easier to deal with than whatever creative things somebody can come up with with JS.
- shmerl 8y agoAll browsers should care about security. All browsers can have vulnerabilities. It's not an excuse to ban competing browsers if users want to install them. That's the essence of the matter. Apple's behavior is anti-competitive in doing it. In fact, I'd argue that it reduces security, since users can't install more secure browsers than Apple's own one (and no one would care to even make one since it won't be usable).
- kllrnohj 8y agoStatic code IS arbitrary code. Apple didn't author it and didn't vet it. They ran a static analyzer over it (not remotely foolproof) and then trusted the actual security to the process sandbox. Besides, nothing stops you from still running arbitrary code in iOS downloaded from the web. You're simply restricted to doing that either interpreted or via Apple's JIT. In either case you're still getting arbitrary execution that Apple never statically analyzed, interacting with any APIs that the app wants that code to have access to (intentionally or not).