4 ms·

I'm not sure why I read John Gruber anymore. I get my hopes up that perhaps I'll see some of the smart, incisive that I remember from years ago, but instead I s

I'm not sure why I read John Gruber anymore. I get my hopes up that perhaps I'll see some of the smart, incisive that I remember from years ago, but instead I see another pretty baseless apology for Apple's behavior. He may actually be correct in this case, but it's hard to take him seriously given that he seems to bend over backwards to interpret Apple's actions as charitably as possible. This post is certainly more defensible than his recent defense of Apple's 30% application revenue power-grab, but I am skeptical that it was written in any better faith. With every thing he writes like this, he's behaving more like a fanboy and less like a reliable source of information. It's a bit sad.

tjogin 16y ago
So, even if he's right, he's wrong?
- stephenjudkins 16y ago
  If I'm looking for the most reasonably explanation for Apple's behavior that still manages to cast them in a good light, I'll read Gruber. If I'm looking for the most reasonable possible explanation, full stop, I'll read elsewhere.
- abraham 16y ago
  A broken analog clock is only right twice a day.
spamizbad 16y ago
His reasoning seems shaky to me. Assuming this new JS engine is a security risk (it's not really, but lets pretend) you're not protecting anyone by making it Safari-only. It'd be like leaving all your ground-floor windows wide open, whilst locking your front and back doors in hopes that it will discourage burglars. If the new JS engine is a security problem either fix it or remove it. Compromise helps no one.
- bigiain 16y ago
  I'm not sure which I'd rather see - Gruber being proved wrong (again), or a whole class of new remote "visit this site to jailbreak your iPhone" exploits...
- rayiner 16y ago
  It's not the JS engine that's the security problem. It's that the JS engine requires allowing apps to mark pages as executable. Executable pages opens up a whole another vector of attacks that have nothing to do with dangerous JS apps.
  - kenjackson 16y ago
    That doesn't make any sense. It requires allowing the JIT to mark pages as executable. But that's exactly the same as the browser. There should not be any new security vector exposed that's not already there from the browser.
    - rahoulb 16y ago
      But aren't they within the same process? (I'm asking an honest question - I know nothing of iOS internals). Doesn't that imply that the JIT has privileged access to pages that other code within the same process does not? As saurik (who knows about these things) mentions elsewhere, Apple can trust Safari to not tamper with the executable pages - can they trust 3rd party apps? Home-screen based web-apps being another question entirely.
      - kenjackson 16y ago
        They might be in the same process. I guess they don't do process isolation for hosted browser controls? If not, they should. Otherwise the app stack is always at risk of running arbitrary javascript in process.
    - Someone 16y ago
      The new vector is that, in Safari's case, Apple audited the code that calls the JIT. If UIWebView could JIT, somebody would write an app that dumps the JITs code (I assume that ARM does not have the ability to mark pages as 'executable, but not readable') and run it on a development system. From there, (s)he would figure out what the JIT does to make data executable. That knowledge could be used in an app that can execute code that Apple hasn't seen. Of course, that app would need to pass the app store approval process to be useful, but that should not be hard. A way around this is to move the JIT to the kernel or to a different process. I would guess that that would hinder performance so much that, in typical usage, JIT-ting becomes too expensive to speed up things. Alternatively, Apple could not have spent the time to do so (yet).
ryanisinallofus 16y ago
Man. I totally agree with you but you knew you were going to sacrifice some karma for saying this.
alanstorm 16y ago
You can't read Gruber in the same context you did five or six years ago. At this point he's an established journalisty blogger who depends on a network of sources, some of whom are within Apple Inc. That means, like most working journalists, he needs to consider the tone he takes with any individual article vs. what that article is going to do to his network of sources. The result is his writing still contains the smart incisive analysis it always has, but he also has to bend over backwards to make sure he's presenting what the the internal Apple take on the situation is. Compared to what you or I might say about Apple's behavior over a few beers, yeah, he comes off sounding like an apologist, but compare his coverage to what other in-the-tank tech writers say about Apple and he still comes off as an independent voice covering the company AND someone who can provide a level of context other people can't (details on Nitro's implementation)
panacea 16y ago
He had an explanation quite a while back (he kinda shifted gears) which I parsed as him saying he wasn't going to spend as much time being a link roll with snippets of commentary, into spending more time on his long-form pieces. (No idea what my search terms would be to find it) Perhaps his best work was when he distilled the ecosystem down into a fantastic stream of links, a brilliant and hard-working focused aggregator/editor. Bit more of a bloviating opinion columnist now-a-days. And I guess his biases are brought to the front more. Understandable though. Everyone is converging on his range of primary sources and editorially crowd-sourcing it in realtime. I'll still be frequenting his site. It's still quality. You just read with a bias-aware filter like you do any other news source.
xpaulbettsx 16y ago
100% agreed, his treatment of Apple here and in other articles reads like an Animal Farm'esque quote. If he wants to be Apple's PR department, that's fine, but his masquerade as "independent journalism" strikes me as pretty disingenuous. Which is a shame, because I think he's an very insightful writer who puts a lot of work into his articles. '"Ah, that is different!" said Boxer. "If Comrade Napoleon says it, it must be right."'
jsz0 16y ago
No one knows for sure either way yet. So wouldn't most people's opinion on the subject be inherently lacking in the 'reliable source of information' department? He usually provides links to the other side of any given argument. Isn't it really up to the reader to decide what they believe? I tend to agree with him on this one because web apps on 4.2 weren't exactly impossibly slow and unusable. The performance increases in 4.3 are nice but it doesn't really make any huge difference to someone's ability to write good web apps today. Apple could have just removed the ability to launch web apps from the home-screen entirely if they wanted to. Why would they be so sloppy at executing a grand anti-competitive conspiracy?

tjogin 16y ago

So, even if he's right, he's wrong?

stephenjudkins 16y ago
If I'm looking for the most reasonably explanation for Apple's behavior that still manages to cast them in a good light, I'll read Gruber. If I'm looking for the most reasonable possible explanation, full stop, I'll read elsewhere.
abraham 16y ago
A broken analog clock is only right twice a day.

spamizbad 16y ago

His reasoning seems shaky to me. Assuming this new JS engine is a security risk (it's not really, but lets pretend) you're not protecting anyone by making it Safari-only. It'd be like leaving all your ground-floor windows wide open, whilst locking your front and back doors in hopes that it will discourage burglars. If the new JS engine is a security problem either fix it or remove it. Compromise helps no one.

bigiain 16y ago
I'm not sure which I'd rather see - Gruber being proved wrong (again), or a whole class of new remote "visit this site to jailbreak your iPhone" exploits...
rayiner 16y ago
It's not the JS engine that's the security problem. It's that the JS engine requires allowing apps to mark pages as executable. Executable pages opens up a whole another vector of attacks that have nothing to do with dangerous JS apps.
- kenjackson 16y ago
  That doesn't make any sense. It requires allowing the JIT to mark pages as executable. But that's exactly the same as the browser. There should not be any new security vector exposed that's not already there from the browser.
  - rahoulb 16y ago
    But aren't they within the same process? (I'm asking an honest question - I know nothing of iOS internals). Doesn't that imply that the JIT has privileged access to pages that other code within the same process does not? As saurik (who knows about these things) mentions elsewhere, Apple can trust Safari to not tamper with the executable pages - can they trust 3rd party apps? Home-screen based web-apps being another question entirely.
    - kenjackson 16y ago
      They might be in the same process. I guess they don't do process isolation for hosted browser controls? If not, they should. Otherwise the app stack is always at risk of running arbitrary javascript in process.
  - Someone 16y ago
    The new vector is that, in Safari's case, Apple audited the code that calls the JIT. If UIWebView could JIT, somebody would write an app that dumps the JITs code (I assume that ARM does not have the ability to mark pages as 'executable, but not readable') and run it on a development system. From there, (s)he would figure out what the JIT does to make data executable. That knowledge could be used in an app that can execute code that Apple hasn't seen. Of course, that app would need to pass the app store approval process to be useful, but that should not be hard. A way around this is to move the JIT to the kernel or to a different process. I would guess that that would hinder performance so much that, in typical usage, JIT-ting becomes too expensive to speed up things. Alternatively, Apple could not have spent the time to do so (yet).

ryanisinallofus 16y ago

Man. I totally agree with you but you knew you were going to sacrifice some karma for saying this.

alanstorm 16y ago

You can't read Gruber in the same context you did five or six years ago. At this point he's an established journalisty blogger who depends on a network of sources, some of whom are within Apple Inc. That means, like most working journalists, he needs to consider the tone he takes with any individual article vs. what that article is going to do to his network of sources. The result is his writing still contains the smart incisive analysis it always has, but he also has to bend over backwards to make sure he's presenting what the the internal Apple take on the situation is. Compared to what you or I might say about Apple's behavior over a few beers, yeah, he comes off sounding like an apologist, but compare his coverage to what other in-the-tank tech writers say about Apple and he still comes off as an independent voice covering the company AND someone who can provide a level of context other people can't (details on Nitro's implementation)

panacea 16y ago

He had an explanation quite a while back (he kinda shifted gears) which I parsed as him saying he wasn't going to spend as much time being a link roll with snippets of commentary, into spending more time on his long-form pieces. (No idea what my search terms would be to find it) Perhaps his best work was when he distilled the ecosystem down into a fantastic stream of links, a brilliant and hard-working focused aggregator/editor. Bit more of a bloviating opinion columnist now-a-days. And I guess his biases are brought to the front more. Understandable though. Everyone is converging on his range of primary sources and editorially crowd-sourcing it in realtime. I'll still be frequenting his site. It's still quality. You just read with a bias-aware filter like you do any other news source.

xpaulbettsx 16y ago

100% agreed, his treatment of Apple here and in other articles reads like an Animal Farm'esque quote. If he wants to be Apple's PR department, that's fine, but his masquerade as "independent journalism" strikes me as pretty disingenuous. Which is a shame, because I think he's an very insightful writer who puts a lot of work into his articles. '"Ah, that is different!" said Boxer. "If Comrade Napoleon says it, it must be right."'

jsz0 16y ago

No one knows for sure either way yet. So wouldn't most people's opinion on the subject be inherently lacking in the 'reliable source of information' department? He usually provides links to the other side of any given argument. Isn't it really up to the reader to decide what they believe? I tend to agree with him on this one because web apps on 4.2 weren't exactly impossibly slow and unusable. The performance increases in 4.3 are nice but it doesn't really make any huge difference to someone's ability to write good web apps today. Apple could have just removed the ability to launch web apps from the home-screen entirely if they wanted to. Why would they be so sloppy at executing a grand anti-competitive conspiracy?