16 ms·

I like Apples devices, but aren't they just as vulnerable to CPU bugs? There's plenty of good reasons to use an iOS device (and some good reasons to avoid one)

I like Apples devices, but aren't they just as vulnerable to CPU bugs? There's plenty of good reasons to use an iOS device (and some good reasons to avoid one), but I wouldn't think that CPU bug would be a particularly strong reason on either side.

GeekyBear 6y ago
Bugs can be discovered anywhere. The question is whether those bugs will be patched. The original iPhone SE is about to start it's sixth year of OS updates and security patches. Which works out to less than $70 per supported year. That's a legitimate advantage over the Android ecosystem.
- darksaints 6y ago
  In my personal experience, the sole reason for those updates is to cripple your hardware and battery life in order for you to upgrade to newer hardware.
  - lotsofpulp 6y ago
    In my experience, my iPhone 6 is perfectly usable, as is an old SE and 6S Plus. Batteries degrade, and after being replaced they work fine. And they’re still getting updates this year.
    - Xylakant 6y ago
      I can second this. I’m hanging on to my SE for the form factor and it’s still going strong. My wife’s SE is nearing a battery replacement after what feels like half a decade of usage. I dread the day the SE will no longer be supported. Typing this on an iPhone SE
    - Abishek_Muthian 6y ago
      >Batteries degrade, and after being replaced they work fine. If the batteries were user replaceable, it would have been a perfect story. Sending the device back to the manufacturer (authorised service center) can be inconvenience(data formatting, TOTP apps etc.) at best to security breach(malware install, device imaging etc.) at worst. Also, if indeed a user decides to replace the battery on their own, an iPhone is the least repairable phone out there and getting worse with every iteration.
      - rstupek 6y ago
        The procedure to get an iphone battery replaced is to make an appointment at the apple store and they swap it out as you wait.
        jsheard 6y ago
        That's great if you live near an Apple Store, but only 25 countries have Apple Stores and half of those only have 1-3 stores for the whole country.
        saagarjha 6y ago
        Then you can go to an AASP.
        zaroth 6y ago
        Or spend 15-30 minutes replacing it yourself?
        Abishek_Muthian 6y ago
        Does the technician change battery before your eyes? Didn't happen when I went to AASP and anything can happen in that room they do their work. Maybe we know a technician we trust, who can repair iPhone before our eyes, but alas independent repair shops doesn't get Apple love[1]. [1]https://www.macrumors.com/2020/02/06/apple-independent-repair-shops-contracts/ https://www.macrumors.com/2020/02/06/apple-independent-repai...
  - christophilus 6y ago
    Typing this on a perfectly fast iPhone 6.
  - GeekyBear 6y ago
    Refusing to fix bugs and issue patches is much cheaper, if forcing obsolescence is your goal.
    - darksaints 6y ago
      The vast majority of security vulnerabilities and bugs that end users experience are fixed within the first few years of the device's shelf life. Security vulnerabilities tend to go unnoticed by most end users, and therefore don't really play a role in forcing users to upgrade. Wouldn't it be nice though if users could choose to patch security vulnerabilities without installing updates that deliberately slow down the phone?
      - acdha 6y ago
        Do you have a citation supporting the claim that old bugs don’t affect users? That’s certainly not true in the Windows world. Similarly, “updates that deliberately slow down the phone” sounds like a conspiracy theory. The closest we’ve come to that being real would have required a caveat “… when your battery has degraded to the point that the phone would otherwise crash”, which is an important distinction.
        darksaints 6y ago
        It's pretty hard to fine a company that has one of the world's largest legal departments €25m based on a conspiracy theory. And no, that caveat isn't even close to the truth. Apple states that they do it "once the battery begins to degrade", which is so ambiguous that it could even apply to brand new batteries, because all batteries begin to degrade upon their first usage. In my case, I had a 9 month old iPhone 6 that drastically slowed down due to the update. When the apple store told me that it only slowed down phones with aging batteries, I asked them to replace my battery for my phone which was still under warranty. They "tested" it and told me my battery life was perfectly fine. Fuck that...have not and will not ever buy an apple product ever again.
        valuearb 6y ago
  - pdimitar 6y ago
    Guess you didn't read the articles explaining that reduced performance on phones with heavily amortised batteries is to be expected. And didn't read the testimonials of people who paid for a new battery and got their device working fast again.
- dongvsascript 6y ago
  and literally any 10 year old android phone can run not just the latest security patches but even the latest android. you are taking the iphone limitation of 'os must be from hardware manufacturer' and for some reason applying it to android phones. my 10 year old motorola nexus is running android 10 -which is the current version. you install the new os on android by downloading an app, which installs the new os on reboot. it takes 15 minutes, and gramma can do it. next you'll tell me mac laptops are better because you can't put windows 10 on your old hp laptop, because hp's system image for it only goes to windows 7.
  - whynotminot 6y ago
    Lol who's your gramma?
  - easton 6y ago
    Dang, I wish my grandma was a AOSP contributor. But most phones in the United States sold within the last decade had the bootloaders locked so you can’t install another rom even if you knew how to do it.
    - dongvsascript 6y ago
      this is simply false. very few phones have actually 'locked' bootloaders. as in, can't go into settings and uncheck 'locked' checkbox to unlock it. when they do, you can easily unlock it -usually by simply asking your service provider or the manufacturer. and the ones you can't -yes, you have to hack it with a usb cable and a computer. for like .05% of phones. and google's phones are not ever locked in any way, being the proper comparison, since you're comparing phones to apple. what we have here with the op is trump voter logic, so he can feel better about himself by creating a fake reality where he is king. 'mr trump, i'm saying death as %of population, not tested cases.' - 'well, you can't do that.' i got an old android, i'm gonna put the latest os on it. 'well, you can't do that.' no mr apple. you are the one who can't do that.
      - fuzxi 6y ago
        HN is not for politics, and especially not for political shit-flinging.
krn 6y ago
I like Android One devices and the complete freedom of choice they provide me, but the likehood and the severity of CPU vulnerabilites seem to be much higher with Snapdragon chips. Also, the security patches arrive much slower to Android than to iOS devices. And I am especially concerned about ARM's TrustZone, which seems to be inferior to Apple's Secure Enclave.
- esperent 6y ago
  This is the first exploit specific to snapdragon that I've ever heard of. Were there others?
  - krn 6y ago
    Multiple Kernel Vulnerabilities Affecting All Qualcomm Devices (2020) https://blog.zimperium.com/multiple-kernel-vulnerabilities-affecting-all-qualcomm-devices/ https://blog.zimperium.com/multiple-kernel-vulnerabilities-a... The Road to Qualcomm TrustZone Apps Fuzzing (2019) https://research.checkpoint.com/2019/the-road-to-qualcomm-trustzone-apps-fuzzing/ https://research.checkpoint.com/2019/the-road-to-qualcomm-tr... QualPwn - Exploiting Qualcomm WLAN and Modem Over The Air (2019) https://blade.tencent.com/en/advisories/qualpwn/ https://blade.tencent.com/en/advisories/qualpwn/ QuadRooter: New Android Vulnerabilities in Over 900 Million Devices (2016) https://blog.checkpoint.com/2016/08/07/quadrooter/ https://blog.checkpoint.com/2016/08/07/quadrooter/
    - fulafel 6y ago
      Those are software bugs thoughe except the WLAN one. But Apple has had same kind of WLAN firmware vulns. The software vulns demonstrate serious failures of the Qualcomm product package of course, and is only relevant from POV of how the fixes can be deployed.
unloco 6y ago
I'm sure there are, remember the bezos hack? Wasnt it a video from snapchat on iphone or something? But mostly the ones coming from Apple seem to be physical access only. You can assume, as with any personal computing device, once it's in someone else's hands, your data is as good as theirs. Some make it more difficult than others. But 400 remote access vulnerabilities is a completely different ball game.

GeekyBear 6y ago

Bugs can be discovered anywhere. The question is whether those bugs will be patched. The original iPhone SE is about to start it's sixth year of OS updates and security patches. Which works out to less than $70 per supported year. That's a legitimate advantage over the Android ecosystem.

darksaints 6y ago
In my personal experience, the sole reason for those updates is to cripple your hardware and battery life in order for you to upgrade to newer hardware.
- lotsofpulp 6y ago
  In my experience, my iPhone 6 is perfectly usable, as is an old SE and 6S Plus. Batteries degrade, and after being replaced they work fine. And they’re still getting updates this year.
  - Xylakant 6y ago
    I can second this. I’m hanging on to my SE for the form factor and it’s still going strong. My wife’s SE is nearing a battery replacement after what feels like half a decade of usage. I dread the day the SE will no longer be supported. Typing this on an iPhone SE
  - Abishek_Muthian 6y ago
    >Batteries degrade, and after being replaced they work fine. If the batteries were user replaceable, it would have been a perfect story. Sending the device back to the manufacturer (authorised service center) can be inconvenience(data formatting, TOTP apps etc.) at best to security breach(malware install, device imaging etc.) at worst. Also, if indeed a user decides to replace the battery on their own, an iPhone is the least repairable phone out there and getting worse with every iteration.
    - rstupek 6y ago
      The procedure to get an iphone battery replaced is to make an appointment at the apple store and they swap it out as you wait.
      - jsheard 6y ago
        That's great if you live near an Apple Store, but only 25 countries have Apple Stores and half of those only have 1-3 stores for the whole country.
        saagarjha 6y ago
        Then you can go to an AASP.
        zaroth 6y ago
        Or spend 15-30 minutes replacing it yourself?
      - Abishek_Muthian 6y ago
        Does the technician change battery before your eyes? Didn't happen when I went to AASP and anything can happen in that room they do their work. Maybe we know a technician we trust, who can repair iPhone before our eyes, but alas independent repair shops doesn't get Apple love[1]. [1]https://www.macrumors.com/2020/02/06/apple-independent-repair-shops-contracts/ https://www.macrumors.com/2020/02/06/apple-independent-repai...
- christophilus 6y ago
  Typing this on a perfectly fast iPhone 6.
- GeekyBear 6y ago
  Refusing to fix bugs and issue patches is much cheaper, if forcing obsolescence is your goal.
  - darksaints 6y ago
    The vast majority of security vulnerabilities and bugs that end users experience are fixed within the first few years of the device's shelf life. Security vulnerabilities tend to go unnoticed by most end users, and therefore don't really play a role in forcing users to upgrade. Wouldn't it be nice though if users could choose to patch security vulnerabilities without installing updates that deliberately slow down the phone?
    - acdha 6y ago
      Do you have a citation supporting the claim that old bugs don’t affect users? That’s certainly not true in the Windows world. Similarly, “updates that deliberately slow down the phone” sounds like a conspiracy theory. The closest we’ve come to that being real would have required a caveat “… when your battery has degraded to the point that the phone would otherwise crash”, which is an important distinction.
      - darksaints 6y ago
        It's pretty hard to fine a company that has one of the world's largest legal departments €25m based on a conspiracy theory. And no, that caveat isn't even close to the truth. Apple states that they do it "once the battery begins to degrade", which is so ambiguous that it could even apply to brand new batteries, because all batteries begin to degrade upon their first usage. In my case, I had a 9 month old iPhone 6 that drastically slowed down due to the update. When the apple store told me that it only slowed down phones with aging batteries, I asked them to replace my battery for my phone which was still under warranty. They "tested" it and told me my battery life was perfectly fine. Fuck that...have not and will not ever buy an apple product ever again.
        valuearb 6y ago
- pdimitar 6y ago
  Guess you didn't read the articles explaining that reduced performance on phones with heavily amortised batteries is to be expected. And didn't read the testimonials of people who paid for a new battery and got their device working fast again.
dongvsascript 6y ago
and literally any 10 year old android phone can run not just the latest security patches but even the latest android. you are taking the iphone limitation of 'os must be from hardware manufacturer' and for some reason applying it to android phones. my 10 year old motorola nexus is running android 10 -which is the current version. you install the new os on android by downloading an app, which installs the new os on reboot. it takes 15 minutes, and gramma can do it. next you'll tell me mac laptops are better because you can't put windows 10 on your old hp laptop, because hp's system image for it only goes to windows 7.
- whynotminot 6y ago
  Lol who's your gramma?
- easton 6y ago
  Dang, I wish my grandma was a AOSP contributor. But most phones in the United States sold within the last decade had the bootloaders locked so you can’t install another rom even if you knew how to do it.
  - dongvsascript 6y ago
    this is simply false. very few phones have actually 'locked' bootloaders. as in, can't go into settings and uncheck 'locked' checkbox to unlock it. when they do, you can easily unlock it -usually by simply asking your service provider or the manufacturer. and the ones you can't -yes, you have to hack it with a usb cable and a computer. for like .05% of phones. and google's phones are not ever locked in any way, being the proper comparison, since you're comparing phones to apple. what we have here with the op is trump voter logic, so he can feel better about himself by creating a fake reality where he is king. 'mr trump, i'm saying death as %of population, not tested cases.' - 'well, you can't do that.' i got an old android, i'm gonna put the latest os on it. 'well, you can't do that.' no mr apple. you are the one who can't do that.
    - fuzxi 6y ago
      HN is not for politics, and especially not for political shit-flinging.

krn 6y ago

I like Android One devices and the complete freedom of choice they provide me, but the likehood and the severity of CPU vulnerabilites seem to be much higher with Snapdragon chips. Also, the security patches arrive much slower to Android than to iOS devices. And I am especially concerned about ARM's TrustZone, which seems to be inferior to Apple's Secure Enclave.

esperent 6y ago
This is the first exploit specific to snapdragon that I've ever heard of. Were there others?
- krn 6y ago
  Multiple Kernel Vulnerabilities Affecting All Qualcomm Devices (2020) https://blog.zimperium.com/multiple-kernel-vulnerabilities-affecting-all-qualcomm-devices/ https://blog.zimperium.com/multiple-kernel-vulnerabilities-a... The Road to Qualcomm TrustZone Apps Fuzzing (2019) https://research.checkpoint.com/2019/the-road-to-qualcomm-trustzone-apps-fuzzing/ https://research.checkpoint.com/2019/the-road-to-qualcomm-tr... QualPwn - Exploiting Qualcomm WLAN and Modem Over The Air (2019) https://blade.tencent.com/en/advisories/qualpwn/ https://blade.tencent.com/en/advisories/qualpwn/ QuadRooter: New Android Vulnerabilities in Over 900 Million Devices (2016) https://blog.checkpoint.com/2016/08/07/quadrooter/ https://blog.checkpoint.com/2016/08/07/quadrooter/
  - fulafel 6y ago
    Those are software bugs thoughe except the WLAN one. But Apple has had same kind of WLAN firmware vulns. The software vulns demonstrate serious failures of the Qualcomm product package of course, and is only relevant from POV of how the fixes can be deployed.

unloco 6y ago

I'm sure there are, remember the bezos hack? Wasnt it a video from snapchat on iphone or something? But mostly the ones coming from Apple seem to be physical access only. You can assume, as with any personal computing device, once it's in someone else's hands, your data is as good as theirs. Some make it more difficult than others. But 400 remote access vulnerabilities is a completely different ball game.