4 ms·

You don't create a whitelist system literally called ContentFilterExclusionList by accident.

zaphirplane 6y ago
A backdoor has some malicious connotations to me. Having security profiles controlled by a list seems a thing Without spending a lot of time sshd has allowLists (AllowGroups) and match directives Sudo also has per group config As a user on any operating system what you can and can’t do is controlled by a list Perhaps the issue is the list isn’t user controlled ? Perhaps the issue falls into the “I own and control my device” vs “we sell you a safe, foot gun safe, easy to use device (in their opinion)”
- jakubp 6y ago
  If they claim "here's the API you can use to control network access" but can then put arbitrary apps to work around that, that's the definition of backdoor access to the device.
  - zaphirplane 6y ago
    I’m not supporting their approach. Why can’t this be thought of as a control API with a built in allow list ? Where the list is hidden by obscurity
- yarcob 6y ago
  A "back door" is any kind of mechanism that was added by the vendor to circumvent security mechanisms. Back doors are typically not disclosed to the user, and can't be turned off. So for example an automatic software update mechanism isn't a back door, as the user is aware of it and can typically turn it off if they are concerned about security. An undisclosed mechanism that allows Apple apps to circumvent firewalls does very much fit the description of a back door. Intent doesn't matter with regards to back doors. Most back doors are not made with malicious intent, or at least the vendors usually claim that they only had good intentions for the back door. (Eg. see the recent reports where a router manufacturer had a secret password that they claimed was only used for software updates) The danger about back doors is that malicious software can use the back doors to circumvent the security measures, just like Patrick Wardle demonstrated that it was possible to use Apple's content filter exclusion to circumvent firewalls.

A backdoor has some malicious connotations to me. Having security profiles controlled by a list seems a thing Without spending a lot of time sshd has allowLists (AllowGroups) and match directives Sudo also has per group config As a user on any operating system what you can and can’t do is controlled by a list Perhaps the issue is the list isn’t user controlled ? Perhaps the issue falls into the “I own and control my device” vs “we sell you a safe, foot gun safe, easy to use device (in their opinion)”

jakubp 6y ago
If they claim "here's the API you can use to control network access" but can then put arbitrary apps to work around that, that's the definition of backdoor access to the device.
- zaphirplane 6y ago
  I’m not supporting their approach. Why can’t this be thought of as a control API with a built in allow list ? Where the list is hidden by obscurity
yarcob 6y ago
A "back door" is any kind of mechanism that was added by the vendor to circumvent security mechanisms. Back doors are typically not disclosed to the user, and can't be turned off. So for example an automatic software update mechanism isn't a back door, as the user is aware of it and can typically turn it off if they are concerned about security. An undisclosed mechanism that allows Apple apps to circumvent firewalls does very much fit the description of a back door. Intent doesn't matter with regards to back doors. Most back doors are not made with malicious intent, or at least the vendors usually claim that they only had good intentions for the back door. (Eg. see the recent reports where a router manufacturer had a secret password that they claimed was only used for software updates) The danger about back doors is that malicious software can use the back doors to circumvent the security measures, just like Patrick Wardle demonstrated that it was possible to use Apple's content filter exclusion to circumvent firewalls.