3 ms·
Their rationale for not allowing other browser engines is that allowing JIT (writable AND executable memory pages, in general) would make the hell break loose.
by grishka 6y ago
Their rationale for not allowing other browser engines is that allowing JIT (writable AND executable memory pages, in general) would make the hell break loose.
- chj 6y agoThis is an insult to their OS team. macOS appears to be working just fine.
- grishka 6y agoWell, if there is an RCE vulnerability, that would allow the user to run arbitrary code on their own device with the same permissions that the browser process has, which is clearly unacceptable in the iOS world.
- chj 6y agoI don't see how that could be acceptable in macOS world.
- grishka 6y agoOn macOS you as the user already have complete and unrestricted access to your computer. You don't jailbreak your mac because it already comes with root and an unlocked bootloader. Mac apps also have much more access to the underlying system than iOS apps do, and this helps with better sandboxing, I presume.
- McTossOut 6y agoDifferent sandbox, syscalls, attack surface. You could root an iPhone from a web page back in 2012. That's what you call a disaster now.
- superjan 6y agoThis was a good argument in the past, because there were very few ios exploits and apple was proactive in hunting them down, to prevent jailbreaking. Not sure if it is a valid argument today.
- black3r 6y agoJIT is already allowed on iOS since 14.2 though.
- grishka 6y agoFor externally-loaded or user-supplied code as well?