5 ms·

> And yet it’s apparently insecure for me to buy a Kindle book with the exact same mechanism in the exact same app? Get the fuck out of here. Gonna play the de

by mbesto 5y ago

> And yet it’s apparently insecure for me to buy a Kindle book with the exact same mechanism in the exact same app? Get the fuck out of here. Gonna play the devil's advocate here. If I pay for a physical good, I have an expectation of continued use of that physical good absent of the use the technology medium I used to pay for it. If I buy a physical book and Amazon shut down, I can still read the book. If I pay for a digital good that uses Apple's hardware in some shape or form (Kindle is a weird grey area because you could technically use an Amazon Kindle device, but that is an edge case) then giving Apple money provides an expectation that they continue to commercially support App Developers. A great example - App Store guidelines that enforce a yearly update (or whatever the cadence is) to the app store so that developers don't get lazy and their apps break with new releases of iOS. I think this is effectively what Cook is saying - we need an economic incentive to keep app developers honest and in a symbiotic relationship with them.

pretendgeneer 5y ago
Why does a book reader app need yearly updates? I bought my ereader years ago still opens epubs fine without updates. If the epub worked when I bought it why does it need to keep updating? Why does an ebook only work on the certified™ app?
- mbesto 5y ago
  1. You picked one example that I explicitly mentioned was an edge case. Thanks. 2. More importantly, if your question is why does <INSERT LITERALLY ANY TECHNOLoGY> ever need updates? Answer: https://en.wikipedia.org/wiki/Software_entropy https://en.wikipedia.org/wiki/Software_entropy
- amatecha 5y ago
  Right? Reading this discussion and posting this comment from an iBook G4 from 2005. It actually works great (other than many websites being inaccessible due to SSL compatibility issues). That said I'm only using it for the heck of it while the battery is charging… ;) Still, yes, I wish there wasn't such a constant expectation from tech companies to constantly update to the latest & greatest (complete with persistently-nagging update reminders, UX dark patterns, etc.) So much waste inherent to the industry IMO. Though people seem to just happily go along with it too…
  - mbesto 5y ago
    > Reading this discussion and posting this comment from an iBook G4 from 2005. Which version of MacOS are you using? Is it officially supported by Apple? Do you receive security updates?
    - amatecha 5y ago
      This iBook is running OS X 10.4.11 … No, it definitely is not supported and hasn't received updates in years. I wouldn't try to use it as a daily driver for general usage unless I installed a new OS like FreeBSD or OpenBSD on it.
      - mbesto 5y ago
        And so you're a great target for a malicious actor since you no longer receive security updates. I guess you just proved my point.
        amatecha 5y ago
        Oh.. yeah, malicious actors will definitely have easy pickings with the outdated iBook I connected to a firewalled internet-only wifi AP for an hour or so, and haven't powered on in close to a year. Perfect opportunity for the elite hackers that were just chomping at the bit for me to connect an outdated device to the internet, that doesn't have access to my LAN or anything else of mine. You understand anyone, anywhere is great target for a malicious actor, right? Unless every single piece of software on every piece of hardware on their network is fully patched and up to date, and doesn't contain any zero-day vulnerabilities, of course. What point do you think I apparently helped prove? Are you referring to software entropy? The Wikipedia article you adjacently linked suggests that software bugs will only increase with every change, unless specifically mitigated - "as a system is modified, its disorder, or entropy, tends to increase".
        mbesto 5y ago
        > haven't powered on in close to a year. Didn't you just say you were viewing that website from the iBook but yet it hasn't been turned on in over year? So which is it? Are you actively using that computer or are you just using it as a strawman to prove some orthogonal point.. > Unless every single piece of software on every piece of hardware on their network is fully patched and up to date, and doesn't contain any zero-day vulnerabilities, of course. Take two scenarios: one where everyone is on a unpatched 2004 iBook and one that we live in today. The chances of the former being hacked are WAY higher. > What point do you think I apparently helped prove? That you're an edge case and people aren't actively running on older versions of software because software vendors provide support to those systems. Support requires costly resources (humans, systems, etc.) to maintain. Those updates don't just come for free. The "system" that the WP article is referring to is the whole mobile ecosystem and internet. iOS needs to constantly be updated (including the SDK) to mitigate every new attack that comes with changes in ISPs, people's usage behavior, SSL/TLS changes, Wi-fi changes, and and and...this list goes on forever. So how do you expect Apple to keep up with those changes? How do they enforce their walled garden has gardeners who water their plants and give them nutrients? EDIT: To further reiterate, back to one of your points before: > Still, yes, I wish there wasn't such a constant expectation from tech companies to constantly update to the latest & greatest For exactly the reasons I put above. There's probably a good reason TLS/SSL is throwing an error...because SSL2/3 is deemed insecure and this is an enforcement policy to change webmaster's behaviors.
- deleted 5y ago
  [deleted]
ViViDboarder 5y ago
Your incentive seems particularly perverse to me. How is taking money away from developers and giving it to apple somehow an incentive to the developers updating their apps? Apple creating arbitrary rules doesn’t cost Apple anything but costs the app developers a lot of time.
anothernewdude 5y ago
That's the most irrelevant argument I've ever heard.
ashneo76 5y ago
Why okay devil's advocate? What is the reasoning behind that?

by mbesto 5y ago

pretendgeneer 5y ago

Why does a book reader app need yearly updates? I bought my ereader years ago still opens epubs fine without updates. If the epub worked when I bought it why does it need to keep updating? Why does an ebook only work on the certified™ app?

mbesto 5y ago
1. You picked one example that I explicitly mentioned was an edge case. Thanks. 2. More importantly, if your question is why does <INSERT LITERALLY ANY TECHNOLoGY> ever need updates? Answer: https://en.wikipedia.org/wiki/Software_entropy https://en.wikipedia.org/wiki/Software_entropy
amatecha 5y ago
Right? Reading this discussion and posting this comment from an iBook G4 from 2005. It actually works great (other than many websites being inaccessible due to SSL compatibility issues). That said I'm only using it for the heck of it while the battery is charging… ;) Still, yes, I wish there wasn't such a constant expectation from tech companies to constantly update to the latest & greatest (complete with persistently-nagging update reminders, UX dark patterns, etc.) So much waste inherent to the industry IMO. Though people seem to just happily go along with it too…
- mbesto 5y ago
  > Reading this discussion and posting this comment from an iBook G4 from 2005. Which version of MacOS are you using? Is it officially supported by Apple? Do you receive security updates?
  - amatecha 5y ago
    This iBook is running OS X 10.4.11 … No, it definitely is not supported and hasn't received updates in years. I wouldn't try to use it as a daily driver for general usage unless I installed a new OS like FreeBSD or OpenBSD on it.
    - mbesto 5y ago
      And so you're a great target for a malicious actor since you no longer receive security updates. I guess you just proved my point.
      - amatecha 5y ago
        Oh.. yeah, malicious actors will definitely have easy pickings with the outdated iBook I connected to a firewalled internet-only wifi AP for an hour or so, and haven't powered on in close to a year. Perfect opportunity for the elite hackers that were just chomping at the bit for me to connect an outdated device to the internet, that doesn't have access to my LAN or anything else of mine. You understand anyone, anywhere is great target for a malicious actor, right? Unless every single piece of software on every piece of hardware on their network is fully patched and up to date, and doesn't contain any zero-day vulnerabilities, of course. What point do you think I apparently helped prove? Are you referring to software entropy? The Wikipedia article you adjacently linked suggests that software bugs will only increase with every change, unless specifically mitigated - "as a system is modified, its disorder, or entropy, tends to increase".
        mbesto 5y ago
        > haven't powered on in close to a year. Didn't you just say you were viewing that website from the iBook but yet it hasn't been turned on in over year? So which is it? Are you actively using that computer or are you just using it as a strawman to prove some orthogonal point.. > Unless every single piece of software on every piece of hardware on their network is fully patched and up to date, and doesn't contain any zero-day vulnerabilities, of course. Take two scenarios: one where everyone is on a unpatched 2004 iBook and one that we live in today. The chances of the former being hacked are WAY higher. > What point do you think I apparently helped prove? That you're an edge case and people aren't actively running on older versions of software because software vendors provide support to those systems. Support requires costly resources (humans, systems, etc.) to maintain. Those updates don't just come for free. The "system" that the WP article is referring to is the whole mobile ecosystem and internet. iOS needs to constantly be updated (including the SDK) to mitigate every new attack that comes with changes in ISPs, people's usage behavior, SSL/TLS changes, Wi-fi changes, and and and...this list goes on forever. So how do you expect Apple to keep up with those changes? How do they enforce their walled garden has gardeners who water their plants and give them nutrients? EDIT: To further reiterate, back to one of your points before: > Still, yes, I wish there wasn't such a constant expectation from tech companies to constantly update to the latest & greatest For exactly the reasons I put above. There's probably a good reason TLS/SSL is throwing an error...because SSL2/3 is deemed insecure and this is an enforcement policy to change webmaster's behaviors.
deleted 5y ago
[deleted]

ViViDboarder 5y ago

Your incentive seems particularly perverse to me. How is taking money away from developers and giving it to apple somehow an incentive to the developers updating their apps? Apple creating arbitrary rules doesn’t cost Apple anything but costs the app developers a lot of time.

anothernewdude 5y ago

That's the most irrelevant argument I've ever heard.

ashneo76 5y ago

Why okay devil's advocate? What is the reasoning behind that?