3 ms·

iOS. I realise it feels like smartphones have been ubiquitous forever, but iOS is actually only 14 years old (and obviously most of the code in it is far younge

iOS. I realise it feels like smartphones have been ubiquitous forever, but iOS is actually only 14 years old (and obviously most of the code in it is far younger). It's not as if no-one knew about the dangers of writing security-sensitive systems in C or C++ in 2007 or as if the Internet was some new idea where no-one understood that bad people would try to remotely compromise your system using it. Apple might not yet have realised how important the iPhone was going to become back then but they were doing very well by a decade ago and they were huge by five years ago.

saagarjha 5y ago
iOS reuses the XNU kernel from macOS, so most of its code is far older than that. And even in 2007, what good options were there for writing kernels? Most of the attempts in memory-safe languages were just toys.
- why_only_15 5y ago
  I believe (unsure about this) that it reused a reasonable amount of userspace macOS code as well, perhaps to do fonts and the like? i have to imagine most of e.g. webkit was also taken from macos.
  - saagarjha 5y ago
    If it wasn’t true when iOS was launched, it’s certainly true now.
- pjmlp 5y ago
  Apparently the NEWP toy used by Unisys to write their high secure profile OS is an aging grandpa language from 1961. Multics had a DoD validated security profile higher than any UNIX, it was written in Acme Corporation PL/I. The original Mac OS and Lisa were written in Fluffy Object Pascal. Apparently many airplanes get to fly in a toy language created around 1983. ....
- Silhouette 5y ago
  Right, but it's not 2007 any more. Apple has more technical and financial resources available to it than many small countries. Memory-safe languages aren't toys now. Even if they still were, Apple could have built a better one from scratch. Maybe in 2007 it made sense to build iOS on an existing platform and use the normal systems programming languages. Why couldn't more recent development of potentially vulnerable components have been done using safer technologies though? Take a look at the long list of security issues fixed by last week's iOS 14.7 update[1] and tell me how many of the vulnerable systems could have been written or rewritten to use more secure technologies. Look for terms like "use-after-free", "buffer overflow" and "out-of-bounds read". Then there is the iOS 14.7.1 update we're discussing today. Yet again this seems to be about fixing a memory corruption issue in a kernel extension written in an unsafe language that has a track record of exposing vulnerabilities. When do we start learning from those mistakes? [1] https://www.cybernewsgroup.co.uk/apple-issues-urgent-iphone-updates-nothing-for-pegasus-zero-day/ https://www.cybernewsgroup.co.uk/apple-issues-urgent-iphone-...
deleted 5y ago
[deleted]

saagarjha 5y ago

iOS reuses the XNU kernel from macOS, so most of its code is far older than that. And even in 2007, what good options were there for writing kernels? Most of the attempts in memory-safe languages were just toys.

why_only_15 5y ago
I believe (unsure about this) that it reused a reasonable amount of userspace macOS code as well, perhaps to do fonts and the like? i have to imagine most of e.g. webkit was also taken from macos.
- saagarjha 5y ago
  If it wasn’t true when iOS was launched, it’s certainly true now.
pjmlp 5y ago
Apparently the NEWP toy used by Unisys to write their high secure profile OS is an aging grandpa language from 1961. Multics had a DoD validated security profile higher than any UNIX, it was written in Acme Corporation PL/I. The original Mac OS and Lisa were written in Fluffy Object Pascal. Apparently many airplanes get to fly in a toy language created around 1983. ....
Silhouette 5y ago
Right, but it's not 2007 any more. Apple has more technical and financial resources available to it than many small countries. Memory-safe languages aren't toys now. Even if they still were, Apple could have built a better one from scratch. Maybe in 2007 it made sense to build iOS on an existing platform and use the normal systems programming languages. Why couldn't more recent development of potentially vulnerable components have been done using safer technologies though? Take a look at the long list of security issues fixed by last week's iOS 14.7 update[1] and tell me how many of the vulnerable systems could have been written or rewritten to use more secure technologies. Look for terms like "use-after-free", "buffer overflow" and "out-of-bounds read". Then there is the iOS 14.7.1 update we're discussing today. Yet again this seems to be about fixing a memory corruption issue in a kernel extension written in an unsafe language that has a track record of exposing vulnerabilities. When do we start learning from those mistakes? [1] https://www.cybernewsgroup.co.uk/apple-issues-urgent-iphone-updates-nothing-for-pegasus-zero-day/ https://www.cybernewsgroup.co.uk/apple-issues-urgent-iphone-...

deleted 5y ago

[deleted]