4 ms·

I certainly don’t want to suggest that Apple couldn’t do more in terms of security, but 0-days are inevitable. Every OS has them, and will continue to have them

I certainly don’t want to suggest that Apple couldn’t do more in terms of security, but 0-days are inevitable. Every OS has them, and will continue to have them. Throwing money at this can make it better, but I don’t think it’s possible to “fix” it without creating some sort of new paradigm for how software is made.

albntomat0 5y ago
True, but there's a wide range of things that can be done to change how difficult it is to find those 0-days, while also provide good incentives to those capable of finding said O-days. Writing the iMessage parser in a memory safe language is a step towards a "new paradigm" [0], but more can and should be done by a company Apple's size. [0]: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
simion314 5y ago
Apple has the money and influence to buy this exploits and analyze them, probably NSA are using them too so Apple won't attempt to upset NSA so they do nothing because the "good guys" are using it too. Also Apple is notorious on their bad bounties and on have a bad history on providing researchers with unlocked devices for testing, probably Google found more security bugs in iOS then Apple.
sumedh 5y ago
How about Apple gives more money(in millions) to people who report legit security vulnerabilities?
- cehrlich 5y ago
  I agree that Apple should do more to improve their relationship with security researchers, including paying better. However I also don't think that this can fully solve the problem - if a government creates a sufficiently funded black hat operation (or outsources it to someone like NSO, which is effectively the same thing), it's inevitable that they will find a 0-day sooner or later. This is going off topic a bit, but I honestly don't know what the solution to this is. The pragmatic truth is that anyone who is a big enough target that it would be worth for a hostile entity to spend a couple million to intercept their communication should assume at all times that their devices are compromised.
hvis 5y ago
Some 0-days - sure. But we're talking about a major corporation continuing their business uninhibited. If the NSO Group has been active for a number of years, couldn't Apple make an effort to purchase their products (through some third party, perhaps) and then reverse-engineer the vulnerabilities?

albntomat0 5y ago

True, but there's a wide range of things that can be done to change how difficult it is to find those 0-days, while also provide good incentives to those capable of finding said O-days. Writing the iMessage parser in a memory safe language is a step towards a "new paradigm" [0], but more can and should be done by a company Apple's size. [0]: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

simion314 5y ago

Apple has the money and influence to buy this exploits and analyze them, probably NSA are using them too so Apple won't attempt to upset NSA so they do nothing because the "good guys" are using it too. Also Apple is notorious on their bad bounties and on have a bad history on providing researchers with unlocked devices for testing, probably Google found more security bugs in iOS then Apple.

sumedh 5y ago

How about Apple gives more money(in millions) to people who report legit security vulnerabilities?

cehrlich 5y ago
I agree that Apple should do more to improve their relationship with security researchers, including paying better. However I also don't think that this can fully solve the problem - if a government creates a sufficiently funded black hat operation (or outsources it to someone like NSO, which is effectively the same thing), it's inevitable that they will find a 0-day sooner or later. This is going off topic a bit, but I honestly don't know what the solution to this is. The pragmatic truth is that anyone who is a big enough target that it would be worth for a hostile entity to spend a couple million to intercept their communication should assume at all times that their devices are compromised.

hvis 5y ago

Some 0-days - sure. But we're talking about a major corporation continuing their business uninhibited. If the NSO Group has been active for a number of years, couldn't Apple make an effort to purchase their products (through some third party, perhaps) and then reverse-engineer the vulnerabilities?