8 ms·

This seems like much more of an organisational dysfunction problem than a computer science problem. I haven’t heard anything like this about Microsoft or Google

This seems like much more of an organisational dysfunction problem than a computer science problem. I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly), have responsible browser update models (where fixes for 0 days can be pushed to the whole world within hours) instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3 lines of code in Safari, but we don’t push updates when ready since we don’t want to cause update fatigue, so you’ll need to wait 4 weeks for the fix to come in the next programmed OS update”, and so much more. Even Android seems decent security-wise, since many of the processes that would cause security concerns get updated through Play Store, even in really old phones. Another example: my grandma doesn’t have WiFi, and I bought her an iPhone, but iOS updates can’t be done on 4G, which can only be bypassed by internet-tethering a computer (which she doesn’t have), downloading the full IPSW, and installing it. She was on iOS 14.0 until 2 weeks ago when I fixed it. And with Safari being, according to security researchers, much less secure than Chrome, that makes me shudder. This isn’t an “anecdote” or an edge case, not everyone lives in a developed country and millions are just like my grandma, and Apple’s poor security design leaves her vulnerable for zero good technical reason, where Android wouldn’t. (They just dropped Google Play Services support for Jelly Bean a few months ago, so even an old Android phone would be reasonably secure). Caring about security requires thinking of details like this.

PostThisTooFast 5y ago
Not to mention Apple's amateur-hour, dogshit-stupid policy of forcing everyone to use an E-mail address as his user ID. How many people probably think they need to use their E-mail account password for every one of these idiotic organizations that forces them to log in with their E-mail address? I'm guessing a SHITLOAD. Your grandma definitely is not going to understand the difference. And that makes every one of those organizations the gatekeeper to every user's E-mail account. One disgruntled employee, one poorly secured system, or one nefarious forum operator can now access untold numbers of E-mail accounts and steal identities galore. You don't see banks or brokerages forcing people to use a goddamned E-mail address as a user ID, but Apple has doubled down on this bullshit policy even after being called out on it. No excuse.
guntars 5y ago
The other day I tried to update my Macbook over a personal hotspot and it happily downloaded about 2GB before the computer went to sleep and I was greeted with a "Whoopsie, failed to download the update, try again" message when I woke it and, of course, it would just start over again. They don't even support resuming the download! That's just embarrassing.
- robertlagrant 5y ago
  Strangely I did the same thing last night and it did resume, although you only see the resumption when it starts. There's no prior indication that it will resume.
  - merb 5y ago
    it depends on your free storage. if it is less than X % they will try to download it one go. the resumable download will download all in chunks and than concat them.
    - guntars 5y ago
      Just tried it again. I have 70GB available. Got on the hotspot, started the download, unplugged the laptop, waited for it to go to sleep, woke it up - same result. I had to accept the EULAs again and it started to download from about 50mb. Having attempted (unsuccessfully) to write a resumable HTTP/HTTPS downloader, which is what I suspect nsurlsessiond is using behind the scenes - it's really hard to get it right. Meanwhile I expect to be able to start a BitTorrent download, throw the laptop down the stairs, take out the hard drive and be able to successfully resume it on a different computer because that's a protocol that was actually designed for it.
      - codetrotter 5y ago
        But Apple has the luxury of controlling both the server and the client. Why isn’t it just a matter of using HTTP range requests? https://developer.mozilla.org/en-US/docs/Web/HTTP/Range_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/Range_requ... And if they need to get more clever than that, why not have a BitTorrent-like map of chunk hashes. So you download the update, check the hash of the whole thing and if it fails the hash check, download the chunk hashes which will be say a 256 bit hash for every individual 32 MB chunk of the file. And for any chunk that fails the hash check, use a HTTP range request to download it again.
slvng 5y ago
Microsoft has been all over the cyber security news due to their repeat vulnerabilities in Exchange and Azure AND the way they have handled disclosures made to them
- artiszt 5y ago
  u must have missed reading this : ".. Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly) .." but then u not need to read it. and who would given all the exquisite experiences with M$ and/or Goo compared to nightmares Apple delivers to u, overpriced, ofc in a sense it is good reading tho after all in that it indicates that exactly those are not the one's one does meet in Apple-communities
  - iso1210 5y ago
    It's spelt "you"
mschuster91 5y ago
> but iOS updates can’t be done on 4G > This isn’t an “anecdote” or an edge case, not everyone lives in a developed country and millions are just like my grandma In too many countries, mobile data is incredibly expensive. If Apple were to allow over-the-air OS updates, you can bet it would take only a week until the first class-action lawsuit by people having their data caps blown through because they did not understand that updates are huge.
- seszett 5y ago
  In many other countries, 4G is so inexpensive that many people use it as their primary Internet connection though. They don't see a need for a modem hooked to a wired line necessitating a second subscription and procedures to follow when you move apartments, when in any case you will have a 4G connection that follows you around on your smartphone.
  - Reason077 5y ago
    I've been using 5G as my primary internet connection since January 2020. It's much faster than wired broadband in buildings that don't have fibre installed. It's also cheaper (I pay £30/month for unlimited data), there's no contract locking you in to 12 or 24 months of service, and I can take it with me whenever I travel or if I move house.
    - jeffwass 5y ago
      If you have a desktop, how do you provide the 5G connection? Is there a better way than providing a wifi hotspot with your mobile phone?
      - Reason077 5y ago
        I have a Huawei E6878-870 5G mobile WiFi (other brands are available), which provides a "proper" WiFi base station, so no need for a phone hotspot. I have a separate cheap SIM card for my phone.
- 5y ago
user-the-name 5y ago
Apple's entire bug reporting system has always been massively dysfunctional. It is little surprise this extends to their handling of externally reported security issues as well.
rixed 5y ago
> my grandma doesn’t have WiFi Tech workers have difficulty taking into consideration lifestyles they don't know exist, which is understandable. At the end of the day this comes as another consequence of the lack of diversity in tech, I guess.
- funcDropShadow 5y ago
  So, is this the lack of grandmas working at Apple in software development? This is nothing you can fix by following some diversity ideology. This is a question of respecting different requirements from different user groups. You cannot mirror every user group in the development teams. How do you represent people of old age, with illnesses, or certain disabilities in a development team? How do you represent people living at certain locations in the world in a development team? How do you represent poor people or people of low education? Or how do you represent people which live under oppressive regimes or are the continued victims of criminals? All these groups have different needs and expectations to the products they buy or lease. And development teams and their business cannot expect to understand that by having a more diverse development team. They have to do better requirements engineering, they have to listen better to their customers and they have to decide and prioritize those needs and expectations. E.g. A/B testing has abysmal consequences for the needs and expectations of minorities.
  - shorner 5y ago
    Now that you mention it, I think there's a real lack of grandmas in tech... maybe I shouldn't be saying this publicly, but we don't have any at our company.
    - OldHand2018 5y ago
      One of our product managers is a grandmother (she is actually taking an early retirement soon because her 4th grandchild is on the way). We are in the B2B/B2EDU space so the "As a grandmother, I think..." line of thought does not apply. However, she has frequently had insights and observations that none of us would have come up with. Once implemented, they have been very successful/profitable. So yes, absolutely, unless your company wants to be in a very specific niche, the lack of true diversity in your company is a drag on your success. PS - my grandfather had a tech job in Sunnyvale. He passed away last year at the age of 92. Point is - everyone alive has lived in a world with pervasive technology and computing. "They're old and can't understand this stuff" is pure BS.
samhw 5y ago
> instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3 lines of code in Safari..." Your comment seems to be implying that Apple could simply ship the delta in the source code: i.e. something like `git diff --minimal --word-diff=porcelain head^1`. Would this not require iOS to be compiled on the device, and store its own source code, à la `.git`? How would you address the issue of the compiler itself needing to be updated as part of this process? Or are you suggesting they would ship the diff for the binary? For one, I don't think the delta in the resulting binary would be as small as the delta in the source, due to addresses changing, etc. There are tools like bsdiff which can 'intelligently' handle this, but I believe they aren't widely used for operating system updates, as opposed to standard userspace binaries. In addition to this, the diff shipped would be relative to whatever version the device is currently using, which would necessitate storing a very large number of diffs, especially for binaries, or else computing it on the fly (which simply shifts the burden from disk space to CPU cycles). Or have I misunderstood you entirely?
- willis936 5y ago
  They're suggesting a patch in the classical sense of the term. A whole hog OS update does not qualify. These complications were addressed 20+ years ago when whole hog OS updates were unreasonable. It requires a certain amount of cleverness, but that may be too much to ask of the fruit company. https://en.wikipedia.org/wiki/Patch_(computing) https://en.wikipedia.org/wiki/Patch_(computing)
  - samhw 5y ago
    I understand the change would be a patch, but that's separate from the question of how you encode and ship it, surely? How are you suggesting a small patch would be shipped?
    - howinteresting 5y ago
      Android does them just fine: https://source.android.com/devices/tech/ota/reduce_size https://source.android.com/devices/tech/ota/reduce_size In particular, bsdiff has been around for a very long time and is an industry standard binary diffing tool.
acdha 5y ago
> I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly) Print Nightmare was part of a risky call in the printing subsystem design which was recognized as such when they made it in the 90s. That specific vulnerability was disclosed to Microsoft in 2020, accidentally disclosed in public in June, flailed at with incomplete patches and bad documentation all summer while ransomware gangs exploited it, and has theoretically finally been patched in the September release following multiple incomplete patches. The Exchange auto discover bug announced yesterday had previously been reported with Microsoft telling the reporter that it wasn’t a bug. Oops. This is hard but it’s also important to remember that this is an industry-wide failure because it’s been cheaper to clean afterwards than invest in proactive cleanup of old “stable” code, and it will likely continue as long as there are no financial consequences for a breach. Adding consequences would change that dynamic but would also be a massive change to the industry. It could endanger open source and would almost certainly make everything more expensive.
- smolder 5y ago
  It would not certainly make everything more expensive. The cost of breaches is significant, though difficult to quantify, so the cost of effective prevention could be lower.
  - acdha 5y ago
    That's _possible_ but fundamentally I'm looking at this from the perspective of requiring new work to be done by expensive people (infosec, dev, ops are all in-demand skills) — maybe some of that comes from changing team priorities, in which case the cost is less feature work, but in most cases I'd expect that to be hiring. There aren't many breaches which have direct costs greater than that because companies have been able to avoid penalties or compensation in most cases. If the cost of a breach was greater than, say, a year of free credit monitoring that calculation could change dramatically. Ransomware has already changed this somewhat: now the cost is halting operations for a potentially lengthy period of time, and that has spurred a lot more awareness that the current model is insufficient but not from what I've seen significant efforts to change it.
scns 5y ago
I hate blaming people and pointing fingers. It seems to me, that the current CEO, who was the CFO at the same company before, would be well advised to drop the "numbers & metrics" MBA mindset. Written five years ago but sadly still relevant: https://steveblank.com/2016/10/24/why-tim-cook-is-steve-ballmer-and-why-he-still-has-his-job-at-apple/ https://steveblank.com/2016/10/24/why-tim-cook-is-steve-ball...
- Revercomb 5y ago
  Agreed here.
wrycoder 5y ago
Depending on her data plan, downloading several tens of gigs over her 4G could have resulted in a rather exciting phone bill.
Abishek_Muthian 5y ago
> “you need a 3GB OS update even if the only fix is 3 lines of code in Safari,...”, If Apple really cared, it would have changed this scenario by now. A 7year old android device which can download/sideload latest Firefox is technically more secure for web browsing than an latest iOS device which is yet to receive an OS update with the critical patch for the Safari. But as Tim Cook proudly claims, People who use Apple products are those 'don't want to take risky decisions themselves' maybe they'd be willing to wait for that OS update however long it takes.

PostThisTooFast 5y ago

Not to mention Apple's amateur-hour, dogshit-stupid policy of forcing everyone to use an E-mail address as his user ID. How many people probably think they need to use their E-mail account password for every one of these idiotic organizations that forces them to log in with their E-mail address? I'm guessing a SHITLOAD. Your grandma definitely is not going to understand the difference. And that makes every one of those organizations the gatekeeper to every user's E-mail account. One disgruntled employee, one poorly secured system, or one nefarious forum operator can now access untold numbers of E-mail accounts and steal identities galore. You don't see banks or brokerages forcing people to use a goddamned E-mail address as a user ID, but Apple has doubled down on this bullshit policy even after being called out on it. No excuse.

guntars 5y ago

The other day I tried to update my Macbook over a personal hotspot and it happily downloaded about 2GB before the computer went to sleep and I was greeted with a "Whoopsie, failed to download the update, try again" message when I woke it and, of course, it would just start over again. They don't even support resuming the download! That's just embarrassing.

robertlagrant 5y ago
Strangely I did the same thing last night and it did resume, although you only see the resumption when it starts. There's no prior indication that it will resume.
- merb 5y ago
  it depends on your free storage. if it is less than X % they will try to download it one go. the resumable download will download all in chunks and than concat them.
  - guntars 5y ago
    Just tried it again. I have 70GB available. Got on the hotspot, started the download, unplugged the laptop, waited for it to go to sleep, woke it up - same result. I had to accept the EULAs again and it started to download from about 50mb. Having attempted (unsuccessfully) to write a resumable HTTP/HTTPS downloader, which is what I suspect nsurlsessiond is using behind the scenes - it's really hard to get it right. Meanwhile I expect to be able to start a BitTorrent download, throw the laptop down the stairs, take out the hard drive and be able to successfully resume it on a different computer because that's a protocol that was actually designed for it.
    - codetrotter 5y ago
      But Apple has the luxury of controlling both the server and the client. Why isn’t it just a matter of using HTTP range requests? https://developer.mozilla.org/en-US/docs/Web/HTTP/Range_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/Range_requ... And if they need to get more clever than that, why not have a BitTorrent-like map of chunk hashes. So you download the update, check the hash of the whole thing and if it fails the hash check, download the chunk hashes which will be say a 256 bit hash for every individual 32 MB chunk of the file. And for any chunk that fails the hash check, use a HTTP range request to download it again.

slvng 5y ago

Microsoft has been all over the cyber security news due to their repeat vulnerabilities in Exchange and Azure AND the way they have handled disclosures made to them

artiszt 5y ago
u must have missed reading this : ".. Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly) .." but then u not need to read it. and who would given all the exquisite experiences with M$ and/or Goo compared to nightmares Apple delivers to u, overpriced, ofc in a sense it is good reading tho after all in that it indicates that exactly those are not the one's one does meet in Apple-communities
- iso1210 5y ago
  It's spelt "you"

mschuster91 5y ago

> but iOS updates can’t be done on 4G > This isn’t an “anecdote” or an edge case, not everyone lives in a developed country and millions are just like my grandma In too many countries, mobile data is incredibly expensive. If Apple were to allow over-the-air OS updates, you can bet it would take only a week until the first class-action lawsuit by people having their data caps blown through because they did not understand that updates are huge.

seszett 5y ago
In many other countries, 4G is so inexpensive that many people use it as their primary Internet connection though. They don't see a need for a modem hooked to a wired line necessitating a second subscription and procedures to follow when you move apartments, when in any case you will have a 4G connection that follows you around on your smartphone.
- Reason077 5y ago
  I've been using 5G as my primary internet connection since January 2020. It's much faster than wired broadband in buildings that don't have fibre installed. It's also cheaper (I pay £30/month for unlimited data), there's no contract locking you in to 12 or 24 months of service, and I can take it with me whenever I travel or if I move house.
  - jeffwass 5y ago
    If you have a desktop, how do you provide the 5G connection? Is there a better way than providing a wifi hotspot with your mobile phone?
    - Reason077 5y ago
      I have a Huawei E6878-870 5G mobile WiFi (other brands are available), which provides a "proper" WiFi base station, so no need for a phone hotspot. I have a separate cheap SIM card for my phone.
5y ago

user-the-name 5y ago

Apple's entire bug reporting system has always been massively dysfunctional. It is little surprise this extends to their handling of externally reported security issues as well.

rixed 5y ago

> my grandma doesn’t have WiFi Tech workers have difficulty taking into consideration lifestyles they don't know exist, which is understandable. At the end of the day this comes as another consequence of the lack of diversity in tech, I guess.

funcDropShadow 5y ago
So, is this the lack of grandmas working at Apple in software development? This is nothing you can fix by following some diversity ideology. This is a question of respecting different requirements from different user groups. You cannot mirror every user group in the development teams. How do you represent people of old age, with illnesses, or certain disabilities in a development team? How do you represent people living at certain locations in the world in a development team? How do you represent poor people or people of low education? Or how do you represent people which live under oppressive regimes or are the continued victims of criminals? All these groups have different needs and expectations to the products they buy or lease. And development teams and their business cannot expect to understand that by having a more diverse development team. They have to do better requirements engineering, they have to listen better to their customers and they have to decide and prioritize those needs and expectations. E.g. A/B testing has abysmal consequences for the needs and expectations of minorities.
- shorner 5y ago
  Now that you mention it, I think there's a real lack of grandmas in tech... maybe I shouldn't be saying this publicly, but we don't have any at our company.
  - OldHand2018 5y ago
    One of our product managers is a grandmother (she is actually taking an early retirement soon because her 4th grandchild is on the way). We are in the B2B/B2EDU space so the "As a grandmother, I think..." line of thought does not apply. However, she has frequently had insights and observations that none of us would have come up with. Once implemented, they have been very successful/profitable. So yes, absolutely, unless your company wants to be in a very specific niche, the lack of true diversity in your company is a drag on your success. PS - my grandfather had a tech job in Sunnyvale. He passed away last year at the age of 92. Point is - everyone alive has lived in a world with pervasive technology and computing. "They're old and can't understand this stuff" is pure BS.

samhw 5y ago

> instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3 lines of code in Safari..." Your comment seems to be implying that Apple could simply ship the delta in the source code: i.e. something like `git diff --minimal --word-diff=porcelain head^1`. Would this not require iOS to be compiled on the device, and store its own source code, à la `.git`? How would you address the issue of the compiler itself needing to be updated as part of this process? Or are you suggesting they would ship the diff for the binary? For one, I don't think the delta in the resulting binary would be as small as the delta in the source, due to addresses changing, etc. There are tools like bsdiff which can 'intelligently' handle this, but I believe they aren't widely used for operating system updates, as opposed to standard userspace binaries. In addition to this, the diff shipped would be relative to whatever version the device is currently using, which would necessitate storing a very large number of diffs, especially for binaries, or else computing it on the fly (which simply shifts the burden from disk space to CPU cycles). Or have I misunderstood you entirely?

willis936 5y ago
They're suggesting a patch in the classical sense of the term. A whole hog OS update does not qualify. These complications were addressed 20+ years ago when whole hog OS updates were unreasonable. It requires a certain amount of cleverness, but that may be too much to ask of the fruit company. https://en.wikipedia.org/wiki/Patch_(computing) https://en.wikipedia.org/wiki/Patch_(computing)
- samhw 5y ago
  I understand the change would be a patch, but that's separate from the question of how you encode and ship it, surely? How are you suggesting a small patch would be shipped?
  - howinteresting 5y ago
    Android does them just fine: https://source.android.com/devices/tech/ota/reduce_size https://source.android.com/devices/tech/ota/reduce_size In particular, bsdiff has been around for a very long time and is an industry standard binary diffing tool.

acdha 5y ago

> I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly) Print Nightmare was part of a risky call in the printing subsystem design which was recognized as such when they made it in the 90s. That specific vulnerability was disclosed to Microsoft in 2020, accidentally disclosed in public in June, flailed at with incomplete patches and bad documentation all summer while ransomware gangs exploited it, and has theoretically finally been patched in the September release following multiple incomplete patches. The Exchange auto discover bug announced yesterday had previously been reported with Microsoft telling the reporter that it wasn’t a bug. Oops. This is hard but it’s also important to remember that this is an industry-wide failure because it’s been cheaper to clean afterwards than invest in proactive cleanup of old “stable” code, and it will likely continue as long as there are no financial consequences for a breach. Adding consequences would change that dynamic but would also be a massive change to the industry. It could endanger open source and would almost certainly make everything more expensive.

smolder 5y ago
It would not certainly make everything more expensive. The cost of breaches is significant, though difficult to quantify, so the cost of effective prevention could be lower.
- acdha 5y ago
  That's _possible_ but fundamentally I'm looking at this from the perspective of requiring new work to be done by expensive people (infosec, dev, ops are all in-demand skills) — maybe some of that comes from changing team priorities, in which case the cost is less feature work, but in most cases I'd expect that to be hiring. There aren't many breaches which have direct costs greater than that because companies have been able to avoid penalties or compensation in most cases. If the cost of a breach was greater than, say, a year of free credit monitoring that calculation could change dramatically. Ransomware has already changed this somewhat: now the cost is halting operations for a potentially lengthy period of time, and that has spurred a lot more awareness that the current model is insufficient but not from what I've seen significant efforts to change it.

scns 5y ago

I hate blaming people and pointing fingers. It seems to me, that the current CEO, who was the CFO at the same company before, would be well advised to drop the "numbers & metrics" MBA mindset. Written five years ago but sadly still relevant: https://steveblank.com/2016/10/24/why-tim-cook-is-steve-ballmer-and-why-he-still-has-his-job-at-apple/ https://steveblank.com/2016/10/24/why-tim-cook-is-steve-ball...

Revercomb 5y ago
Agreed here.

wrycoder 5y ago

Depending on her data plan, downloading several tens of gigs over her 4G could have resulted in a rather exciting phone bill.

Abishek_Muthian 5y ago

> “you need a 3GB OS update even if the only fix is 3 lines of code in Safari,...”, If Apple really cared, it would have changed this scenario by now. A 7year old android device which can download/sideload latest Firefox is technically more secure for web browsing than an latest iOS device which is yet to receive an OS update with the critical patch for the Safari. But as Tim Cook proudly claims, People who use Apple products are those 'don't want to take risky decisions themselves' maybe they'd be willing to wait for that OS update however long it takes.