> of these bugs could be caught via static analysis which Apple obviously uses as part of its approval process. What? Are you suggesting that OS security bugs

> of these bugs could be caught via static analysis which Apple obviously uses as part of its approval process. What? Are you suggesting that OS security bugs are in fact non-issues because static analysis can detect programs that exploit these bugs? No, it doesn't work that way. You can always encode program logic in a way that will defeat static analysis. All you have to do is write a little interpreter with PEEK, POKE, and JUMP opcodes, then encode your actual exploit logic using the little instruction set you've just created. You can make this sort of indirection as elaborate as you want, and there's no way for static analysis to see through it all. When this kind of technique is used for DRM, it takes months of expert human analysis to figure out what's going on. No way some scanner is going to do that, especially if (unlike in the DRM cracking case) there's no clear indication that there's something to discover and decode in the first place.