6 ms·

Frustrated dev drops three zero-day vulns affecting Apple iOS 15

187 points by LinuxBender 5y ago

riknos314 5y ago
>he told The Register, "Talking to Apple Product Security is like talking to a brick wall." >The Register asked Apple to comment, but the brick wall did not respond. Seems about right.
- twiceaday 5y ago
  https://tenor.com/view/dono-wall-talking-wall-bricks-gif-17741481 https://tenor.com/view/dono-wall-talking-wall-bricks-gif-177...
- TameAntelope 5y ago
  Very presumptuous of me to say this, but I wonder if the "brick wall" is a non-technical PR type who has been put in the center of many very technical questions, and has realized that his/her boss doesn't yell at him/her if he/she simply doesn't respond very much to external queries. It can be hard when your job mostly consists of talking to extremely knowledgable people (such as many researchers in this field are) without yourself being at least broadly knowledgable on nearly everything technical.
  - hnarn 5y ago
    I don’t understand your point. They are talking about “Apple Product Security”. If the person employed there is as you describe then it’s first of all an outrage that Apple do not hire sufficiently competent people for these types of critical positions, and secondly it does not exonerate this hypothetical person from the duty of escalating and understanding the impact.
JonathanBeuys 5y ago
I am always shocked when I find out how lax security is handled even by parties of whom I thought they would take security very serious. Did you know that you can bypass the lockscreen on Linux Mint by plugging in an external monitor? https://github.com/linuxmint/cinnamon/issues/9123 https://github.com/linuxmint/cinnamon/issues/9123 Did you know that when you use Chromium on an up-to-date Debian stable, it has over 100 unpatched security holes? https://security-tracker.debian.org/tracker/status/release/stable https://security-tracker.debian.org/tracker/status/release/s... If you cannot trust Debian - whom can you trust? Any suggestions which distro takes security serious?
- amelius 5y ago
  > Any suggestions how to run a secure Linux machine? Prevent physical access, install only ssh for external access and run Sshguard. And use Firefox as a browser.
  - JonathanBeuys 5y ago
    Hmm.. that is not what I meant. Rephrased it to "Any suggestions which distro takes security serious?" now. Since it seems that Debian has decided to not patch Chromium for months now, how do I know they won't do the same for Firefox at some point? Or any other software in their repos? I would prefer a distro which promises to keep all software in their repos secure for a certain amount of time. Even if that means having fewer packages than other distros.
    - amelius 5y ago
      Good question. Perhaps NixOS, because it allows you to easily compile your own packages (?)
      - edoceo 5y ago
        You're just compiling the same broken code.
        amelius 5y ago
        The idea is that you download the most recent version of the source code of the package.
        tossaway9000 5y ago
        Its the same problem just at a different point in time. The latest code introduces the latest bugs and security vulnerabilities too.
        edoceo 5y ago
rado 5y ago
> Apple is shipping iOS with known bugs Shocker
- xchaotic 5y ago
  it's working fine for the bottom line and stock price so why should they care more?
- shreddit 5y ago
  This is not about bugs, there will always be bugs. These are security HOLES.
  - w0mbat 5y ago
    Security holes like letting any app see the name of the current Wi-Fi network? I didn't know that wasn't the default. I wouldn't really class this as an urgent security hole.
saurik 5y ago
There were a ton of comments about this a few days ago: https://news.ycombinator.com/item?id=28637276 https://news.ycombinator.com/item?id=28637276
amelius 5y ago
Apple's acting more and more like a government, also with their regulated app market.
deleted 5y ago
[deleted]
userbinator 5y ago
Unfortunately it doesn't sound like these could be used for jailbreaking. Maybe that's why Apple didn't care so much...
orloffm 5y ago
Question: aren't these objects files on the filesystem since MacOS is Unix-based? In other words, have they forgotten to `chmod` them, or are they just plain objects and the checks are high-level abstractions each developer has to implement manually?

187 points by LinuxBender 5y ago

>he told The Register, "Talking to Apple Product Security is like talking to a brick wall." >The Register asked Apple to comment, but the brick wall did not respond. Seems about right.

twiceaday 5y ago
https://tenor.com/view/dono-wall-talking-wall-bricks-gif-17741481 https://tenor.com/view/dono-wall-talking-wall-bricks-gif-177...
TameAntelope 5y ago
Very presumptuous of me to say this, but I wonder if the "brick wall" is a non-technical PR type who has been put in the center of many very technical questions, and has realized that his/her boss doesn't yell at him/her if he/she simply doesn't respond very much to external queries. It can be hard when your job mostly consists of talking to extremely knowledgable people (such as many researchers in this field are) without yourself being at least broadly knowledgable on nearly everything technical.
- hnarn 5y ago
  I don’t understand your point. They are talking about “Apple Product Security”. If the person employed there is as you describe then it’s first of all an outrage that Apple do not hire sufficiently competent people for these types of critical positions, and secondly it does not exonerate this hypothetical person from the duty of escalating and understanding the impact.

JonathanBeuys 5y ago

I am always shocked when I find out how lax security is handled even by parties of whom I thought they would take security very serious. Did you know that you can bypass the lockscreen on Linux Mint by plugging in an external monitor? https://github.com/linuxmint/cinnamon/issues/9123 https://github.com/linuxmint/cinnamon/issues/9123 Did you know that when you use Chromium on an up-to-date Debian stable, it has over 100 unpatched security holes? https://security-tracker.debian.org/tracker/status/release/stable https://security-tracker.debian.org/tracker/status/release/s... If you cannot trust Debian - whom can you trust? Any suggestions which distro takes security serious?

amelius 5y ago
> Any suggestions how to run a secure Linux machine? Prevent physical access, install only ssh for external access and run Sshguard. And use Firefox as a browser.
- JonathanBeuys 5y ago
  Hmm.. that is not what I meant. Rephrased it to "Any suggestions which distro takes security serious?" now. Since it seems that Debian has decided to not patch Chromium for months now, how do I know they won't do the same for Firefox at some point? Or any other software in their repos? I would prefer a distro which promises to keep all software in their repos secure for a certain amount of time. Even if that means having fewer packages than other distros.
  - amelius 5y ago
    Good question. Perhaps NixOS, because it allows you to easily compile your own packages (?)
    - edoceo 5y ago
      You're just compiling the same broken code.
      - amelius 5y ago
        The idea is that you download the most recent version of the source code of the package.
        tossaway9000 5y ago
        Its the same problem just at a different point in time. The latest code introduces the latest bugs and security vulnerabilities too.
        edoceo 5y ago

rado 5y ago

> Apple is shipping iOS with known bugs Shocker

xchaotic 5y ago
it's working fine for the bottom line and stock price so why should they care more?
shreddit 5y ago
This is not about bugs, there will always be bugs. These are security HOLES.
- w0mbat 5y ago
  Security holes like letting any app see the name of the current Wi-Fi network? I didn't know that wasn't the default. I wouldn't really class this as an urgent security hole.

saurik 5y ago

There were a ton of comments about this a few days ago: https://news.ycombinator.com/item?id=28637276 https://news.ycombinator.com/item?id=28637276

amelius 5y ago

Apple's acting more and more like a government, also with their regulated app market.

deleted 5y ago

[deleted]

userbinator 5y ago

Unfortunately it doesn't sound like these could be used for jailbreaking. Maybe that's why Apple didn't care so much...

orloffm 5y ago

Question: aren't these objects files on the filesystem since MacOS is Unix-based? In other words, have they forgotten to `chmod` them, or are they just plain objects and the checks are high-level abstractions each developer has to implement manually?