4 ms·

It really feels like sanitizing user inputs is a new concept to Apple.

• musicale 5y ago
  You'd think they'd have implemented data taint tracking or something in the Swift language/runtime/libraries to reduce the attack surface. You might even be able to implement it in the sandboxing system.
• olliej 5y ago
  The problem is really how you respond - a valid (from a security standpoint) response to invalid input is termination: it means that you can’t exploit it. In this case such a response would be inappropriate (I have know idea what the actual bug in the code was, whether it was deliberate or unintentional). Hell I’ve seen utf8 libraries that terminate on invalid input, so good luck using those :-/
  • 0x0 5y ago
    Doesn't help if you're just terminating the springboard over and over, basically bootlooping the device
    • olliej 5y ago
      But at least it’s not a security bug \o/ At least that is the logic that occurs. I am not saying it’s good logic :) Honestly I feel the bigger bug is something going wrong in HomeKit taking out springboard.