5 ms·

It doesn't mean they spend all that budget on hardening against attacks. The vast majority is for user experience, flashy+useful end user features, etc.

dmitriid 5y ago
And actual military grade security would stand in the way of so much of that. Consumer products are in a he unenviable position of trying to combine things that don't combine well.
- joe_the_user 5y ago
  If being hacked makes someone feel bad, consumer products are in an unenviable position. If making money makes some feel good, consumer product are in an enviable position.
olliej 5y ago
There are only a finite number of engineering hours available. Employing more engineers doesn’t work. Rewriting the stack in a safe language would take years (25+ years of code to rewrite). Saying the vast majority is on ux+flash, is the super common mistake: you don’t see any of the work that is not in the UI portion of an app, that doesn’t mean that’s not getting huge amounts of work.
gruez 5y ago
To make it even worse, the "flashy+useful end user features" are the very thing that make the OS hard to secure. Nearly all of iMessage exploits stem from parts related to non-text handling. FORCEDENTRY was caused by code related to image handling, for instance. I'm sure if you're willing to cut the scope of the messaging app to only text, it'd be impossible to hack.
- codeflo 5y ago
  You’d probably have to limit it to ASCII text, and even then use fixed-width fonts just to be sure — at least one iOS vulnerability was related to word-wrapping of Zalgo-style Unicode in lock screen notifications.
  - Ntrails 5y ago
    And practically nobody would buy that product, secure or not
    - emn13 5y ago
      Yeah, nobody would use a text only communication platform.;-)
      - Ntrails 5y ago
        There is a reason smart phones won. That discord trumps irc and xmpp. I am not sure how secure a Nokia 3210 really is, but I could phone and text with it even today I expect. The users are rare, and that is not accidentap
        emn13 5y ago
        Sure, it's just a particularly amusing case to make on a text-only platform like hacker news.
geenew 5y ago
That is what we pay them for, to a material degree. iOS wins in a lot of use-cases because it's perceived as the platform that better protects privacy. For me, it's fine if they lose some battles, but they should budget to win the war.

dmitriid 5y ago

And actual military grade security would stand in the way of so much of that. Consumer products are in a he unenviable position of trying to combine things that don't combine well.

joe_the_user 5y ago
If being hacked makes someone feel bad, consumer products are in an unenviable position. If making money makes some feel good, consumer product are in an enviable position.

olliej 5y ago

There are only a finite number of engineering hours available. Employing more engineers doesn’t work. Rewriting the stack in a safe language would take years (25+ years of code to rewrite). Saying the vast majority is on ux+flash, is the super common mistake: you don’t see any of the work that is not in the UI portion of an app, that doesn’t mean that’s not getting huge amounts of work.

gruez 5y ago

To make it even worse, the "flashy+useful end user features" are the very thing that make the OS hard to secure. Nearly all of iMessage exploits stem from parts related to non-text handling. FORCEDENTRY was caused by code related to image handling, for instance. I'm sure if you're willing to cut the scope of the messaging app to only text, it'd be impossible to hack.

codeflo 5y ago
You’d probably have to limit it to ASCII text, and even then use fixed-width fonts just to be sure — at least one iOS vulnerability was related to word-wrapping of Zalgo-style Unicode in lock screen notifications.
- Ntrails 5y ago
  And practically nobody would buy that product, secure or not
  - emn13 5y ago
    Yeah, nobody would use a text only communication platform.;-)
    - Ntrails 5y ago
      There is a reason smart phones won. That discord trumps irc and xmpp. I am not sure how secure a Nokia 3210 really is, but I could phone and text with it even today I expect. The users are rare, and that is not accidentap
      - emn13 5y ago
        Sure, it's just a particularly amusing case to make on a text-only platform like hacker news.

geenew 5y ago

That is what we pay them for, to a material degree. iOS wins in a lot of use-cases because it's perceived as the platform that better protects privacy. For me, it's fine if they lose some battles, but they should budget to win the war.