4 ms·

Security is very hard in companies driven by marketing. Even if "security" is a feature being marketed. Having security by design means moving much slower, havi

by aenis 5y ago

Security is very hard in companies driven by marketing. Even if "security" is a feature being marketed. Having security by design means moving much slower, having code reviews done by paranoiacs who care not one bit about features, and constantly thinking about reducing attack surfaces. Paranoiacs will start with "do we need to handle any user messages at all? that's untrusted data!", much less "do we need to support ALL SORTS of image formats, including some handled by obscure, obsolete libraries that noone truly knows how they work?". The fact that the messaging application allowed untrusted data to escape the sandbox via obscure data processing libraries they didn't write themselves is a proof of lack of internal software risk assessment process. I hope they learned their lesson and code is now reviewed by people not incentivised to rubber stamp everything the moment in lands on their desks.

pm90 5y ago
> I hope they learned their lesson and code is now reviewed by people not incentivised to rubber stamp everything the moment in lands on their desks. Almost certain they did not learn any lesson. Like you say, they’re marketing security. If they had made investments we would have heard of it (big hires, security rampup etc). Anecdotal, but It seems like Apple’s DNA is still very hardware focused. People in my friends group have all interviewed there but none of them accepted offers because they would never match other Big Tech.
- grapescheesee 5y ago
  Nonprofessional observation from. "Anecdotal, but It seems like Apple’s DNA is still very hardware focused. People in my friends group have all interviewed there but none of them accepted offers because they would never match other Big Tech." It seems most of the real magic, long term R&D ROI, and difficult hires. Now rest in the switch from OEM to in house made chips. I would be interested in others perceptions of this. A modern phone is built on tech from chips like a Z80. However now the amount of chemical engineers, electrical engineers, process, and so on has changes so dramatically. We have large teams of people becoming so specialized the first stack software is far more times the abstraction it was year by year. Security is hard. Just like quality, they both take back seats more and more often since they generally only hurt ROI.
  - datavirtue 5y ago
    Then they need to explicitly tell people who are at risk of government tracking not to use their phone.
    - grapescheesee 5y ago
      Suppose that is true. If they did say it (which they will not do) anytime in the near future. They would say 'everyone is.'
makapuf 5y ago
Maybe security can be enabled by a toggle where, like plane mode, you restrict your phone to a smaller set of features but with better security. Of course the difficulty is once you've said that the feature set will be much reduced because you've exposed your responsibility. But then security is an additional feature
- aenis 5y ago
  Disabled code is still an attack surface, sadly - and the false sense of security might make it a net negative. A different os build would be better. Sadly, the biggest surface, aside from the users themselves, is likely still the web browser. With them being nothing short of mini OSes, I am not sure one can make a secure modern phone. If you have secrets, design your opsec around the assumption that your phone is easily hackable.
- fsflover 5y ago
  This is how Librem 5 smartphone works, with hardware kill switches.
0xy 5y ago
I think the key question is why does Apple consider it okay to make moves like dropping the headphone jack for merely cosmetic reasons, whereas dropping obscure 30 year old formats that do all kinds of psychotic stuff (like run code) for security reasons is a much tougher sell?
- elcdodedocle 5y ago
  They dropped the jack because there was money to be made, selling airpods.
  - elcdodedocle 5y ago
    (same reason as almost every other I/O decision they make, apparently)
  - culturestate 5y ago
    Apple was going to sell hundreds of millions of AirPods with or without a headphone jack. We may never really know what the final straw was, but I’d be willing to bet that Jony Ive & Co. were looking for a suitable excuse to drop it for years. It’s one more component that limits how thin the device can be, it’s an ingress point for water (Apple was never going to add a flap), and if you’re the kind of person who digs symmetry then a giant hole on one side looks ugly. Luckily for them, the market came their way. Bluetooth headphones were massively outselling wired headphones by that point, and it’s one of those areas Apple loves to work in - a space where they can add some proprietary magic (H-series chips, instant pairing, auto source switching) that makes what would otherwise be a relatively ordinary product into a remarkable one.
    - fomine3 5y ago
      I don't know whether wireless earphones sold like now what if Apple didn't remove 3.5mm hole. There were many phones 3.5mm jack and waterproof without a flap.
blep-arsh 5y ago
They have moved image parsing to a separate restricted process. That's way overdue. Wouldn't hurt to have these parsers rewritten with more attention to memory safety, though.

by aenis 5y ago

pm90 5y ago

> I hope they learned their lesson and code is now reviewed by people not incentivised to rubber stamp everything the moment in lands on their desks. Almost certain they did not learn any lesson. Like you say, they’re marketing security. If they had made investments we would have heard of it (big hires, security rampup etc). Anecdotal, but It seems like Apple’s DNA is still very hardware focused. People in my friends group have all interviewed there but none of them accepted offers because they would never match other Big Tech.

grapescheesee 5y ago
Nonprofessional observation from. "Anecdotal, but It seems like Apple’s DNA is still very hardware focused. People in my friends group have all interviewed there but none of them accepted offers because they would never match other Big Tech." It seems most of the real magic, long term R&D ROI, and difficult hires. Now rest in the switch from OEM to in house made chips. I would be interested in others perceptions of this. A modern phone is built on tech from chips like a Z80. However now the amount of chemical engineers, electrical engineers, process, and so on has changes so dramatically. We have large teams of people becoming so specialized the first stack software is far more times the abstraction it was year by year. Security is hard. Just like quality, they both take back seats more and more often since they generally only hurt ROI.
- datavirtue 5y ago
  Then they need to explicitly tell people who are at risk of government tracking not to use their phone.
  - grapescheesee 5y ago
    Suppose that is true. If they did say it (which they will not do) anytime in the near future. They would say 'everyone is.'

makapuf 5y ago

Maybe security can be enabled by a toggle where, like plane mode, you restrict your phone to a smaller set of features but with better security. Of course the difficulty is once you've said that the feature set will be much reduced because you've exposed your responsibility. But then security is an additional feature

aenis 5y ago
Disabled code is still an attack surface, sadly - and the false sense of security might make it a net negative. A different os build would be better. Sadly, the biggest surface, aside from the users themselves, is likely still the web browser. With them being nothing short of mini OSes, I am not sure one can make a secure modern phone. If you have secrets, design your opsec around the assumption that your phone is easily hackable.
fsflover 5y ago
This is how Librem 5 smartphone works, with hardware kill switches.

0xy 5y ago

I think the key question is why does Apple consider it okay to make moves like dropping the headphone jack for merely cosmetic reasons, whereas dropping obscure 30 year old formats that do all kinds of psychotic stuff (like run code) for security reasons is a much tougher sell?

elcdodedocle 5y ago
They dropped the jack because there was money to be made, selling airpods.
- elcdodedocle 5y ago
  (same reason as almost every other I/O decision they make, apparently)
- culturestate 5y ago
  Apple was going to sell hundreds of millions of AirPods with or without a headphone jack. We may never really know what the final straw was, but I’d be willing to bet that Jony Ive & Co. were looking for a suitable excuse to drop it for years. It’s one more component that limits how thin the device can be, it’s an ingress point for water (Apple was never going to add a flap), and if you’re the kind of person who digs symmetry then a giant hole on one side looks ugly. Luckily for them, the market came their way. Bluetooth headphones were massively outselling wired headphones by that point, and it’s one of those areas Apple loves to work in - a space where they can add some proprietary magic (H-series chips, instant pairing, auto source switching) that makes what would otherwise be a relatively ordinary product into a remarkable one.
  - fomine3 5y ago
    I don't know whether wireless earphones sold like now what if Apple didn't remove 3.5mm hole. There were many phones 3.5mm jack and waterproof without a flap.

blep-arsh 5y ago

They have moved image parsing to a separate restricted process. That's way overdue. Wouldn't hurt to have these parsers rewritten with more attention to memory safety, though.