47 ms·

If an attacker has a way to escape the browser javascript sandbox on webkit and also has an iOS app sandbox exploit, that right now will pwn any iOS user who cl

If an attacker has a way to escape the browser javascript sandbox on webkit and also has an iOS app sandbox exploit, that right now will pwn any iOS user who clicks a malicious link. If I can run firefox instead, and that javascript sandbox exploit was already patched in firefox, the iOS app sandbox escape won't do them any good. They can't get through the earlier layer to exploit it. The claims being made here is that the first layer, the browser exploit, is easier with safari/webkit, and the second layer, the iOS sandbox escape, is identical. Even if it only changes one layer of security, that is still a meaningful change and is more secure. There are additional factors too. Right now, if you have a webkit vuln, but no iOS sandbox escape, you can still steal cookies from other sites, browser history, exfiltrate passwords, etc. The browser engine is a valuable target on its own, even ignoring the rest of the system.

asdff 4y ago
That's one stance on security but its so baffling that there are two Apple's here. There is the apple that gives you the ropes on macos to install your own software and run unsigned code, knowing that this doesn't lead to macos users regularly being pwned or the world burning down or anything like that today. And there is also the apple that thinks that letting you do this same thing on a much less consequential device than your home computer, your cellphone or your tablet, would infact lead to the sky falling down and users around the world being pwned and the stock price no doubt crashing into the depths. These two things can't both exist. The fact that the sky isn't falling on macos leads me to believe that this position of apple's, while spoken in terms of privacy and security publicly, is really all about dominating what software runs on their devices which i remind you have to pay a hefty fee on profits to apple in order to be installed on users devices through official means. That is pretty user hostile, but obviously shareholder friendly, which explains why it perpetuates and why apple share prices have reached the stratosphere since the iPhone.
- idle_zealot 4y ago
  > letting you do this same thing on a much less consequential device than your home computer, your cellphone or your tablet Last I heard then officially defend this apparent contradiction, the Apple rep asserted that people's phones are in fact the more important/personal devices, as well as being more common, and as such security on iOS is more important than on macOS.
  - asdff 4y ago
    But why, because the phone connects to your instagram account? Meanwhile, most people's computers have passwords to literally all their accounts saved in the various system or web browser autofillers. They might also have personal documents such as tax information saved locally. Maybe even their social security number and other very important information written down in a word document on their desktop. Especially if your macbook is synced with icloud, I can't imagine why your phone might be a more sensitive device considering at that point the macbook is at feature parity with everything sensitive that the iphone does and more perhaps.
    - idle_zealot 4y ago
      Consider that most internet-connected people only have a phone, and many that own a "real computer" use it primarily for work. The phone has their banking info, health info, personal communications, professional communications, most of their browsing history. A huge number of people manage their taxes on their phones. I think Apple's claim that in aggregate they are more important than laptops/desktops is largely accurate. That said, I consider that all the more reason that people should be able to run whatever software they wish on their phone. The present paradigm of such a personal device's operation being totally out of the hands of its owner is troubling.
      - asdff 4y ago
        If their iphone has that, by virtue of icloud sync, their macbook if they have one has that same sensitive info as well. So is apple saying then, if you want to be the most secure, don't buy our macbook and don't sync it up with your iphone?

asdff 4y ago

That's one stance on security but its so baffling that there are two Apple's here. There is the apple that gives you the ropes on macos to install your own software and run unsigned code, knowing that this doesn't lead to macos users regularly being pwned or the world burning down or anything like that today. And there is also the apple that thinks that letting you do this same thing on a much less consequential device than your home computer, your cellphone or your tablet, would infact lead to the sky falling down and users around the world being pwned and the stock price no doubt crashing into the depths. These two things can't both exist. The fact that the sky isn't falling on macos leads me to believe that this position of apple's, while spoken in terms of privacy and security publicly, is really all about dominating what software runs on their devices which i remind you have to pay a hefty fee on profits to apple in order to be installed on users devices through official means. That is pretty user hostile, but obviously shareholder friendly, which explains why it perpetuates and why apple share prices have reached the stratosphere since the iPhone.

idle_zealot 4y ago
> letting you do this same thing on a much less consequential device than your home computer, your cellphone or your tablet Last I heard then officially defend this apparent contradiction, the Apple rep asserted that people's phones are in fact the more important/personal devices, as well as being more common, and as such security on iOS is more important than on macOS.
- asdff 4y ago
  But why, because the phone connects to your instagram account? Meanwhile, most people's computers have passwords to literally all their accounts saved in the various system or web browser autofillers. They might also have personal documents such as tax information saved locally. Maybe even their social security number and other very important information written down in a word document on their desktop. Especially if your macbook is synced with icloud, I can't imagine why your phone might be a more sensitive device considering at that point the macbook is at feature parity with everything sensitive that the iphone does and more perhaps.
  - idle_zealot 4y ago
    Consider that most internet-connected people only have a phone, and many that own a "real computer" use it primarily for work. The phone has their banking info, health info, personal communications, professional communications, most of their browsing history. A huge number of people manage their taxes on their phones. I think Apple's claim that in aggregate they are more important than laptops/desktops is largely accurate. That said, I consider that all the more reason that people should be able to run whatever software they wish on their phone. The present paradigm of such a personal device's operation being totally out of the hands of its owner is troubling.
    - asdff 4y ago
      If their iphone has that, by virtue of icloud sync, their macbook if they have one has that same sensitive info as well. So is apple saying then, if you want to be the most secure, don't buy our macbook and don't sync it up with your iphone?