4 ms·

This is overblown hyperbole, it disables a few features a lot of people have never even heard of. Disabling the JIT compiler makes the browser a bit slower. It

This is overblown hyperbole, it disables a few features a lot of people have never even heard of. Disabling the JIT compiler makes the browser a bit slower. It does not cripple it. Disabling profiles, debugging and MDM? These are not useful unless you’re in ‘enterprise’ or a developer. Can’t send documents or links through iMessage? Use another service or copy and paste the links you actually want to open. Really a tiny price to pay for the added security.

arcturus17 4y ago
Yea I am a developer but when you put it like that I would consider getting a phone for debugging and adding lockdown to my personal phone. I’m not Jeff Bezos nor do I intend to be but at least I would like to support this and see what the experience looks like.
- cmorgan31 4y ago
  Yup, there is little downside to supporting this concept as it should inevitably move others to adopt similar functionality. It isn’t the perfect solution or likely even the best idea in the room but the biggest player just made a big move in the consumer’s favor. It does coincide with a big privacy push that will keep their market share up so not really benevolence.
- bigiain 4y ago
  Same, I'm planning on running this on a spare iPhone, looking into whether I'd be OK running it on my daily carry phone. I consider myself "recreationally paranoid", I enjoy locking my stuff down for fun, not because I ever think anyone's gonna burn an NSO zero day to get into my stuff.
joveian 4y ago
I agree, this mode seems like something most people could manage without difficulty. Amusingly, my (non-Apple) system is much more locked down than this and isn't exactly unusuable IMO, although some things might be harder to manage on a phone. Microsoft did some tests for Edgium's "Super Duper Secure Mode" and found that disabling JIT improves real world performance more often than it makes it worse (and usually makes no difference): https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... Diabling JIT makes it possible to enable some additional exploit mitigation methods. A follow up article mentioned that few people who tried it noticed a difference: https://microsoftedge.github.io/edgevr/posts/Introducing-Enhanced-Security-for-Microsoft-Edge/ https://microsoftedge.github.io/edgevr/posts/Introducing-Enh... "It is worth mentioning that when we originally had this idea, we doubted our Microsoft Edge peers would even consider it. We quietly made changes to our browser without explicitly telling them the specifics and then asked them weeks later to see if they noticed the change. They would always say no, and only then would we inform them that we disabled the JIT. After surprising multiple developers in Microsoft Edge, we got the support needed to try this experiment. One can’t help but wonder what other well established assumptions about users and the web we should reconsider."
rsync 4y ago
"Disabling profiles, debugging and MDM?" I'm not really going to argue this but, just in case it is interesting for you and others to learn: I use profiles/configurator on my kids' iphones ...
- acdha 4y ago
  Note that this doesn’t disable MDM entirely: it disables adding new MDM profiles after its enabled (I’d hope there’s a “do you trust the existing one with your life?” prompt…) which seems like a reasonable compromise for preventing spear phishing to install new profiles.

arcturus17 4y ago

Yea I am a developer but when you put it like that I would consider getting a phone for debugging and adding lockdown to my personal phone. I’m not Jeff Bezos nor do I intend to be but at least I would like to support this and see what the experience looks like.

cmorgan31 4y ago
Yup, there is little downside to supporting this concept as it should inevitably move others to adopt similar functionality. It isn’t the perfect solution or likely even the best idea in the room but the biggest player just made a big move in the consumer’s favor. It does coincide with a big privacy push that will keep their market share up so not really benevolence.
bigiain 4y ago
Same, I'm planning on running this on a spare iPhone, looking into whether I'd be OK running it on my daily carry phone. I consider myself "recreationally paranoid", I enjoy locking my stuff down for fun, not because I ever think anyone's gonna burn an NSO zero day to get into my stuff.

joveian 4y ago

I agree, this mode seems like something most people could manage without difficulty. Amusingly, my (non-Apple) system is much more locked down than this and isn't exactly unusuable IMO, although some things might be harder to manage on a phone. Microsoft did some tests for Edgium's "Super Duper Secure Mode" and found that disabling JIT improves real world performance more often than it makes it worse (and usually makes no difference): https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... Diabling JIT makes it possible to enable some additional exploit mitigation methods. A follow up article mentioned that few people who tried it noticed a difference: https://microsoftedge.github.io/edgevr/posts/Introducing-Enhanced-Security-for-Microsoft-Edge/ https://microsoftedge.github.io/edgevr/posts/Introducing-Enh... "It is worth mentioning that when we originally had this idea, we doubted our Microsoft Edge peers would even consider it. We quietly made changes to our browser without explicitly telling them the specifics and then asked them weeks later to see if they noticed the change. They would always say no, and only then would we inform them that we disabled the JIT. After surprising multiple developers in Microsoft Edge, we got the support needed to try this experiment. One can’t help but wonder what other well established assumptions about users and the web we should reconsider."

rsync 4y ago

"Disabling profiles, debugging and MDM?" I'm not really going to argue this but, just in case it is interesting for you and others to learn: I use profiles/configurator on my kids' iphones ...

acdha 4y ago
Note that this doesn’t disable MDM entirely: it disables adding new MDM profiles after its enabled (I’d hope there’s a “do you trust the existing one with your life?” prompt…) which seems like a reasonable compromise for preventing spear phishing to install new profiles.