4 ms·

The disconnect here is that Apple already monopolizes the devices, the service, and the application distribution platform. Now, they're expecting you to be

The disconnect here is that Apple already monopolizes the devices, the service, and the application distribution platform. Now, they're expecting you to be satisfied with them monopolizing the security controls and monitoring on your phone. We expect so little of our phones with respect to our desktops when we know full well there's no legitimate reason to do so. Particularly now, if you're imagining that one needs security against state level actors.. then the notion that a single vendor is required to simplify the ecosystem and broaden adoption is directly in conflict with this future you have declared we are now in. It's literally the weakest possible model of defense available. This isn't the perfect being the enemy of the good.. this is Apple monopolizing yet another aspect of the platform for themselves at the cost of true innovation.

noduerme 4y ago
It's also a handy way to keep their stranglehold on iOS web browsers, forcing all to use webkit. How exactly they turn off JIT compiling and allow any javascript to run at all, I don't really understand, and I don't know what vulnerabilities they must be aware of in Safari's engine that could lead to unsandboxed code execution (although thinking about it, this seems to prove they're aware of something inherently unsafe there). But if their claim is along the lines that all JIT compilers are vulnerable, that's a strong case for never allowing V8 or any other engine in the app store.
- jquery 4y ago
  This lockdown mode means they can support those other browsers in a non-lockdown mode. All they have to do is have lockdown mode disable all non-webkit browsers.
- alwillis 4y ago
  But if their claim is along the lines that all JIT compilers are vulnerable, that's a strong case for never allowing V8 or any other engine in the app store. I’m okay with this; I’ve always felt that dealing with the security issues of 3rd party rendering engines and JavaScript implementations is a valid reason to not allow them on iOS. Since Apple is the platform vendor, at the end of the day, if there’s a vulnerability, it’s their responsibility, even if (in a hypothetical future) it’s Google’s or Mozilla’s JIT that allowed the the malware to be installed on a user's device. Of course, since all browsers on iOS use WebKit and JavaScript Core, they all get Lockdown protection for free.
andsoitis 4y ago
> Now, they're expecting you to be satisfied with them monopolizing the security controls and monitoring on your phone. What is the alternative, though? That each user figures out for themselves how what their security risks are, cobble together various security-focused apps, stays up to date with new developments, etc.?
- akira2501 4y ago
  Yes. You're describing a market that's obviously ripe for innovation. Otherwise are you suggesting it would actually be impossible for any other company than Apple to do the best job here? If that isn't the case, and absent that market, then is there any reason to believe Apple is itself currently doing the best job?
  - acdha 4y ago
    Think about how that’s worked out in the desktop security or VPN markets: there’s a long history of outright scams, a bunch of companies which made their software worse (crammed with ads, etc.) or left their users less secure over time, and the remaining products are for most people completely interchangeable. The average person has no meaningful way to distinguish between any those. They all claim to be great, auditing is expensive and difficult, and most people are going to get recommendations from people they incorrectly think are experts (shoutout to the websites I had to migrate/secure after someone’s “tech guy” picked GoDaddy for the bikini pictures). Even enterprise security software tends to be long on snake oil despite theoretically more knowledgeable buyers & budgets for auditing. I think there is a solid argument that this space is not a naturally well-functioning market and is probably better with a few regulated players, similar to how we decided that the patent medicine market wasn’t good (and, yes, the regulatory failures are an important cautionary point!). People are literally staking their lives on something which has to be better than some SEO-d rathole.
    - akira2501 4y ago
      And yet, we do no such thing when it comes to home and property security, financial security or medical records security. So, why when it comes to a phone which clearly has less overall value than these items, is it suddenly necessary to throw in the towel and allow an unnatural monopoly to form? You're describing an unregulated market where the FTC and DOJ didn't seem particularly interested in policing. I would suggest that's a bigger reason for the state of the market then thinking it's a natural phenomenon endemic to this particular case. And finally.. the giant disconnect here is that "you should worry about state level actors" but "you're too unsophisticated to do anything other than beg Apple for help." Mostly, I was trying to point out the absurdity of this position while at the same time taking a dig at Apple for their "cute friendly monopoly" tactics.

noduerme 4y ago

It's also a handy way to keep their stranglehold on iOS web browsers, forcing all to use webkit. How exactly they turn off JIT compiling and allow any javascript to run at all, I don't really understand, and I don't know what vulnerabilities they must be aware of in Safari's engine that could lead to unsandboxed code execution (although thinking about it, this seems to prove they're aware of something inherently unsafe there). But if their claim is along the lines that all JIT compilers are vulnerable, that's a strong case for never allowing V8 or any other engine in the app store.

jquery 4y ago
This lockdown mode means they can support those other browsers in a non-lockdown mode. All they have to do is have lockdown mode disable all non-webkit browsers.
alwillis 4y ago
But if their claim is along the lines that all JIT compilers are vulnerable, that's a strong case for never allowing V8 or any other engine in the app store. I’m okay with this; I’ve always felt that dealing with the security issues of 3rd party rendering engines and JavaScript implementations is a valid reason to not allow them on iOS. Since Apple is the platform vendor, at the end of the day, if there’s a vulnerability, it’s their responsibility, even if (in a hypothetical future) it’s Google’s or Mozilla’s JIT that allowed the the malware to be installed on a user's device. Of course, since all browsers on iOS use WebKit and JavaScript Core, they all get Lockdown protection for free.

andsoitis 4y ago

> Now, they're expecting you to be satisfied with them monopolizing the security controls and monitoring on your phone. What is the alternative, though? That each user figures out for themselves how what their security risks are, cobble together various security-focused apps, stays up to date with new developments, etc.?

akira2501 4y ago
Yes. You're describing a market that's obviously ripe for innovation. Otherwise are you suggesting it would actually be impossible for any other company than Apple to do the best job here? If that isn't the case, and absent that market, then is there any reason to believe Apple is itself currently doing the best job?
- acdha 4y ago
  Think about how that’s worked out in the desktop security or VPN markets: there’s a long history of outright scams, a bunch of companies which made their software worse (crammed with ads, etc.) or left their users less secure over time, and the remaining products are for most people completely interchangeable. The average person has no meaningful way to distinguish between any those. They all claim to be great, auditing is expensive and difficult, and most people are going to get recommendations from people they incorrectly think are experts (shoutout to the websites I had to migrate/secure after someone’s “tech guy” picked GoDaddy for the bikini pictures). Even enterprise security software tends to be long on snake oil despite theoretically more knowledgeable buyers & budgets for auditing. I think there is a solid argument that this space is not a naturally well-functioning market and is probably better with a few regulated players, similar to how we decided that the patent medicine market wasn’t good (and, yes, the regulatory failures are an important cautionary point!). People are literally staking their lives on something which has to be better than some SEO-d rathole.
  - akira2501 4y ago
    And yet, we do no such thing when it comes to home and property security, financial security or medical records security. So, why when it comes to a phone which clearly has less overall value than these items, is it suddenly necessary to throw in the towel and allow an unnatural monopoly to form? You're describing an unregulated market where the FTC and DOJ didn't seem particularly interested in policing. I would suggest that's a bigger reason for the state of the market then thinking it's a natural phenomenon endemic to this particular case. And finally.. the giant disconnect here is that "you should worry about state level actors" but "you're too unsophisticated to do anything other than beg Apple for help." Mostly, I was trying to point out the absurdity of this position while at the same time taking a dig at Apple for their "cute friendly monopoly" tactics.