4 ms·
Surely there is a better fix to a deserialization exploit than just making every new app implement `bool dontBeHackable { return true; }`?? Even just, I don't
by akersten 4y ago
Surely there is a better fix to a deserialization exploit than just making every new app implement `bool dontBeHackable { return true; }`??
Even just, I don't know, forcing all builds to silently include this property in the compiled output - I mean, interacting with OS app state data files should be abstracted away from the programmer anyway, so it shouldn't matter if they're signed/encrypted behind the scenes, just handle it automatically, right?
- brundolf 4y agoIt could break a bunch of apps. Could argue that the user should get to decide, but it would have consequences to just do it across the board automatically
- jshier 4y agoApple originally intended to require NSSecureCoding in some way after it was introduced in macOS 10.8 (2012) but constantly delayed those plans due to the compatibility issues sibling mentioned.
- crazysim 4y agoDid apple lose their courage? Maybe they should throw a dialog not unlike the 32-bit x86 deprecation
- michelb 4y agoCould this simply be a 'quick fix'? Can't imagine this being the definitive solution to this.