5 ms·

Apple saying "looking at web content can lead to arbitrary code execution, this is potentially already used in the wild" wasn't enough?

by detaro 4y ago

lesuorac 4y ago
Isn't that the whole point of the Web nowendays? Anybody can put code out there that you'll run on your device?
- spcebar 4y ago
  Yes, but ideally in a sandboxed environment that prevents drive-by attacks. The web looks very different when you need to treat websites with the same caution as an exe.
  - OrangeMonkey 4y ago
    Or with the same caution as an ex.
    - MarcoZavala 4y ago
- BHSPitMonkey 4y ago
  You forgot the "arbitrary" qualifier.
tomjen3 4y ago
They didn't say that in the update notes I could see. It was the same vague stuff about system security that they normally say.
drewg123 4y ago
It sure would be nice if Apple stopped forcing web browsers to be reskins of Safari, and allowed full implementations of 3rd party web browsers like Firefox and Chrome. Then we wouldn't have such a monoculture on iOS
- mistrial9 4y ago
  I think the idea is that another browser is a "good thing" as along as there is more than .. three? include non-English world-power languages for the full puzzle
- sofixa 4y ago
  And/or allow Safari to be updated independently from the OS. Chrome/Firefox/etc. and Android WebView are updatable as normal apps outside of the Android lifecycle, there's no excuse for Apple's self-imposed limitations here.
  - Bud 4y ago
    1) Apple doesn't need an "excuse", it only needs a reason, and it has one 2) The reason is, they know that the moment they allow all the stuff you're talking about, we'll all be in the wild West again, with God knows what fucking version of Chrome being run, and it will be a nightmare to support, and a nightmare environment in which to protect privacy and security 3) Users have conclusively voted for it to be this way. We know it's this way and we're still buying iPhones instead of Android. What's annoying to me is that people like you, a lot of people, are still unable to summon any respect for the legitimacy of THAT choice. You can only think of the choice that YOU want.
    - v0idzer0 4y ago
      Yeah the people who think they want this really don’t want this. One of the biggest advantages of the iPhone over Android is the lack of version fragmentation. Not just in the OS but in the browser. It’s a better developer experience which leads to a better user experience.
    - Finnucane 4y ago
      I think you underestimate the number of iphone/ipad users who would switch browsers if there was a meaningful choice.
      - sgammon 4y ago
rzz3 4y ago
How do we know whether we’ve been exploited by this? Is there such a thing as antivirus for iOS?
- sgammon 4y ago
  there is, at enterprise https://www.cisco.com/c/en/us/products/security/security-connector/index.html https://www.cisco.com/c/en/us/products/security/security-con... but "antivirus" for iOS is typically focused on network-side interception and blocking

Apple saying "looking at web content can lead to arbitrary code execution, this is potentially already used in the wild" wasn't enough?

by detaro 4y ago

Apple saying "looking at web content can lead to arbitrary code execution, this is potentially already used in the wild" wasn't enough?

lesuorac 4y ago

Isn't that the whole point of the Web nowendays? Anybody can put code out there that you'll run on your device?

spcebar 4y ago
Yes, but ideally in a sandboxed environment that prevents drive-by attacks. The web looks very different when you need to treat websites with the same caution as an exe.
- OrangeMonkey 4y ago
  Or with the same caution as an ex.
  - MarcoZavala 4y ago
BHSPitMonkey 4y ago
You forgot the "arbitrary" qualifier.

tomjen3 4y ago

They didn't say that in the update notes I could see. It was the same vague stuff about system security that they normally say.

drewg123 4y ago

It sure would be nice if Apple stopped forcing web browsers to be reskins of Safari, and allowed full implementations of 3rd party web browsers like Firefox and Chrome. Then we wouldn't have such a monoculture on iOS

mistrial9 4y ago
I think the idea is that another browser is a "good thing" as along as there is more than .. three? include non-English world-power languages for the full puzzle
sofixa 4y ago
And/or allow Safari to be updated independently from the OS. Chrome/Firefox/etc. and Android WebView are updatable as normal apps outside of the Android lifecycle, there's no excuse for Apple's self-imposed limitations here.
- Bud 4y ago
  1) Apple doesn't need an "excuse", it only needs a reason, and it has one 2) The reason is, they know that the moment they allow all the stuff you're talking about, we'll all be in the wild West again, with God knows what fucking version of Chrome being run, and it will be a nightmare to support, and a nightmare environment in which to protect privacy and security 3) Users have conclusively voted for it to be this way. We know it's this way and we're still buying iPhones instead of Android. What's annoying to me is that people like you, a lot of people, are still unable to summon any respect for the legitimacy of THAT choice. You can only think of the choice that YOU want.
  - v0idzer0 4y ago
    Yeah the people who think they want this really don’t want this. One of the biggest advantages of the iPhone over Android is the lack of version fragmentation. Not just in the OS but in the browser. It’s a better developer experience which leads to a better user experience.
  - Finnucane 4y ago
    I think you underestimate the number of iphone/ipad users who would switch browsers if there was a meaningful choice.
    - sgammon 4y ago

rzz3 4y ago

How do we know whether we’ve been exploited by this? Is there such a thing as antivirus for iOS?

sgammon 4y ago
there is, at enterprise https://www.cisco.com/c/en/us/products/security/security-connector/index.html https://www.cisco.com/c/en/us/products/security/security-con... but "antivirus" for iOS is typically focused on network-side interception and blocking