4 ms·

Yes. This protects your data against a malicious app. Your proposal gives a malicious app a workaround to avoid this. Is there a reason you don’t want this on

by josho 4y ago

Yes. This protects your data against a malicious app. Your proposal gives a malicious app a workaround to avoid this. Is there a reason you don’t want this on by default?

kllrnohj 4y ago
No it doesn't. Malicious apps aren't impacted by this at all. It's a hardening technique for non-malicious apps to help protect them against malicious inputs. Which any maintained, updated app would naturally just get when they update, and in the meantime there's no regression in security from previous releases. It's only on-everywhere because Apple doesn't do backwards compatible. Update or get kicked out is the expectation.
- josho 4y ago
  Aren't both benefits? E.g. a malicious app mallocs a large buffer and just reads the memory looking for anything interesting? AND as you pointed out a non-malicious app that doesn't handle input. > It's only on-everywhere because Apple doesn't do backwards compatible. If this causes issue in an app then doesn't it mean that app has a possible vulnerability? So, it can be argued that breaking an app is increasing the security of the ecosystem. And yes, I understand the other side too of having an obscure app that you depend upon breaking because it is no longer supported. That's also the type of app that doesn't have a high probability of being exploited.
  - esprehn 4y ago
    > E.g. a malicious app mallocs a large buffer and just reads the memory looking for anything interesting? No, the OS zeros pages before giving them to a new process, otherwise you'd have all kinds of information leaks across security boundaries. You only see dirty memory within the same process when you malloc and then free and malloc again and get a page from the free list within the process. Increasingly allocators are zeroing those too though to reduce the attack surface from malicious inputs (which is what changed in iOS).
  - kllrnohj 4y ago
    > If this causes issue in an app then doesn't it mean that app has a possible vulnerability? Only if the app had any untrusted inputs in the first place. If the app doesn't ever touch the network or only connects to its own servers then no, it's not really improving security.
deleted 4y ago
[deleted]

by josho 4y ago

Yes. This protects your data against a malicious app. Your proposal gives a malicious app a workaround to avoid this. Is there a reason you don’t want this on by default?

kllrnohj 4y ago

No it doesn't. Malicious apps aren't impacted by this at all. It's a hardening technique for non-malicious apps to help protect them against malicious inputs. Which any maintained, updated app would naturally just get when they update, and in the meantime there's no regression in security from previous releases. It's only on-everywhere because Apple doesn't do backwards compatible. Update or get kicked out is the expectation.

josho 4y ago
Aren't both benefits? E.g. a malicious app mallocs a large buffer and just reads the memory looking for anything interesting? AND as you pointed out a non-malicious app that doesn't handle input. > It's only on-everywhere because Apple doesn't do backwards compatible. If this causes issue in an app then doesn't it mean that app has a possible vulnerability? So, it can be argued that breaking an app is increasing the security of the ecosystem. And yes, I understand the other side too of having an obscure app that you depend upon breaking because it is no longer supported. That's also the type of app that doesn't have a high probability of being exploited.
- esprehn 4y ago
  > E.g. a malicious app mallocs a large buffer and just reads the memory looking for anything interesting? No, the OS zeros pages before giving them to a new process, otherwise you'd have all kinds of information leaks across security boundaries. You only see dirty memory within the same process when you malloc and then free and malloc again and get a page from the free list within the process. Increasingly allocators are zeroing those too though to reduce the attack surface from malicious inputs (which is what changed in iOS).
- kllrnohj 4y ago
  > If this causes issue in an app then doesn't it mean that app has a possible vulnerability? Only if the app had any untrusted inputs in the first place. If the app doesn't ever touch the network or only connects to its own servers then no, it's not really improving security.

deleted 4y ago

[deleted]