4 ms·

>however the iOS platform is nothing more than security theater - it keeps the script kiddies out, it gives you an illusion of safety, but it won't keep out the

>however the iOS platform is nothing more than security theater - it keeps the script kiddies out, it gives you an illusion of safety, but it won't keep out the people with the right resources and experience. And those people are the people you should be worried about. You should be worried about the script kiddies too. Security is all about layers and vectors. Installing an innocent looking wallpaper pack by casual users shouldn't lead to malware infestation. That is much easier for the bad guys to do rather than get people to visit a malicious website. Reducing the attack surface definitely makes you safer on relative terms. It does not make you absolutely safe. >Do you feel secure when using an iPhone? If I had an iPhone I would feel safer installing a whole bunch of unknown third party apps compared to doing the same on, say an Android phone. I would not feel "secure" though.

bad_user 15y ago
You should be worried about the script kiddies too No, I'm not, as script kiddies do not have the means to distribute mallware to me, as I never install software from unreliable sources, I never visit untrusted websites and so on. However, when you're compromised by just connecting to the network or just by visiting a compromised website (and lots of high-profile websites have been compromised before) - then all bets are off.
- nknight 15y ago
  "Untrusted websites". Which websites do you trust, exactly? Malware has been distributed on many major websites most people would consider "trusted", either via ad networks or through simply cracking the servers. On the Internet, you can't "trust" anybody not to be a vector for malware onto your client. Your client must be able to protect itself.
  - bad_user 15y ago
    By that rationale you shouldn't trust anybody from your social circle either, friends or otherwise. The world is an ugly place, full of bad people. That doesn't mean I need to barricade inside the house and give Apple the key. Which websites do you trust, exactly? The Ubuntu repository. Plus, I trust several publishers as good sources for packages that don't exist in Ubuntu's repository. On Windows - I either buy my software, or I'm getting known open-source software from their respective websites. I can't remember the last time my anti-virus (commercial, kept up to date) detected anything.
    - nknight 15y ago
      Are you being deliberately obtuse? I honestly can't tell. First of all, I don't trust anyone from my social circle not to be a vector for malware on the Internet, just as I don't trust them to not be a vector for real-life viruses and bacteria. If they have been compromised, they can be an unwilling vector. Toward that end, I have an immune system, as well as additional strategies such as vaccinations, hand washing, good nutrition, etc., to help protect myself. Websites that have been compromised can be a vector for malware. Even HN could be a vector for malware. You can't simply trust that it isn't. Second, your "answer" has nothing to do with my question. I asked which websites you trust, not which software repositories you trust. Browsers can and have had flaws that permit malware installation and other arbitrary code execution without an affirmative action on your part. So I say again, more forcefully, which websites do you trust so completely that you believe they can never be a vector for malware?
      - Tobu 15y ago
        Maybe the grandparent was stupid to mention "untrusted" websites. When you visit hundreds of websites per day, but stick to one browser, it's obvious that the responsibility for not breaking client security lies in the browser (and its platform), not the websites.
    - trotsky 15y ago
      Just as an FYI, pretty much nobodies AV detects anything of note anymore. How malware campaigns are run these days are heavily reliant on rebuilt executables pre-tested against AV engines. AV is more or less completely broken (even more than it used to be) it's just there isn't particularly an alternative so it doesn't get discussed too much.
- evgen 15y ago
  First you claim that iOS is bad because a user could visit an untrusted website that runs the equivalent of the jailbreakme code and then later you claim that your web browsing is safe from zero-day vectors because you do not visit untrusted sites. Perhaps if iOS users were assumed to follow similar habits they would have similar security; if so then the problem is not with the device but with the person driving it. The two common solutions to this problem are user education (hasn't worked so far...) and pre-emptive blocking at the browser. Would you now argue that for the sake of security we need more of a walled-garden approach to the web so that general users can enjoy the same level of security that you do?

bad_user 15y ago

You should be worried about the script kiddies too No, I'm not, as script kiddies do not have the means to distribute mallware to me, as I never install software from unreliable sources, I never visit untrusted websites and so on. However, when you're compromised by just connecting to the network or just by visiting a compromised website (and lots of high-profile websites have been compromised before) - then all bets are off.

nknight 15y ago
"Untrusted websites". Which websites do you trust, exactly? Malware has been distributed on many major websites most people would consider "trusted", either via ad networks or through simply cracking the servers. On the Internet, you can't "trust" anybody not to be a vector for malware onto your client. Your client must be able to protect itself.
- bad_user 15y ago
  By that rationale you shouldn't trust anybody from your social circle either, friends or otherwise. The world is an ugly place, full of bad people. That doesn't mean I need to barricade inside the house and give Apple the key. Which websites do you trust, exactly? The Ubuntu repository. Plus, I trust several publishers as good sources for packages that don't exist in Ubuntu's repository. On Windows - I either buy my software, or I'm getting known open-source software from their respective websites. I can't remember the last time my anti-virus (commercial, kept up to date) detected anything.
  - nknight 15y ago
    Are you being deliberately obtuse? I honestly can't tell. First of all, I don't trust anyone from my social circle not to be a vector for malware on the Internet, just as I don't trust them to not be a vector for real-life viruses and bacteria. If they have been compromised, they can be an unwilling vector. Toward that end, I have an immune system, as well as additional strategies such as vaccinations, hand washing, good nutrition, etc., to help protect myself. Websites that have been compromised can be a vector for malware. Even HN could be a vector for malware. You can't simply trust that it isn't. Second, your "answer" has nothing to do with my question. I asked which websites you trust, not which software repositories you trust. Browsers can and have had flaws that permit malware installation and other arbitrary code execution without an affirmative action on your part. So I say again, more forcefully, which websites do you trust so completely that you believe they can never be a vector for malware?
    - Tobu 15y ago
      Maybe the grandparent was stupid to mention "untrusted" websites. When you visit hundreds of websites per day, but stick to one browser, it's obvious that the responsibility for not breaking client security lies in the browser (and its platform), not the websites.
  - trotsky 15y ago
    Just as an FYI, pretty much nobodies AV detects anything of note anymore. How malware campaigns are run these days are heavily reliant on rebuilt executables pre-tested against AV engines. AV is more or less completely broken (even more than it used to be) it's just there isn't particularly an alternative so it doesn't get discussed too much.
evgen 15y ago
First you claim that iOS is bad because a user could visit an untrusted website that runs the equivalent of the jailbreakme code and then later you claim that your web browsing is safe from zero-day vectors because you do not visit untrusted sites. Perhaps if iOS users were assumed to follow similar habits they would have similar security; if so then the problem is not with the device but with the person driving it. The two common solutions to this problem are user education (hasn't worked so far...) and pre-emptive blocking at the browser. Would you now argue that for the sake of security we need more of a walled-garden approach to the web so that general users can enjoy the same level of security that you do?