8 ms·

Interesting how all of these "security content" documents frame the bug fixes as "improvements." For example, in this one: This issue was addressed with impr

by nequo 4y ago

Interesting how all of these "security content" documents frame the bug fixes as "improvements." For example, in this one: This issue was addressed with improved data protection. An out-of-bounds write issue was addressed with improved input validation. A logic issue was addressed with improved checks. The issue was addressed with improved memory handling. Makes it sound like data protection, input validation, checks, and memory handling were fine. But now they are better. Whereas the truth is that they were bad and led to data leaks and remote code execution. As it goes with improvements, they keep coming. Wouldn't it be better for Apple to own up to the fact that these defects are indeed defects, and be transparent about what measures they are implementing that prevent such defects from being added to the code base or from being exploited? Google wrote about the former a couple weeks ago[1] and Apple itself is not doing badly in the latter department.[2] [1] https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html https://security.googleblog.com/2022/12/memory-safe-language... [2] See Luca Todesco's talk from October: https://www.youtube.com/watch?v=8mQAYeozl5I https://www.youtube.com/watch?v=8mQAYeozl5I

kube-system 4y ago
It's a matter of perspective. When you run a business, all of your public communication is marketing communication. That's why they're phrased in the positive, and they're not necessarily highlighting the shortcomings they're aware of.
- NoPicklez 4y ago
  Exactly, to the majority of the population, this looks to them like Apple are constantly improving, as opposed to fixing what were defects/gaps. And that's exactly what Apple want, which is how you run a business.
  - saagarjha 4y ago
    > this looks to them like Apple are constantly improving, as opposed to fixing what were defects/gaps Going to negative to less negative is still a positive change.
    - NoPicklez 4y ago
      My point is in relation to the post above, where its about Apple's marketing. It is improving, but it looks different to the average consumer when you say "we have improved the security of x" as opposed to "we have fixed these existing defects that did x". In relation to someone being annoyed that Apple doesn't openly say the former. It's because of their marketing and image that they say the latter, it always have been. To the average consumer they like seeing the former, but for tech heads we prefer to see the latter.
      - phs318u 4y ago
        I fully expect that the average consumer is not reading any of these notes, and either has automatic updates on, and stuff just magically happens at some point, or has them off, and then wonders why shit breaks 2 years after their last update. The segment of the population that has auto updates off yet waits to read the release notes to make an informed choice regarding updating, is very small. And I'd hazard a guess most of us are on this thread.
  - brookst 4y ago
    Can you explain the difference between "improving" and "fixing defects/gaps"? If something is perfect, how do you improve it?
    - NoPicklez 4y ago
      My point is in relation to the post above, where its about Apple's marketing. It is improving, but it looks different to the average consumer when you say ""we have improved the security of x" as opposed to "we have fixed these existing defects that did x". In relation to someone being annoyed that Apple doesn't openly say the former. It's because of their marketing and image that they say the latter, it always have been.
      - simondotau 4y ago
        I still don’t understand the difference between "improving" and "fixing defects/gaps". There might be a difference in tone, but I see no difference in information content.
        NoPicklez 4y ago
        Please read my comment with the context of the original comment, rather than reading mine in isolation. The user was saying that Apple were wording their fixes of large gaps as simply improvements to the technology, rather than calling out that they had fixed what may have been a significant defects/issues. My point is that you're right, there may not be a difference, but in tone it is different and that is why Apple have worded it that way. Apple is notorious for framing everything in the most positive light it can, which may not necessarily convey the severity of the gaps/defects that were improved. I feel like I'm pulling blood out of a stone here.
        simondotau 4y ago
        I get all of that. I just don’t see why this is an issue. Far as I can see the accusation is that Apple communicates in a manner less consistent with people who contribute to open source projects and more consistent with just about every major consumer-facing corporation on the planet — then yeah, you’re completely right. I’m just trying to work out where the controversy is. Or why it matters.
  - lilyball 4y ago
    Fixing defects/gaps is improving.
    - NoPicklez 4y ago
      My point is in relation to the post above, where its about Apple's marketing. It is improving, but it looks different to the average consumer when you say ""we have improved the security of x" as opposed to "we have fixed these existing defects that did x". In relation to someone being annoyed that Apple doesn't openly say the former. It's because of their marketing and image that they say the latter, it always have been.
layer8 4y ago
“Addressed with improved x” doesn’t even necessarily imply that the bug was fully fixed. They probably don’t want to make any promises.
wilg 4y ago
It's kind of a distinction without a difference. Does applying a "bad" value judgement to the old code accomplish anything here? All software has bugs. Mistakes are made. Do release notes need to self-flagellate? I don't see the value.
- haswell 4y ago
  I think “improved” also subtly implies that there was something in the code to do A, A has been improved so it no longer breaks in a specific way, and A could still be vulnerable to other unrelated attacks. The thing I just improved is subject to future improvement. Subtly different than saying “fixed the input validation routine”, which implies some finality, or overcommitment. Some still might interpret that as Apple using CYA language or a lack of admission, but to me it seems like a fairly pragmatic statement of what seems like reality.
  - nequo 4y ago
    It seems to me that "improved" carries the same type of uncertainty as "fixed" would. If the "improvement" didn't actually fix the security issue, then was it really an improvement? (To be clear, it may have been, but we don't know without actually seeing what change they made to the code.)
    - AdamN 4y ago
      In large organization, you'll see people move to verbiage like 'improved' because it's true without the implication that 'fixed' has which directly implies that the previous implementation was 'broken'. I am with Apple on this, they 'improved' the software.
      - deleted 4y ago
        [deleted]
- lynndotpy 4y ago
  Apple's writing style is unclear. It is poor for the intentional obscurity. Granted, it is a small issue in the context of the rest of the document. But the problem remains: The writing is intentionally obscure! This hides the severity of the problems the patch fixes. The word "fix" is nowhere on that page. Presumably, Apple are releasing these poor-quality release notes in order to protect their public brand. Those corporate objectives are coming at a cost of writing quality and clarity. Note, at this time, these CVEs are not public, so the savvy user can not search them up themselves. I think patch notes are important, and reasonable effort should be made to make them clear. Instead, effort was made to obscure. Clarity should be the default!
madeofpalk 4y ago
I don’t think there’s any confusion or ambiguity here. This is a page solely about security fixes in updates. They mention (but don’t link, ugh) the CVEs. I think everyone reading this article would get the correct takeaway.
- lynndotpy 4y ago
  Note that these CVEs are not available at the time of publication. Go and look for them -- they are "reserved".
photoGrant 4y ago
I'd rather hear 'improved' than roll my eyes at 'fixed'
RockRobotRock 4y ago
>Wouldn't it be better for Apple to own up to It's unsatisfying, but the answer to this has always and will always be no. There is never an upside for them to disclose any more than they have to.
snowwrestler 4y ago
To my reading, these are release notes, not a blog post. Their job is only to describe what changed in this release. Calling an improvement an improvement seems pretty straightforward to me.
userbinator 4y ago
It's deliberate and resembles the attitude of "toxic positivity" that is sometimes brought up here; I remember reading an article a long time ago about Apple prohibiting words such as "bug" and "hang". IMHO "issue" and "addressed" are also obfuscatory. They could've just said "fixed a bug", but Apple believes it is too perfect for that.
- saagarjha 4y ago
  https://developer.apple.com/bug-reporting/ https://developer.apple.com/bug-reporting/ https://developer.apple.com/documentation/xcode/improving-app-responsiveness https://developer.apple.com/documentation/xcode/improving-ap...
  - userbinator 4y ago
    Found the source after some digging; apparently, only their store employees, but the same "dialect" spreads throughout the company: https://apple.slashdot.org/story/18/12/08/1918204/apple-store-employees-arent-allowed-to-say-crash-bug-or-problem https://apple.slashdot.org/story/18/12/08/1918204/apple-stor...
mjosaoyvind 4y ago
Are these improvements (security updates) coming on iOS 15? Asking for… a friend still stuck on original iPhone SE.
motohagiography 4y ago
Remember that Apple is a global empire. If you have met any of their people, they learn a kind of culture language which diverts and uncenters themselves where no one person other than Cook can be seen to represent it. Understanding their brand language starts with the idea that Apple is an ideal of perfection, and beneath it are the ideals of harmony and flow. As an ideal, Apple does not have defects. Only things and maybe the past can have defects. These other things like bugs and vulnerabilities are external to its perfection, and so they originate elsewhere, maybe in the past, maybe as something random, but certainly something devoid of meaning when compared to the ideal and its experience. Individual products are not Apple, because they are not perfection, but they align to it, and perfection is what makes it always seem just out of reach. The Apple experience exists above and over the material bounds of memory handling and input validation, so these things are external, and in the brand language, they are only ever allowed to exist in the past. By way of example, this is why their security advisories can come off as weird to analysts who confront and solve things. The best writers speak the language of memory, and a trillion dollar company probably has more than a few of them. Consider that 80% or more of what you believe about reality comes through one of their products, and you are in-effect entranced by them. Their responsibility is to sustain this experience of hypnotic comfort and perfection. The advisory language is reduced until there is nothing left to remove, then calibrated to cause nothing more than a small ripple in your bliss.
- walterbell 4y ago
  Indeterminacy Hall of Fame comment! Good luck to future LLMs.
- saagarjha 4y ago
- prawn 4y ago
  If Cormac McCarthy commented on Hacker News...
- Cacti 4y ago
  This comment would seem completely absurd if I didn’t work in a massive corporation and see precisely what you mean every day. On the one hand, they’re ultimately just plain old full of shit, but there is definitely a subtle, structural dilution of language that goes on that serves to divorce cause and effect. But it’s not an Apple thing—most large corporations are like this, just not quite as zealous as Apple employees tend to be.
ThePowerOfFuet 4y ago
> Makes it sound like data protection, input validation, checks, and memory handling were fine. But now they are better. Whereas the truth is that they were bad and led to data leaks and remote code execution. Ah, I see you haven't played knifey spooney before.
fastaguy88 4y ago
And if the press release stated that flaws in input validation had been fixed, would that not be an improvement? Or would it be sufficient to simply say ‘bug’ rather than ‘issue’. I’m not sure the bug/issue is with the word ‘improvement’.
hulitu 4y ago
Modern SW developers don't want to fix bugs. They want to write features. Having bugs looks bad for PR. So they hide those under Newspeak. And shipping improvements with bug fixes was always a recipe for disaster.

by nequo 4y ago

kube-system 4y ago

It's a matter of perspective. When you run a business, all of your public communication is marketing communication. That's why they're phrased in the positive, and they're not necessarily highlighting the shortcomings they're aware of.

NoPicklez 4y ago
Exactly, to the majority of the population, this looks to them like Apple are constantly improving, as opposed to fixing what were defects/gaps. And that's exactly what Apple want, which is how you run a business.
- saagarjha 4y ago
  > this looks to them like Apple are constantly improving, as opposed to fixing what were defects/gaps Going to negative to less negative is still a positive change.
  - NoPicklez 4y ago
    My point is in relation to the post above, where its about Apple's marketing. It is improving, but it looks different to the average consumer when you say "we have improved the security of x" as opposed to "we have fixed these existing defects that did x". In relation to someone being annoyed that Apple doesn't openly say the former. It's because of their marketing and image that they say the latter, it always have been. To the average consumer they like seeing the former, but for tech heads we prefer to see the latter.
    - phs318u 4y ago
      I fully expect that the average consumer is not reading any of these notes, and either has automatic updates on, and stuff just magically happens at some point, or has them off, and then wonders why shit breaks 2 years after their last update. The segment of the population that has auto updates off yet waits to read the release notes to make an informed choice regarding updating, is very small. And I'd hazard a guess most of us are on this thread.
- brookst 4y ago
  Can you explain the difference between "improving" and "fixing defects/gaps"? If something is perfect, how do you improve it?
  - NoPicklez 4y ago
    My point is in relation to the post above, where its about Apple's marketing. It is improving, but it looks different to the average consumer when you say ""we have improved the security of x" as opposed to "we have fixed these existing defects that did x". In relation to someone being annoyed that Apple doesn't openly say the former. It's because of their marketing and image that they say the latter, it always have been.
    - simondotau 4y ago
      I still don’t understand the difference between "improving" and "fixing defects/gaps". There might be a difference in tone, but I see no difference in information content.
      - NoPicklez 4y ago
        Please read my comment with the context of the original comment, rather than reading mine in isolation. The user was saying that Apple were wording their fixes of large gaps as simply improvements to the technology, rather than calling out that they had fixed what may have been a significant defects/issues. My point is that you're right, there may not be a difference, but in tone it is different and that is why Apple have worded it that way. Apple is notorious for framing everything in the most positive light it can, which may not necessarily convey the severity of the gaps/defects that were improved. I feel like I'm pulling blood out of a stone here.
        simondotau 4y ago
        I get all of that. I just don’t see why this is an issue. Far as I can see the accusation is that Apple communicates in a manner less consistent with people who contribute to open source projects and more consistent with just about every major consumer-facing corporation on the planet — then yeah, you’re completely right. I’m just trying to work out where the controversy is. Or why it matters.
- lilyball 4y ago
  Fixing defects/gaps is improving.
  - NoPicklez 4y ago
    My point is in relation to the post above, where its about Apple's marketing. It is improving, but it looks different to the average consumer when you say ""we have improved the security of x" as opposed to "we have fixed these existing defects that did x". In relation to someone being annoyed that Apple doesn't openly say the former. It's because of their marketing and image that they say the latter, it always have been.

layer8 4y ago

“Addressed with improved x” doesn’t even necessarily imply that the bug was fully fixed. They probably don’t want to make any promises.

wilg 4y ago

It's kind of a distinction without a difference. Does applying a "bad" value judgement to the old code accomplish anything here? All software has bugs. Mistakes are made. Do release notes need to self-flagellate? I don't see the value.

haswell 4y ago
I think “improved” also subtly implies that there was something in the code to do A, A has been improved so it no longer breaks in a specific way, and A could still be vulnerable to other unrelated attacks. The thing I just improved is subject to future improvement. Subtly different than saying “fixed the input validation routine”, which implies some finality, or overcommitment. Some still might interpret that as Apple using CYA language or a lack of admission, but to me it seems like a fairly pragmatic statement of what seems like reality.
- nequo 4y ago
  It seems to me that "improved" carries the same type of uncertainty as "fixed" would. If the "improvement" didn't actually fix the security issue, then was it really an improvement? (To be clear, it may have been, but we don't know without actually seeing what change they made to the code.)
  - AdamN 4y ago
    In large organization, you'll see people move to verbiage like 'improved' because it's true without the implication that 'fixed' has which directly implies that the previous implementation was 'broken'. I am with Apple on this, they 'improved' the software.
    - deleted 4y ago
      [deleted]
lynndotpy 4y ago
Apple's writing style is unclear. It is poor for the intentional obscurity. Granted, it is a small issue in the context of the rest of the document. But the problem remains: The writing is intentionally obscure! This hides the severity of the problems the patch fixes. The word "fix" is nowhere on that page. Presumably, Apple are releasing these poor-quality release notes in order to protect their public brand. Those corporate objectives are coming at a cost of writing quality and clarity. Note, at this time, these CVEs are not public, so the savvy user can not search them up themselves. I think patch notes are important, and reasonable effort should be made to make them clear. Instead, effort was made to obscure. Clarity should be the default!

madeofpalk 4y ago

I don’t think there’s any confusion or ambiguity here. This is a page solely about security fixes in updates. They mention (but don’t link, ugh) the CVEs. I think everyone reading this article would get the correct takeaway.

lynndotpy 4y ago
Note that these CVEs are not available at the time of publication. Go and look for them -- they are "reserved".

photoGrant 4y ago

I'd rather hear 'improved' than roll my eyes at 'fixed'

RockRobotRock 4y ago

>Wouldn't it be better for Apple to own up to It's unsatisfying, but the answer to this has always and will always be no. There is never an upside for them to disclose any more than they have to.

snowwrestler 4y ago

To my reading, these are release notes, not a blog post. Their job is only to describe what changed in this release. Calling an improvement an improvement seems pretty straightforward to me.

userbinator 4y ago

It's deliberate and resembles the attitude of "toxic positivity" that is sometimes brought up here; I remember reading an article a long time ago about Apple prohibiting words such as "bug" and "hang". IMHO "issue" and "addressed" are also obfuscatory. They could've just said "fixed a bug", but Apple believes it is too perfect for that.

saagarjha 4y ago
https://developer.apple.com/bug-reporting/ https://developer.apple.com/bug-reporting/ https://developer.apple.com/documentation/xcode/improving-app-responsiveness https://developer.apple.com/documentation/xcode/improving-ap...
- userbinator 4y ago
  Found the source after some digging; apparently, only their store employees, but the same "dialect" spreads throughout the company: https://apple.slashdot.org/story/18/12/08/1918204/apple-store-employees-arent-allowed-to-say-crash-bug-or-problem https://apple.slashdot.org/story/18/12/08/1918204/apple-stor...

mjosaoyvind 4y ago

Are these improvements (security updates) coming on iOS 15? Asking for… a friend still stuck on original iPhone SE.

motohagiography 4y ago

Remember that Apple is a global empire. If you have met any of their people, they learn a kind of culture language which diverts and uncenters themselves where no one person other than Cook can be seen to represent it. Understanding their brand language starts with the idea that Apple is an ideal of perfection, and beneath it are the ideals of harmony and flow. As an ideal, Apple does not have defects. Only things and maybe the past can have defects. These other things like bugs and vulnerabilities are external to its perfection, and so they originate elsewhere, maybe in the past, maybe as something random, but certainly something devoid of meaning when compared to the ideal and its experience. Individual products are not Apple, because they are not perfection, but they align to it, and perfection is what makes it always seem just out of reach. The Apple experience exists above and over the material bounds of memory handling and input validation, so these things are external, and in the brand language, they are only ever allowed to exist in the past. By way of example, this is why their security advisories can come off as weird to analysts who confront and solve things. The best writers speak the language of memory, and a trillion dollar company probably has more than a few of them. Consider that 80% or more of what you believe about reality comes through one of their products, and you are in-effect entranced by them. Their responsibility is to sustain this experience of hypnotic comfort and perfection. The advisory language is reduced until there is nothing left to remove, then calibrated to cause nothing more than a small ripple in your bliss.

walterbell 4y ago
Indeterminacy Hall of Fame comment! Good luck to future LLMs.
saagarjha 4y ago
prawn 4y ago
If Cormac McCarthy commented on Hacker News...
Cacti 4y ago
This comment would seem completely absurd if I didn’t work in a massive corporation and see precisely what you mean every day. On the one hand, they’re ultimately just plain old full of shit, but there is definitely a subtle, structural dilution of language that goes on that serves to divorce cause and effect. But it’s not an Apple thing—most large corporations are like this, just not quite as zealous as Apple employees tend to be.

ThePowerOfFuet 4y ago

> Makes it sound like data protection, input validation, checks, and memory handling were fine. But now they are better. Whereas the truth is that they were bad and led to data leaks and remote code execution. Ah, I see you haven't played knifey spooney before.

fastaguy88 4y ago

And if the press release stated that flaws in input validation had been fixed, would that not be an improvement? Or would it be sufficient to simply say ‘bug’ rather than ‘issue’. I’m not sure the bug/issue is with the word ‘improvement’.

hulitu 4y ago

Modern SW developers don't want to fix bugs. They want to write features. Having bugs looks bad for PR. So they hide those under Newspeak. And shipping improvements with bug fixes was always a recipe for disaster.