4 ms·

> Evidence that this isn't already happening anyway? Whither current iOS users in China? I'm taking about a situation where a government, say a fictional Unite

by judge2020 4y ago

> Evidence that this isn't already happening anyway? Whither current iOS users in China? I'm taking about a situation where a government, say a fictional United States, implements privacy regulations. For any legitimate company, they must follow these to operate in the United States. In this scenario, the Government has no way to protect vulnerable citizens who search "free clash of clans gems ios", download a third-party app store provided by some data company in China, and have their PII beamed to servers in China (bonus points if it uses a zero-day to do something like purchase a bunch of product from Amazon or otherwise use the person's phone as a zombie in a botnet or money-laundering scheme). This is currently impossible on iOS without the data firm having something like a hacked Apple Enterprise account it's using to distribute software outside of the App Store, where it's checked to ensure IDFA compliance and levels of static/dynamic behavior analysis & preventing JIT code compilation or most things that could run unaudited code.

Apocryphon 4y ago
Then Apple will have to harden iOS's security model further. Do you doubt that they can? They've been able to, so far. For one thing, they'll likely be able to force notarization by default for all apps, regardless of origin.
- judge2020 4y ago
  Most of Apple's security model is inherit to the human auditing and binary analysis that happens during app store submission; the inherit nature of computer software is to have unintended behavior due to unforeseen input and state. As Craig said, "Today, we have a level of malware on the Mac that we don’t find acceptable and that is much worse than iOS" https://www.cnbc.com/2021/05/19/apples-head-of-software-says-current-level-of-mac-malware-is-not-acceptable.html https://www.cnbc.com/2021/05/19/apples-head-of-software-says...
  - Apocryphon 4y ago
    Ah, well I stand corrected on that point. My other points also stand. I've also speculated elsewhere that perhaps Apple could open source binary analysis tools, or at least present some sort of public-facing service to scan binaries. They could manage the semi-opening of their platform themselves, if they wanted to. https://news.ycombinator.com/item?id=32170848 https://news.ycombinator.com/item?id=32170848

Apocryphon 4y ago

Then Apple will have to harden iOS's security model further. Do you doubt that they can? They've been able to, so far. For one thing, they'll likely be able to force notarization by default for all apps, regardless of origin.

judge2020 4y ago
Most of Apple's security model is inherit to the human auditing and binary analysis that happens during app store submission; the inherit nature of computer software is to have unintended behavior due to unforeseen input and state. As Craig said, "Today, we have a level of malware on the Mac that we don’t find acceptable and that is much worse than iOS" https://www.cnbc.com/2021/05/19/apples-head-of-software-says-current-level-of-mac-malware-is-not-acceptable.html https://www.cnbc.com/2021/05/19/apples-head-of-software-says...
- Apocryphon 4y ago
  Ah, well I stand corrected on that point. My other points also stand. I've also speculated elsewhere that perhaps Apple could open source binary analysis tools, or at least present some sort of public-facing service to scan binaries. They could manage the semi-opening of their platform themselves, if they wanted to. https://news.ycombinator.com/item?id=32170848 https://news.ycombinator.com/item?id=32170848