3 ms·

Remotely exploitable does not require it can be hacked without user action (although there have been many exploits which have achieved that too, e.g. Pegasus) b

Remotely exploitable does not require it can be hacked without user action (although there have been many exploits which have achieved that too, e.g. Pegasus) but typically involves visiting a web page, opening an attachment, or installing an app with a vulnerability. Chrome updates and app scanning will protect against some problems, but advances are often tied to platform security features. So really, you've made an absurd comment. If the phone is to be usable past 3-4 years it must have security patches. Otherwise there will be a pool of devices which are still in use and easily targetted.

userbinator 4y ago
Otherwise there will be a pool of devices which are still in use and easily targetted. There already are, and the world hasn't ended yet... It's your paranoia that's absurd (and what these companies are relying on to keep the masses under their control, so keep drinking the kool-aid...) The fact that so many here are going on about updates and support, when in fact there's plenty of people who don't give a shit and the world works fine for them, just shows what a corporate-authoritarian shitshow this cursed industry has become.
- angry_octet 4y ago
  You've obviously never dealt with people who've been hacked and had their life's savings extracted or the business made unviable. Just goes to show, you can lead a horse to security patches (or vaccination, or the effects of climate change) but you can't make him apply them.
  - ClumsyPilot 4y ago
    > Just goes to show, you can lead a horse to security patches I don't agree with the poster but he has one thing right - our industry is a shitshow. The soviet government handled Chernobyl better than we handle security. Its impossible, even for most proffeshionals, to tell if a device is secure It would be easier for me to measure radiation. The british government had Mi5 check Huawei source code and even couldn't be sure.
    - angry_octet 4y ago
      I disagree that security is impossible, because that is using 'secure' to mean absolutely proof against compromise, which is fundamentally impossible because of complexity (even formally verified systems like seL4 run on real processors/RAM which have side channels). Practically a fully patched iPhone or Pixel without sketchy apps is a very hard target and exploits have a limited lifetime. There is a vast gulf between that and a phone running a 5 year old release without patches. Why are governments so bad at mandating security? Paralysis in Congress and the EU? Re Huawei, they were sure there were exploits that could be used against it, and they could never be sure it was exploit-free. (We know that major vendors like Cisco have bugs constantly, so it only requires early access to the code to discover them to produce a ready stream of exploits.) Which is totally what we would expect.
      - ClumsyPilot 4y ago
        > Practically a fully patched iPhone or Pixel without sketchy apps is a very hard target and exploits have a limited lifetime. Yes, those are two well-known quantities, and possibly best in the world. Now try to tell security of something random - if I take a random Linix server, or a wifi-connected bosh dishwasher, ir smart TV, and I ask 100 IT proffeshionals, which one is insecure, how many of them can tell? > Why are governments so bad at mandating security? Paralysis in Congress and the EU Why are corporations so bad at securiry? My internet provider ships a router so obsolete, first google search explains how to PWN it, eith instructions any 12 year old can follow The problem is the whoke industry is engaged in deception, "we are taking security seriously". If they were selling garage locks, there would be lawsuits seeking conpensation for stolen car due to negligence in design and lying to the customer
  - userbinator 4y ago
    I have, but it was ultimately due to being phished or similar social engineering tactics, which I'd say is far more likely than being hacked remotely by some obscure exploit. Just goes to show, you can lead a horse to security patches (or vaccination, or the effects of climate change) but you can't make him apply them. Many of us would rather continue fighting for our freedom instead of advocating for and cheering on the rise of dystopia.

userbinator 4y ago

Otherwise there will be a pool of devices which are still in use and easily targetted. There already are, and the world hasn't ended yet... It's your paranoia that's absurd (and what these companies are relying on to keep the masses under their control, so keep drinking the kool-aid...) The fact that so many here are going on about updates and support, when in fact there's plenty of people who don't give a shit and the world works fine for them, just shows what a corporate-authoritarian shitshow this cursed industry has become.

angry_octet 4y ago
You've obviously never dealt with people who've been hacked and had their life's savings extracted or the business made unviable. Just goes to show, you can lead a horse to security patches (or vaccination, or the effects of climate change) but you can't make him apply them.
- ClumsyPilot 4y ago
  > Just goes to show, you can lead a horse to security patches I don't agree with the poster but he has one thing right - our industry is a shitshow. The soviet government handled Chernobyl better than we handle security. Its impossible, even for most proffeshionals, to tell if a device is secure It would be easier for me to measure radiation. The british government had Mi5 check Huawei source code and even couldn't be sure.
  - angry_octet 4y ago
    I disagree that security is impossible, because that is using 'secure' to mean absolutely proof against compromise, which is fundamentally impossible because of complexity (even formally verified systems like seL4 run on real processors/RAM which have side channels). Practically a fully patched iPhone or Pixel without sketchy apps is a very hard target and exploits have a limited lifetime. There is a vast gulf between that and a phone running a 5 year old release without patches. Why are governments so bad at mandating security? Paralysis in Congress and the EU? Re Huawei, they were sure there were exploits that could be used against it, and they could never be sure it was exploit-free. (We know that major vendors like Cisco have bugs constantly, so it only requires early access to the code to discover them to produce a ready stream of exploits.) Which is totally what we would expect.
    - ClumsyPilot 4y ago
      > Practically a fully patched iPhone or Pixel without sketchy apps is a very hard target and exploits have a limited lifetime. Yes, those are two well-known quantities, and possibly best in the world. Now try to tell security of something random - if I take a random Linix server, or a wifi-connected bosh dishwasher, ir smart TV, and I ask 100 IT proffeshionals, which one is insecure, how many of them can tell? > Why are governments so bad at mandating security? Paralysis in Congress and the EU Why are corporations so bad at securiry? My internet provider ships a router so obsolete, first google search explains how to PWN it, eith instructions any 12 year old can follow The problem is the whoke industry is engaged in deception, "we are taking security seriously". If they were selling garage locks, there would be lawsuits seeking conpensation for stolen car due to negligence in design and lying to the customer
- userbinator 4y ago
  I have, but it was ultimately due to being phished or similar social engineering tactics, which I'd say is far more likely than being hacked remotely by some obscure exploit. Just goes to show, you can lead a horse to security patches (or vaccination, or the effects of climate change) but you can't make him apply them. Many of us would rather continue fighting for our freedom instead of advocating for and cheering on the rise of dystopia.