3 ms·
> This is RCE (with a slight delay). Eh, that's really a stretch of the definition. Hardly anyone installs software via physical media anymore, so doesn't mean
by lapcat 3y ago
> This is RCE (with a slight delay).
Eh, that's really a stretch of the definition. Hardly anyone installs software via physical media anymore, so doesn't mean that all code execution is remote code execution?
"Software updates are RCE" is not the greatest take.
> It's up to you to go into Settings after setup and disable it if you don't want Apple to be able to push new and unknown code to your device arbitrarily.
Which you can do very easily.
Regardless, every user notices when Apple has shipped an OS update, because your device rebooted.
Furthermore, software updates can still be reverse engineered after they're released.
- lrvick 3y agoThey notice there was an update, but they have no clue if that update just decrypted all their messages then reverted itself along with all evidence. If this is just done on select targets, capture and detection is highly unlikely. A court order on whoever controls the Apple signing keys could do this. I would wager that this is already happening in China since the CCP took control of the signing keys. If a system is not open, accountable, with distributed reproducible builds each adding their own signature, then you are in fact granting a central party access to execute any code they wish on your device if you accept updates without reverse engineering every single CPU instruction, driver, firmware bundle, and microcode change in every update bundle and sideloading them by hand somehow... which Apple does not permit.
- lapcat 3y ago> I would wager that this is already happening in China since the CCP took control of the signing keys. Which signing keys are you talking about?
- sneak 3y ago> Regardless, every user notices when Apple has shipped an OS update, because your device rebooted. I would venture to say that these users notice because of the notification that says "Your device has been updated to iOS <version>", not because of the 2 AM reboot. That notification, of course, being entirely within Apple's discretion. Apple can effectively silently run whatever code they want on most iPhones and iPads.
- lapcat 3y ago> I would venture to say that these users notice because of the notification that says "Your device has been updated to iOS <version>" That's what I meant. > Apple can effectively silently run whatever code they want on most iPhones and iPads. You may feel that this is a powerful argument, but I'm completely unimpressed by it when anyone can easily go into Settings and turn off automatic updates. ¯\_(ツ)_/¯ I'm not a fan of automatic updates, especially as the default setting, but that's not because I think Apple is going to send down some secretly evil update. Rather, it's just because updates can break stuff that the user relies on, which is no secret.
- lrvick 3y agoSo the defense you suggest, is for everyone to never accept updates to any software again? Are you serious?
- lapcat 3y agoI'm not suggesting any "defense", because I'm not suggesting any attack. You're the one suggesting an attack. I'm worried about Apple making the OS crappier, but I'm not worried about Apple attacking me, or anyone else for that matter. Once again, you said, "Apple can remotely execute any code they want on your phone at any time", which is what I replied to. Until you're willing to admit that you misspoke, we're done here.