4 ms·

Executing code remotely via default-enabled automatic updates with some delay, or via an ssh command with less delay, the result is the same. Someone chooses to

by lrvick 3y ago

Executing code remotely via default-enabled automatic updates with some delay, or via an ssh command with less delay, the result is the same. Someone chooses to run code on your client, and it runs. The semantics do not impact the threat model here so who cares?

lapcat 3y ago
As I already said, "users can choose not to install software updates". So no, Apple can't "remotely" execute any code they want on your phone at any time, when you've made the simple, easy choice to change your Settings. This is not just "semantics". This discussion is getting pretty tiresome to me. You and sneak want to redefine all software updates as "remote code execution". That's complete BS IMO, and I'm never going to agree to that redefinition.
- lrvick 3y ago
  If you fail to apply updates, then you fail to apply actual security patches to stop RCEs -anyone- can use. In exchange you agree to allow apple to execute any code they, or anyone coercing the key holders, want. You can play semantic games, but the end result is the same under a threat model that does not trust any single entity to run code of their choosing on your device. A supply chain attack is the correct term for this, but a supply chain attack is, in effect, and RCE path available to anyone in the supply chain. Saying supply chain attacks are not a form of RCE because you can disable software updates is like saying no RCEs exist because you have the choice to disconnect from the internet. Security discussions should be grounded in threat models over semantics.
  - lapcat 3y ago
    > Security discussions should be grounded in threat models over semantics. There's no evidence that Apple is a threat. You claimed that Apple could already remotely execute any code at any time. That sounded very sinister, as if Apple had added a secret back door to the OS, but it was extremely misleading at best, completely false at worst. Yes, Apple can ship software updates, as we all know. But that's not a threat in itself. I don't want to hear what Apple could theoretically do. Your lover could theoretically kill you while you sleep. How's that for a threat model? Are you going to sleep alone for the rest of your life? I suspect it's actually more likely, though, than Apple shipping the malicious OS update that you fear.

by lrvick 3y ago

lapcat 3y ago

As I already said, "users can choose not to install software updates". So no, Apple can't "remotely" execute any code they want on your phone at any time, when you've made the simple, easy choice to change your Settings. This is not just "semantics". This discussion is getting pretty tiresome to me. You and sneak want to redefine all software updates as "remote code execution". That's complete BS IMO, and I'm never going to agree to that redefinition.

lrvick 3y ago
If you fail to apply updates, then you fail to apply actual security patches to stop RCEs -anyone- can use. In exchange you agree to allow apple to execute any code they, or anyone coercing the key holders, want. You can play semantic games, but the end result is the same under a threat model that does not trust any single entity to run code of their choosing on your device. A supply chain attack is the correct term for this, but a supply chain attack is, in effect, and RCE path available to anyone in the supply chain. Saying supply chain attacks are not a form of RCE because you can disable software updates is like saying no RCEs exist because you have the choice to disconnect from the internet. Security discussions should be grounded in threat models over semantics.
- lapcat 3y ago
  > Security discussions should be grounded in threat models over semantics. There's no evidence that Apple is a threat. You claimed that Apple could already remotely execute any code at any time. That sounded very sinister, as if Apple had added a secret back door to the OS, but it was extremely misleading at best, completely false at worst. Yes, Apple can ship software updates, as we all know. But that's not a threat in itself. I don't want to hear what Apple could theoretically do. Your lover could theoretically kill you while you sleep. How's that for a threat model? Are you going to sleep alone for the rest of your life? I suspect it's actually more likely, though, than Apple shipping the malicious OS update that you fear.