2 ms·
If you fail to apply updates, then you fail to apply actual security patches to stop RCEs -anyone- can use. In exchange you agree to allow apple to execute any
by lrvick 3y ago
If you fail to apply updates, then you fail to apply actual security patches to stop RCEs -anyone- can use. In exchange you agree to allow apple to execute any code they, or anyone coercing the key holders, want.
You can play semantic games, but the end result is the same under a threat model that does not trust any single entity to run code of their choosing on your device.
A supply chain attack is the correct term for this, but a supply chain attack is, in effect, and RCE path available to anyone in the supply chain.
Saying supply chain attacks are not a form of RCE because you can disable software updates is like saying no RCEs exist because you have the choice to disconnect from the internet. Security discussions should be grounded in threat models over semantics.
- lapcat 3y ago> Security discussions should be grounded in threat models over semantics. There's no evidence that Apple is a threat. You claimed that Apple could already remotely execute any code at any time. That sounded very sinister, as if Apple had added a secret back door to the OS, but it was extremely misleading at best, completely false at worst. Yes, Apple can ship software updates, as we all know. But that's not a threat in itself. I don't want to hear what Apple could theoretically do. Your lover could theoretically kill you while you sleep. How's that for a threat model? Are you going to sleep alone for the rest of your life? I suspect it's actually more likely, though, than Apple shipping the malicious OS update that you fear.