4 ms·

I typically belong to the bucket of users who have a working iPhone that does not support the latest major iOS release (iPhone 7), but still get Apple's securit

by pil0u 3y ago

I typically belong to the bucket of users who have a working iPhone that does not support the latest major iOS release (iPhone 7), but still get Apple's security updates. The author states that security updates on earlier iOS versions give a false sense of security. Is that true? What is Apple's incentive to maintain old iOS versions, but only partially?

starbugs 3y ago
> The author states that security updates on earlier iOS versions give a false sense of security. The author links to this article which provides more detail: https://www.intego.com/mac-security-blog/apples-poor-patching-policies-potentially-make-users-security-and-privacy-precarious/ https://www.intego.com/mac-security-blog/apples-poor-patchin... I wouldn't take everything that's written in a random tech article for granted. Fear inducing titles generate more clicks. As soon as you do something in this world, there's a risk. Even if you do nothing, there's a risk. Nobody will be able to be completely safe using any device under the sun. And if a tech company tries to make you believe otherwise, run.
Joeri 3y ago
Apple does not backport all security fixes and they never have, and what they do backport they do on a delayed schedule. It's not clear whether they have an actual policy that determines what gets backported or whether it's just a judgment call, but the consequence is that indeed on any Apple device the most secure OS is the current OS. They will however backport fixes for particularly egregious security issues quite far. For example, iOS 12 got a fix for a web-based remote code execution attack in the beginning of this year, despite at that point being over 4 years old and 4 major releases older than the current iOS.
- superq 3y ago
  They will backport fixes for SOME issues for SOME phones. The further back you go, the more likely you will be ignored. I do have some sympathy for Apple on the difficulty of supporting old phones etc, but let's be realistic, too: 1. They leave you with a strong impression that all phones and all iOS versions are kept safe by dribbling out a few fixes from time to time for older devices. That's probably worse than on Android, because you think it's safe, but it's not. 2. The whole point of getting your hardware and software from the same place was precisely because then you knew they had a limited number of things they had to support, so it'd work better. If they have too many things to support, then maybe that argument starts to fall apart.
  - thevagrant 3y ago
    I can't agree at all. At least Apple patch some issues on older unsupported devices. It is likely they have some reasons for choosing what to patch and when. e.g risk assessment, knowledge of what exploits are occurring etc. They have teams constantly working at this. Android on the other hand has a lot of devices with no patches at all. Pot luck and pray that Google saves the negligent manufacturers via play store patching. If someone has to choose between the two (using an outdated phone), it's sensible to stick with Apple. I myself use android and still recognize what Apple does right.
bell-cot 3y ago
> What is Apple's incentive to maintain old iOS versions, but only partially? Um...how about encouraging those who can to purchase a $Nice $New $Apple $Product, while not suffering too much bad PR over the security holes in old-but-still-perfectly-functional hardware?

by pil0u 3y ago

starbugs 3y ago

> The author states that security updates on earlier iOS versions give a false sense of security. The author links to this article which provides more detail: https://www.intego.com/mac-security-blog/apples-poor-patching-policies-potentially-make-users-security-and-privacy-precarious/ https://www.intego.com/mac-security-blog/apples-poor-patchin... I wouldn't take everything that's written in a random tech article for granted. Fear inducing titles generate more clicks. As soon as you do something in this world, there's a risk. Even if you do nothing, there's a risk. Nobody will be able to be completely safe using any device under the sun. And if a tech company tries to make you believe otherwise, run.

Joeri 3y ago

Apple does not backport all security fixes and they never have, and what they do backport they do on a delayed schedule. It's not clear whether they have an actual policy that determines what gets backported or whether it's just a judgment call, but the consequence is that indeed on any Apple device the most secure OS is the current OS. They will however backport fixes for particularly egregious security issues quite far. For example, iOS 12 got a fix for a web-based remote code execution attack in the beginning of this year, despite at that point being over 4 years old and 4 major releases older than the current iOS.

superq 3y ago
They will backport fixes for SOME issues for SOME phones. The further back you go, the more likely you will be ignored. I do have some sympathy for Apple on the difficulty of supporting old phones etc, but let's be realistic, too: 1. They leave you with a strong impression that all phones and all iOS versions are kept safe by dribbling out a few fixes from time to time for older devices. That's probably worse than on Android, because you think it's safe, but it's not. 2. The whole point of getting your hardware and software from the same place was precisely because then you knew they had a limited number of things they had to support, so it'd work better. If they have too many things to support, then maybe that argument starts to fall apart.
- thevagrant 3y ago
  I can't agree at all. At least Apple patch some issues on older unsupported devices. It is likely they have some reasons for choosing what to patch and when. e.g risk assessment, knowledge of what exploits are occurring etc. They have teams constantly working at this. Android on the other hand has a lot of devices with no patches at all. Pot luck and pray that Google saves the negligent manufacturers via play store patching. If someone has to choose between the two (using an outdated phone), it's sensible to stick with Apple. I myself use android and still recognize what Apple does right.

bell-cot 3y ago

> What is Apple's incentive to maintain old iOS versions, but only partially? Um...how about encouraging those who can to purchase a $Nice $New $Apple $Product, while not suffering too much bad PR over the security holes in old-but-still-perfectly-functional hardware?