4 ms·
> It is new software added to old stack and made to gell with it. That 'gluing' process churns up new security issues. Perhaps I'm misunderstanding you, but th
by da_chicken 3y ago
> It is new software added to old stack and made to gell with it. That 'gluing' process churns up new security issues.
Perhaps I'm misunderstanding you, but this is not really correct. Most vulnerabilities are not regressions.
Attention is what makes security issues discoverable, and popularity is what makes exploits valuable serious enough to warrant attention. The more popular software is, the more attention it gets from the security community (both black and white hat). The more popular software is, the higher the impact of an exploit is. The more popular the software is, the more significant the response is.
That doesn't mean older software is secure, or that it can't be exploited. It just means nobody is really looking at it. Fairly often, security alerts come up for software that doesn't list older releases because they didn't bother to check their EoL releases not because they're unaffected.
Take the Print Spooler vulnerability on Windows, or the ShellShock exploit in bash, or the Apache Log4j 2.x vulnerability. These vulnerabilities are all so old that they essentially work on any version of the affected software, including those that are more than a decade old for which no fix was even planned. Like the ShellShock bug in bash was found to go back to bash 1.03 released in 1989.
As long as you have an earlier version of software that was later found to be vulnerable, you should assume that it is unless you've explicitly investigated the vulnerability and found otherwise.
- Apocryphon 3y agoI guess the question then are there any attackers bothering to target that old software. We’re not in the era where there were millions of users living on unpatched out outdated versions of Windows XP anymore. Would malicious actors attack an iPhone 8?
- Atotalnoob 3y agoSweet summer child... The military extensively uses older OS versions, which means they are very much targets. The UK's new HMS Queen Elizabeth aircraft carrier uses windows XP.
- hluska 3y agoIt’s interesting how such a wise comment can be completely ruined by your first sentence.
- zdragnar 3y agoWhy is that? The phrase and intended meaning (innocent, potentially to the point of being naive) is 200-ish years old. It fits the sentiment perfectly. Developers who exclusively think in terms of commercial internet are prone to thinking that everyone uses up-to-date browsers, and therefore OSs. The world is actually messier than that common misconception. It fits rather well.
- Apocryphon 3y agoWhatever alleged origin of that quote is, its present identity has been dominated by the TV show, which isn’t even current anymore and ended so poorly that its cultural cachet has eroded. But mostly it’s condescending as hell and thus marks the user as someone who both trafficks in cliches and enjoys patronizing others.
- checkyoursudo 3y agoWhat tv show?
- Kerb_ 3y agoPretty sure it was referenced in Game of Thrones which introduced it to a whole new group of people, typically more online than the origins of the phrase, and popularized it's use on Reddit/Twitter for being a hilarious and original way to condescend people
- Apocryphon 3y ago> a hilarious and original way Well, it was.
- Xylakant 3y ago> Would malicious actors attack an iPhone 8 It depends. The iPhone 8 might belong to someone they’re interested in for reasons as mundane as being a control freak and the iPhone belongs to their partner. Or just someone that annoyed them on the internet. Or the attack might woken across all device generations in the same way. Then no specific targeting would be required and the phone owner gets caught in the net like all other unpatched versions, except they never had a chance to fix the issue.
- prmoustache 3y agoIf your an activist, journalist, politician or CEO, yes you could be targeted specifically.
- blackoil 3y agoBut 99.99% don't belong to this category, and don't really need same level of caution.
- superq 3y agoA close relative has an iPhone 8, so, absolutely, I believe there are probably millions of them in the wild and they'd be child's play to compromise. If you are in the business of compromising, why would you not?
- theonemind 3y agoan iphone 8 can run ios 16, last updated Sept 21, 2023, less than a month ago https://en.wikipedia.org/wiki/IOS_version_history https://en.wikipedia.org/wiki/IOS_version_history & https://en.wikipedia.org/wiki/IPhone_8 https://en.wikipedia.org/wiki/IPhone_8 I don't think Apple's patching every major security flaw on current - 1, but right at this moment, they're still able to run n - 1, which would probably put them roughly on par with the average on smartphone security, so I don't think it would be especially any more child's play than compromising an average phone, all things being equal (all things being equal, some people update, some don't; the iphone 8 on the latest iOS 16 is probably better than a later model lagged 3 years on updates) Although it's all downhill from here.
- __d 3y agoI run an iPhone8. As of now, it's running iOS 16.7 (20H19). I know it won't install iOS 17. So I figure I have about 12 months more of reasonable security updates. At this point, I'll likely get an iPhone SE 3rd generation to replace it.
- LegitShady 3y agoMy work phone is an an iPhone 8. Employer provided. Most likely to be replaced pretty soon.