4 ms·

I agree with all of this except for your bafflement. Justice doesn’t always prevail and Apple’s legal gambit might work. Remember how Microsoft got in legal tr

by gizmo 3y ago

I agree with all of this except for your bafflement. Justice doesn’t always prevail and Apple’s legal gambit might work. Remember how Microsoft got in legal trouble for bundling software in the 90s? A judge ruled that Microsoft had to be broken up for their monopolistic and anticompetitive practices. And today Microsoft has leveraged the popularity of Excel and Powerpoint to get every business to use Teams and the rest of the suite. Sometimes big business can just defy the courts and get away with it.

szasamasa 3y ago
you are right, I could have expected this but I just did not... I did not expect Apple to try another round... their argument is just so transparent and weak in my eyes I am studying DMA and I still think there is no way they can get away with this I would really love some open discussion somewhere with legal experts and Chromium, Gecko, Webkit engineers, even android, windows, linux, mac, ios engineers. But even without them, web apps just literally work in all OS so Apple cannot really claim it is that much effort to be secure on iOS. Does anybody know any security issues that ever happened because of modern web app capabilities? How on earth is a native app more secure, does apple has access to source code?
- lozenge 3y ago
  Apple uses W^X, meaning all the executable code is included in the app download. If the app writes to some memory, eg after downloading something from the internet, it can't then jump into- execute- that memory. When Apple or anybody reviews an app's compiled code, the code they review is always the entirety of the code that can run on a user's device. This applies for App Store and for new post-DMA marketplaces (that can only install Apple Notarized apps). The exception is Safari because it can compile JS into machine code and jump into it. That allowance is now being extended to new post-DMA web browsers. It's up to Safari and other post-DMA web browsers to prevent any JS from making nefarious machine code. The exception is already bad for iPhone security, but without it battery life and performance of web browsing would tank. Actually, you can remove the exception with the Lockdown Mode setting, eg if you are a politician or think advanced hackers might target you. https://www.mdsec.co.uk/2012/05/introduction-to-ios-platform-security/ https://www.mdsec.co.uk/2012/05/introduction-to-ios-platform...
  - szasamasa 3y ago
    well if you trusted Apple with Safari you can do so why is it such a problem foryou if I trust Google with Chrome on an iPhone or Microsoft or Mozilla? I find this extremely misleading: "the exception is already bad for iPhone security"... not if you stay with Safari I travel regularly on rails with a private train company instead of the train company that actually built those rails... Apple has nothing to do with iPhones that get compromised because of Google or Microsoft or Mozilla Apple should concentrate on Safari and stop fearmongering... or just solve these iOS challenges to make every web browser more secure how come macOS is just fine with fully capable web browsers?
    - lozenge 3y ago
      > the exception is already bad for iPhone security It objectively is. Safari is a weak spot in the iPhone security. https://www.cvedetails.com/cve/CVE-2023-42890/ https://www.cvedetails.com/cve/CVE-2023-42890/ https://www.cvedetails.com/cve/CVE-2023-42917/ https://www.cvedetails.com/cve/CVE-2023-42917/ https://www.cvedetails.com/cve/CVE-2023-42916/ https://www.cvedetails.com/cve/CVE-2023-42916/ Three vulnerabilities that involve visiting a webpage, and all are due to the W^X exception I mentioned. Something that users do very often, unlike with installing an app. Apple also can't remove webpages from the internet, it can remove apps. It doesn't scan webpages before they're published, it does this with apps. A webpage can have an advert, which is loaded from a different server. A webpage can redirect you to another webpage run by another company, without user confirmation. Etc. > or just solve these iOS challenges to make every web browser more secure That comes at a cost though. Increased battery usage, memory usage, and slower web browsing. As I explained, there is a setting called Lockdown Mode which enables this, but it's a user choice. > how come macOS is just fine with fully capable web browsers? Well macOS is less secure than iOS - and Safari is a weak point on macOS as well - but users also don't expect it to be as secure. For example I expect that apps can read data of other apps on the desktop, but on the phone there is a separation enforced. There is a clause in the DMA for Apple to maintain security which is their justification for Notarization and some other stuff that isn't done on desktop. Also macOS started in 2001 and has been basically backwards compatible since then, if it started in 2010 like the iPhone then it would be a lot different in terms of the security architecture. You are being very argumentative and hostile without understanding what I'm saying, which I don't appreciate because I was just trying to answer your question about security.

by gizmo 3y ago

szasamasa 3y ago

you are right, I could have expected this but I just did not... I did not expect Apple to try another round... their argument is just so transparent and weak in my eyes I am studying DMA and I still think there is no way they can get away with this I would really love some open discussion somewhere with legal experts and Chromium, Gecko, Webkit engineers, even android, windows, linux, mac, ios engineers. But even without them, web apps just literally work in all OS so Apple cannot really claim it is that much effort to be secure on iOS. Does anybody know any security issues that ever happened because of modern web app capabilities? How on earth is a native app more secure, does apple has access to source code?

lozenge 3y ago
Apple uses W^X, meaning all the executable code is included in the app download. If the app writes to some memory, eg after downloading something from the internet, it can't then jump into- execute- that memory. When Apple or anybody reviews an app's compiled code, the code they review is always the entirety of the code that can run on a user's device. This applies for App Store and for new post-DMA marketplaces (that can only install Apple Notarized apps). The exception is Safari because it can compile JS into machine code and jump into it. That allowance is now being extended to new post-DMA web browsers. It's up to Safari and other post-DMA web browsers to prevent any JS from making nefarious machine code. The exception is already bad for iPhone security, but without it battery life and performance of web browsing would tank. Actually, you can remove the exception with the Lockdown Mode setting, eg if you are a politician or think advanced hackers might target you. https://www.mdsec.co.uk/2012/05/introduction-to-ios-platform-security/ https://www.mdsec.co.uk/2012/05/introduction-to-ios-platform...
- szasamasa 3y ago
  well if you trusted Apple with Safari you can do so why is it such a problem foryou if I trust Google with Chrome on an iPhone or Microsoft or Mozilla? I find this extremely misleading: "the exception is already bad for iPhone security"... not if you stay with Safari I travel regularly on rails with a private train company instead of the train company that actually built those rails... Apple has nothing to do with iPhones that get compromised because of Google or Microsoft or Mozilla Apple should concentrate on Safari and stop fearmongering... or just solve these iOS challenges to make every web browser more secure how come macOS is just fine with fully capable web browsers?
  - lozenge 3y ago
    > the exception is already bad for iPhone security It objectively is. Safari is a weak spot in the iPhone security. https://www.cvedetails.com/cve/CVE-2023-42890/ https://www.cvedetails.com/cve/CVE-2023-42890/ https://www.cvedetails.com/cve/CVE-2023-42917/ https://www.cvedetails.com/cve/CVE-2023-42917/ https://www.cvedetails.com/cve/CVE-2023-42916/ https://www.cvedetails.com/cve/CVE-2023-42916/ Three vulnerabilities that involve visiting a webpage, and all are due to the W^X exception I mentioned. Something that users do very often, unlike with installing an app. Apple also can't remove webpages from the internet, it can remove apps. It doesn't scan webpages before they're published, it does this with apps. A webpage can have an advert, which is loaded from a different server. A webpage can redirect you to another webpage run by another company, without user confirmation. Etc. > or just solve these iOS challenges to make every web browser more secure That comes at a cost though. Increased battery usage, memory usage, and slower web browsing. As I explained, there is a setting called Lockdown Mode which enables this, but it's a user choice. > how come macOS is just fine with fully capable web browsers? Well macOS is less secure than iOS - and Safari is a weak point on macOS as well - but users also don't expect it to be as secure. For example I expect that apps can read data of other apps on the desktop, but on the phone there is a separation enforced. There is a clause in the DMA for Apple to maintain security which is their justification for Notarization and some other stuff that isn't done on desktop. Also macOS started in 2001 and has been basically backwards compatible since then, if it started in 2010 like the iPhone then it would be a lot different in terms of the security architecture. You are being very argumentative and hostile without understanding what I'm saying, which I don't appreciate because I was just trying to answer your question about security.