4 ms·

That's an wild accusation to make without citations. It doesn't even apply in this instance, since Apple's work on fingerprint resistance still results in real

That's an wild accusation to make without citations. It doesn't even apply in this instance, since Apple's work on fingerprint resistance still results in real privacy improvements even when later shown to be imperfect. It means Apple has to improve what they've already done, not that what they've done so far is mere "marketing" or "theatre".

lapcat 3y ago
> That's an wild accusation to make without citations. Shall I cite my list of CVE? Or perhaps it would be more interesting to cite my list of unfixed 0days. > It doesn't even apply in this instance, since Apple's work on fingerprint resistance still results in real privacy improvements even when later shown to be imperfect. It means Apple has to improve what they've already done, not that what they've done so far is mere "marketing" or "theatre". What does it say about Apple engineering that that they keep shipping features with very obvious and/or predictable flaws?
- jessekv 3y ago
  I haven't seen marketing related to audio fingerprinting protection. Maybe Hanlon's applies here. As for your point about the pattern of vulnerabilities: I'd attribute this to being closed source. They keep shipping security features with limited auditing, and only discover flaws in production.
  - lapcat 3y ago
    > I haven't seen marketing related to audio fingerprinting protection. Apple announces powerful new privacy and security features: https://www.apple.com/newsroom/2023/06/apple-announces-powerful-new-privacy-and-security-features/ https://www.apple.com/newsroom/2023/06/apple-announces-power... WebKit Features in Safari 17.0: https://webkit.org/blog/14445/webkit-features-in-safari-17-0/ https://webkit.org/blog/14445/webkit-features-in-safari-17-0... In general, Apple is trying to market itself as the privacy company. "What happens on iPhone stays on iPhone", yadda yadda. > Maybe Hanlon's applies here. I think my view is in alignment with Hanlon's razor. I don't think it's necessarily malicious deception. Rather, Apple has a habit of shipping the laziest implementations and slapping a "privacy" label on them, but the public doesn't know that these are lazy half-measures. > As for your point about the pattern of vulnerabilities: I'd attribute this to being closed source. WebKit is open source. > They keep shipping security features with limited auditing, and only discover flaws in production. I don't think this is a closed/open source issue. It's just bad engineering.
    - shuckles 3y ago
      Bad engineering yet state of the art. What are Chromium’s protections against web audio fingerprinting? In the game of tracking, minor hurdles are great at stymying many actors. And finally, your citation in response to someone saying they haven’t seen Apple market web audio fingerprinting protections has no references to said feature. Are you saying all the privacy features in that press release are a smokescreen? It’s quite unclear.
      - lapcat 3y ago
        > What are Chromium’s protections against web audio fingerprinting? I'm not aware of any. But they aren't advertising fingerprinting resistance either. > In the game of tracking, minor hurdles are great at stymying many actors. That's questionable. > And finally, your citation in response to someone saying they haven’t seen Apple market web audio fingerprinting protections has no references to said feature. There were multiple antifingerprinting methods in Safari 17. The linked articles referred to them collectively.
        shuckles 3y ago
        >> In the game of tracking, minor hurdles are great at stymying many actors. > > That's questionable. It's basically indisputable. Ask any online advertising buyer about the effectiveness of audience targeting for Safari users versus the competition. Or consider the ability of the average website operator to adopt Fingerprint.js instead of whatever half-broken tool their usual audience measurement provider offers them. https://blog.google/products/chrome/privacy-sandbox-tracking-protection/ https://blog.google/products/chrome/privacy-sandbox-tracking... > Chrome is testing Tracking Protection, a new feature that limits cross-site tracking.
    - simondotau 3y ago
      > In general, Apple is trying to market itself as[...] And I haven't heard any argument suggesting that the marketing is deceptive. Apple implemented numerous fingerprinting protections and nobody has demonstrated any of them to be "theatre" or mere "marketing", only that a security researcher was able to defeat one protection among many (and then published their work so Apple can solve for it in the next release). In reality, ALL such work is an ongoing battle between developers and security researchers. In each subsequent reply you are shifting your stance in order to deflect away from this original claim, essentially by holding Apple to an impossible standard where anything less than perfection on the first try is equivalent to scamming the public with lies. Do you want to defend your original claim that "a lot of Apple's privacy features nowadays are marketing" and "privacy theater"?
- shuckles 3y ago
  “Apple’s quantity and resolution rate of security bugs undermine its privacy marketing” and “Apple’s privacy marketing is a lie” are two very different claims, and it seems like you meant to make the first. Even that claim though is unsupported since Safari users are definitely harder to track across the web in practice than Chrome users. > Shall I cite my list of CVE? Or perhaps it would be more interesting to cite my list of unfixed 0days. The list of vulnerabilities is not very informative for the same reason a trackers blocked statistic is not. It doesn’t give any baseline for comparison and may just be a reflection of how important and interesting to security researchers the target is.
  - lapcat 3y ago
    I think you missed the point of my comment. When I said my list of CVE and my list of unfixed 0days, I meant that literally: CVE attributed by Apple to me, and unfixed 0days that I personally discovered. I wasn't making a "wild accusation".
    - shuckles 3y ago
      No I understood exactly what you meant. The number of reports is not helpful data without a lot of other context, but you offered it as if it would be convincing or definitive. How many CVEs and 0-days have you filed against Audacity? Is it because that software is security bug free?
      - lapcat 3y ago
        > No I understood exactly what you meant. That's a rather bold claim, unless you're a mind-reader. > The number of reports is not helpful data without a lot of other context, but you offered it as if it would be convincing or definitive. I didn't give a number. I only said I have a list. It seems that you're still missing my point, which was simply that my knowledge of and experience with these specific technologies means that my original comment was not a "wild accusation". That's it, that's the whole point. > How many CVEs and 0-days have you filed against Audacity? I don't use Audacity, and I have no idea how it's relevant here.

lapcat 3y ago

> That's an wild accusation to make without citations. Shall I cite my list of CVE? Or perhaps it would be more interesting to cite my list of unfixed 0days. > It doesn't even apply in this instance, since Apple's work on fingerprint resistance still results in real privacy improvements even when later shown to be imperfect. It means Apple has to improve what they've already done, not that what they've done so far is mere "marketing" or "theatre". What does it say about Apple engineering that that they keep shipping features with very obvious and/or predictable flaws?

jessekv 3y ago
I haven't seen marketing related to audio fingerprinting protection. Maybe Hanlon's applies here. As for your point about the pattern of vulnerabilities: I'd attribute this to being closed source. They keep shipping security features with limited auditing, and only discover flaws in production.
- lapcat 3y ago
  > I haven't seen marketing related to audio fingerprinting protection. Apple announces powerful new privacy and security features: https://www.apple.com/newsroom/2023/06/apple-announces-powerful-new-privacy-and-security-features/ https://www.apple.com/newsroom/2023/06/apple-announces-power... WebKit Features in Safari 17.0: https://webkit.org/blog/14445/webkit-features-in-safari-17-0/ https://webkit.org/blog/14445/webkit-features-in-safari-17-0... In general, Apple is trying to market itself as the privacy company. "What happens on iPhone stays on iPhone", yadda yadda. > Maybe Hanlon's applies here. I think my view is in alignment with Hanlon's razor. I don't think it's necessarily malicious deception. Rather, Apple has a habit of shipping the laziest implementations and slapping a "privacy" label on them, but the public doesn't know that these are lazy half-measures. > As for your point about the pattern of vulnerabilities: I'd attribute this to being closed source. WebKit is open source. > They keep shipping security features with limited auditing, and only discover flaws in production. I don't think this is a closed/open source issue. It's just bad engineering.
  - shuckles 3y ago
    Bad engineering yet state of the art. What are Chromium’s protections against web audio fingerprinting? In the game of tracking, minor hurdles are great at stymying many actors. And finally, your citation in response to someone saying they haven’t seen Apple market web audio fingerprinting protections has no references to said feature. Are you saying all the privacy features in that press release are a smokescreen? It’s quite unclear.
    - lapcat 3y ago
      > What are Chromium’s protections against web audio fingerprinting? I'm not aware of any. But they aren't advertising fingerprinting resistance either. > In the game of tracking, minor hurdles are great at stymying many actors. That's questionable. > And finally, your citation in response to someone saying they haven’t seen Apple market web audio fingerprinting protections has no references to said feature. There were multiple antifingerprinting methods in Safari 17. The linked articles referred to them collectively.
      - shuckles 3y ago
        >> In the game of tracking, minor hurdles are great at stymying many actors. > > That's questionable. It's basically indisputable. Ask any online advertising buyer about the effectiveness of audience targeting for Safari users versus the competition. Or consider the ability of the average website operator to adopt Fingerprint.js instead of whatever half-broken tool their usual audience measurement provider offers them. https://blog.google/products/chrome/privacy-sandbox-tracking-protection/ https://blog.google/products/chrome/privacy-sandbox-tracking... > Chrome is testing Tracking Protection, a new feature that limits cross-site tracking.
  - simondotau 3y ago
    > In general, Apple is trying to market itself as[...] And I haven't heard any argument suggesting that the marketing is deceptive. Apple implemented numerous fingerprinting protections and nobody has demonstrated any of them to be "theatre" or mere "marketing", only that a security researcher was able to defeat one protection among many (and then published their work so Apple can solve for it in the next release). In reality, ALL such work is an ongoing battle between developers and security researchers. In each subsequent reply you are shifting your stance in order to deflect away from this original claim, essentially by holding Apple to an impossible standard where anything less than perfection on the first try is equivalent to scamming the public with lies. Do you want to defend your original claim that "a lot of Apple's privacy features nowadays are marketing" and "privacy theater"?
shuckles 3y ago
“Apple’s quantity and resolution rate of security bugs undermine its privacy marketing” and “Apple’s privacy marketing is a lie” are two very different claims, and it seems like you meant to make the first. Even that claim though is unsupported since Safari users are definitely harder to track across the web in practice than Chrome users. > Shall I cite my list of CVE? Or perhaps it would be more interesting to cite my list of unfixed 0days. The list of vulnerabilities is not very informative for the same reason a trackers blocked statistic is not. It doesn’t give any baseline for comparison and may just be a reflection of how important and interesting to security researchers the target is.
- lapcat 3y ago
  I think you missed the point of my comment. When I said my list of CVE and my list of unfixed 0days, I meant that literally: CVE attributed by Apple to me, and unfixed 0days that I personally discovered. I wasn't making a "wild accusation".
  - shuckles 3y ago
    No I understood exactly what you meant. The number of reports is not helpful data without a lot of other context, but you offered it as if it would be convincing or definitive. How many CVEs and 0-days have you filed against Audacity? Is it because that software is security bug free?
    - lapcat 3y ago
      > No I understood exactly what you meant. That's a rather bold claim, unless you're a mind-reader. > The number of reports is not helpful data without a lot of other context, but you offered it as if it would be convincing or definitive. I didn't give a number. I only said I have a list. It seems that you're still missing my point, which was simply that my knowledge of and experience with these specific technologies means that my original comment was not a "wild accusation". That's it, that's the whole point. > How many CVEs and 0-days have you filed against Audacity? I don't use Audacity, and I have no idea how it's relevant here.