6 ms·

Still hilarious how apple goes about their "system security". Instead of actually implementing security in the kernel they just kinda prevent you from distribu

Still hilarious how apple goes about their "system security". Instead of actually implementing security in the kernel they just kinda prevent you from distributing an app that may call that functionality. Because that way they can still let their buddies abuse it without appearing too biased (by e.g. having a whitelist on the device). This technical failing probably, partially, explains why they are so against allowing sideloading. That, and they're scared of losing their cash cow of course.

asveikau 2y ago
The hilarious thing is how people justify Apple's bugs with a security concern. Just squinting at the stack trace from the article, my intuition is that someone at Apple added a bunch of nice looking object-oriented stuff without regard for overhead. So a call to get a single integer from the kernel, namely the time, results in lots of objects being created on the heap and tons of "validation" going on. Then somebody on hacker news says this is all for your own good.
NotPractical 2y ago
> This technical failing probably, partially, explains why they are so against allowing sideloading. This occurred to me the other day. I've always laughed at the idea that Apple blocks sideloading for security purposes, but if the first line of defense is and always has been security through obscurity + manual App Store review (>= 2.0) on iOS, it's very possible that sideloading could cause problems. iOS didn't even have an App Store in release 1.0, meanwhile the Android security model has taken into account sideloaded apps since the very beginning [1]: > Android is designed to be open. [...] Securing an open platform requires a strong security architecture and rigorous security programs. Android was designed with multilayered security that's flexible enough to support an open platform while still protecting all users of the platform. [1] https://source.android.com/docs/security/overview https://source.android.com/docs/security/overview Edit: Language revised to clarify that I'm poking fun of the idea and not the one who believes it.
- threatofrain 2y ago
  Is there a reputation of a security difference between Android and iOS? And in what direction does the badness lean?
  - beeboobaa3 2y ago
    There is a reputation of Apple being more secure, but it's largely unfounded. It just looks that way because the ecosystem is completely locked down and software isn't allowed to exist without apple's stamp of approval.
    - kbolino 2y ago
      Apple drove genuine security improvements in mobile hardware well before Android, including dedicated security chips and encrypted storage. The gap has been closed for a few years now, though, so the reputation is not so much "unfounded" as "out of date".
      - beeboobaa3 2y ago
        You're not talking about security that protects end users against malware. You're talking about "security" that protects the device against "tampering", i.e. the owner using it in a way apple does not approve of. Apple's "security improvements" have always been about protecting their walled garden first and foremost.
        fingerlocks 2y ago
        This just isn’t true. We have multiple bricked android devices from bootloader infected malware downloaded directly from the Play store. Nothing like that has ever happened on iOS.
        beeboobaa3 2y ago
        The only thing this may prove is that Apple's app store review is more strict.
dang 2y ago
We detached this subthread from https://news.ycombinator.com/item?id=40274188 https://news.ycombinator.com/item?id=40274188.

asveikau 2y ago

The hilarious thing is how people justify Apple's bugs with a security concern. Just squinting at the stack trace from the article, my intuition is that someone at Apple added a bunch of nice looking object-oriented stuff without regard for overhead. So a call to get a single integer from the kernel, namely the time, results in lots of objects being created on the heap and tons of "validation" going on. Then somebody on hacker news says this is all for your own good.

NotPractical 2y ago

> This technical failing probably, partially, explains why they are so against allowing sideloading. This occurred to me the other day. I've always laughed at the idea that Apple blocks sideloading for security purposes, but if the first line of defense is and always has been security through obscurity + manual App Store review (>= 2.0) on iOS, it's very possible that sideloading could cause problems. iOS didn't even have an App Store in release 1.0, meanwhile the Android security model has taken into account sideloaded apps since the very beginning [1]: > Android is designed to be open. [...] Securing an open platform requires a strong security architecture and rigorous security programs. Android was designed with multilayered security that's flexible enough to support an open platform while still protecting all users of the platform. [1] https://source.android.com/docs/security/overview https://source.android.com/docs/security/overview Edit: Language revised to clarify that I'm poking fun of the idea and not the one who believes it.

threatofrain 2y ago
Is there a reputation of a security difference between Android and iOS? And in what direction does the badness lean?
- beeboobaa3 2y ago
  There is a reputation of Apple being more secure, but it's largely unfounded. It just looks that way because the ecosystem is completely locked down and software isn't allowed to exist without apple's stamp of approval.
  - kbolino 2y ago
    Apple drove genuine security improvements in mobile hardware well before Android, including dedicated security chips and encrypted storage. The gap has been closed for a few years now, though, so the reputation is not so much "unfounded" as "out of date".
    - beeboobaa3 2y ago
      You're not talking about security that protects end users against malware. You're talking about "security" that protects the device against "tampering", i.e. the owner using it in a way apple does not approve of. Apple's "security improvements" have always been about protecting their walled garden first and foremost.
      - fingerlocks 2y ago
        This just isn’t true. We have multiple bricked android devices from bootloader infected malware downloaded directly from the Play store. Nothing like that has ever happened on iOS.
        beeboobaa3 2y ago
        The only thing this may prove is that Apple's app store review is more strict.

dang 2y ago

We detached this subthread from https://news.ycombinator.com/item?id=40274188 https://news.ycombinator.com/item?id=40274188.