5 ms·

Apple built iOS with the assumption that apps can’t use JIT. They can migrate to a new set of constraints, but I’m sure they’re right that right now it’s necess

Apple built iOS with the assumption that apps can’t use JIT. They can migrate to a new set of constraints, but I’m sure they’re right that right now it’s necessary for security. It could take a while to patch all of the security holes from opening up JIT.

walterbell 2y ago
How does MacOS survive attacks while supporting JIT and a subsystem for running iOS/iPadOS apps?
- teaearlgraycold 2y ago
  It’s a different operating system.
  - walterbell 2y ago
    https://en.wikipedia.org/wiki/Darwin_(operating_system) https://en.wikipedia.org/wiki/Darwin_(operating_system) Darwin is the core Unix-like operating system of macOS (previously OS X and Mac OS X), iOS, watchOS, tvOS, iPadOS, audioOS, visionOS, and bridgeOS. It previously existed as an independent open-source operating system, first released by Apple Inc. in 2000. It is composed of code derived from NeXTSTEP, FreeBSD, other BSD operating systems, Mach, and other free software projects' code, as well as code developed by Apple.
    - teaearlgraycold 2y ago
      I’m aware. They’re still different.
      - leoh 2y ago
        Kernel is largely what matters here
  - wiseowise 2y ago
    So somehow they managed to create shittier system despite having 30 years of OS building behind their belt is what you’re saying?
    - cqqxo4zV46cp 2y ago
      “Shittier” Is your word, not anyone else’s. Can you really not relate this to any experience you’ve had developing anything? Different goals? Different system gets built. Different trade-offs. This isn’t hard to understand. You’re being overly harsh for ideological reasons.
      - meiraleal 2y ago
        You are arguing about resources of a company that has an endless amount of it. The limitations mentioned could be changed/"fixed" with no time and effort.
      - wiseowise 2y ago
        > Different goals? Different system gets built. Different trade-offs. This isn’t hard to understand. You’re being overly harsh for ideological reasons. Poor Apple with its virtually unlimited resources. Somehow Google, Microsoft, Linux and Apple themselves managed to make it work with JIT, but Apple can’t do it.
  - callalex 2y ago
    Can you teach me how it’s meaningfully different in terms of securely running a JIT compiler? What components should I be learning about?
EMIRELADERO 2y ago
I doubt that's true because it goes against every modern OS security practice. Apple heavily practices defense-in-depth. Sandboxing, PAC, AMFID, etc. All those are even more onerous than Android. So no, giving away JIT privs wouldn't do much. EDIT: What's with the downvoting?
- teaearlgraycold 2y ago
  My understanding comes from what jailbreakers say about the OS, what Apple says, as well as time spent working at Android where people that know what they’re talking about told me about iOS security.
  - deaddodo 2y ago
    Your misunderstanding comes from a group of misinformed individuals than. Or you've made them up. Either way, you're wrong.
    - Qwertious 2y ago
      >Either way, you're wrong. This claim is based on what expertise?
      - deaddodo 2y ago
        There are about a dozen other responders who agree with said assessment with technical reasonings embedded into their messages. Read those. Suffice to say, I don't feel the need to rehash why the basic premise of "the OS wasn't built to handle JIT apps" is directly contradicted by it, you know, allowing JIT in all but one app. If they offered something of a basic technical assessment or reasoning beyond "I know people", perhaps then I would bother to dig into some credentialed argument. So, in the same way it's not worth delving into "proving God doesn't exist", it's not worth proving how OP clearly has no idea what they're talking about. They bear the burden of their claims, not me.
mcfedr 2y ago
The no JIT rule is just a rule enforced through the app store review process, so it's not going to part of the security architecture. It could of make some static analysis fail, but there are plenty of ways to do that.

walterbell 2y ago

How does MacOS survive attacks while supporting JIT and a subsystem for running iOS/iPadOS apps?

teaearlgraycold 2y ago
It’s a different operating system.
- walterbell 2y ago
  https://en.wikipedia.org/wiki/Darwin_(operating_system) https://en.wikipedia.org/wiki/Darwin_(operating_system) Darwin is the core Unix-like operating system of macOS (previously OS X and Mac OS X), iOS, watchOS, tvOS, iPadOS, audioOS, visionOS, and bridgeOS. It previously existed as an independent open-source operating system, first released by Apple Inc. in 2000. It is composed of code derived from NeXTSTEP, FreeBSD, other BSD operating systems, Mach, and other free software projects' code, as well as code developed by Apple.
  - teaearlgraycold 2y ago
    I’m aware. They’re still different.
    - leoh 2y ago
      Kernel is largely what matters here
- wiseowise 2y ago
  So somehow they managed to create shittier system despite having 30 years of OS building behind their belt is what you’re saying?
  - cqqxo4zV46cp 2y ago
    “Shittier” Is your word, not anyone else’s. Can you really not relate this to any experience you’ve had developing anything? Different goals? Different system gets built. Different trade-offs. This isn’t hard to understand. You’re being overly harsh for ideological reasons.
    - meiraleal 2y ago
      You are arguing about resources of a company that has an endless amount of it. The limitations mentioned could be changed/"fixed" with no time and effort.
    - wiseowise 2y ago
      > Different goals? Different system gets built. Different trade-offs. This isn’t hard to understand. You’re being overly harsh for ideological reasons. Poor Apple with its virtually unlimited resources. Somehow Google, Microsoft, Linux and Apple themselves managed to make it work with JIT, but Apple can’t do it.
- callalex 2y ago
  Can you teach me how it’s meaningfully different in terms of securely running a JIT compiler? What components should I be learning about?

EMIRELADERO 2y ago

I doubt that's true because it goes against every modern OS security practice. Apple heavily practices defense-in-depth. Sandboxing, PAC, AMFID, etc. All those are even more onerous than Android. So no, giving away JIT privs wouldn't do much. EDIT: What's with the downvoting?

teaearlgraycold 2y ago
My understanding comes from what jailbreakers say about the OS, what Apple says, as well as time spent working at Android where people that know what they’re talking about told me about iOS security.
- deaddodo 2y ago
  Your misunderstanding comes from a group of misinformed individuals than. Or you've made them up. Either way, you're wrong.
  - Qwertious 2y ago
    >Either way, you're wrong. This claim is based on what expertise?
    - deaddodo 2y ago
      There are about a dozen other responders who agree with said assessment with technical reasonings embedded into their messages. Read those. Suffice to say, I don't feel the need to rehash why the basic premise of "the OS wasn't built to handle JIT apps" is directly contradicted by it, you know, allowing JIT in all but one app. If they offered something of a basic technical assessment or reasoning beyond "I know people", perhaps then I would bother to dig into some credentialed argument. So, in the same way it's not worth delving into "proving God doesn't exist", it's not worth proving how OP clearly has no idea what they're talking about. They bear the burden of their claims, not me.

mcfedr 2y ago

The no JIT rule is just a rule enforced through the app store review process, so it's not going to part of the security architecture. It could of make some static analysis fail, but there are plenty of ways to do that.