5 ms·

ios is capabilities based, no? Edit, to explain: in ios, everything revolves around mach ports, which are capabilities. https://docs.darlinghq.org/internals/m

by est31 2y ago

ios is capabilities based, no? Edit, to explain: in ios, everything revolves around mach ports, which are capabilities. https://docs.darlinghq.org/internals/macos-specifics/mach-ports.html#ports-as-capabilities https://docs.darlinghq.org/internals/macos-specifics/mach-po...

ggm 2y ago
Yes. And without over stating it, iOS is an amazingly robust, very secure OS. it has high trust and low trust models, a secure zone, special purpose hardware and an operating system designed around minimum access rights models which manages to keep going, despite app authors worst intentions. At one level, it proves the model. The shame is that Mach otherwise has kind of not taken off. Gnu the OS was going to be Mach at the core, at one point IIRC
- supriyo-biswas 2y ago
  I'd have to disagree -- the lack of OS-level sandboxing primitives such as seccomp-bpf and SELinux[1] means that exploits happen rather regularly in iOS rather often ([2], among others). [1] https://source.android.com/docs/security/app-sandbox#protections https://source.android.com/docs/security/app-sandbox#protect... [2] https://www.csoonline.com/article/3811322/iphone-users-targeted-in-apples-first-zero-day-exploit-in-2025.html https://www.csoonline.com/article/3811322/iphone-users-targe...
  - nullpoint420 2y ago
    Does the Apple Sandbox[1] not count? What about TrustedBSD[2] and the MAC (Mandatory Access Control) subsystem introduced as part of SEDarwin[3]? [1] https://www.ise.io/wp-content/uploads/2017/07/apple-sandbox.pdf https://www.ise.io/wp-content/uploads/2017/07/apple-sandbox.... [2] http://www.trustedbsd.org/mac.html http://www.trustedbsd.org/mac.html [3] http://www.trustedbsd.org/sedarwin.html http://www.trustedbsd.org/sedarwin.html
  - ggm 2y ago
    Not to deny that, but it didn't (for example) break the Secure Enclave. Key exfiltration didn't happen AFAIK.
  - saagarjha 2y ago
    iOS has a perfectly good sandboxing model that is literally called "the sandbox". You will note that the impact of that bug is limited to the process it is triggered in for precisely this reason.
- dd_xplore 2y ago
  It maybe robust, but it's very very limited in capability. There's no depth to GUI interactions.
- mdhb 2y ago
  iOS is without question one of the most secure OS out there today with any amount of real world use but the gap between what it is and what state of the art looks like is also insane. Fuchsia is actually quite well aligned with something that’s actually defendable in the real world and across time.
- NotPractical 2y ago
  > despite app authors worst intentions All app authors must comply with the rigorous App Store guidelines so the technical limitations on what they can do don't really matter anyway. Add sideloading as an option and we'll get to see how secure iOS really is. GrapheneOS is definitely secure enough to tolerate sideloading, but I don't know if iOS is or not.

by est31 2y ago

ggm 2y ago

Yes. And without over stating it, iOS is an amazingly robust, very secure OS. it has high trust and low trust models, a secure zone, special purpose hardware and an operating system designed around minimum access rights models which manages to keep going, despite app authors worst intentions. At one level, it proves the model. The shame is that Mach otherwise has kind of not taken off. Gnu the OS was going to be Mach at the core, at one point IIRC

supriyo-biswas 2y ago
I'd have to disagree -- the lack of OS-level sandboxing primitives such as seccomp-bpf and SELinux[1] means that exploits happen rather regularly in iOS rather often ([2], among others). [1] https://source.android.com/docs/security/app-sandbox#protections https://source.android.com/docs/security/app-sandbox#protect... [2] https://www.csoonline.com/article/3811322/iphone-users-targeted-in-apples-first-zero-day-exploit-in-2025.html https://www.csoonline.com/article/3811322/iphone-users-targe...
- nullpoint420 2y ago
  Does the Apple Sandbox[1] not count? What about TrustedBSD[2] and the MAC (Mandatory Access Control) subsystem introduced as part of SEDarwin[3]? [1] https://www.ise.io/wp-content/uploads/2017/07/apple-sandbox.pdf https://www.ise.io/wp-content/uploads/2017/07/apple-sandbox.... [2] http://www.trustedbsd.org/mac.html http://www.trustedbsd.org/mac.html [3] http://www.trustedbsd.org/sedarwin.html http://www.trustedbsd.org/sedarwin.html
- ggm 2y ago
  Not to deny that, but it didn't (for example) break the Secure Enclave. Key exfiltration didn't happen AFAIK.
- saagarjha 2y ago
  iOS has a perfectly good sandboxing model that is literally called "the sandbox". You will note that the impact of that bug is limited to the process it is triggered in for precisely this reason.
dd_xplore 2y ago
It maybe robust, but it's very very limited in capability. There's no depth to GUI interactions.
mdhb 2y ago
iOS is without question one of the most secure OS out there today with any amount of real world use but the gap between what it is and what state of the art looks like is also insane. Fuchsia is actually quite well aligned with something that’s actually defendable in the real world and across time.
NotPractical 2y ago
> despite app authors worst intentions All app authors must comply with the rigorous App Store guidelines so the technical limitations on what they can do don't really matter anyway. Add sideloading as an option and we'll get to see how secure iOS really is. GrapheneOS is definitely secure enough to tolerate sideloading, but I don't know if iOS is or not.