2 ms·
Or maybe, you know, we should stop writing security-critical software in memory-unsafe languages. Mobile devices not treating their owner as an adversary would
by grishka 8mo ago
Or maybe, you know, we should stop writing security-critical software in memory-unsafe languages. Mobile devices not treating their owner as an adversary would also be nice.
- microtonal 8mo agoThat's only part of it. That all security issues would be gone after writing code in a memory-safe language is a fairytale (though it does help a lot). The other parts layered defense, reducing the number of privileged/non-sandboxed applications/processes, not shipping spyware/adware, etc. Only Apple/GrapheneOS and to a slightly lesser extend Google Pixel are good at this. Many phone manufacturers still use the TrustZone TEE on the main CPU (rather than a separate security processor), isolated radios, hardware memory tagging, and dozens of other defense-in-depth features.
- Obscurity4340 8mo agoCould you elaborate more on this?
- lorakamina 8mo agoHow do you defend against supply chain attacks??? The problem is that Israelis and their firms have access to the full chain due to their influence.
- grishka 8mo agoIf you mean the software supply chain, minimize third-party dependencies and carefully review any updates. I mean read and understand code diffs before you bump versions. If you mean the hardware supply chain, has that ever actually happened? I've only ever seen it mentioned as a theoretical possibility so far.