4 ms·
> Haven't we learned our lesson on this? What is the purported lesson we should have learned? Users choose phones with rich messaging features. This was a majo
by JumpCrisscross 6mo ago
> Haven't we learned our lesson on this?
What is the purported lesson we should have learned? Users choose phones with rich messaging features. This was a major selling point for iPhone, first, with iMessage, and later with Android until iOS caught up with RCS.
- pessimizer 6mo ago> What is the purported lesson we should have learned? Not to automatically execute things within data that we have been sent.
- sneak 6mo agoI think it's "don't use parsers written in unsafe languages".
- fg137 6mo agoI think it's simpler: don't touch untrusted content unless/until you need to.
- stavros 6mo agoThat's easy, and already done. Phones only touch untrusted content when they need to, it's just that they need to touch it immediately upon receipt
- saagarjha 6mo agoAlas, there are a lot of things that you need to touch that are untrusted.
- marysol5 6mo agoBut that just moves it from 0-touch, to 1-touch (which is of course better). But users are morons. We STILL NOW, have people getting phished and pwning their employers.
- olyjohn 6mo agoLet's think about why that happens though We all go through that stupid phishing training. They give us a list of red flags to help determine if an email is legit. Then the next day, the CTO sends out an email that says IMPORTANT and the only text body says PLEASE READ THE ATTACHED .DOCX FILE. This is exactly what we were just trained not to open, but its from some exempt C-level who didn't have time to take the training, and all he is now doing is training the employees to open mails that look like phishing.
- NetMageSCW 6mo agoAll languages are unsafe. Some just make it less obvious.
- yard2010 6mo agoTreat every input as an attack vector.
- tialaramex 6mo agoThe subtle lesson, which we won't learn is [astronaut meme] all communication is potentially remote code execution. This isn't a computer thing, it's in the inherent nature of how communication works for us too. You can be more or less careful, but you can't eliminate the problem entirely or else communicating ceases to be effective.
- saagarjha 6mo agoHey, you! Stop executing code in my head!
- GeekyBear 6mo agoOne of the things Apple's Lockdown mode does is disable previews of images or links that are sent to you. It seems like the lesson is that you shouldn't be processing data sent to the device by random strangers without the user explicitly choosing to open the file or follow the link.
- thewebguyd 6mo agoThat should be the default behavior, not a special lock down option that also disables other features. Why can't they just make it like most email clients? No preview by default, give a banner with an option to explicitly allow a preview for that specific message or conversation?
- thrownthatway 6mo agoI tend to agree. But how does that prevent one from receiving and opening a malicious message?
- lupire 6mo agoBecause many people know not trust unknown senders.
- thrownthatway 6mo agoI should have said “a well crafted malicious email” or SMS etc.
- amarant 6mo agoNo such thing as completely idiot proof. But I think we can all agree an exploit that requires a click is a lot better for the intended victim than one that doesn't. This way they at least have a chance to not click it. Then we can start tackling the other problems with separate solutions
- dnnddidiej 6mo ago
- Xirdus 6mo agoWell, one could argue that the lesson from CVE-2017-0780[1] should've been "don't automatically decode rich messages from untrusted sources". [1]: https://www.trendmicro.com/en_us/research/17/i/cve-2017-0780-denial-service-vulnerability-android-messages-app.html https://www.trendmicro.com/en_us/research/17/i/cve-2017-0780...
- microtonal 6mo agoStagefright is even older: https://en.wikipedia.org/wiki/Stagefright_(bug) https://en.wikipedia.org/wiki/Stagefright_(bug)
- four-yellow 6mo agoWhere are users being given an actual choice? There is no option for "iphone without these features", and I would wager that it has 0 bearing on anyone's decision to purchase a new iphone
- bsharper 6mo agoThere is a choice, but almost nobody uses it: https://support.apple.com/en-us/105120 https://support.apple.com/en-us/105120
- Onavo 6mo agoDidn't Android switch their codec stack to rust?
- hdjrudni 6mo agoWho are these people that are buying phones based on their 1st party SMS features? There's a plethora of 3rd party messaging apps, namely WhatsApp or WeChat -- I haven't felt that messaging has sucked since then BBM days.