6 ms·

> Users are vastly better protected from the kind of network surveillance they mention with Apple products, thanks to their curated, controlled approach to thir

> Users are vastly better protected from the kind of network surveillance they mention with Apple products, thanks to their curated, controlled approach to third party software distribution. You have got to be kidding. For an ecosystem where its been the 'norm' to slurp users entire address books[1], NOTHING about Apple's 'curated, controlled' approach protects users. Please get real. 1. https://news.ycombinator.com/item?id=3563016 https://news.ycombinator.com/item?id=3563016 2. https://news.ycombinator.com/item?id=5632934 https://news.ycombinator.com/item?id=5632934 3. https://news.ycombinator.com/item?id=3564830 https://news.ycombinator.com/item?id=3564830 4. http://www.idownloadblog.com/2012/09/27/facebook-ios-6-phone-number/ http://www.idownloadblog.com/2012/09/27/facebook-ios-6-phone...

aaronbrethorst 13y ago
Not any longer. Users must explicitly approve app access to contacts the first time it's requested.
- devx 13y ago
  Yes, and what else we don't know about, thanks to their closed software? Yes, Apple just told us your fingerprint will be stored locally. So? Does that mean Apple si telling the truth, or couldn't leave a backdoor for NSA to get the data? No it doesn't, and we wouldn't know if they did do that. That's the problem with closed software.
  - jarcoal 13y ago
    I'm not going to say that your fingerprints won't fall into the wrong hands, but it's incredibly simple to monitor network traffic from the device, and it's a guarantee someone will do this just to see. It's also a guarantee that Apple knows this, so why bother lying?
  - coldtea 13y ago
    >That's the problem with closed software. That's also the problem with open software people get off of the internet/provider in binary form instead of compiling it themselves. That is, all software.
    - scardine 13y ago
      For all practical concerns, downloading FOSS in binary form is not that worst compared to source code, unless you are willing to audit thousands of lines of code before compiling (and is competent enough). The exploit can even be hidden into the compiler itself, not in the source. I don't have a solution for this problem, I'm just commenting the fact that it is more complex than "compile from source" and that you have to draw a line somewhere unless you assemble your hardware from raw materials and write your own software.
- brymaster 13y ago
  And that only took them until iOS 6! My point still stands.
  - deleted 13y ago
    [deleted]
  - epistasis 13y ago
    This is really stretching the point, because it's implying that not only is a single breach proof of complete insecurity, but also that even a temporary breach is proof of complete insecurity. If one is going to reason in black and white, then the only answer is that everything, absolutely everything, is susceptible to being compromised. In such a black and white world, there's no security benefit for open source software, because it is also possible that you could be tricked into running something that compromises your security, as it is also possible to have a design flaw in the architecture of open source code, as it is with closed source code. It is only when one allows the concept of risk that a coherent security picture can emerge. Leave absolutes to mathematical proofs, and trust and risk assessments to the real world, at least until we can prove code correctness for an entire computer system.
    - brymaster 13y ago
      > This is really stretching the point, because it's implying that not only is a single breach proof of complete insecurity, but also that even a temporary breach is proof of complete insecurity. Not stretching the point at all, because this isn't the only case of a security or trust breach, and once that is broken, you have no reason to trust them again. OP's post made the ridiculous claim that somehow Apple's 'controlled' approach protects users. I provided evidence which proved that false.
      - halostatue 13y ago
        Totally stretching the point. Apple had to make stands as to where to trust developers and where not to trust them. Certain developers broke that trust with Apple, and Apple had to regain the trust with users. Blame Path &c., not Apple, for abusing a feature that was originally provided for the convenience of developers and users together.
superuser2 13y ago
Still better than Android requiring ridiculous, all-or-nothing, irrevocable permissions for every application.
coldtea 13y ago
>For an ecosystem where its been the 'norm' to slurp users entire address books[1], NOTHING about Apple's 'curated, controlled' approach protects users. Well, for one, that doesn't happen anymore without specific user approval. Second, even with that hole, still SOMETHING protects the users more, hence the huge disparity in attacks and malware between the two platforms. For example, what you described is your adress book data taken by the company whose app you use without your consent. That's bad, but not as bad as your whole data (and device) being taken by malicious software you never even intended on using.
abalone 13y ago
Actually, 26% of Android apps have permission to slurp your contacts, including many that have no business doing so. Apple's current approach is much better at protecting your address book, because it makes apps ask permission at the moment they want access, not upfront when installing (which most users grant blindly). This of course has little to do with curation -- except that curation helps too, in that malicious apps can be blocked. Apple's curated approach is why it literally has 1/100th the malicious attacks of Android. It chokes malware at the distribution point. I noticed you had no response to that point. Source: http://www.darkreading.com/privacy/more-than-25-of-android-apps-know-too-mu/240012705 http://www.darkreading.com/privacy/more-than-25-of-android-a...

aaronbrethorst 13y ago

Not any longer. Users must explicitly approve app access to contacts the first time it's requested.

devx 13y ago
Yes, and what else we don't know about, thanks to their closed software? Yes, Apple just told us your fingerprint will be stored locally. So? Does that mean Apple si telling the truth, or couldn't leave a backdoor for NSA to get the data? No it doesn't, and we wouldn't know if they did do that. That's the problem with closed software.
- jarcoal 13y ago
  I'm not going to say that your fingerprints won't fall into the wrong hands, but it's incredibly simple to monitor network traffic from the device, and it's a guarantee someone will do this just to see. It's also a guarantee that Apple knows this, so why bother lying?
- coldtea 13y ago
  >That's the problem with closed software. That's also the problem with open software people get off of the internet/provider in binary form instead of compiling it themselves. That is, all software.
  - scardine 13y ago
    For all practical concerns, downloading FOSS in binary form is not that worst compared to source code, unless you are willing to audit thousands of lines of code before compiling (and is competent enough). The exploit can even be hidden into the compiler itself, not in the source. I don't have a solution for this problem, I'm just commenting the fact that it is more complex than "compile from source" and that you have to draw a line somewhere unless you assemble your hardware from raw materials and write your own software.
brymaster 13y ago
And that only took them until iOS 6! My point still stands.
- deleted 13y ago
  [deleted]
- epistasis 13y ago
  This is really stretching the point, because it's implying that not only is a single breach proof of complete insecurity, but also that even a temporary breach is proof of complete insecurity. If one is going to reason in black and white, then the only answer is that everything, absolutely everything, is susceptible to being compromised. In such a black and white world, there's no security benefit for open source software, because it is also possible that you could be tricked into running something that compromises your security, as it is also possible to have a design flaw in the architecture of open source code, as it is with closed source code. It is only when one allows the concept of risk that a coherent security picture can emerge. Leave absolutes to mathematical proofs, and trust and risk assessments to the real world, at least until we can prove code correctness for an entire computer system.
  - brymaster 13y ago
    > This is really stretching the point, because it's implying that not only is a single breach proof of complete insecurity, but also that even a temporary breach is proof of complete insecurity. Not stretching the point at all, because this isn't the only case of a security or trust breach, and once that is broken, you have no reason to trust them again. OP's post made the ridiculous claim that somehow Apple's 'controlled' approach protects users. I provided evidence which proved that false.
    - halostatue 13y ago
      Totally stretching the point. Apple had to make stands as to where to trust developers and where not to trust them. Certain developers broke that trust with Apple, and Apple had to regain the trust with users. Blame Path &c., not Apple, for abusing a feature that was originally provided for the convenience of developers and users together.

superuser2 13y ago

Still better than Android requiring ridiculous, all-or-nothing, irrevocable permissions for every application.

coldtea 13y ago

>For an ecosystem where its been the 'norm' to slurp users entire address books[1], NOTHING about Apple's 'curated, controlled' approach protects users. Well, for one, that doesn't happen anymore without specific user approval. Second, even with that hole, still SOMETHING protects the users more, hence the huge disparity in attacks and malware between the two platforms. For example, what you described is your adress book data taken by the company whose app you use without your consent. That's bad, but not as bad as your whole data (and device) being taken by malicious software you never even intended on using.

abalone 13y ago

Actually, 26% of Android apps have permission to slurp your contacts, including many that have no business doing so. Apple's current approach is much better at protecting your address book, because it makes apps ask permission at the moment they want access, not upfront when installing (which most users grant blindly). This of course has little to do with curation -- except that curation helps too, in that malicious apps can be blocked. Apple's curated approach is why it literally has 1/100th the malicious attacks of Android. It chokes malware at the distribution point. I noticed you had no response to that point. Source: http://www.darkreading.com/privacy/more-than-25-of-android-apps-know-too-mu/240012705 http://www.darkreading.com/privacy/more-than-25-of-android-a...