5 ms·

And that only took them until iOS 6! My point still stands.

deleted 13y ago
[deleted]
epistasis 13y ago
This is really stretching the point, because it's implying that not only is a single breach proof of complete insecurity, but also that even a temporary breach is proof of complete insecurity. If one is going to reason in black and white, then the only answer is that everything, absolutely everything, is susceptible to being compromised. In such a black and white world, there's no security benefit for open source software, because it is also possible that you could be tricked into running something that compromises your security, as it is also possible to have a design flaw in the architecture of open source code, as it is with closed source code. It is only when one allows the concept of risk that a coherent security picture can emerge. Leave absolutes to mathematical proofs, and trust and risk assessments to the real world, at least until we can prove code correctness for an entire computer system.
- brymaster 13y ago
  > This is really stretching the point, because it's implying that not only is a single breach proof of complete insecurity, but also that even a temporary breach is proof of complete insecurity. Not stretching the point at all, because this isn't the only case of a security or trust breach, and once that is broken, you have no reason to trust them again. OP's post made the ridiculous claim that somehow Apple's 'controlled' approach protects users. I provided evidence which proved that false.
  - halostatue 13y ago
    Totally stretching the point. Apple had to make stands as to where to trust developers and where not to trust them. Certain developers broke that trust with Apple, and Apple had to regain the trust with users. Blame Path &c., not Apple, for abusing a feature that was originally provided for the convenience of developers and users together.
    - brymaster 13y ago
      Not stretching any point. I presented actual cases and proved Apple's 'controlled' environment hasn't protected user privacy. > Blame Path &c., not Apple Oh sure, I won't blame Apple for leaving the door wide open and turning a blind eye for years! Wow.
  - revscat 13y ago
    > Not stretching the point at all, because this isn't the only case of a security or trust breach, and once that is broken, you have no reason to trust them again. This is foolish. Every non-trivial piece of software will eventually succumb to a security flaw. This does not mean the software is untrustworthy in toto. You fix the bug and move on.
enraged_camel 13y ago
No, your point does not stand. You shifted goalposts, like most posters here do when they are proven wrong. Just admit your ignorance and move on.
- ihsw 13y ago
  If you can get people to admit defeat without shame or guilt, they'll quite happily concede. You may not have any interest in those restrictions on communication, but you'd have an easier time getting someone to admit their ignorance.
- Dylan16807 13y ago
  It's not moving the goalposts. That was a single example of apple not protecting users, and the first post uses past tense when talking about it.
- brymaster 13y ago
  Admit what defeat? What an odd thing to say - as if posting on HN is some sort of battleground. Anyway, for years apps have been collecting user data without interference. My point still stands. Apple can't protect users on their own platform. Keep those blinders on, I guess.
  - derefr 13y ago
    Everywhere people talk is a battleground, called "civil, reasoned debate." One of the rules of that battleground is that when someone pokes a hole in the evidence you've used to draw your audience toward a conclusion, you can't put new evidence in its place to support the same argument; you have to make an entirely new argument, because the new evidence might lead you somewhere entirely else when looked at on its own.
    - deleted 13y ago
      [deleted]
    - brymaster 13y ago
      > you can't put new evidence in its place to support the same argument Nah, no where did that happen. It's just hard for some people to handle truths and make connections.
coldtea 13y ago
Yes, after all what do hard data matter, when one has a point!
- brymaster 13y ago
  Hard data. Like the facts I pointed out earlier and backed them up with...data.
TheZenPsycho 13y ago
And when did Android fix it? Oh wait, they didn't did they? Open source software freedom means the freedom to write software that slurps up whole address books. And it's the user's responsibility to read the source code to ensure it's not doing that. Because obviously most people are capable to do that and also have the time to do that for every piece of software they install, right? At the end of the day, I'd rather Apple and the NSA have my data than some random hacker in russia.
- chatman 13y ago
  You don't understand what free software means. It means freedom respecting software; something that you control. Apple could still have audited free software into its appstore as it does for nonfree software currently.
  - TheZenPsycho 13y ago
    Your comment is incoherent. I know what "Free Software" means. Your definition has no connection to what you assert here: "Apple could still have audited free software into its appstore as it does for nonfree software currently." So, unless you're suggesting that apps be distributed as source code, and compiled locally on your phone, there's no way to determine if the binary the App store distributes is an accurate uncompromised representation of the original source. Furthermore, expecting normal users to examine source code for security holes is an unreasonable burden. The security of iPhone apps is based on how much we trust Apple to maintain that security, and to review the apps. Not in our personal freedom to examine the source code, which we can do already, for many apps. You confuse developer control/freedom with user control/freedom. They are very different things. A user doesn't have programming skills, and their personal interests are in freedom from malware- freedom from developers that have the ability to do whatever they feel like with the user's data. They have no interest in being able to compile their own apps and run them on their own hardware. On the other hand, developers are interested in having the freedom of not being in a sandbox. not having to go through an app review/approval process. The freedom from security restrictions. The freedom to slurp address books. The freedom to override any hardware button, use any API, without limit. Do you not see how developer freedom and user freedom are in conflict?
lkbm 13y ago
How does it still stand? Maybe the curated system doesn't protect users, but the only example you provided of it failing to do so has apparently been fixed.

deleted 13y ago

[deleted]

This is really stretching the point, because it's implying that not only is a single breach proof of complete insecurity, but also that even a temporary breach is proof of complete insecurity. If one is going to reason in black and white, then the only answer is that everything, absolutely everything, is susceptible to being compromised. In such a black and white world, there's no security benefit for open source software, because it is also possible that you could be tricked into running something that compromises your security, as it is also possible to have a design flaw in the architecture of open source code, as it is with closed source code. It is only when one allows the concept of risk that a coherent security picture can emerge. Leave absolutes to mathematical proofs, and trust and risk assessments to the real world, at least until we can prove code correctness for an entire computer system.

brymaster 13y ago
> This is really stretching the point, because it's implying that not only is a single breach proof of complete insecurity, but also that even a temporary breach is proof of complete insecurity. Not stretching the point at all, because this isn't the only case of a security or trust breach, and once that is broken, you have no reason to trust them again. OP's post made the ridiculous claim that somehow Apple's 'controlled' approach protects users. I provided evidence which proved that false.
- halostatue 13y ago
  Totally stretching the point. Apple had to make stands as to where to trust developers and where not to trust them. Certain developers broke that trust with Apple, and Apple had to regain the trust with users. Blame Path &c., not Apple, for abusing a feature that was originally provided for the convenience of developers and users together.
  - brymaster 13y ago
    Not stretching any point. I presented actual cases and proved Apple's 'controlled' environment hasn't protected user privacy. > Blame Path &c., not Apple Oh sure, I won't blame Apple for leaving the door wide open and turning a blind eye for years! Wow.
- revscat 13y ago
  > Not stretching the point at all, because this isn't the only case of a security or trust breach, and once that is broken, you have no reason to trust them again. This is foolish. Every non-trivial piece of software will eventually succumb to a security flaw. This does not mean the software is untrustworthy in toto. You fix the bug and move on.

enraged_camel 13y ago

No, your point does not stand. You shifted goalposts, like most posters here do when they are proven wrong. Just admit your ignorance and move on.

ihsw 13y ago
If you can get people to admit defeat without shame or guilt, they'll quite happily concede. You may not have any interest in those restrictions on communication, but you'd have an easier time getting someone to admit their ignorance.
Dylan16807 13y ago
It's not moving the goalposts. That was a single example of apple not protecting users, and the first post uses past tense when talking about it.
brymaster 13y ago
Admit what defeat? What an odd thing to say - as if posting on HN is some sort of battleground. Anyway, for years apps have been collecting user data without interference. My point still stands. Apple can't protect users on their own platform. Keep those blinders on, I guess.
- derefr 13y ago
  Everywhere people talk is a battleground, called "civil, reasoned debate." One of the rules of that battleground is that when someone pokes a hole in the evidence you've used to draw your audience toward a conclusion, you can't put new evidence in its place to support the same argument; you have to make an entirely new argument, because the new evidence might lead you somewhere entirely else when looked at on its own.
  - deleted 13y ago
    [deleted]
  - brymaster 13y ago
    > you can't put new evidence in its place to support the same argument Nah, no where did that happen. It's just hard for some people to handle truths and make connections.

coldtea 13y ago

Yes, after all what do hard data matter, when one has a point!

brymaster 13y ago
Hard data. Like the facts I pointed out earlier and backed them up with...data.

TheZenPsycho 13y ago

And when did Android fix it? Oh wait, they didn't did they? Open source software freedom means the freedom to write software that slurps up whole address books. And it's the user's responsibility to read the source code to ensure it's not doing that. Because obviously most people are capable to do that and also have the time to do that for every piece of software they install, right? At the end of the day, I'd rather Apple and the NSA have my data than some random hacker in russia.

chatman 13y ago
You don't understand what free software means. It means freedom respecting software; something that you control. Apple could still have audited free software into its appstore as it does for nonfree software currently.
- TheZenPsycho 13y ago
  Your comment is incoherent. I know what "Free Software" means. Your definition has no connection to what you assert here: "Apple could still have audited free software into its appstore as it does for nonfree software currently." So, unless you're suggesting that apps be distributed as source code, and compiled locally on your phone, there's no way to determine if the binary the App store distributes is an accurate uncompromised representation of the original source. Furthermore, expecting normal users to examine source code for security holes is an unreasonable burden. The security of iPhone apps is based on how much we trust Apple to maintain that security, and to review the apps. Not in our personal freedom to examine the source code, which we can do already, for many apps. You confuse developer control/freedom with user control/freedom. They are very different things. A user doesn't have programming skills, and their personal interests are in freedom from malware- freedom from developers that have the ability to do whatever they feel like with the user's data. They have no interest in being able to compile their own apps and run them on their own hardware. On the other hand, developers are interested in having the freedom of not being in a sandbox. not having to go through an app review/approval process. The freedom from security restrictions. The freedom to slurp address books. The freedom to override any hardware button, use any API, without limit. Do you not see how developer freedom and user freedom are in conflict?

lkbm 13y ago

How does it still stand? Maybe the curated system doesn't protect users, but the only example you provided of it failing to do so has apparently been fixed.