3 ms·
They don't need to fork Objective-C to lock down the use of private APIs! They just need to check for disallowed or computed symbols in the sumbitted binaries.
by blasdel 17y ago
They don't need to fork Objective-C to lock down the use of private APIs!
They just need to check for disallowed or computed symbols in the sumbitted binaries. They don't do any static analysis whatsoever — not even strings!
- joezydeco 17y agoLooks like you got your wish... http://www.theiphoneblog.com/2009/11/16/apple-static-analysis-tool-find-private-apis-reject-apps/ http://www.theiphoneblog.com/2009/11/16/apple-static-analysi...
- ryanpetrich 17y agoThe fact that private APIs can crash the device, access private data or cause issues with the network means Apple hasn't done their job in securing the OS. If OS X allowed processes in unprivileged user accounts access to hardware or other users' files, that would be considered a massive security hole
- drewcrawford 17y agoYou don't need to be root to rm -rf ~/
- lukifer 17y agoThe vulnerability was due solely to users running SSH (which is not installed except by jailbreaking) without changing the default root password. It's surprising that such a gaping security hole took as long as it did to be widely exploited.