Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

macrumors.com

Post reply on HN
Print view View original

31–40 of 182 posts

Re: Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

#31

Post by gpvos »

andreasley wrote: post #19
dessant wrote: post #6

It's unfortunate how Apple and Google approach device ownership, and their attitude towards the concept of general computing is concerning. We do not control our own devices, we cannot stop certain processes on them, and we do not know where our personal data is sent. We either have to flash ROMs from questionable sources and apply temporary exploits to get some kind of resemblance of control of our own devices, or w…

I think Apple's approach is the only reasonable one for the general population. The technological complexity of any smartphone is far beyond comprehension for most people. I write iOS software for a living, and even with complete access to the source code, I couldn't reasonably evaluate my iPhone's software - let alone the hardware. The idea that ROMs from questionable sources make your device safer sounds very stran…

Well, they didn't say the ROMs made their device safer, just that they gave them some semblance of control.

Re: Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

#32

Post by dessant »

andreasley wrote: post #19
dessant wrote: post #6

It's unfortunate how Apple and Google approach device ownership, and their attitude towards the concept of general computing is concerning. We do not control our own devices, we cannot stop certain processes on them, and we do not know where our personal data is sent. We either have to flash ROMs from questionable sources and apply temporary exploits to get some kind of resemblance of control of our own devices, or w…

I think Apple's approach is the only reasonable one for the general population. The technological complexity of any smartphone is far beyond comprehension for most people. I write iOS software for a living, and even with complete access to the source code, I couldn't reasonably evaluate my iPhone's software - let alone the hardware. The idea that ROMs from questionable sources make your device safer sounds very stran…

I think locking down a system by default, but offering a way to gain elevated priviledges, while educating and properly warning users before certain actions is better than taking away everyone's control over their own devices, and therefore restricting their freedom.

Re: Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

#33

Post by coldtea »

adrianN wrote: post #28
rimliu wrote: post #20

Earlier quoted context omitted.

There are things I want to control, and there are things I do not want to control. Smartphone is not a "general purpose computer" and I want just use it not to babysit it. And more often than not having "control over your own" device means that is is just some malware that has this control, not the user.

Your smartphone has all the hardware that it needs to be a general purpose computer. If you could plug in a decent screen and connect a mouse and a keyboard it would be more powerful than the computers you used just a few years ago.

>Your smartphone has all the hardware that it needs to be a general purpose computer.

Which is neither here nor there. Parent doesn't mean a smartphone doesn't have the cpu power etc. of being a general purpose computing, he says it is not one.

Re: Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

#34

Post by reacweb »

mehrdadn wrote: post #18
stock_toaster wrote: post #7

No regression tests? ಠ_ಠ

I mean... does every single patch need a regression test? If I did free(p); p[i] = 1; and then I fixed it by doing p[i] = 1; free(p); do I really need a regression test to trigger the dumb use-after-free I'd introduced?

I think the answer to your question is not obvious. Here, it would have prevented the problem of Apple. 12 years ago while working on a military project on sun, I have encountered a similar vulnerability caused by a regression https://blog.erratasec.com/2007/02/trivial-remote-solaris-0d...

Adding this kind of non regression test is costly, but it protects against source code management mistakes.

Re: Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

#35

Post by DavideNL »

coldtea wrote: post #27
dessant wrote: post #6

It's unfortunate how Apple and Google approach device ownership, and their attitude towards the concept of general computing is concerning. We do not control our own devices, we cannot stop certain processes on them, and we do not know where our personal data is sent. We either have to flash ROMs from questionable sources and apply temporary exploits to get some kind of resemblance of control of our own devices, or w…

Or, you know, buy something else. Before the"locked devices, people had the inverse problem: everything was two open ended and complicated, could cripple the system, stuff was open for exploit (much more so than in this case of unpatched vulnerability, viruses were everyday occurence). Techies didn't have this issue, but the general public did (heck, even techies did suffer somewhat). And that might have been OK for…

> Whereas you can give a 2-year old an iPad, and they can start using it just fine...

What makes you think that if Apple would provide a mechanism in iOS, like SIP (System Integrity Protection) on macOS which can be disabled by technical users if needed, would change anything?

Right now, regular users do not disable SIP on macOS so there's no issue there. They don't even know/care that this possibility exists. So your 2 year old could still use the same iPad just fine.

Re: Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

#36

Post by 9HZZRfNlpR »

coldtea wrote: post #30
thefz wrote: post #24

Earlier quoted context omitted.

> The technological complexity of any smartphone is far beyond comprehension for most people. Don't use it then. By shielding the stupid we are creating more stupid.

That idea is stupid in itself. The whole of civilization has been a process of shielding people from having to know stuff. The same way you don't know how to make fire from first principles, fix your car, make a CPU, or whatever... Even someone with a Ph.D in computer hardware is shielded from tons of complexities and never has to know the whole process end to end.

But they are allowed to learn, which Apple doesn't want you to do. They could make it so your mom doesn't get root by accident, but you would still have the right to do so.

Re: Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

#37

Post by 9HZZRfNlpR »

mehrdadn wrote: post #9

I got a lot of flak here recently for suggesting that maybe security researchers shouldn't be publishing PoCs or deep vulnerability details literally 1 week after the vendor issues a patch. Here's to hoping that, now that this happened, someone will give this idea another consideration... (P.S. for those wondering: apparently this is CVE-2019-8605: https://bugs.chromium.org/p/project-zero/issues/detail?id=18... )

Gives people opportunity to jailbreak their devices?

Re: Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

#38

Post by StavrosK »

dessant wrote: post #14
snaky wrote: post #13

Earlier quoted context omitted.

Do you consider https://download.lineageos.org/ a questionable source?

I do not, but you have to be lucky enough to have a device that is supported by LineageOS, or you need to spend time learning the skills to build a custom ROM for your device. Why isn't there an option in developer mode that gives us a root shell on our Android devices? Why is an escape hatch that gives back control to the user so frightening for these companies?

I mean, it's not luck if you just buy one of those devices...

Re: Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

#39

Post by bluescrn »

coldtea wrote: post #27
dessant wrote: post #6

It's unfortunate how Apple and Google approach device ownership, and their attitude towards the concept of general computing is concerning. We do not control our own devices, we cannot stop certain processes on them, and we do not know where our personal data is sent. We either have to flash ROMs from questionable sources and apply temporary exploits to get some kind of resemblance of control of our own devices, or w…

Or, you know, buy something else. Before the"locked devices, people had the inverse problem: everything was two open ended and complicated, could cripple the system, stuff was open for exploit (much more so than in this case of unpatched vulnerability, viruses were everyday occurence). Techies didn't have this issue, but the general public did (heck, even techies did suffer somewhat). And that might have been OK for…

Give a child an iPad, and they’ll be bombarded with toxic advertising and apps wanting money, money, money.

Back in ‘the old days’ (80s+90s), a child with access to a computer was likely to learn something, even if their primary use of it was playing games.

Re: Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

#40

Post by michaelt »

reacweb wrote: post #34
mehrdadn wrote: post #18

Earlier quoted context omitted.

I mean... does every single patch need a regression test? If I did free(p); p[i] = 1; and then I fixed it by doing p[i] = 1; free(p); do I really need a regression test to trigger the dumb use-after-free I'd introduced?

I think the answer to your question is not obvious. Here, it would have prevented the problem of Apple. 12 years ago while working on a military project on sun, I have encountered a similar vulnerability caused by a regression https://blog.erratasec.com/2007/02/trivial-remote-solaris-0d... Adding this kind of non regression test is costly, but it protects against source code management mistakes.

Unless, of course, the code management mistake that removes the patch also removes the regression test!
Post reply on HN