Apple's claim is that it bans other browsers for security
1–10 of 593 posts
Re: Apple's claim is that it bans other browsers for security
#2It depends how you look at it and this twitter post takes only one perspective.
Mine is different. The security I'm interested in for my use case is that there is one egress point from the operating system as far as a browser goes. That means I don't have apps shipping their own browser engines to circumvent the system block lists and screen time whitelist controls.
Also comparing CVE rates is pointless as that's exploits and vulnerabilities that were identified and patched, not ones that are in active exploit or publicly unknown which is a metric you cannot measure.
And of course if every app ships a browser or you change it, how many CVEs do you have from unpatched browsers shipped in apps?
This twitter post feels like the old political adverts: "vote for us because the other guy is shit" (not because we have a better solution).
Re: Apple's claim is that it bans other browsers for security
#3No post body was provided.
Re: Apple's claim is that it bans other browsers for security
#4It depends how you look at it and this twitter post takes only one perspective. Mine is different. The security I'm interested in for my use case is that there is one egress point from the operating system as far as a browser goes. That means I don't have apps shipping their own browser engines to circumvent the system block lists and screen time whitelist controls. Also comparing CVE rates is pointless as that's exp…
That means I don't have apps shipping their own browser engines to circumvent the system block lists and screen time whitelist controls.
The mechanism for banning third-party browsers is rejection by the App Store reviewer, correct? Supposing Apple allowed third-party browsers but disallowed embedded browsers in non-browser apps, how would this security model change at all?
Re: Apple's claim is that it bans other browsers for security
#5It depends how you look at it and this twitter post takes only one perspective. Mine is different. The security I'm interested in for my use case is that there is one egress point from the operating system as far as a browser goes. That means I don't have apps shipping their own browser engines to circumvent the system block lists and screen time whitelist controls. Also comparing CVE rates is pointless as that's exp…
Comparing CVE rates is NOT pointless. The bad guys have basically the same toolset as the good guys. Therefore the rate at which vulnerabilities are being discovered by the good guys is indicative of how fast they are being discovered and exploited by the bad guys.
Second the thread pointed out that many iPhones remain vulnerable and unpatched to openly disclosed security holes WITHOUT an option to update them. One must assume at that point that they are being exploited. The fact that alternate browsers don't have this problem is a significant version.
But you do have a good point that it is bad for third party apps to bundle their own browsers to bypass controls, and then leave them vulnerable.
Re: Apple's claim is that it bans other browsers for security
#6So they are saying that they can't make a secure sandbox?
Why is running other applications somehow secure?
Re: Apple's claim is that it bans other browsers for security
#7Re: Apple's claim is that it bans other browsers for security
#8So they are saying that they can't make a secure sandbox? Why is running other applications somehow secure?
fwiw: the App Store also prohibits JITed code or in general code pulled in after app publishing. I guess the idea is that (at least in theory) that Apple sees all code that an app runs.
Re: Apple's claim is that it bans other browsers for security
#9It depends how you look at it and this twitter post takes only one perspective. Mine is different. The security I'm interested in for my use case is that there is one egress point from the operating system as far as a browser goes. That means I don't have apps shipping their own browser engines to circumvent the system block lists and screen time whitelist controls. Also comparing CVE rates is pointless as that's exp…
OP here. The point of the post was not that Safari's security is bad (browser security in general is pretty excellent), the point is that Apple uses security as an excuse to block competition and has no evidence that it's browser is more secure than Firefox/Chrome/Edge etc.
As for system block lists and screentime whitelist controls, that sounds like something any browser could plug-in to via a OS provided API.
I'm in somewhat agreement with you that you can't identify the number of security flaws by vulnerability count, but when you combine that with the big delay in patching + patches not being delivered to the current (most popular) version of the OS it brings a lot of doubt to Apple's claims of both being able to patch faster and have better security.
We're not advocating that apps should not be allowed to ship a browser unless they receive a browser entitlement which should be subject to some approval process / vetting etc. i.e. Browsers with strong security track records should be allowed to bring their browsers along with the engines with some affordance given to browsers that run from soft-forks of those engines.
Re: Apple's claim is that it bans other browsers for security
#10Comparing CVE counts is a bit nonsensical. For instance, Chrome and Firefox don't individually assign CVEs for internally reported vulnerabilities.
For instance, in these patch notes Chrome lists "Various fixes from internal audits, fuzzing and other initiatives" and doesn't even look to have a CVE:
https://chromereleases.googleblog.com/2022/05/stable-channel...
Or for Firefox, there's a dozen or so bundled together in a single CVE under "Memory safety bugs fixed in Firefox 101":
https://www.mozilla.org/en-US/security/advisories/mfsa2022-2...