Live data from Hacker News

No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

joshua.hu

81–90 of 242 posts

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#81
post #75

The iPhone 8 was sold new less than 3 years ago. Okay, new features shouldn't be expected, but patching known vulnerabilities should be required.

iPhone 8 had a patch to iOS 16 released a week ago, 6 years after it was released and 3 years after it was last sold during a global pandemic?

And the entire point of the article is that those security patches are ignoring known vulnerabilities that are patched by Apple in iOS 17.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#82
post #16

Earlier quoted context omitted.

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

It was difficult to locate but I found a new iPhone 7 for sale for $92. Seems affordable.

[flagged]

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#83
post #68
post #50

That is why I am an android dude, you will always find a random ROM on xda with the latest android security patch and sometimes even the latest android version on devices 10+ years old even if the manufacturer has stopped supporting it a while ago.

lol! Are you really comparing Apple released operating system updates to xda?

[deleted]

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#84
post #16
post #7

This is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

>but still not very affordable, models

The 2020 SE is available from a wide variety of sources for 200USD (still new in box); it'll be supported until 2027. The 2022 SE is 400USD, supported until 2029.

By comparison the Android phones at this price point functionally went out of support 2 years before they even existed- not only is there zero support for them, but they ship with outdated OS versions to begin with. And no, "but I can go to XDA and get a shitty ROM at the cost of my camera" doesn't count as support.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#85

Earlier quoted context omitted.

Yea, this reads like someone was denied a bounty for a "exploit" and decided to make it a whole thing as retribution.

I don't see how. Apple is choosing to not patch known vulnerabilities on hardware sold new less than 3 years ago. Hardware they're happy to charge for repairs on.

[flagged]

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#86
post #77

Earlier quoted context omitted.

Wait... so because you don't want to be infected because you're using an out of date OS, you load OS patches of questionable provenance, but you're not worried about that since nobody would bother to infect you anyway? Why not skip a few steps there and just run an out of date OS?

Every device running an old OS is vulnerable, so it's better to throw the dice on an aftermarket ROM. Edit: Though to keep things fair, it must be said that that particular argument only really applies to old devices. If you have a new device (or rather, one still getting regular security updates from the vendor) and a trustworthy vendor, a person could reasonably argue for staying on the stock ROM.

Fair point

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#87
post #72

Some iOS 15 phones like the 5S/SE have no newer comparable phones which makes upgrading difficult. Oh dear, I suppose not browsing the web is another option.

What’s missing from the more recent SE models?

Small physical size, also a headphone jack.

The more recent SE models are iPhone 8 bodies with upgraded internals (being an iPhone 11 and 13 inside, respectively) and Apple no longer offers a Mini version of their newer phones (not that the A16 and A17 are significant improvements on the A15, but still).

And the Mini is still larger than the first SE by about a half inch in either direction; the 8 (and the newer phones) add another half inch on top of that.

Of course, the problem with using a first-gen SE today is that because information density on mobile is abysmal, the added vertical space has been very welcome to app developers (who also might not test on the smallest screens). So while the smaller phones were ergonomically far superior to the larger ones, and this is to a point true for the Minis as well, that's since been "balanced" by inherently worse UI/UX on said phones.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#88

The iPhone 8 was sold new less than 3 years ago. Okay, new features shouldn't be expected, but patching known vulnerabilities should be required.

What does the iPhone 8 have to do with this discussion? The linked piece specifically refers to iPhone 6S and iOS 15.8.

It runs iOS 16, where Apple has the same policy of only providing partial fixes. From the article:

> A new exploit targeting the iOS (among other OS’) Bluetooth stack has also been left unpatched by Apple in all versions except iOS 17.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#89
post #37

Earlier quoted context omitted.

Personally I don’t think Apple’s level of support is incredibly bad when you take a look at the used device market. Even with Apple’s famously high resale values, depreciation on smartphones is huge. Don’t buy brand new old phones new from Apple, they’re a ripoff. If you buy either an iPhone 12 or 13 used for $250-350 you can basically plan on a $50 a year budget to have a smartphone that always has the latest OS jud…

> I don’t think we will be able to say the same thing about an iPhone 12 or 13 The wildcard here is local LLM use cases and any new hardware that increases their speed by orders of magnitude.

That’s not really a need for smartphone users. I can access an LLM on a website for free right now.

I also don’t see any indication that there will be impactful local LLM silicon at the smartphone scale anytime soon.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#90
post #16
post #7

This is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

You can't seriously give Apple shit for this and at the same time praise Google. iPhones have, pretty consistently since the 5 or so, received 5 or 6 years worth of OS updates since the phone's release whereas with Android phones you'll receive 2. Only after years of complaining is Google finally promising to support it for longer. And that doesn't cover Samsung, etc...
Post reply on HN