Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

joshua.hu

Post reply on HN
Print view View original

121–130 of 242 posts

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#121

Post by walteweiss »

ionyun wrote: post #16
gridder wrote: post #7

This is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

Google promises. I don’t believe their promises after what happened to Google Reader.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#122

Post by parker_mountain »

jeswin wrote: post #117
mrcarruthers wrote: post #90

Earlier quoted context omitted.

You can't seriously give Apple shit for this and at the same time praise Google. iPhones have, pretty consistently since the 5 or so, received 5 or 6 years worth of OS updates since the phone's release whereas with Android phones you'll receive 2. Only after years of complaining is Google finally promising to support it for longer. And that doesn't cover Samsung, etc...

But Android also lets you run custom builds, and my 2016 phone runs the latest OS. Sure not everyone does this, but unlike iOS I can take care of it myself.

> But Android also lets you run custom builds

Yes, but that is only one component of a modern phone. Basebands and system bootloaders, among other firmwares, don't receive updates. Those are regularly attacked.

It's good that they do but it's not enough.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#123

Post by walteweiss »

dangus wrote: post #37
ionyun wrote: post #16

Earlier quoted context omitted.

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

Personally I don’t think Apple’s level of support is incredibly bad when you take a look at the used device market. Even with Apple’s famously high resale values, depreciation on smartphones is huge. Don’t buy brand new old phones new from Apple, they’re a ripoff. If you buy either an iPhone 12 or 13 used for $250-350 you can basically plan on a $50 a year budget to have a smartphone that always has the latest OS jud…

I still use a 6s and a fist Gen. se, I won’t say they’re terribly slow. It’s the apps, the modern apps, that make the device too slow. If you use not so many, it works quite very well. The only downside that the OS is not updated any longer. Although I got a security update recently, weeks ago.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#124

Post by lloeki »

jeswin wrote: post #117
mrcarruthers wrote: post #90

Earlier quoted context omitted.

You can't seriously give Apple shit for this and at the same time praise Google. iPhones have, pretty consistently since the 5 or so, received 5 or 6 years worth of OS updates since the phone's release whereas with Android phones you'll receive 2. Only after years of complaining is Google finally promising to support it for longer. And that doesn't cover Samsung, etc...

But Android also lets you run custom builds, and my 2016 phone runs the latest OS. Sure not everyone does this, but unlike iOS I can take care of it myself.

> my 2016 phone runs the latest OS. Sure not everyone does this, but unlike iOS I can take care of it myself.

"not everyone" is an understatement.

That's a solution for you (and the dozens - dozens! - of people doing the same), in practice it is not for 99% of Android users, therefore, again in practice, there's a huge fleet of devices with out-of-date software out there.

> But Android also lets you run custom builds

That's not even counting that:

- many Android manufacturers make it non-trivial† to root/unlock/flash a build and/or make it blow a warranty fuse, and that's if it's even possible at all.

- usually the camera goes ape shit, and often loudspeaker audio quality too.

- unless you relock the bootloader it immediately compromises security and makes bootloader updates nontrivial as unlocking again clears the device.

Mind you, this is a fine, intellectually satisfying strategy for you and me to be able to flash open builds, but it's by and large an extremely fringe strategy, and it's been shown over a decade that it's staying that way.

† Often involving downloading random flashing tools from obscure forums, that run only on Windows, some of these being one shot and requiring to plug in magic numbers corresponding to your exact device, and if you screw it up the device is bricked (e.g Samsung). Or the unlocking is on a low-write-count chip and once you exceed that limit the device is bricked (e.g OnePlus). I know, I've been there, bricked a few, recovered only one through JTAG.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#125

Post by kernal »

polyomino wrote: post #100
ionyun wrote: post #16

Earlier quoted context omitted.

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

Google doesn’t have enough e-fuses to update the pixel phones for seven years, the marketing department is incompetent and didn’t talk to literally the only engineers they should have.

Does the Pixel 8 use e-fuses? I was under the impression that it used a stored rollback index to prevent OS rollbacks.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#126

Post by fouc »

Dylan16807 wrote: post #110
qball wrote: post #84

Earlier quoted context omitted.

>but still not very affordable, models The 2020 SE is available from a wide variety of sources for 200USD (still new in box); it'll be supported until 2027. The 2022 SE is 400USD, supported until 2029. By comparison the Android phones at this price point functionally went out of support 2 years before they even existed- not only is there zero support for them, but they ship with outdated OS versions to begin with. An…

You had a strong first paragraph, but your second is going too far. A Pixel 6a is $349 and supported until 2027. A galaxy A15 is $175 and supported until the end of 2028 or early 2029. The full feature updates don't go quite as far, but they're still offered for multiple years into the future.

Isn't pixel 6 when google stopped using qualcomm modems and now has terrible signal reception?

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#127

Post by SirMittens »

Almondsetat wrote: post #112
ionyun wrote: post #16

Earlier quoted context omitted.

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

Apple: proven track record Google: promises you're being disingenuous

> Google: promises

Google is not promising this out of the goodness of their heart. They're just getting ahead of what the EU is planning to mandate [0], and doing that to get some good marketing while they're at it.

So, while Google's track record leaves a lot to be desired, in this, I think they'll keep their promise, either because they actually care, or because the EU will force them to. Either way, we, the end users, will benefit from it.

And this will apply to all electronic device makers. That's probably why Samsung also increased their updates policy to five years as well.

[0]: https://www.insideprivacy.com/cybersecurity-2/eu-publishes-d...

> "The requirements apply for the lifetime of a product or five years from its placement on the market, whichever is shorter."

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#128

Post by kaba0 »

ionyun wrote: post #16
gridder wrote: post #7

This is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

Promising is easy - google can’t keep maintaining successful apps of theirs, let alone a whole phone.

I’ll believe it at 6 years in, maybe.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#129

Post by fouc »

usui wrote: post #98
mattl wrote: post #72

Earlier quoted context omitted.

What’s missing from the more recent SE models?

A 4-inch screen size that allows the phone to be used single-handed with ease anywhere on the screen, which I’m using to write this comment right now. It’s uncompromising in battery longevity when considering its size, too. First-gen SE is the best phone Apple ever made. The newer SE are terrible.

As someone that went from 5S to 2016 SE to 2020 SE which is my current phone, I've been very satisfied with the 2020 SE.

With each phone I have always taken steps to reduce battery usage, disabled background refresh, and manually turn on low power mode after charging every single time.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#130

Post by kaba0 »

jeswin wrote: post #117
mrcarruthers wrote: post #90

Earlier quoted context omitted.

You can't seriously give Apple shit for this and at the same time praise Google. iPhones have, pretty consistently since the 5 or so, received 5 or 6 years worth of OS updates since the phone's release whereas with Android phones you'll receive 2. Only after years of complaining is Google finally promising to support it for longer. And that doesn't cover Samsung, etc...

But Android also lets you run custom builds, and my 2016 phone runs the latest OS. Sure not everyone does this, but unlike iOS I can take care of it myself.

Does it really let you run custom builds when it zeroes out proprietary firmware blobs on many models, turning your fancy camera into a shitty basic one? Or what about the million proprietary blobs you would need for full functionality — will those also get patched?
Post reply on HN