Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

About the security content of iOS 9.3

support.apple.com

Post reply on HN
Print view View original

11–20 of 20 posts

Re: About the security content of iOS 9.3

#11

Post by saidajigumi »

brokentone wrote: post #5

Is the big security roll up here due to external or internal scrutiny of iOS security spawned by the FBI inquiry perhaps?

Seems doubtful. The overwhelming majority of the CVEs have external reporters cited.

Instead, I expect iOS 10 and the fall hardware announcements are where we'll start seeing signs of any really big changes, e.g. an Apple push to seal itself (and government actors) completely away from customer data access.

Re: About the security content of iOS 9.3

#14

Post by wtallis »

knodi wrote: post #4
abritishguy wrote: post #3

So many memory corruption issues, I'd like to think in 5/10 years time this would be solved and everything written in a safe language but maybe I'm being optimistic.

Thats the same thing people said 10 years ago.

The people saying that 10 years ago were quite obviously being unrealistic. Holding such an opinion back then was essentially predicting that C++ would be replaced by Java, Python, etc.

Now, we've got languages like Rust that offer improved safety mechanisms without really sacrificing expressiveness or runtime performance the way "managed" languages do, so there's a real alternative for software that needs the highest performance or best battery life.

Re: About the security content of iOS 9.3

#15

Post by kabdib »

Apple's basically saying "Here are a bunch of bugs that are not fixed in the version of the phone the FBI has. You don't need us, or source code, or anything other than to hire someone to take advantage of these holes. Go away."

Nice timing.

Probably pissed off a bunch of the intelligence community today.

Re: About the security content of iOS 9.3

#16

Post by pbarnes_1 »

mhw wrote: post #10

Hmm: CVE-2016-1752 : CESG CVE-2016-1750 : CESG I wonder if that's " rel="nofollow">https://www.cesg.gov.uk/> , which is "the Information Security Arm of GCHQ". If so I guess we should be thankful that they saw these vulnerabilities is a risk rather than an opportunity.

Government uses iPhones -> Government reports iPhone vulns.

Re: About the security content of iOS 9.3

#17

Post by 0x0 »

brokentone wrote: post #5

Is the big security roll up here due to external or internal scrutiny of iOS security spawned by the FBI inquiry perhaps?

This is nothing special in iOS terms, most point releases have security release notes that are often even longer than this one.

Re: About the security content of iOS 9.3

#18

Post by matt_wulfeck »

pbarnes_1 wrote: post #16
mhw wrote: post #10

Hmm: CVE-2016-1752 : CESG CVE-2016-1750 : CESG I wonder if that's " rel="nofollow">https://www.cesg.gov.uk/> , which is "the Information Security Arm of GCHQ". If so I guess we should be thankful that they saw these vulnerabilities is a risk rather than an opportunity.

Government uses iPhones -> Government reports iPhone vulns.

And this is exactly the way it should work.

Re: About the security content of iOS 9.3

#19

Post by robin_reala »

kevincox wrote: post #12

Am I reading this wrong or does it not say which devices received fixes? Or is it not including which devices were affected?

The issues reports are OS level rather than device level. Every device that can run iOS 9 gains these fixes. Full list is at https://www.apple.com/ios/whats-new/#compatibility , but basically iPhone 4S+ / iPad2+.
Post reply on HN