171–177 of 177 posts
Earlier quoted context omitted.
iOS exploits are cheaper than Android exploits because iOS exploits are so plentiful[1][2]. [1] https://www.theregister.com/2020/05/14/zerodium_ios_flaws/ [2] http://zerodium.com/program.html
This doesn't mean that iOS is any less or more secure then Android just that more people where looking at it and finding vulnerabilities.
.........
Apple needs to make it possible for users to choose other ways of sending and receiving messages and listening to music, or of choosing not to do either of those things if they don't want to. Obviously, you can currently install and use other applications that provide the same functionality, but you cannot uninstall or disable defaults. The most shocking experience to me in trying to evaluate the Mac ecosystem when t…
I also have bluetooth headphones I use with a mac, and that’s never happened to me. Is it a new thing with the M1 machines or something?
Earlier quoted context omitted.
Perfectly secure computers are an oxymoron. They don’t exist. iOS is the least worst mobile option and it’s ridiculous to say Apple is lying about security if any exploits are found, ever. If you look at e.g. how messaging works in iOS 14 [0] you’ll see that they do in fact work on making secure systems. But parsing and memory safety are hard. Like, really hard. The fact that NSO found exploits doesn’t mean Apple is…
> But parsing and memory safety are hard. Like, really hard. This doesn't have to be the case. Start by avoiding C and C++. Use Java (on Android) to write parsers. It is very hard to take a buggy parser written in Java, and to escalate to a memory corruption attack. If you really can't use a language like Java, write your parser in safe Rust using slices over Vec . Then run a fuzzer over it. You'll find a few runtime…
In fact I believe that it's hubris to think that we can write massive, complex systems in unsafe languages and -not- overlook some bugs here and there. We had no choice but to use these languages before, but Rust, etc, give us alternate choices now.
Earlier quoted context omitted.
They have already angered the FBI quite a lot during the 2016 San Bernadino case and made their position on the matter clear: https://www.apple.com/customer-letter/
Yes, a good PR move by Apple. Especially when you can get access by going to someone like NSO instead.
Earlier quoted context omitted.
Apple is actually not in the business of selling the data of their users. They will also risk aggravating large players in favor of improved privacy. A recent example: App Tracking Transparency [1] which makes tracking an opt-in feature to be requested from the user. To no one's surprise users are happily declining when made this offer. Companies like Facebook aren't too happy about it. [2] [1] https://www.apple.com/…
Privacy and security are related, but distinct. Apple has been pushing privacy, but we're talking about security here. Typically the tradeoffs around increasing security have to do with user experience, something Apple typically does not like to compromise on.
I wonder if there is a way to disable iMessage and iTunes usage. With windows server I used to have a target of balance in any attack footprint.. if Microsoft provided the OS, the component services that the server exists to provide should always try to be third party software (db, web server, etc) to try and minimize one type of escalation vulnerabilities… while possibly opening up to another, hopefully less worse s…
You can use a NextDNS configuration profile at https://apple.nextdns.io and a NextDNS account to block the device communicating with many Apple services. A good way to disable iMessage and iTunes, though, is to simply not have an Apple ID. (This prevents the install of applications via the App Store, however.) You can of course set up the device with no Apple ID and then only add the Apple ID to the App Store (and no…
I wonder if there is a way to disable iMessage and iTunes usage. With windows server I used to have a target of balance in any attack footprint.. if Microsoft provided the OS, the component services that the server exists to provide should always try to be third party software (db, web server, etc) to try and minimize one type of escalation vulnerabilities… while possibly opening up to another, hopefully less worse s…
You can block or restrict these with the (free) tool apple publishes called “apple configurator”.