181–190 of 458 posts
That's a pretty huge flaw. Millions if not billions of people can suddenly remotely spy on almost any other ios or mac anywhere in the world, just by knowing their email address or phone number? Perhaps Apple should simply pull the plug on the facetime servers for now.
Perhaps apppe should disable Group FaceTime calls until an update is out.
Just thinking out loud here - why isn't there legislation that makes it mandatory for phone manufacturers to send out a notification to all devices affected by serious security flaws (like this one)? Not only will fixing and rolling out an update take a while, there is also no guarantee that the update will be installed. Meanwhile, hackers will have a field day. Or maybe there is already one, and I'm blissfully ignor…
I imagine at some point the government will regulate software and the liability may shift. It could be good, but it could also be bad.
Earlier quoted context omitted.
If you don't trust the software in the first place, there's no real reason for you to trust that airplane mode is actually effective.
If you can't trust the software at all, you might be better served with turning your phone off :/
Like the SamuelAdams said, you might do better with a Faraday bag.
Earlier quoted context omitted.
OP is referring to the ability to tap into any Alexa device, a feature Amazon calls Drop In ( https://www.amazon.com/gp/help/customer/display.html?nodeId=... ).
Google Duo does offers it as well.
Earlier quoted context omitted.
Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? It’s not like iPhones have a reputation for not having bugs; it seems like every version has a passcode bypass or a DoS-via-iMessage. By some standards, this is worse (remotely triggerable, leaks audio/video), but in other cases it’s not as bad: the attacker’s Apple ID ends up in the call logs of the affected person.…
Well this is the top Twitter trend right now, for starters. It's a very visible, very easy to reproduce bug in a very popular service, and it's definitely going to hurt their reputation with consumers more than if it was something more technical yet equally or more dangerous.
Earlier quoted context omitted.
I’m not sure about the situation at Apple, but this is 100% true in the web development world today; with the exception that many of the new programmers hired straight out of General Assembly and the like can’t implement a DFS algorithm either. It’s a nightmare for security and performance - the number of obvious, blatant security issues I’ve spotted and fixed just through luck alone is horrifying.
I'm sorry, but I don't know what "General Assembly" is. I live in the US, so is this some part of a degree program in your country (if you live somewhere else) that I'm not aware of? But coming back to your point, there have always been new engineers with weak skills, just like there have always been smart engineers as well. I don't think the choice of programming language changes this fact significantly, although ce…
As programming gets easier to learn, people spend less time learning programming. This has a number of negative knock-on effects, eg less understanding & focus on correctness, performance, security, etc. Obviously there’s lots of wider benefits too - but I suspect that the average person writing objective-c today spent more time studying programming than the average person writing swift today.
It sounds like we generally agree on that - but my claim is that this effect size is big enough to dominate almost all other considerations. I suspect the average C program is more secure than the average JavaScript web app, despite how the absurd difficulty in writing correct C, just because of the ratio of new and old programmers in both communities.
VOIP is indeed listed. https://cdn.vox-cdn.com/thumbor/6r9jLyDaTuh8MlCgiL-9Uq588TQ=...
Earlier quoted context omitted.
Most likely 2 different teams worked on it. One worked on accepting calls, the other worked on transmitting audio, another probably worked on video. Then it got integrated and complete e2e testing wasn't done.
How would an e2e test catch this though? What would the test condition be? Wouldn’t I have to be checking for audio from the other party during all seemingly random events like adding a person to the call group? Apologies in advance for my ignorance, I haven’t written code for a long time.
:format(webp)/cdn.vox-cdn.com/uploads/chorus_image/image/61159115/prism-slide-4.1419979622.0.jpg){kind=link}