I dont think apple is entitled to that information on any basis, and i dont think its a legitimate threat to expose actual ill behaviour
I think they're talking about the implication that if Apple don't pay, then the vulnerability is published.
I agree with you on a moral basis: what difference does it make if I get payed not to publish it vs. If I just publish it without even asking to get paid. But I'm not sure the law would agree with us.
Is it true that Apple devices are more secure than good Android devices(like Google's Pixel)? Or is it just security theater ?
From what I've seen, the majority of it is theater. Does that mean it's more secure than Android devices? Not necessarily. In any case, the biggest vulnerability in any system is the end user. No amount of idiot-proofing will stop people from being scammed on an iPhone, nor will it stop someone on Android. When these companies market their "Secure Enclave" or "Titan Security", they're really just dressing up otherwis…
> The T2 chip was basically a dedicated PRNG chip with basic encoding capabilities
This is an extremely misleading description of the scope of T2’s duties.
If Apple are actually serious, why are they taking so long to give the bounty? It's sounds like madness to me.
Those who fix the bug and those who issue payment are likely in two different groups with two different sets of motivators. Not excusing but explaining.
A new Mac comes with something like 30 apps in the bar. I clicked and disabled every single one of them except Finder and used Safari to download another browser. If it was any other manufacturer, this mess would be quickly denounced by reviewers as crapware. But because it is by Apple, it is not a problem at all. I am not expecting this to fix by itself. Maybe some major review blogs should first not parrot how magi…
I assume you mean the Dock? I am with you there, on a new install of macOS I drag pretty much all their apps out of it (to be fair, I do the same thing on a new Ubuntu desktop install too...). Of course in a sense the Dock is an anachronism, I find it useful once in the while to drag a file onto an app there, but generally for launching apps I prefer Spotlight (actually Alfred).
Yes. The term dock came out of my mind, thanks. And yes, I emptied the dock. But obviously taking stuff off the dock is the minor inconvenience, but the idea that all this was preinstalled. Package managers and app stores should be where almost all of this belongs.
So, is this an issue on my old mac running 10.11.6 that will not get fixed?
I'm on 10.9 and I don't want to use anything newer. I can deal with some risk, but this vulnerability is unacceptably bad. The core problem is that really dumb feature which auto-expands certain zip files. I need to turn that off. MailWebAttachment.h contains a method: - (BOOL)isAutoArchiveAttachment; I bet that if I Swizzle that to always return false, this "feature" will go away. I'll found out this weekend... Edit…
I’m curious and not attacking.
Do you follow all security-related announcements for Mac OS and do your own back ports and fixes?
How did you decide 10.9 is the right balance of risk for you?
I can't find any information on the following questions:
Are all past versions of OS X / Apple Mail affected?
For what OS X Version does Apple provide a security update regarding this issue?
Has anyone found a fix that prevents auto-uncompression (such as a "defaults write com.apple.mail xyz False" command)?
Due to several reasons, I am also on an older Version of OS X and this issue makes me a bit nervous.
> Mail will parse it to find out any attachments with x-mac-auto-archive=yes header in place. Mail will uncompress those files automatically. What could possibly go wrong? ;-/
Perhaps someone more knowledgeable could explain it to me, but uncompressing the files automatically doesn't seem like that big a deal to me. The much bigger sin appears to be allowing symlinks or a reference of any kind outside of a sandboxed directory.
I may be wrong, but I thought the symlinks have to be in the sandbox. The problem is that the sandbox includes config files, preferences, etc. that can affect the way the Mail application works.
I wouldn't call it extreme when there was a known public website allowing one-click jailbreak for good few months (not sure if it was actually ever patched or just the iOS version got eol)
It's unsurprising that the main vector for iOS jailbreaks would be through the web engine. The FreeBSD-based PlayStation 4 was also jailbroken via it's browser. If you have written a hardened, safe browser engine then you are free to share it to the world, otherwise I wouldn't downplay their efforts.
Chrome/Chromium has a better track record and it is shared with the world. The number of Safari-based iOS exploits found in the wild is embarrassing.
Not OP, but I'll stop complaining when Apple lets me use other browser engines.
I like this idea. 1. Company verifies the bug 2. Assigns it a price according to impact 3. Keeps details hidden until Apple pays them, then reveals the bug. Thus Apple is forced to pay, but bad actors dont get access. Different bug markets can compete to correctly price bugs.
That may be considered black-mail by some courts.
It's only blackmail if the threat is to do something you are not otherwise legally allowed to do. It is legal to, say, announce a zero-day on Twitter. Or to sell the zero-day to the NSA, or some grey hat broker like Zerodium.
Apple puts rather extreme security effort into preventing iOS jailbreaks. They are pretty serious about trying to prevent data exfiltration from locked iOS devices as well. They aren’t perfect but I don’t think it’s fair to say they don’t try.
I wouldn't call it extreme when there was a known public website allowing one-click jailbreak for good few months (not sure if it was actually ever patched or just the iOS version got eol)