A while back I filed a bug on libplist with some examples of the hilarious this-is-not-XML issues in Apple's userland plist parser, which people might find fun here as it is highly related to this issue.
Psychic Paper: iOS Sandbox Escape
41–50 of 61 posts
Re: Psychic Paper: iOS Sandbox Escape
#42That made me shudder go all the people I know who won’t update their phones
Re: Psychic Paper: iOS Sandbox Escape
#43Earlier quoted context omitted.
Problem is legacy software tends to use XML. iOS can be considered legacy at this point. Plists are prevalent at every level of iOS.
As somebody who was already a high school student deeply ‘into’ computer technology at the time, I perfectly remember the hype and release of XML. IOS was released last week by mental accounting standards. To hear both be branded as ‘legacy’ is, frankly... well, it makes me feel ancient.
XML came out in 1998, iOS in 2007 (or a year later for the SDK). It’s closer to XML than to today.
Re: Psychic Paper: iOS Sandbox Escape
#44The section of the WHATWG HTML spec about parsing XHTML begins with this note: > An XML parser, for the purposes of this specification, is a construct that follows the rules given in XML to map a string of bytes or characters into a Document object. > Note: At the time of writing, no such rules actually exist. What do the authors of HTML mean by this? Isn't there a spec for XML? There is -- here's what it has to say…
I am very skeptical. This state-machine approach seems much more like an implementation than a specification. Having a reference implementation could certainly be a good thing, but this doesn't even look like something one could run and test against.
The declarative form of Comment, above, is wonderfully concise and clear when compared to these several lines of imperative, update-this/goto-there style alternative. You can see in your head what it should match without mentally simulating these specific instructions against some imagined parser state.
There certainly can be a host of terrible issues with BNF-style grammars. When they're just used as a notation to write down a bunch of rules, with no regard to actually implementing these rules, the result can be a sprawling and terribly ambiguous mess. For instance, this[1] is an abject disaster, chock full of ambiguity and senseless distinctions.
But if one is prepared to take the effort to really write a machine-readable grammar like this[2], the result is a straightforward, high-level, concise spec that can be compiled into an implementation to boot. What's not to like?
[1] http://sven.xtreme-eda.com/ [2] https://docs.python.org/3/reference/grammar.html
Re: Psychic Paper: iOS Sandbox Escape
#45Maybe we should take this as a lesson that we should use the simplest marshalling format that adequately captures our use cases rather than using a swiss-army knife format like XML.
I’m not sure that there were much better choices available at the time. IIRC property lists date back to NextStep. By the time stuff like JSON started popping up, plists were pervasive all throughout OS X. Typical legacy problem!
I wouldn’t view it as a legacy problem. There’s no actual need to change to another format (JSON etc?) just for the sake of it.
Re: Psychic Paper: iOS Sandbox Escape
#46That made me shudder go all the people I know who won’t update their phones
If they know what they’re doing, Apple will have either blocked these invalid apps from the App Store or started removing them.
Re: Psychic Paper: iOS Sandbox Escape
#47[deleted]
Re: Psychic Paper: iOS Sandbox Escape
#48Maybe we should take this as a lesson that we should use the simplest marshalling format that adequately captures our use cases rather than using a swiss-army knife format like XML.
I’m not sure that there were much better choices available at the time. IIRC property lists date back to NextStep. By the time stuff like JSON started popping up, plists were pervasive all throughout OS X. Typical legacy problem!
Property lists in NeXTSTEP didn't use XML but rather a different text-based format.
https://developer.apple.com/library/archive/documentation/Co...
Re: Psychic Paper: iOS Sandbox Escape
#49> I just hate GUIs for development, especially when you Google how to do something, and the answer is a series of 17 “click here and there”s that are no longer valid because all the GUI stuff moved somewhere else in the last update. It's not just developer tools that suffer from this problem. I opened iMovie recently after not playing with it for almost 10 years, and was so flabbergasted at how everything worked. Too…
It’s hilarious that it was easier for me to adjust to FCPX than to try to move my amateur video editing brain to new iMovie, so much so that I just renew my trial once a year instead of try to use iMovie. They ported the iOS version and it shows (especially considering how many features are missing from iMovie 09).
Actually iMovie on macOS is based con FCPX.
Re: Psychic Paper: iOS Sandbox Escape
#50I'm not in the security community and as an end user there seems to be two lesson there:
-Apple should provide better audit tool so that security consultants don't need to rely on unpublished 0day exploits to find other exploits
-As an exposed user I really don't thank grey hat People that refrain from publishing 0day exploit for two frigging years for personal gain...