61–70 of 124 posts
I haven't been able to update my iPhone in months because it just does not have enough room available to download the update. I just checked now and it needs 13.2 GB free to be able to update to iOS 26.5 (from 26.3). On a 64gb device! It just seems like massive software development malpractice to tie together critical operating system updates with whatever else they've bundled.
I thought one just get a new iphone when run out of storage.
when multiple independent parties are simultaneously tripping over different holes in the same kernel, that's not bad luck, that's a systemic attack surface problem
Which gets even better by still using C. Large majority of CVEs in the update are related to memory corruption, out of bounds and use after free. Naturally the logic and wrong permissions ones would happen regardless of the language.
Earlier quoted context omitted.
Which gets even better by still using C. Large majority of CVEs in the update are related to memory corruption, out of bounds and use after free. Naturally the logic and wrong permissions ones would happen regardless of the language.
A strong enough type system can catch permission problems.
I wonder how well Apple has deployed these tools internally for security research. Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has…
I'd guess they haven't even begun to really utilize them. They've never been a terribly security conscious company, despite the marketing.
Where all of this is going? Will there be a dedicated servers running coding agents that iterate throught codebases for each company to find vulnerabilities 24/7?
google has been running ClusterFuzz since ~2012, and naptime was announced in 2024 (https://projectzero.google/2024/06/project-naptime.html). they call it big sleep and codemender now.
openai announced aardvark last year, no they call it codex security.
I haven't been able to update my iPhone in months because it just does not have enough room available to download the update. I just checked now and it needs 13.2 GB free to be able to update to iOS 26.5 (from 26.3). On a 64gb device! It just seems like massive software development malpractice to tie together critical operating system updates with whatever else they've bundled.
Maybe some day the fruit company with all their billions will be able to innovate a solution for deploying for example browser fixes so that they can be installed without requiring tens of gigabytes of free storage on the device. Meanwhile, we're stuck using a computer and iTunes for that.
This isn't a 26.5 bug, this is a bug fixed in 26.5.
Earlier quoted context omitted.
I am part of Apple's SEAR (Security Engineering and Architecture) organization and can’t attest that we have been using Anthropic models, including, but not limited to, Mythos, as part of our participation in Project Glassing and previous private partnerships with different frontier AI labs for years. We simply don’t talk about it because there’s no benefit to talk about it, and also NDA’s, but mostly because there’s…
You wrote "can't attest" but the rest of what you wrote seems like you're actually attesting it. Typo, or I am just misreading?
Earlier quoted context omitted.
Yeah I’m honestly not sure why macOS updates seem to be so huge. Often gigabytes. Do they actually have thousands of changes, so they basically ship out new versions of almost all system libraries? Or is it that they don’t have good diffing in place? Or is it a BSD thing where you basically ship everyone at once since it’s all sort of “one version” of the base system?
> Yeah I’m honestly not sure why macOS updates seem to be so huge. An update to macOS 26.5 contains all the necessary code to update a Mac from 26.0 to 26.5 for both x86_64 and arm64 architectures.