Apple patches CVE-2020-9859 (unc0ver)

Post by saagarjha » Tue, Jun 02, 2020, 6:08 AM UTC

jfindley wrote: post #60

ComputerGuru wrote: post #40

Earlier quoted context omitted.

That’s not an axiomatic truth. Binary diff algorithms exist (ask me, I’ve written several) that can identify and isolate changes across versions even when content is changed at non-block boundaries, non-contiguously, etc and while they are computationally expensive patches to create, they are trivial to unpack/apply. But generally the software industry has moved to a model where diffs are shunned and “recreate from s…

That's not universally true. Android makes significant use of binary diffs for patching to reduce OTA upgrade sizes, for example. However they're not appropriate for all situations, and there's a bunch of legitimate reasons Apple may have chosen not to pursue this for kernel updates.

Post by rurban » Tue, Jun 02, 2020, 6:41 AM UTC

hu3 wrote: post #70

nitrogen wrote: post #66

Earlier quoted context omitted.

I want to point out that software and space are quite different problems. Much of the engineering for space appears to be mathematically differentiable and continuous -- a small change in inputs usually results in a predictable change in outputs. It's hard work, but relatively intuitive. Software is more chaotic though. A small change in inputs can change behavior drastically, like stepping a tiny bit to the right on…

There's no amount of handwaving that will excuse Apple for messing up their signin authentication, mobile throttling, faulty keyboards being delivered for years despite customer outcry or allowing anyone to login as root with blank password on macos. Those things should get caught in basic QA. It's not rocket science. I repeat: it's incompetence.

Post by api » Tue, Jun 02, 2020, 8:03 AM UTC

blinkingled wrote: post #68

prvc wrote: post #49

Earlier quoted context omitted.

If that doesn't illustrate their true priorities re: user security/ privacy, then I'm not sure what could.

https://twitter.com/s1guza/status/1266433756270866433 This may also illustrate their priority to reintroduce the same bug and re-fix it at faster speeds to wow their fanbase. Or you know the priority may also be keeping the walled garden - walled? Also it might just be security response 101 - like every other major OS vendor out there depending on the bug. But yeah privacy and security for users that's a much nicer m…

Post by dang » Tue, Jun 02, 2020, 10:34 PM UTC

andarleen wrote: post #19

saagarjha wrote: post #17

Earlier quoted context omitted.

I currently don't have one, so…no? I do usually try to keep Hacker News clean of low-quality comments, though, which is fairly distinct from "negative apple feedback".

Yeah people like you did a lot of work to hide apple’s planned obsolence in the past, wouldnt be entirely shocked if this was the case. Now you can apply for a job at apple showing what a good sheeple you are.