Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak
macrumors.com
macrumors.com
We do not control our own devices, we cannot stop certain processes on them, and we do not know where our personal data is sent.
We either have to flash ROMs from questionable sources and apply temporary exploits to get some kind of resemblance of control of our own devices, or we have to spend years to learn the skills to unlock these systems ourselves.
Why isn't there an option in developer mode that gives us a root shell on our Android devices? Why is an escape hatch that gives back control to the user so frightening for these companies?
And unfortunately as we have seen all too often users are willing to blindly do what they are told if they get something out of it e.g. free game, credits etc.
The idea that ROMs from questionable sources make your device safer sounds very strange to me.
Basically every electronic device has countless security issues. Some of them are found of which some are published of which most are eventually fixed (by rather large teams of professionals). In that regard, Apple could and should do better.
But the burden of making such a complex device secure simply can't be put on the end user.
While I would welcome deeper access for technically inclined people, I'm not sure that option can really be given by Apple/Google without the risk of becoming a disadvantage for many users.
Don't use it then. By shielding the stupid we are creating more stupid.
The whole of civilization has been a process of shielding people from having to know stuff.
The same way you don't know how to make fire from first principles, fix your car, make a CPU, or whatever...
Even someone with a Ph.D in computer hardware is shielded from tons of complexities and never has to know the whole process end to end.
How? Serious, genuine question. How can they give you “the right to do so”, but prevent “mom” from accidentally doing so or worse, having someone do it to their phone without them knowing?
It could even be as involved as getting an official image from apple/google that allows root access. I don’t think a “mom” would accidentally download an image and flash their telephones.
Who says “mom” flashed her phone?
How does “mom” know the shady place they took their phone to repair a broken screen didn’t do it? (P.S. many documented cases of this)
How does “mom” know their jealous/cheating/whatever spouse/bf/gf/whatever didn’t do it? (P.S. many documented cases of this)
How does “mom” know the phone they bought off someone didn’t do this? (P.S. many documented cases of this)
How does “mom” know their kid didn’t do this so they could install stolen games? (P.S. many documented cases of this)
The list goes on and on.
In order for any of those threats to work it would require physical access and access to passwords and accounts (for example reconnecting to cloud services, restoring backups or even just unlocking the phone to perform a flash). At that point I don’t think it’s having or not having root access that is the issue.
Of course they do, hence my comment.
> At that point I don’t think it’s having or not having root access that is the issue.
That’s the most naive thing I’ve seen said all week.
My coffee grinder won't turn on without the lid locked in place. Is that anti consumer?
It's about owning your hardware, not safety. A person that's willing to go through the hassle knows the consequences of such actions and how to deal with them.
Do "normal people" need to do that? Absolutely not. Should it be easy to do that? Absolutely not. But for those of us that really want to own our hardware, there should be a way of doing so without relying on exploits.
As far as I'm concerned, I actually read the popups and having to click okay about five or six times in a row would make me second-guess my decision. Would that work for everyone? Most of the people? Some of the people? I don't know that answer.
> I'm not even sure if such a barrier should be technological or legal.
My answer would be both. I highly doubt it's in hardware manufacturer's interest to figure out a technological solution, but if there's some legal incentive for them to at least try, they'll figure out a technological solution.
Looking at recent Samsung devices, is Google Services Framework really that integral to the security of my device that I must be forbidden from disabling that package? Isn't there an alternative way to achieve a comparable level of security, but without slurping up my personal data?
The consequence of security does not have to be a complete loss of control, nor the inability to prevent in a practical way the collection of our personal data.
Not to mention the whole security argument falls apart when perfectly fine Android devices are left without security updates 2-3 years after purchase.
I’m still on the fence about whether that justifies their protocols. I think I actually lean toward “no”, but I’ve also lately become keenly aware of the difficulty of even simple things like keeping everything up to date, and my lack of real insight into what those updates include. If I’m effectively trusting them anyway, might as well trust them to get it to me ASAP, right?
I’m also enough of a realist to assume there’s a Fight Club style “A times B times C > X” reputational/financial risk logic going on here. If there’s few enough of the devices out there, it’s probably cheaper to apologize (legally, as in settle).
They create products, which they offer for sale. People can freely choose to purchase those products or not.
Apple has opinions about how to make products, which are embodied in the products they offer for sale. Other companies have different opinions. This is how a market is supposed to work.
I don’t think we should talk about Apple as if they are a government taking away freedoms. It confers too much authority upon Apple and too much victimhood upon customers.
They patently did contribute to the erosion of freedoms that people fundamentally used to have with their hardware.
We shouldn't be talking about Apple like a government, but the government should probably be regulating this a bit better;
And the problem with a single signature authority, as we're seeing in China, is being murdered by an illicit state, or undergoing active discrimination in many other ways even in most western countries.
It's like saying "Why should we have knives? It's only a matter of time until $popular_social_media comes along and tells people to cut off their index fingers and before long there's a significant proportion of users who can't point anymore".
That's not the case for smartphone (etc) users.
If a knive could be built which allows to cut food, and protects you from cutting off your index finger, wouldn't that be great?
Most users will leave the default settings if they don't have an active need to change them. Easily usable (and understandable) tools and interfaces prevent most needs from arising in the first place.
Concrete example: The root account on many Linux distros is disabled by default. I've never felt the need to enable it, because sudo does everything I need. Secure default, useful tools, unlockable system.
Historically we haven't had either of those things. Poor design and implementation led to bad choices by clueless users. The resulting mess is used as an excuse to restrict freedoms. The cure is arguably worse than the poison.
Now what? Millions of users have to wipe and restore their phones or throw them away and buy new ones because someone's app trashed the phone? That would cripple Apple
That's not the point. The point is that the community will be able to do it and auditors' lives will be much easier, which benefits everyone because it vastly increases the likelihood of an issue being found.
> The idea that ROMs from questionable sources make your device safer sounds very strange to me.
On Android by default most vendors ship a lot of bloatware and have demonstrated almost infinite incompetence or malice of both. While the developers "custom ROMs from questionable sources" (XDA forum threads) may not be experts in their fields at all and are quite likely to misconfigure the software possible creating some new holes, at least those images are compiled from open sources and are not the terrible manufacturer OS (I wouldn't onlike bank on stock Xiaomi software).
The first step on Android is usually to unlock the device boot loader in order to flash a recovery that will allow to erase partitions and install a tarball of the system. I saw no tutorial suggesting to re-lock the device boot and I bet people rarely do it.
This means anyone can take the device, boot it into recovery, plug it into USB and throw some adb/fastboot commands to do anything they want. Device encryption becomes moot because neither the recovery nor the bootloader can be trusted.
The exact same goes for regular computers and operating systems. And we still have those. Shouldn't we at least have the option on mobile?
You have computer form factors and OS'es invented in the 80's and 90s for desktop. The only reason they still work that way is because of legacy/inertia.
The exception is the ChromeBook and CromeOS and that works similar to a smartphone. For a reason.
The general population uses macOS just fine.
Which is neither here nor there. Parent doesn't mean a smartphone doesn't have the cpu power etc. of being a general purpose computing, he says it is not one.
People were justifying locked down smartphones by saying they're not GP computers.
Factually, if they were open, they could be GP computers. The only reason they aren't is because they are locked in the first place! That justification for locking phones is based on a consequence of them being locked, so it doesn't make sense.
That's the difference it makes.
"It's not a computer" by that I mean "I don't want it to be a computer" in the sense that if it had the complexity/risk of a PC I wouldn't buy it in the first place.
That Apple and Google have taken that from the user is unfortunate and I think there's not much of a case to be made against that. All you've been saying so far boils down to: you don't want an open phone, and because Apple and Google have coincidentally made the same choice for their customers this kind of paternalism is fine by you. Kind of a short sighted position, no?
On the other hand I bought my dad a laptop with Windows and despite having an antivirus he's had all kinds of problems with it, including some heavy duty adware.
Provide the password for elevation and educate to only type that in when they are installing something they know is secure. Likely they will forget the password and have to check with their "IT helper" anyway, and sanity check there actions then.
I have a Windows 7 machine setup like this for my parents and they have never had a problem with malware. The stuff that lives in the user profile gets caught by AV, and I have to install something for them maybe twice a year.
I would rather put in a little extra work setting up a Windows laptop than send metrics for the entire system to Google. Their Android phones take care of that invasion of privacy.
Or I could get them to buy something far cheaper that's already secure, rather than having to learn how to admin an OS that I have had no need to use for nearly 20 years.
> check with their "IT helper"
The whole point is to avoid being an "IT Helper", otherwise I'd just give them an ubuntu laptop.
> The stuff that lives in the user profile gets caught by AV,
Audio video?
Before the"locked devices, people had the inverse problem:
everything was two open ended and complicated, could cripple the system, stuff was open for exploit (much more so than in this case of unpatched vulnerability, viruses were everyday occurence). Techies didn't have this issue, but the general public did (heck, even techies did suffer somewhat). And that might have been OK for when the PC was an unconnected tool, but not when everybody has one with them, from school to nursing home, and everybody buys and does tons of sensitive stuff from it, while connected 24/7.
Whereas you can give a 2-year old an iPad, and they can start using it just fine...
What makes you think that if Apple would provide a mechanism in iOS, like SIP (System Integrity Protection) on macOS which can be disabled by technical users if needed, would change anything?
Right now, regular users do not disable SIP on macOS so there's no issue there. They don't even know/care that this possibility exists. So your 2 year old could still use the same iPad just fine.
Back in ‘the old days’ (80s+90s), a child with access to a computer was likely to learn something, even if their primary use of it was playing games.
Every been to the modern web? Or used 90s-00s shareware?
Compared to those, the iPad is advertising and nagging free...
And can be totally free, you don't have to buy (a) adware apps, or (b) games with in-app-purchases.
I only get stuff that's in neither category, which all the best apps are...
That's because this new devices aren't "secure" but severely limited and crippled, you can't do much with them and they are far from actually usable like a computer. By that metric, my old Nokia was even more secured than an iPhone.
That's the whole point: for them to not be as open ended and complex as computers, while having the power to run highly feature-full apps.
>By that metric, my old Nokia was even more secured than an iPhone.
It indeed was, and that's the ideal. To make extremely feature full modern smartphones as easy to use and as complexity/trouble-free as appliances...
Maybe on Windows, but on macOS this has never been generally a problem.
Your AT&T, Vodafone, Verizon & Co, put an enormous amount of pressure on Apple to limit and protect device unlocking.
This is a cat & mouse situation where either party might benefit from tight unlocking controls.
For example, MVNOs benefit from manufacturers with flexible and open unlocking policies that make it easy to unlock devices (without approval from the original operator), whereas long-term commitment contracts with traditional operators want to make it as hard as possible for you to leave with an unlocked device (regardless of whether you are legally entitled to or not - but that's a different story).
The economics of whether Apple would benefit from less strict unlocking policies (ignoring Telco's wishes) are not that clear.
You might think that unlocked devices would have longer lives, and therefore limit Apple's ability to push a new one to you, but you could also say that giving phones 2 or 3 different owners in their lifespans could help with app store purchases, limiting jailbreaking and possibly avoiding going with a newer less expensive android version.
Disclaimer: We unlock phones for MVNOs and individuals who get bullied around by their telcos.
Edit: Spelling
Lock restrictions only come into play if you want the mobile network to subsidize your phone.
Each country has different policies when it comes to unlocking. Locked phones greatly outnumber unlocked ones.
Take Chile, where phones must be legally unlocked by the telco or manufacturer to work WITHIN other operators in the country, but not necessarily abroad.
Buy an "unlocked" phone from a Chilean and you might get stuck with a brick.
The different and complex type of unlocking levels Apple has for its devices (and there are many) are designed to assist the Telco and any countrywide regulatory policies that need to be enforced.
There are many parts to this jigsaw puzzle.
Here in the France the telco are compelled by law to fully unlock any phone bound to their network 6 months after the purchase (or earlier if initial contract duration was lower than 6 month).
Apple comply gracefully to this law.
Apple does not consider phones devices for general computing and so prioritises stability, power consumption and security over flexibility and the ability to run arbitrary code. I'm happy with that trade-off.
The proposition, in my mind, that Apple is trying to sell with the iPad to the majority of people who use their computers for social media, content consumption, and office tasks like email and Word document authoring is "you don't need general computing flexibility for the vast majority of things that you do".
Could you give your definition of 'general computing'?
As for the "We do not control our own devices, we cannot stop certain processes on them, and we do not know where our personal data is sent.", with stock Android provided by an OEM, you have no control over the opaque and invasive monolith that is Google Play Services and there's no way to control what data exits your device, aside from installing a VPN-based firewall. You can't even control when apps have access to your data, just a binary on/off switch.
> with stock Android provided by an OEM, you have no control over the opaque and invasive monolith that is Google Play Services and there's no way to control what data exits your device, aside from installing a VPN-based firewall.
This is true of all systems (and even worse on iOS, which has the same data collection as Play Services but can't be disabled or avoided) and irrelevant to the discussion about whether a user can completely control their device if they wish.
I don’t think those flashed ROMs give you appreciably more “control” over your iPhone than stock iOS provides, because actual control requires usable control surfaces. More likely, you are replacing the control surfaces provided by an accountable entity (Apple) who has prioritized your security and privacy and provides a constant stream of updates to maintain that, with what exactly?
The entire iOS feature set is designed to protect your personal data, from outside attackers who would seek to compromise it, to insider threats like apps trying to siphon off more than you might expect, to end-users inadvertently giving away their own (or your) data without a care in the world.
The security that a modern iPhone provides to its owner is truly a remarkable and commendable experience overall. I am extremely happy we as consumers have the choice to purchase exactly such a device.
I mostly agree with you, but you don't necessarily need a Mac in order to use your developer account for sideloading—you can also use Cydia Impactor which is available for Windows/Linux.
That's what your comment boils down to. You really want to go down that road of an argument? On a website that has hacker culture in its very name?
Sure, for an extra $100 every single year. Apple charging money for a feature does not protect users.
Or you can get a free dev account, but the feature set it more limited and signatures are only good for 7 days.
Apple charges money for features so that they remain in business to keep making more features, and security updates too. So it is, in fact, exactly how they protect users.
And again, how does that restriction protect users? As I see it, it's entirely user-hostile: it ensures any self-created apps aren't really usable.
If the limit was significantly longer, I would mostly shut up about all of this.
Apple does not allow dictionary apps on the App Store which actually use the word definitions built into iOS—they are required to provide their own definitions, which either take up precious storage space or are not available offline.
So, I found some old WTFPL-licensed code on Github, spent an hour or so futzing around to make it compile and look pretty on iOS 12 (because I had no clue what I was doing), and came up with this: https://github.com/Wowfunhappy/Dictionary. It works super well, and I use it every day on my phone.
The only reason I can use this app is because I'm Jailbroken.
• Install a Userscript to de-AMP pages in Google search results.
• Prevent Apple News from saving a history of what articles I read, thus disabling their recommendation engine and preventing a filter bubble.
• Add an extra row of app icons to my homescreen, so I can fit all my apps on one page.
• Get a warning when I set an alarm for PM rather than AM.
...and countless other little things.
Separately, I consider $100 an awful lot of money, especially for a subscription, which I try really hard to keep out of my life.
But now you say they have to buy a Mac and pay $100/year. Well, that's a no for that little initial change, so now they never get started to begin with.
Demanding all software be free is also demanding the end to freedom. People want iOS to be more open because of the incredible value of iOS. Not because there’s an equivalent free alternative at hand they simply didn’t notice.
> Darwin/XNU is libre software, so it's a contradiction to make people pay for the right to program.
This does not make logical sense? That other free software exists is not an argument that all software must be free. Apple has a business model which increasingly relies on selling services and licenses on iOS over selling new hardware. That’s their choice for how to fund their operations, which I’m very happy that they are free to make!
Being forced to make all my code freely available would be an appalling restriction on my own personal freedom. Not to diminish the brutal history of slavery, but what gives someone the right to free access to my work?
That Apple's investment of billions into the ecosystem is not an argument I see valid, given the alternatives.
>all software must be free.
Heavens, that's not what I'm saying. I find it contradictory that Apple have open sourced an entire operating system and an entire kernel, and are kvetching over a mere privilege to begin approaching a distro of their OS. I'm not fighting the freedom fight, I'm in awe of the bait-and-switch they're employing.
Apple's App Store earns developers something like 50%+ more revenue than equivalent apps on Android. No small part of that is due to the ease of piracy on Android.
I do not see any contradiction, nor any "bait-and-switch". The operating system and a kernel are not the services engine which keeps their company running. Open sourcing that code doesn't imperil their primary revenue streams.
Granted the worldwide open source community has had and has nearly zero interest in making a darwin distro with a minimalistic tiling window manager, or anything similar. Yet I see gnu/linux developers create dozens of linux distros and dozens of functionally identical window managers. So much for side-rant.
The $99 is not likely to make them money. It is a token fee to protect the app store from the simplest spam and scam apps.
The argument was users should have the ability to run whatever code they want on their iPhones. That is actually possible today.
It costs a $100/year, which considering the costs of the phones is pretty reasonable. Part of the reason it has to cost something non-trivial is because otherwise it would encourage massive piracy, which would devalue the entire App Store (in fact exactly what we see on Android).
If the argument is users should be able to run whatever code they want, but they also must have free access to the development tools and resources like Xcode and Dev Center (which cost how many tens or hundreds of millions to develop?) then you’ve totally lost me.
I understand and appreciate the principle that it should generally be possible to develop and run the programs of your choosing on smartphone-type hardware. In no way should a company be forced to spends millions of dollars to facilitate that at scale if that’s not their business model, particularly when it would primarily be used to directly attack their ecosystem.
Technically possible, fine. But there's a big gulf between "possible" and "not extremely painful".
Let's say I create a personal fork of the open source Bitwarden password manager, to add some trivial quirk that makes the software better fit my life. How do you propose I actually use my custom version without paying Apple an extra $100 per year?
Every 7 days, my version of the app will suddenly refuse to launch, until I get back to my computer and re-sign it. I would need to create a weekly calendar reminder, and never go on vacation without a computer nearby. Oh, and I'd better not have more than three of these forks, because that's another limitation for free accounts.
The 7 day limit is not Apple refusing to provide "free access to the development tools", it's an artificial restriction explicitly created to make running un-blessed code impractical for more than rudimentary testing.
The free account is good for playing around with the environment and learning how to write code for iOS. It is not well suited for running production software on your phone. If you want to run production software on your phone, blessed or unblessed, you probably want to pay Apple $100/yr for the longer duration and higher app limit.
In my opinion, if you could do what you wanted for free, it would contribute massively to app piracy, and devalue the work of millions of developers on the App Store. $100/year is at about the right level to dissuade most people from circumventing the App Store (the average Apple user spends ~$75/year on the App Store).
> ...it's an artificial restriction explicitly created to make running un-blessed code impractical for more than rudimentary testing.
Crucially, paying Apple $100/year does not mean they ever see or have to bless code you deploy to your own devices. It just removes the limits in the development environment!
But, I also fundamentally believe we shouldn't be restricting user freedoms to protect copyright.
$100 a year is completely and utterly cost-prohibitive for a lot of people, even within the context of someone who already owns an iPhone. A lot of children begin coding so they can create something for themselves, or change one thing in an application. With a 7-day limit, who would want to do that? While it's true that free accounts can technically experiment with coding, there's not much incentive when you can't really _use_ anything you've created.
I worry about a generation of children who is given iPads rather than computers. Sure, most of them would never have touched code anyway, and that's fine. But iOS completely removes the incentive to learn and explore—to actually hack and tweak and create the tools we use everyday, instead of blindly consuming them.
I’m pretty sure they said the same thing about shells when GUI came along.
> But iOS completely removes the incentive to learn and explore...
I guess I just have an entirely different perspective on this. If the PC was a bicycle for the mind, what we have now is a veritable rocket ship. Consider the devices, peripherals, platforms, APIs, connectivity, distribution, and tooling that is available today for anyone with any interest in creative artistic expression, be it coding, non-textual programming, or otherwise...
Anyone with a inventive flair is going to look at the mind-bogglingly advanced technology that a billion people are carrying around and just salivate at the opportunity that provides.
Modern devices and the modern Internet may placate the masses, but they are likewise catnip and catapult for anyone who wants to code the next great solution for Problem X.
It's a legitimate point to make, but it should rather be that we talk about the content of the article rather than bring out the 'Apple's taking our freedom away' soapbox.
It inevitably turns into a debate between one side who values personal freedoms but won't be told to buy Android phones widespread safety, security, and privacy and tell the others to just buy Android phones.
This goes around and around, usually getting nobody anywhere, and happens all over again the next time an article about iOS turns up on the front page.
The average consumer could care less. They want to make phone calls, send text messages (over iMessage), surf Facebook, and take back to school pictures of their kids - and they just want it to work.
Of course people don't care more about iPhones than their own kids. Pick just about any X and people don't care more about X than their own kids.
That doesn't mean X doesn't matter, or people wouldn't care more about it if the understood it better, or wouldn't be better off if it was different, or that we shouldn't try to do something about it.
And if you're talking about a poll where you ask people whether they would like to have a larger selection of apps for their phone, or they think it should be easier for small developers to enter the market, or they think Google should have more control over their phone than they do, the majority of people are not going to choose less apps and less freedom at the same price.
The fact that you have to put it against dollars to get them to do what you want is just leveraging the fact that the median user is not rich to claim that nobody wants something that everybody wants because everybody also wants to save money (and the implication that the median person values it at less than a penny is hyperbole). Why should you have to pay extra for freedom? Should only the rich have it?
You're presuming that the average consumer is uninformed, which I can understand, but it's not true in my experience. Most people I know are well aware that they're in a pickle.
A security regression in a new software release is a much older type of story that just gets talked in circles too.
>it should rather be that we talk about the content of the article
iPhones are jailbreakable again. Whoop-de-doo. What are we supposed to say about it?
Might as well talk about the system design that makes owners of devices getting root on them considered a flaw in the first place.
It's common for the security argument to be used to justify Apple's practices, but Mac users have been perfectly fine installing third party apps such as Transmit, Adobe Photoshop, or even Google Chrome from outside of Apple's walled garden. I've been using macOS since 2007 and I've never had a virus or any security problem, nor anyone else I know using a Mac. From my dev colleagues to my 70 year old mother in law or my 15 year old nephew.
It seems to me the only real arguments for Apple's walled garden are economical.
MacOS used to be a more developer friendly.
If you argue that the 86% is the case on certain demographics, then the same can be argued about macOS.
My prediction: If Apple opened the garden, even for a 'developer only' mode, I would imagine unregulated app stores would go up overnight, with wikihow articles on how to enable and install them, followed by a large amount of the technically illiterate (speaking from experience) trying to get free games, or 'add new emojis'. Users can't be trusted, and if consumer desktop operating systems were designed today, they wouldn't have the freedom they currently have.
[1]: https://gs.statcounter.com/os-market-share/desktop/united-st... (Not entirely sure on the accuracy/gathering of this data, but it had the easy filtering and seems to line up with both of our data points)
I agree some people would do it... but I doubt it would be such a large number. Do you have any data about this?
Users can already do that in Windows, macOS, and Android. From my anecdotal experience very few do it.
No, nothing more than anecdotal. But I'd argue 'some people' when you're operating on the scale of the hundreds of millions-billions that Apple operates at, would still be hundreds of thousands of support requests from users who have inadvertently made their phone unusable (using some jailbreak tweaks as a reference) to extremely annoying (referencing many android apps that abuse push notifications for advertising).
> Users can already do that in Windows, macOS, and Android. From my anecdotal experience very few do it.
I used to work IT for a school system, and I had an entirely different experience. Teachers would occasionally ask for help with their personal laptops (without our AD) and they were near universally a minefield of toolbars and adware. There's obviously some self-selection in there, but if the 5% of teachers couldn't handle a computer responsibly, that would be a big problem for Apple if they added more ways for users to screw themselves.
Of course, all this is anecdotal, so I'm not expecting this conversation to really convert either of us.
But yeah, without any solid data we will both stick to our anecdotal experiences.
Adding this kind of non regression test is costly, but it protects against source code management mistakes.
You mean the answer could be "yes, every single patch must have a regression test"?
Seems a bit overblown when there's a review process in place. I'm sure it's not infallible, but still..
For iOS 9.3.3 there even was an app in the App Store, that could jailbreak your phone. (PG Client)
Why should a publicly known unpatched vulnerability be a lesser concern than something that you don't know exists?
Well, until now I assumed Apple would test for patched vulnerabilities in new iOS releases too.
And even if you assume a publicly traded company lying outright, what do you think is more likely: then silently backdooring the phones of people in Hongkong or pretending to have accidentally unpatched a vulnerability, hoping people would update to that OS in order for pretty obvious exploits being able to run?
If I was as evil as you make Apple out to be I would sure as hell do the former.
Any number of backdoors can be introduced with any update for any operating system or app. Generally governments around the world want backdoors and information from companies and companies generally comply.
We know HKers are getting more and more tracking from the mainland government and are switching to applications not typically used for communication and organization. https://www.businessinsider.com/hong-kong-youth-using-tinder...
We also know that Apple has accommodated Chinese government requests to increase their ability to monitor communications: https://boingboing.net/2018/05/21/apple-bends-to-chinese-gov...
And as one of the most valuable companies in the world that ships software, it is surprising to see regressions in their software.
The article said that right now legitimate applications on the App Store could contain jailbreak code.
Of course these things are entirely possible to be unrelated, which is why I mentioned the tongue in cheek “tinfoil hat”.
The timeliness of the response from Apple in patching this reintroduced vulnerability should be swift. If so, I’m happy to step away from this position entirely.
Here's to hoping that, now that this happened, someone will give this idea another consideration...
(P.S. for those wondering: apparently this is CVE-2019-8605: https://bugs.chromium.org/p/project-zero/issues/detail?id=18...)
But regardless, that's already 3 months people had to design, write, test, and perfect an exploit for it...
If you want to make your point, this is one of the worst examples you can take as it is an old exploit, which has been patched and now works again. The code should be in the public after the patch anyway if a researcher found it.
Huh? Am I misreading the timeline? iOS 12.3 was released May 13, and I see the view restriction removed (Label:-Restrict-View-Commit) on May 20... which is almost exactly 3 months ago: https://bugs.chromium.org/p/project-zero/issues/detail?id=18... https://support.apple.com/en-us/HT210118