Hacker News Reader

Comment by cancerSpreads | Hacker News Reader

Bookmarked for anytime someone tells me Apple products are secure.

Marketing doesn't line up with reality.

Not that those who parrot the marketing would be convinced with evidence.

So according to this article those of us on iOS 13.x (93% of the installed base) used to have one vulnerability, which we got patched through auto-updates 8 months ago. I'm quaking in my boots.

I hope you remember to point out the historical nature of this when you pass on the link.

In fairness, the question is less "how many vulns does this exact device have so far" and more "how many vulns are likely to occur for this device total", in which case this article could be evidence that the last few versions of iOS have each had their share, and therefore it is reasonable to extrapolate that to expect a handful of issues on this version. Now the first obvious catch is that you can't necessarily accurately project the past into the future; if most of these are the result of some underlying design strategy that Apple has stopped doing, then the exploits would dry up. On the other hand, of course, they could start shipping some new technology that turns out to introduce more vulns (not likely, but it could happen).

Of course, I'm pretty sure the same list of exploits per-version of Android would be much longer, so if anything this list, if complete, really does paint iOS in a very good light.

Hope you also tell people who use Android about the dismal state of updates (actually the lack of it) from most manufacturers and how most new phones come with older versions with security vulnerabilities not patched on that device (and probably will never be patched).

It seems like marketing exactly lines up with reality. Security is relative, and compared to the alternatives, iOS is indeed secure.

At least you are guaranteed security patches in a timely manner.

I want to run open source software, but this is the show stopper

I wonder what the difference is in pricing on the 0 day market. I think iOS was always more expensive until last year

When I had my Samsung Galaxy device it used to get a security update like once or twice a year, and usually it was not even available for my phone until my carrier allowed it a couple weeks later. That was a 800€ device too. It's absurd

No need, the security updates list already provides plenty of CVEs examples caused by memory corruption issues.

No software is completely secure, and even the most junior developer operates under that assumption. Therefore everything is relative.

Do you really think the Android list would be shorter, or less consequential?

Which is likely the hidden purpose of projectzero

Reply on news.ycombinator.com