Hacker News Reader

Comment by mdeeks | Hacker News Reader

They have an answer to your last question in the FAQ

  When did you notify Apple?
  We disclosed our results to Apple on September 12, 2022 (408 days before public release).

View on HN

408 days and it still requires a user to enable via a debug menu? This is not a good security look from apple.

I don’t know why they make it an Apple problem. They claim their attack works on all browsers, and it doesn’t look like it’s fixed on any of them.

It only affects Apple processors. From the FAQ:

Yes (with a very high chance), if you have a device running macOS or iOS with Apple's A-series or M-series CPUs. This includes all recent iPhones and iPads, as well as Apple's laptops and desktops from 2020 and onwards.

The only reason why attack works on all browsers is because Apple force all browsers on their platform to use Webkit. This is why it's Apple problem.

That’s only true for the iOS related platforms. Nice old MacOS still lets you run any browser you want, including one you’ve developed yourself if you so wish.

It works on webkit. Firefox isn't affected on MacOS, but it is on iOS because apple forces the use of webkit there.

They added this FAQ point a couple minutes ago, that's why the existing comments didn't see it.

That wasn't on the page when I read it.

Good that they've added it. Disappointing to see that Apple has gone so long without releasing a fix.

Reply on news.ycombinator.com