Hacker News Reader

Comment by teaearlgraycold | Hacker News Reader

Apple built iOS with the assumption that apps can’t use JIT. They can migrate to a new set of constraints, but I’m sure they’re right that right now it’s necessary for security. It could take a while to patch all of the security holes from opening up JIT.

View on HN

How does MacOS survive attacks while supporting JIT and a subsystem for running iOS/iPadOS apps?

It’s a different operating system.

https://en.wikipedia.org/wiki/Darwin_(operating_system)

  Darwin is the core Unix-like operating system of macOS (previously OS X and Mac OS X), iOS, watchOS, tvOS, iPadOS, audioOS, visionOS, and bridgeOS. It previously existed as an independent open-source operating system, first released by Apple Inc. in 2000. It is composed of code derived from NeXTSTEP, FreeBSD, other BSD operating systems, Mach, and other free software projects' code, as well as code developed by Apple.

I’m aware. They’re still different.

Kernel is largely what matters here

So somehow they managed to create shittier system despite having 30 years of OS building behind their belt is what you’re saying?

“Shittier” Is your word, not anyone else’s. Can you really not relate this to any experience you’ve had developing anything?

Different goals? Different system gets built. Different trade-offs. This isn’t hard to understand. You’re being overly harsh for ideological reasons.

You are arguing about resources of a company that has an endless amount of it. The limitations mentioned could be changed/"fixed" with no time and effort.

> Different goals? Different system gets built. Different trade-offs. This isn’t hard to understand. You’re being overly harsh for ideological reasons.

Poor Apple with its virtually unlimited resources. Somehow Google, Microsoft, Linux and Apple themselves managed to make it work with JIT, but Apple can’t do it.

Can you teach me how it’s meaningfully different in terms of securely running a JIT compiler? What components should I be learning about?

The no JIT rule is just a rule enforced through the app store review process, so it's not going to part of the security architecture. It could of make some static analysis fail, but there are plenty of ways to do that.

I doubt that's true because it goes against every modern OS security practice. Apple heavily practices defense-in-depth. Sandboxing, PAC, AMFID, etc. All those are even more onerous than Android. So no, giving away JIT privs wouldn't do much.

EDIT: What's with the downvoting?

My understanding comes from what jailbreakers say about the OS, what Apple says, as well as time spent working at Android where people that know what they’re talking about told me about iOS security.

Your misunderstanding comes from a group of misinformed individuals than. Or you've made them up.

Either way, you're wrong.

>Either way, you're wrong.

This claim is based on what expertise?

There are about a dozen other responders who agree with said assessment with technical reasonings embedded into their messages. Read those.

Suffice to say, I don't feel the need to rehash why the basic premise of "the OS wasn't built to handle JIT apps" is directly contradicted by it, you know, allowing JIT in all but one app.

If they offered something of a basic technical assessment or reasoning beyond "I know people", perhaps then I would bother to dig into some credentialed argument. So, in the same way it's not worth delving into "proving God doesn't exist", it's not worth proving how OP clearly has no idea what they're talking about. They bear the burden of their claims, not me.

Reply on news.ycombinator.com