HHad3

The application looks and feels nice, but the per-device pricing/licensing model seems severely outdated to me. I will not make a purchase unless named licenses, which enable me to use the application on all devices and operating systems I use (with reasonable limits if DRM is needed for some reason), are available.

I am wondering whether there is a management issue at Hex-Rays. The newly released company website features a page which appears to advertise against the product [1], because it entirely misses who their audience is.

The core point made regarding why IDA is a superior product despite license unfairness is vendor support. However, the authors seem to miss that the target audience of IDA are tinkerers, who would be fine with fixing their own tools as long as the issues are only on the surface.

Hex-Rays is not Oracle, who can afford to live from license unfairness because their product is embedded deeply into the livelihood of so many large companies. Hex-Rays provides just a tool, which I have already replaced by Cutter with Radare2 and Ghidra's decompiler in my workflow.

I would not use IDA Home even if it was free due to its limitations and lack of Hex-Rays' Decompiler.

[1] https://www.hex-rays.com/products/ida/compelling-reasons-to-...

Careful though, and read the datasheet first! AM4, for example, uses 1.8V SPI flash chips. Connecting them to Raspberry Pi directly will at the very least fry the chip, if not the whole board.

Apple's WiFi password sharing system uses iCloud Keychain, which is end-to-end encrypted [1]

[1] https://support.apple.com/en-us/HT202303

In addition to the points already mentioned, a good bit of Apple's software depends on Intel-proprietary features, e.g. QuickSync for video encoding. So far, no macOS system ever shipped with an AMD CPU, and porting the OS and user-mode application stack is not trivial.

- The administrator can enforce use of hardware-backed keys [1]

- U2F Tokens cost $8-$25 and are significantly cheaper than full-blown Yubikeys

- U2F Tokens do not have a key limit, which enables using a unique public key per server for privacy/anonymity

[1] https://github.com/openssh/openssh-portable/blob/master/PROT...

Apple maintains a separate document on how individual content is encrypted [1].

Note that it is not apparent whether some of data listed under "end-to-end encrypted" is also included with iCloud Backups.

[1] https://support.apple.com/en-us/HT202303

Indeed! Color me surprised.

I have tried to reproduce the issue and found that even though you can create provisioning profiles for direct distribution with the Network Extension entitlement, and the UI shows that all is fine, the provisioning profile does NOT contain the required entitlement.

After some digging I found a FAQ on network extensions by Apple [1]. Point #8 clearly says:

> #8 — On the Mac, can Developer ID apps host Network Extension providers?

> Currently this is not possible; only Mac App Store apps can host Network Extension providers.

Thus the missing entitlement is most likely not a bug (and the cert UI is just bad). This is not a technical limitation, just Apple with questionable politics.

[1] https://forums.developer.apple.com/thread/67613

The documentation mentions that an entitlement is required. However, this only implies that an Apple account is needed and the yearly dev fee is to be paid. Entitlements work outside of the App Store too.

Personally I'm happy to see WireGuard in the App Store, but would be concerned if Apple indeed limits the API to it. Could you elaborate on if distribution outside of the App Store is impossible?

When the author pointed out that bitcode may impact security, I expected to read about how compiler optimizations that happen during compilation of LLVM IR to machine language may introduce security issues.

However, the article only mentioned that decompilation is easier with LLVM IR, because it is a more high-level language. It certainly is a valid point, but addresses the topic of binary obfuscation instead for algorithmic security.

I'm thus wondering if anyone can shed some light on the real security aspects. For example, let's say that I compile C that is supposed to run in constant time to LLVM IR and submit it to Apple. Does Apple guarantee that their blackbox optimizations do not introduce branches or other factors that may result in variable timing into a constant time algorithm? Can I do anything to ensure that my code will always run in constant time despite unknown optimizations being applied to it in the future?

Correct, Windows does not have per-application identities that could be used with a keychain service. Furthermore, every application in your Windows session (unless sandboxed) has access to virtual memory of other applications in the same session.

On macOS, applications address spaces are isolated and code signing certificates are used for identifying application requests to the keychain.

Safari never shipped with Flash to begin with, and Apple has regularly published metadata updates, which blacklisted old, insecure versions of flash that the user might have had installed.

I think that the price is fair: Apple's Automator, even shell scripts with the OS-supplied "open" command, provide significantly more functionality for quickly setting up a workspace. This tool's worth is the convenience of not having to write such an automator/shell script by hand.