Remember when Apple touted the security platform all-up and a short-time later we learned that an adversary could SMS you and pwn your phone without so much as a link to be clicked.
KSIMET: 2020, FORCEDENTRY: 2021, PWNYOURHOME, FINDMYPWN: 2022, BLASTPASS: 2023
Each time NSO had the next chain ready prior to patch.
I recall working at a lab a decade ago where we were touting full end-to-end exploit chain on the same day that the target product was announcing full end-to-end encryption -- that we could bypass with a click.
It's worth doing (Apple patching) but a reminder that you are never safe from a determined adversary.
I would happily pay Apple an annual subscription fee to run iOS N-1 with backported security fixes from iOS N, along with the ability to restore local data backups to supervised devices (which currently requires at least 2 devices, one for golden image capture and one for restore, i.e. "enterprise" use case).
GrapheneOS on Pixel and Pixel Tablet have been anomaly free, but Android tablet usability is about 20% of Apple iPad Pro.
I hate these lines. Like yes NSA or Mossad could easily pwn you if they want. Canelo Alvarez could also easily beat your ass. Is he worth spending time to defend against also?
Apple really need to open up so at very least 3rd parties can verify integrity of the system.
The real stinker with Liquid Glass has been macOS. You get a half-baked version of the design that barely even looks good and hurts usability.
> ... decade-old ...
> ... was exploited in the wild ...
> ... may have been part of an exploit chain....
There is evidence that some people were aware and exploiting it.
Apple was unaware until right now that it existed, thus is a 'zero day' meaning an exploit that the outside world knows about but they don't.
They don't appear there organically.
dyld has one principal author, who would 100% quit and go to the press if he was told (by who?) to insert a back door. The whole org is composed of the same basic people as would be working on Linux or something. Are you imagining a mass of people in suits who learned how to do systems programming at the institute for evil?
Additionally, do you work in tech? You don’t think bugs appear organically? You don’t think creative exploitation of bugs is a thing?
Of course no one can admit it publicly.
But it is something that governments are known to proactively do.
You can get dirt on people a la Jeffrey Epstein. And use that to coerce them.
Stuxnet was pretty impressive: https://en.wikipedia.org/wiki/Stuxnet
It was a complicated product that many people worked in order to develop and took advantage of many pre-existing vulnerabilities as well knowledge of complex and niche systems in order to work.
OTOH, how rational are spy agencies about such things?
But some just happen to work too well.
But governments do have blatant back doors in chips & software.
>I've heard rumors ...
So like, the comment you're replying to? This is just going in circles.
I don't know what "equally annoying" would be for a company and its customers. We need a law requiring companies open source their hardware within X days of end of life support.
And somehow make sure these are meaningful updates. Not feature parity with new hardware, but security parity when it can be provided by a software only update.
Otherwise a company in effect takes back the property, without compensation.