Apple made it very clear that their security concerns related to third party browsing engines are about difficult-to-contain threats posed by JIT compilation. (JITs require non-text memory pages to be executable.) Apple doesn’t allow other apps to use such technology, so they’re consistent in that respect.
Apple even disables JIT for Safari itself when you put an iPhone in lockdown mode, at no small cost to performance, in an effort to harden the device even more.
That's just their excuse. Javascript is used on practically every web browser in existence, across billions of devices, and it does not have the security risks that Apple claims. It just doesn't. There are plenty of other flaws in their own web browser that have allowed remote code execution, but Javascript isn't typically one of them, in any browser, in any platform, in the last decade or more.
And there are plenty of apps in Apple's app store that are malicious. So the JIT excuse is just Applespeak for "we control what our competitors can do on hardware we supplied that someone bought and paid for". It's abuse and they are being sued by the DOJ. Just read the lawsuit so I don't have to reply to any more of your comments:
First, are you a security expert? If so, please provide your bona fides. Apple employs some of the brightest software and hardware security experts in the business. (Cellebrite can attest to this; they possess far fewer capabilities to crack iPhones than every other phone on the market.) If they perceive handling out JIT capabilities to apps as risky, I believe them. You, on the other hand, come with no evidence to the contrary other than a bare assertion.
Second, I already told you that there is no claim in the complaint that Apple is withholding Safari features in order to pad its apps business. If you believe otherwise, please provide relevant passages from the complaint.
Third, you’ve never had to reply to any of my comments. That’s on you.
>First, are you a security expert? If so, please provide your bona fides.
Nice goalpost move. I'm not playing that game with you.
>Apple employs some of the brightest software and hardware security experts in the business.
And yet Safari still gets hacked.
From the DOJ lawsuit:
16. Apple wraps itself in a cloak of privacy, security, and consumer preferences to
justify its anticompetitive conduct. Indeed, it spends billions on marketing and branding to
promote the self-serving premise that only Apple can safeguard consumers’ privacy and security
interests. Apple selectively compromises privacy and security interests when doing so is in
Apple’s own financial interest—such as degrading the security of text messages, offering
governments and certain companies the chance to access more private and secure versions of app
stores, or accepting billions of dollars each year for choosing Google as its default search engine
when more private options are available. In the end, Apple deploys privacy and security
justifications as an elastic shield that can stretch or contract to serve Apple’s financial and
business interests.
>If they perceive handling out JIT capabilities to apps as risky, I believe them. You, on the other hand, come with no evidence to the contrary other than a bare assertion.
You are influenced by the reality distortion field, that much is clear, no conversation can be had with a cult member. Have a nice day.
IAAL with experience interpreting Federal antitrust complaints. Allegation 16 is not a specific allegation that Apple deliberately withholds features from Safari in order to steer developers toward building apps. It’s a “narrative” paragraph that is intended to characterize Apple’s overall behavior. It alleges that Apple is self-serving, which, at the end of the day, isn’t really that surprising for an American business enterprise, and isn’t in itself unlawful.
> yet Safari still gets hacked
Talk about moving goalposts.
Every browser to date has had security vulnerabilities, and all the major vendors respond to close them when found to impact customers. Expecting Apple—or any developer for that matter—to have a perfect track record is unrealistic. Moreover, a large part of improving overall security is defense in depth, and it’s unreasonable to expect a vendor obsessed with security on its customers’ behalf to intentionally disable one of its defenses if it’s a known vulnerability vector.
I’m not a member of some Apple cult. There are plenty of things I don’t like about Apple; and no company is perfect. At any rate, name-calling one’s opponents isn’t allowed here, and when a discussion stoops to that nadir, I’m out. I’ll let the reader decide who has the better argument.
>IAAL with experience interpreting Federal antitrust complaints
If so, please provide your bona fides. But you won't.
>Apple employs some of the brightest software and hardware security experts in the business.
16. Apple wraps itself in a cloak of privacy, security, and consumer preferences to justify its anticompetitive conduct. Indeed, it spends billions on marketing and branding to promote the self-serving premise that only Apple can safeguard consumers’ privacy and security interests.
I provided the section of the DOJ lawsuit that states that Apple's portrayal of their security stance is nothing more than posturing and anti-competitive. You seem to think Apple are the absolute best in security, but they aren't even close to that. I don't believe that you are a lawyer and more than you believe that I am a security expert.
> You seem to think Apple are the absolute best in security, but they aren't even close to that.
Repeating this opinion ad nauseum doesn’t make it any more true. I already provided Cellebrite as evidence; where’s yours? (No, the fact that security vulnerabilities continue to be filed will not suffice. Security is best judged by the scope of and injury caused by successful exploits.)
> If so, please provide your bona fides. But you won't.
Happy to call your bluff. Send me an email and I’ll send you my California Bar license. otterley at otterley dot org
That’s not the law, and never has been. Devices are combinations of hardware and software. The fact that a device maker allows you to install software subject to limitations is a privilege, not a right. Some device makers, like automobile and medical device manufacturers, often give you no such privileges at all.
Nevertheless, you’re entitled to your belief, which is really at the core of all this discussion. Fine, just say that. But to take that desire and gin up some conspiracy about how Apple is intentionally crippling the browser just to pad its apps business is a bridge too far. You don’t need a villain. Your desire is enough.
Yes. Safari is a less secure browser than Chrome, architecturally. Took far longer to ship sandboxing. Still hasn't fixed SLAP and FLOP. Still hasn't shipped proper site isolation. Takes far longer to fix reported vulnerabilities, and consistently "fixes" them superficially and incorrectly, requiring another fix.
Enough with the Apple fanboy paternalism. They don't need absolute control "for users' sake". They're not entitled to it.
> Still hasn't fixed SLAP and FLOP. Still hasn't shipped proper site isolation.
Those are interesting facts, but are ultimately a red herring. How will enabling JIT for other browser engines, absent the detailed vetting Apple is requiring to provide a Web Browser Engine entitlement, yield a more secure outcome?
> Enough with the Apple fanboy paternalism. They don't need absolute control "for users' sake". They're not entitled to it.
You are, of course, welcome to choose an alternative. If you prefer Android, by all means, use it!
The "vetting" is irrelevant because the other engines will continue to not exist. By design.
I am currently forced to use a less secure browser due to Apple's restrictions, which invalidates your original claim. Your skillful dodging of that point is why it's so frustrating to have any conversation about Apple. There really are cult-like aspects.
The form of questioning is intentional. The person I was responding to claimed they were “forced” to do use a “less secure” browser despite the existence of alternatives like Android. I’m awaiting further details, but anticipate none: most of these conversations boil down to an admission such as, “I’m not really forced to do anything; I just want Apple to let me have my cake and eat it, too” — all while discounting the risks it could impose since they shamelessly believe they know better than the domain experts.
You completely missed the clues, so I informed you of the context.
>The person I was responding to claimed they were “forced” to do use a “less secure” browser despite the existence of alternatives like Android.
Now you're being disingenuous. So now you seem to think that Android has the best security people? Before you said it was Apple.
But then you keep trying to boost Apple, when they are the tyrants, and they are the ones being sued by the DOJ - notice how Google is not being sued by the DOJ for anything they did with Android? Just Apple for what they are doing with iOS and their app store.
I’m not contending that Android is more secure than iOS. They’re both improving security all the time. Lessons learned result in improving the battlements.
But that’s not the point here. The point is that the person said they were “forced” to use a “less secure” browser without explanation. “Forced” suggests there are no alternatives, yet there is one. “Forced” and “less convenient for me” are not synonyms.
> notice how Google is not being sued by the DOJ for anything they did with Android? Just Apple for what they are doing with iOS and their app store.
The antitrust suit is not, as you falsely claimed, about intentionally impeding Safari for their selfish benefit. The DOJ made no specific allegation to that effect. (They have outstanding lawyers and would not have omitted that if they had a shred of evidence that it was true.) It’s about Apple insisting on the App Store as the sole distribution channel for third party apps, with particular focus on the size of their cut, and about integration with third-party devices. And besides, at this stage, they’re still allegations—claims that are still subject to judicial scrutiny. The full story has yet to come out.
As with most things, it’s about who keeps the money. Epic Games would never have sued Apple if its cut was 10% instead of 30%, and many commentators have said (and I agree) that Apple shot themselves in the foot by refusing to negotiate with them.
Apple even disables JIT for Safari itself when you put an iPhone in lockdown mode, at no small cost to performance, in an effort to harden the device even more.
Do you have a rebuttal to that?