News for hackers. Stuff that matters.

A comment on Handling App Transport Security in iOS 9. Parent comment

Re:Handling App Transport Security in iOS 9 by alexbock on Thursday August 27, 2015 @11:53AM (#10130144)
The instructions they give are not creating an exception for any particular ad servers or just for Google's servers; they're asking developers to enable NSAllowsArbitraryLoads, which disables the security features app-wide for any URL.
[ Parent | on HN ]
Re:Handling App Transport Security in iOS 9 by StavrosK on Thursday August 27, 2015 @11:58AM (#10130179)
Still, it's only for developers using their mobile ads SDK. It's not for all developers, which the title implies.
[ Parent | on HN ]
Re:Handling App Transport Security in iOS 9 by st3fan on Thursday August 27, 2015 @12:34PM (#10130440)
No, it is not only for developers using their mobile ads SDK. It is for any application that uses their ads SDK. The result of this is that this application will allow arbitrary insecure http loads by default. They take away a very useful safety net.

Why can'g google be more specific about the domains on which to allow insecure http traffic? Because their SDK loads content from arbitrary ad delivery platforms.

[ Parent | on HN ]
Re:Handling App Transport Security in iOS 9 by gress on Thursday August 27, 2015 @12:00PM (#10130198)
The title is ambiguous on this point and it's irrelevant to the fact that it's an ugly choice of priorities.
[ Parent | on HN ]
Re:Handling App Transport Security in iOS 9 by MrGando on Thursday August 27, 2015 @12:49PM (#10130546)
Can you imagine how many servers would they have to actually add exceptions for?
[ Parent | on HN ]
Re:Handling App Transport Security in iOS 9 by mtgx on Thursday August 27, 2015 @12:07PM (#10130250)
NSA -- coincidence?! I think not.
[ Parent | on HN ]