News for hackers. Stuff that matters.
Re:Disclosure of three 0-day iOS vulnerabilities by guntars on Friday September 24, 2021 @03:20AM (#28639505)
The other day I tried to update my Macbook over a personal hotspot and it happily downloaded about 2GB before the computer went to sleep and I was greeted with a "Whoopsie, failed to download the update, try again" message when I woke it and, of course, it would just start over again. They don't even support resuming the download! That's just embarrassing.
Re:Disclosure of three 0-day iOS vulnerabilities by robertlagrant on Friday September 24, 2021 @05:11AM (#28640160)
Strangely I did the same thing last night and it did resume, although you only see the resumption when it starts. There's no prior indication that it will resume.
Re:Disclosure of three 0-day iOS vulnerabilities by merb on Friday September 24, 2021 @07:05AM (#28640829)
it depends on your free storage. if it is less than X % they will try to download it one go. the resumable download will download all in chunks and than concat them.
Re:Disclosure of three 0-day iOS vulnerabilities by guntars on Friday September 24, 2021 @07:26AM (#28640980)
Just tried it again. I have 70GB available. Got on the hotspot, started the download, unplugged the laptop, waited for it to go to sleep, woke it up - same result. I had to accept the EULAs again and it started to download from about 50mb.

Having attempted (unsuccessfully) to write a resumable HTTP/HTTPS downloader, which is what I suspect nsurlsessiond is using behind the scenes - it's really hard to get it right. Meanwhile I expect to be able to start a BitTorrent download, throw the laptop down the stairs, take out the hard drive and be able to successfully resume it on a different computer because that's a protocol that was actually designed for it.

Re:Disclosure of three 0-day iOS vulnerabilities by codetrotter on Friday September 24, 2021 @09:57AM (#28642401)
But Apple has the luxury of controlling both the server and the client. Why isn’t it just a matter of using HTTP range requests?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Range_requ...

And if they need to get more clever than that, why not have a BitTorrent-like map of chunk hashes. So you download the update, check the hash of the whole thing and if it fails the hash check, download the chunk hashes which will be say a 256 bit hash for every individual 32 MB chunk of the file. And for any chunk that fails the hash check, use a HTTP range request to download it again.

Re:Disclosure of three 0-day iOS vulnerabilities by guntars on Friday September 24, 2021 @02:06PM (#28645843)
We can only speculate, but my guess is some combination of “didn’t feel the need to” and “the code responsible for this is nested 6 layers deep between 3 different frameworks”.
Re:Disclosure of three 0-day iOS vulnerabilities by wrycoder on Friday September 24, 2021 @11:17AM (#28643601)
I’ve now tried three times to update Safari. The first two times I left the laptop on charge with the lid open (I have it set to auto update). The third time I did it manually and watched. It got the download ok, but failed during install. It told me the update failed, but with no reason or suggestion regarding what to do next.
Re:Disclosure of three 0-day iOS vulnerabilities by wrycoder on Friday September 24, 2021 @11:38AM (#28643870)
Edit: I should point out that not everyone has a high data cell account. For example, I’m retired, and we don’t spend much time on the road. When we do, we’re careful how we use data, and we depend on wifi at restaurants and hotels.

We are pretty heavy Internet users at home (Starlink), but the cell plan is 2GB per month, shared between me and my wife. We rarely overrun that.

I think that there are a lot of retired people with small phone plans and no WiFi. All they do is a few phone calls and a bit of email with the family. So, updating those phones frequently is problematic. They probably take them to the phone store where they bought them.