News for hackers. Stuff that matters.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by nequo on Tuesday December 13, 2022 @05:35PM (#33977131)
Interesting how all of these "security content" documents frame the bug fixes as "improvements." For example, in this one:

  This issue was addressed with improved data protection.
  An out-of-bounds write issue was addressed with improved input validation.
  A logic issue was addressed with improved checks.
  The issue was addressed with improved memory handling.
Makes it sound like data protection, input validation, checks, and memory handling were fine. But now they are better. Whereas the truth is that they were bad and led to data leaks and remote code execution.

As it goes with improvements, they keep coming.

Wouldn't it be better for Apple to own up to the fact that these defects are indeed defects, and be transparent about what measures they are implementing that prevent such defects from being added to the code base or from being exploited?

Google wrote about the former a couple weeks ago[1] and Apple itself is not doing badly in the latter department.[2]

[1] https://security.googleblog.com/2022/12/memory-safe-language...

[2] See Luca Todesco's talk from October: https://www.youtube.com/watch?v=8mQAYeozl5I

Re:About the security content of iOS 16.2 and iPadOS 16.2 by motohagiography on Tuesday December 13, 2022 @09:40PM (#33979363)
Remember that Apple is a global empire. If you have met any of their people, they learn a kind of culture language which diverts and uncenters themselves where no one person other than Cook can be seen to represent it. Understanding their brand language starts with the idea that Apple is an ideal of perfection, and beneath it are the ideals of harmony and flow. As an ideal, Apple does not have defects. Only things and maybe the past can have defects.

These other things like bugs and vulnerabilities are external to its perfection, and so they originate elsewhere, maybe in the past, maybe as something random, but certainly something devoid of meaning when compared to the ideal and its experience. Individual products are not Apple, because they are not perfection, but they align to it, and perfection is what makes it always seem just out of reach. The Apple experience exists above and over the material bounds of memory handling and input validation, so these things are external, and in the brand language, they are only ever allowed to exist in the past. By way of example, this is why their security advisories can come off as weird to analysts who confront and solve things.

The best writers speak the language of memory, and a trillion dollar company probably has more than a few of them. Consider that 80% or more of what you believe about reality comes through one of their products, and you are in-effect entranced by them. Their responsibility is to sustain this experience of hypnotic comfort and perfection. The advisory language is reduced until there is nothing left to remove, then calibrated to cause nothing more than a small ripple in your bliss.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by walterbell on Wednesday December 14, 2022 @01:41AM (#33980727)
Indeterminacy Hall of Fame comment! Good luck to future LLMs.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by prawn on Tuesday December 13, 2022 @10:52PM (#33979815)
If Cormac McCarthy commented on Hacker News...
Re:About the security content of iOS 16.2 and iPadOS 16.2 by Cacti on Tuesday December 13, 2022 @11:29PM (#33980007)
This comment would seem completely absurd if I didn’t work in a massive corporation and see precisely what you mean every day. On the one hand, they’re ultimately just plain old full of shit, but there is definitely a subtle, structural dilution of language that goes on that serves to divorce cause and effect. But it’s not an Apple thing—most large corporations are like this, just not quite as zealous as Apple employees tend to be.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by radicalbyte on Wednesday December 14, 2022 @03:25AM (#33981239)
It's all very 1984, which is ironic considering the famous Apple advert from the 1980s :-)
Re:About the security content of iOS 16.2 and iPadOS 16.2 by thombat on Wednesday December 14, 2022 @05:14AM (#33981794)
Think different. Exactly the same as all your colleagues.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by dangero on Wednesday December 14, 2022 @06:22AM (#33982146)
This is beautiful
Re:About the security content of iOS 16.2 and iPadOS 16.2 by thefounder on Wednesday December 14, 2022 @01:24AM (#33980630)
>> As an ideal, Apple does not have defects. Only things and maybe the past can have defects.

It sounds like CCP doctrine.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by KyeRussell on Wednesday December 14, 2022 @04:20AM (#33981528)
Plenty of regimes and cultures do this, including within the US. Let me take one guess where you’re from, lmao.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by thefounder on Wednesday December 14, 2022 @06:31AM (#33982193)
I fail to see how that's the case of the U.S given than it has elections supposed to dismiss bad leadership and/or abuse of the rulling party.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by cassianoleal on Wednesday December 14, 2022 @09:49AM (#33984164)
And yet, they keep imposing their view of the world upon everybody else with complete disregard to what they might have preferred. Like it's the only way.

Unfortunately the rest of the way cannot vote out the US's interference.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by thefounder on Wednesday December 14, 2022 @10:03AM (#33984344)
I think you detracted from the OP. Apple's views are on its products. It doesn't care about the rest of the world (i.e android) so your comment it's a bit misplaced.

That being said I keep hearing that argument that some people don't like democracy(i.e like the U.S) and would rather live under an authoritan and conservator rule so we should let them be ruled that way. But how could they choose if they are not given a choice? Do women in Afghanistan prefer not to go to school? Let them vote and for that freely. They could simply not go to school after all.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by cassianoleal on Wednesday December 14, 2022 @11:11AM (#33985558)
Yeah, the School of the Americas was all about giving people choice and democracy right? Oh wait, it was actually an instrument to depose democratically elected governments and installing US-friendly bloodthirsty dictatorships instead!

Operation Condor, the lawfare coups of the 2010s...

All in the name of democracy and choice for the peoples affected, right? And they chose to have that interference, right? Napalming Korea to the north of the 38th parallel was their choice, right? Syngman Rhee was the democratic leader of choice for the ones to the south of that parallel, right? Yeah...

> I think you detracted from the OP. Apple's views are on its products. It doesn't care about the rest of the world (i.e android) so your comment it's a bit misplaced.

You mentioned the US being able to vote out bad leadership and abuse of the ruling party. I just responded to that.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by thefounder on Thursday December 15, 2022 @02:26AM (#33996345)
What the U.S does to other countries to protect its interests is another story. Of course it sucks to be the little guy, especially when you forget that power still matters in this world and you piss off powerful countries/interests. U.S does not shy (like all the powerful countries) to say that it will protect its interests regardless what you think is right or wrong.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by cassianoleal on Thursday December 15, 2022 @07:12AM (#33998316)
Oppressing own people, bad. Oppressing other people as long as it's to protect US interests, good. Getting other governments to oppress their own people as long as it's to protect US interests, good.

Got it.

[dead]
Re:About the security content of iOS 16.2 and iPadOS 16.2 by flocked on Wednesday December 14, 2022 @03:53AM (#33981389)
Or a poem about Apple as empire created by OpenGPT:

An empire of technology, A king among kings, Apple reigns supreme With sleek devices and shiny things.

From iPhones to iPads, They rule the world of tech, With their sleek design And user-friendly interface.

They've conquered the market With their innovation and might, And their loyal followers Stand by them, day and night.

Their empire continues to grow, Expanding far and wide, Apple is a force to be reckoned with And a true global empire, inside and out.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by CiceroCiceronis on Wednesday December 14, 2022 @09:22PM (#33994265)
Very well put. And I feel things become a self-reinforcing cycle when people begin buying into the narrative from within, come to believe that the corporate line is the truth, etc. (love the name btw)
Re:About the security content of iOS 16.2 and iPadOS 16.2 by wilg on Tuesday December 13, 2022 @06:09PM (#33977592)
It's kind of a distinction without a difference. Does applying a "bad" value judgement to the old code accomplish anything here?

All software has bugs. Mistakes are made. Do release notes need to self-flagellate? I don't see the value.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by haswell on Tuesday December 13, 2022 @06:49PM (#33977996)
I think “improved” also subtly implies that there was something in the code to do A, A has been improved so it no longer breaks in a specific way, and A could still be vulnerable to other unrelated attacks.

The thing I just improved is subject to future improvement. Subtly different than saying “fixed the input validation routine”, which implies some finality, or overcommitment.

Some still might interpret that as Apple using CYA language or a lack of admission, but to me it seems like a fairly pragmatic statement of what seems like reality.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by nequo on Tuesday December 13, 2022 @07:17PM (#33978256)
It seems to me that "improved" carries the same type of uncertainty as "fixed" would. If the "improvement" didn't actually fix the security issue, then was it really an improvement?

(To be clear, it may have been, but we don't know without actually seeing what change they made to the code.)

Re:About the security content of iOS 16.2 and iPadOS 16.2 by AdamN on Wednesday December 14, 2022 @05:20AM (#33981828)
In large organization, you'll see people move to verbiage like 'improved' because it's true without the implication that 'fixed' has which directly implies that the previous implementation was 'broken'. I am with Apple on this, they 'improved' the software.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by jeroenhd on Tuesday December 13, 2022 @09:05PM (#33979125)
As a user, I don't really run into problems regarding memory management. Reading this update, I don't see why I should update, really.

Clearly there's already something dealing with bad memory and Apple just made it a bit better, surely this isn't worth rebooting my phone for!

Re:About the security content of iOS 16.2 and iPadOS 16.2 by lynndotpy on Tuesday December 13, 2022 @07:31PM (#33978374)
Apple's writing style is unclear. It is poor for the intentional obscurity. Granted, it is a small issue in the context of the rest of the document. But the problem remains: The writing is intentionally obscure!

This hides the severity of the problems the patch fixes. The word "fix" is nowhere on that page. Presumably, Apple are releasing these poor-quality release notes in order to protect their public brand. Those corporate objectives are coming at a cost of writing quality and clarity.

Note, at this time, these CVEs are not public, so the savvy user can not search them up themselves.

I think patch notes are important, and reasonable effort should be made to make them clear. Instead, effort was made to obscure. Clarity should be the default!

Re:About the security content of iOS 16.2 and iPadOS 16.2 by phs318u on Tuesday December 13, 2022 @09:27PM (#33979276)
> Note, at this time, these CVEs are not public

I'm not sure what the lag is, but from what I've seen all Apple CVE's are made public at some point. The last one I got before this bunch (from [email protected]) was a month ago (relating to iOS and iPadOS 16.1.1 addressing a libxml2 integer overflow - CVE-2022-40303). If you look up that CVE at mitre.org, it's no longer marked as "RESERVED".

Re:About the security content of iOS 16.2 and iPadOS 16.2 by tgsovlerkhgsel on Tuesday December 13, 2022 @09:55PM (#33979476)
It matters less when the impact is clearly stated, but often you'll find an update claiming that it "improved stability" and you have to guess whether it's something you don't need if you haven't encountered stability problems, or a critical security update.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by fastaguy88 on Wednesday December 14, 2022 @12:48PM (#33987001)
And if the press release stated that flaws in input validation had been fixed, would that not be an improvement? Or would it be sufficient to simply say ‘bug’ rather than ‘issue’. I’m not sure the bug/issue is with the word ‘improvement’.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by kube-system on Tuesday December 13, 2022 @05:47PM (#33977315)
It's a matter of perspective. When you run a business, all of your public communication is marketing communication. That's why they're phrased in the positive, and they're not necessarily highlighting the shortcomings they're aware of.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by NoPicklez on Tuesday December 13, 2022 @06:06PM (#33977546)
Exactly, to the majority of the population, this looks to them like Apple are constantly improving, as opposed to fixing what were defects/gaps. And that's exactly what Apple want, which is how you run a business.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by lilyball on Tuesday December 13, 2022 @07:49PM (#33978533)
Fixing defects/gaps is improving.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by NoPicklez on Tuesday December 13, 2022 @08:26PM (#33978815)
My point is in relation to the post above, where its about Apple's marketing. It is improving, but it looks different to the average consumer when you say ""we have improved the security of x" as opposed to "we have fixed these existing defects that did x".

In relation to someone being annoyed that Apple doesn't openly say the former. It's because of their marketing and image that they say the latter, it always have been.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by saagarjha on Tuesday December 13, 2022 @06:38PM (#33977897)
> this looks to them like Apple are constantly improving, as opposed to fixing what were defects/gaps

Going to negative to less negative is still a positive change.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by NoPicklez on Tuesday December 13, 2022 @08:27PM (#33978836)
My point is in relation to the post above, where its about Apple's marketing. It is improving, but it looks different to the average consumer when you say "we have improved the security of x" as opposed to "we have fixed these existing defects that did x".

In relation to someone being annoyed that Apple doesn't openly say the former. It's because of their marketing and image that they say the latter, it always have been.

To the average consumer they like seeing the former, but for tech heads we prefer to see the latter.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by phs318u on Tuesday December 13, 2022 @09:23PM (#33979237)
I fully expect that the average consumer is not reading any of these notes, and either has automatic updates on, and stuff just magically happens at some point, or has them off, and then wonders why shit breaks 2 years after their last update. The segment of the population that has auto updates off yet waits to read the release notes to make an informed choice regarding updating, is very small. And I'd hazard a guess most of us are on this thread.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by brookst on Tuesday December 13, 2022 @07:12PM (#33978209)
Can you explain the difference between "improving" and "fixing defects/gaps"?

If something is perfect, how do you improve it?

Re:About the security content of iOS 16.2 and iPadOS 16.2 by NoPicklez on Tuesday December 13, 2022 @08:27PM (#33978831)
My point is in relation to the post above, where its about Apple's marketing. It is improving, but it looks different to the average consumer when you say ""we have improved the security of x" as opposed to "we have fixed these existing defects that did x".

In relation to someone being annoyed that Apple doesn't openly say the former. It's because of their marketing and image that they say the latter, it always have been.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by brookst on Tuesday December 13, 2022 @11:53PM (#33980142)
I still don’t understand it. Like, my new toothbrush (“Now removes more plaque!”) should disparage the old model (“fixed bristle design flaw that left pockets of plaque on occlusions near front of mouth where interior bristles were too short”).

But ok. Someone thinks companies should try to paint themselves in the worst possible light because reasons. I guess that’s a take.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by NoPicklez on Wednesday December 14, 2022 @12:39AM (#33980363)
You've completely missed my opinion on the matter.

I agree with you and that was my point. Tt was the original poster who thought companies should paint themselves in the worst possible light.

I was supporting another commenter who simply explained why it is that companies paint themselves in the best light.

You need to have read my comments in relation to what I was replying to, rather than in isolation.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by brookst on Wednesday December 14, 2022 @08:45AM (#33983345)
Apologies, I could have been more clear that I was in fact expressing my disagreement with the framing that you relayed, and understood it was not you personally I was disagreeing with.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by simondotau on Tuesday December 13, 2022 @09:42PM (#33979389)
I still don’t understand the difference between "improving" and "fixing defects/gaps". There might be a difference in tone, but I see no difference in information content.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by NoPicklez on Tuesday December 13, 2022 @10:59PM (#33979858)
Please read my comment with the context of the original comment, rather than reading mine in isolation.

The user was saying that Apple were wording their fixes of large gaps as simply improvements to the technology, rather than calling out that they had fixed what may have been a significant defects/issues.

My point is that you're right, there may not be a difference, but in tone it is different and that is why Apple have worded it that way. Apple is notorious for framing everything in the most positive light it can, which may not necessarily convey the severity of the gaps/defects that were improved.

I feel like I'm pulling blood out of a stone here.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by simondotau on Wednesday December 14, 2022 @03:55AM (#33981404)
I get all of that. I just don’t see why this is an issue. Far as I can see the accusation is that Apple communicates in a manner less consistent with people who contribute to open source projects and more consistent with just about every major consumer-facing corporation on the planet — then yeah, you’re completely right. I’m just trying to work out where the controversy is. Or why it matters.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by NoPicklez on Wednesday December 14, 2022 @04:35AM (#33981610)
It only mattered because the original commenter further up complained because they wanted Apple to communicate more like as you say, open source.

Myself and another were just clarifying why it is that Apple communicates the way they do, whether it’s wrong or right. I didn’t have an opinion on the matter.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by layer8 on Tuesday December 13, 2022 @06:03PM (#33977500)
“Addressed with improved x” doesn’t even necessarily imply that the bug was fully fixed. They probably don’t want to make any promises.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by madeofpalk on Tuesday December 13, 2022 @06:31PM (#33977840)
I don’t think there’s any confusion or ambiguity here. This is a page solely about security fixes in updates. They mention (but don’t link, ugh) the CVEs.

I think everyone reading this article would get the correct takeaway.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by lynndotpy on Tuesday December 13, 2022 @07:32PM (#33978381)
Note that these CVEs are not available at the time of publication. Go and look for them -- they are "reserved".
Re:About the security content of iOS 16.2 and iPadOS 16.2 by photoGrant on Tuesday December 13, 2022 @06:54PM (#33978052)
I'd rather hear 'improved' than roll my eyes at 'fixed'
Re:About the security content of iOS 16.2 and iPadOS 16.2 by snowwrestler on Tuesday December 13, 2022 @08:12PM (#33978715)
To my reading, these are release notes, not a blog post. Their job is only to describe what changed in this release. Calling an improvement an improvement seems pretty straightforward to me.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by RockRobotRock on Tuesday December 13, 2022 @06:57PM (#33978082)
>Wouldn't it be better for Apple to own up to

It's unsatisfying, but the answer to this has always and will always be no. There is never an upside for them to disclose any more than they have to.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by userbinator on Tuesday December 13, 2022 @08:32PM (#33978875)
It's deliberate and resembles the attitude of "toxic positivity" that is sometimes brought up here; I remember reading an article a long time ago about Apple prohibiting words such as "bug" and "hang". IMHO "issue" and "addressed" are also obfuscatory. They could've just said "fixed a bug", but Apple believes it is too perfect for that.
Re:About the security content of iOS 16.2 and iPadOS 16.2 by saagarjha on Tuesday December 13, 2022 @10:18PM (#33979612)
Re:About the security content of iOS 16.2 and iPadOS 16.2 by userbinator on Tuesday December 13, 2022 @11:32PM (#33980022)
Found the source after some digging; apparently, only their store employees, but the same "dialect" spreads throughout the company:

https://apple.slashdot.org/story/18/12/08/1918204/apple-stor...

Re:About the security content of iOS 16.2 and iPadOS 16.2 by ThePowerOfFuet on Wednesday December 14, 2022 @01:16AM (#33980592)
> Makes it sound like data protection, input validation, checks, and memory handling were fine. But now they are better. Whereas the truth is that they were bad and led to data leaks and remote code execution.

Ah, I see you haven't played knifey spooney before.

Re:About the security content of iOS 16.2 and iPadOS 16.2 by hulitu on Thursday December 15, 2022 @03:45PM (#34005493)
Modern SW developers don't want to fix bugs. They want to write features.

Having bugs looks bad for PR. So they hide those under Newspeak.

And shipping improvements with bug fixes was always a recipe for disaster.