News for hackers. Stuff that matters.
Re:iOS 17 app sideloading might only be available in Europe by Cthulhu_ on Sunday April 23, 2023 @06:27AM (#35675008)
> the browser and its sandbox.

A lot of viruses (and jailbreaks on iOS amongst others) are distributed via this browser / sandbox; it's only secure in theory and it took decades to get to that point.

Sure (before the Rust evangelists swoop in), part of that was due to using unsafe languages; part was due to extension frameworks that had too much power (ActiveX, which was even used to update your operating system, I can't fathom why they thought that was a good idea). But it'll take many more years of zero incidents, jailbreaks, etc before I'd trust the browser over Apple's app sandboxing and app review and distribution approach.

Re:iOS 17 app sideloading might only be available in Europe by peoplefromibiza on Sunday April 23, 2023 @07:34AM (#35675347)
a bit of history massaging in this comment.

Chrome and Firefox are as secure as Safari, if not more, banning them is a commercial choice not a technical one.

iOS exploits still exist, there's no real advantage in Apple sandboxing apps, they are routinely leaking users data and being exploited as well.

OTOH Apple refusing to implement certain web standards is proof that they cannot guarantee a safe implementation, which is a reason more to allow better browsers on their platform.

Re:iOS 17 app sideloading might only be available in Europe by stefan_ on Sunday April 23, 2023 @08:23AM (#35675654)
This is funny because by far the most impactful breaches of security on iOS phones have been due to the Apple components, like the messaging app that inexplicably is still written in ObjectiveC as it's ever been, or the image framework found to contain various bits of opensource code they never updated, never audited, or the various terrible magic "serialization" features.

This Apple native crud they force every app to use (up to the whole browser engine, like in the IE days!) is truly the ActiveX of our times. Only you can't even get rid of it.

Re:iOS 17 app sideloading might only be available in Europe by kmeisthax on Sunday April 23, 2023 @12:16PM (#35677533)
Microsoft thought ActiveX was a good idea because they built Internet Explorer out of OLE and COM. Everything in that era of Windows was built to be embeddable and composable - "compound documents" being the original design goal. If you needed to stick, say, a video into a web page, COM/OLE was the obvious way to do that on Windows in 1996. It's not any different from, say, early Firefox extensions being built out of XUL - in fact, I recall XUL extensions for Firefox that would literally add ActiveX support back in. It wasn't until Chrome came along where extensions didn't get to muck about with browser internals.

You can exploit in both native and browser contexts. Most jailbreaks nowadays are assisted by a native application that you dev-sign to deliberately pwn yourself with. In the past we had websites that you could use to jailbreak with. Both are sandboxed environments with significant attackable surface area, so one is not necessarily more trustworthy than the other purely on measures of exploitability.