Re:Apple restricts Pebble from being awesome with iPhones
by Nextgrid on Tuesday March 18, 2025 @02:00PM
(#43402573)
It doesn't need to be a plugin ecosystem - no third party code needs to run within the iMessage processes/sandboxes/containers. In fact, no third-party code needs to run at all on the phone - all that's needed is to expose an API over BLE that allows previously authorized external devices to query/send messages.
Re:Apple restricts Pebble from being awesome with iPhones
by usrusr on Tuesday March 18, 2025 @03:02PM
(#43403484)
In defense of the "it's security!" position (which is not mine): I think they mean a similar vulnerability could exist on the client side of the API. As in someone sends manipulated media that targets a vulnerability on the third party device, the media gets forwarded through the API, now that compromised third party device does bad things over the API.
Personally, I think that it's really just a convenient third party lockout excuse, but the argument isn't quite as bad as it may seem at first glance.
Re:Apple restricts Pebble from being awesome with iPhones
by darkwater on Tuesday March 18, 2025 @05:17PM
(#43405241)
Following that line of reasoning, the Apple should ban WhatsApp and other messaging systems because they can add potential vulnerabilities.
Re:Apple restricts Pebble from being awesome with iPhones
by xigoi on Wednesday March 19, 2025 @02:50AM
(#43408912)
Don’t give them ideas!
Re:Apple restricts Pebble from being awesome with iPhones
by madeofpalk on Tuesday March 18, 2025 @02:53PM
(#43403334)
> People’s phones got compromised by NSO sending images to them via whatsapp
Has this happened on iOS via WhatsApp?
I know Apple's had a view problems with this happening with iMessage, but always been unsure whether third party app sandbox does a good job of containing this?
People’s phones got compromised by NSO sending images to them via whatsapp that used an exploit in one of the image libraries to run a malware payload. The security boundary isn’t about whether you can see your own messages, it’s whether bad people can root your phone by getting untrusted code to run. That’s a very different proposition if iMessage is a single codebase that they fully own end to end versus it has a plugin ecosystem. Having such a plugin system widens the security boundary by adding a much larger codebase that would require trust.