Hacker News new | ask | show | jobs
by benmarks 2610 days ago
> "With access to proprietary guides and tools, hackers can more easily circumvent security protections, harming not only the product owner but also everyone who shares their network"

Of the many consumer insults present in this entire topic, this one really shows the ridiculousness of Apple's position.
2 comments
tombert 2610 days ago
For that matter, if more altruistic people had access to these tools, couldn't you argue that security bugs would be found quicker as well? As of right now, it's possible that there are a million security bugs that black-hat hackers are sitting on that the average person doesn't have the tools to know about.

Isn't security-through-obscurity considered the worst kind of security?

link
henryackerman 2610 days ago
Security-through-obscurity can be very effective by using it to throw up a smoke screen.

Case: you need to protect a web server. If you can successfully hide/spoof your OS/software fingerprint, an attacker won't know whether your server has vulnerable software. This makes exploit selection extremely difficult.

You can protect an already secure system from 0-day or unknown exploits by hiding whether you're running windows/linux/bsd/whatever with IIS/apache/nginx/traefik/caddy.

Of course this should not be used as an argument to introduce laws that limit the rights of repair shops, users or even security researchers.

link
dvfjsdhgfv 2610 days ago
Really? Software detection techniques are so sophisticated these days, you need to put a lot of effort into that, and it all can be defeated by something very simple that doesn't even depend on you. Experts will find the way and newbies will just throw at you everything they have.
link
simion314 2610 days ago
Exactly, like the guides do not leak anyway.
link
CaliforniaKarl 2610 days ago
The way I read GP's comment, is that security researchers have been able to find security vulnerabilities even without access to information.
link
simion314 2610 days ago
That is true, but in this case Apple statement is ridiculous because if Apple relies on security by obscurity the problem is that the guides are shared with many employees and contractors and they arrive on the internet anyway.
link