[olliej]

Look at the attacks on various human rights activists- those are using the same exploits that jailbreaks use.

Fixing bugs used to attack people means fixing bugs used for jailbreaks. There isn’t some magical mechanism by which a jailbreak exploit isn’t exploitable but anyone else.

[swiley]

In other words:

The current model fails to protect people anyway while providing an extremely strong incentive for the community to publish software that undermines the “security” of the device.

[saagarjha]

Of course, removing the need to jailbreak for such control would mean that this dichotomy would not have to exist…

[djrogers]

If you remove the need for a jailbreak in order to allow arbitrary code to run on any device, you're allowing arbitrary malware to run on any device.

[saagarjha]

The problem is not running arbitrary code, but running arbitrary code without informed consent. Malware runs without consent. Apple's solution for iOS is removing the ability to run anything completely, bypassing the need to figure out how to obtain consent.

[jsjohnst]

> bypassing the need to figure out how to obtain consent

How do you propose getting “informed” consent from an audience who doesn’t care and willingly expose everything about themselves and everyone they know to find out which Star Wars character or 80s pop song they are most like? Genuine question, as this doesn’t seem the least bit a solved problem anywhere.

[saagarjha]

It's not an easy problem! But Apple should work on solving it–they have already put in some effort in this direction on macOS, although they have their hands tied behind their back there because they're going from unrestrictive → restrictive and such changes usually break things and make people angry. On iOS they pretty much have a "clean slate" with which to start with.

Usually, solutions in this area generally have a couple of characteristics: the first is that the "secure" case is generally useful for 95+% of people, to the point that they might not even know that there are other "modes" that are more permissive. The second is putting surmountable but significant barriers in place to prevent disabling these features, in an attempt to prevent casual/unintentional deactivation. Strange key combinations that lead to scary text and wiping the device seem to be fairly effective in keeping out people who cannot give informed consent. And a third is allowing a user-specified root of trust: for example, one can imagine an iPhone that is every bit as secure as any other iPhone today because I have enabled all the security features, but it's using my keys to attest against instead of Apple's. There's a lot of interesting work being done in this area: one I personally like is Chromebooks, which have the dual purpose of being secure, "locked-down" devices for general consumer use, but also for being useful for development work. And there we're seeing interesting solutions such as using KVM to run an isolated Linux, developer mode, write protect screws, …

[swiley]

I don’t understand why people think that because some people are clumsy the rest of us have to live in a straight jacket.

[jsjohnst]

> why people think that because some people are clumsy

Nobody said anything about clumsy people. As one of many examples, look at all the guides that tell folks to disable SIP and don’t explain the risk and really don’t even need to disable SIP, the app should just be fixed properly.

There are exceptions of course and good reasons to disable it, so I’m glad Apple has the option, but I’d venture to say 85% of the time it’s done by a person who isn’t really making an “informed consent”.

[pcwalton]

To be more specific, the problem is that malware is a separate category from useful and harmless application code that people want to run but that Apple doesn't want to allow for a variety of reasons, but Apple forbids both types of software.

(Focusing on user consent obscures the actual problem; people often consent to running malware. What matters is whether the software to be run is useful and harmless.)

[saagarjha]

> people often consent to running malware

Ah, but not in an informed way–users don't typically run software they know to be harmful/useless :P (And no, telling them that it is harmful isn't apparently enough to inform them…) But I agree with the first part.

[fomine3]

Bootloader unlock is the way that works on Android. It forces user to erase data when unlock it and unlocked status is shown in boot screen.

[londons_explore]

> Look at the attacks on various human rights activists

I believe all these begin with browser or existing-app based exploits.

None of them seem to rely on tricking the user into installing a new app. That would be too suspicious for the user, and would entail the attacker uploading their exploit code to apple, and giving apple a full list of users who they exploited...

[saagarjha]

Not sure if this call is allowed through the new syscall filter in WebKit, but before it this was one JavaScriptCore bug away from achieving the same thing.