Hacker News new | ask | show | jobs
by est31 480 days ago
ios is capabilities based, no?

Edit, to explain: in ios, everything revolves around mach ports, which are capabilities.

https://docs.darlinghq.org/internals/macos-specifics/mach-po...

1 comments

Yes. And without over stating it, iOS is an amazingly robust, very secure OS. it has high trust and low trust models, a secure zone, special purpose hardware and an operating system designed around minimum access rights models which manages to keep going, despite app authors worst intentions.

At one level, it proves the model. The shame is that Mach otherwise has kind of not taken off. Gnu the OS was going to be Mach at the core, at one point IIRC

I'd have to disagree -- the lack of OS-level sandboxing primitives such as seccomp-bpf and SELinux[1] means that exploits happen rather regularly in iOS rather often ([2], among others).

[1] https://source.android.com/docs/security/app-sandbox#protect...

[2] https://www.csoonline.com/article/3811322/iphone-users-targe...

Does the Apple Sandbox[1] not count? What about TrustedBSD[2] and the MAC (Mandatory Access Control) subsystem introduced as part of SEDarwin[3]?

[1] https://www.ise.io/wp-content/uploads/2017/07/apple-sandbox....

[2] http://www.trustedbsd.org/mac.html

[3] http://www.trustedbsd.org/sedarwin.html

iOS has a perfectly good sandboxing model that is literally called "the sandbox". You will note that the impact of that bug is limited to the process it is triggered in for precisely this reason.
Not to deny that, but it didn't (for example) break the Secure Enclave. Key exfiltration didn't happen AFAIK.
iOS is without question one of the most secure OS out there today with any amount of real world use but the gap between what it is and what state of the art looks like is also insane. Fuchsia is actually quite well aligned with something that’s actually defendable in the real world and across time.
> despite app authors worst intentions

All app authors must comply with the rigorous App Store guidelines so the technical limitations on what they can do don't really matter anyway.

Add sideloading as an option and we'll get to see how secure iOS really is.

GrapheneOS is definitely secure enough to tolerate sideloading, but I don't know if iOS is or not.

It maybe robust, but it's very very limited in capability. There's no depth to GUI interactions.