iOS7 definitely feels rushed. I work doing a lot of mobile web stuff, and the number of bugs in Safari in iOS7 is staggering. Here's hoping we see 7.1 very soon.
While I agree, they did pretty much redo everything on the UI while adding a bunch of features on the backend. They might have some more tricks up their sleeve later as well.
Yeah. They deprecated almost the entire Game Center library. I was working on a game and when I update to iOS7 I got tons of warnings. There is still more stuff that I need to update, but I'll do it later.
They aren't getting credit though because unless you're a developer, no one really cares. Most people want to see changes that effect them directly. That is something that I think Steve had a very good understanding of.
Every time the fact of Apple not permitting other browsers is brought up, someone always says "Yes they can" and points out Chrome, Opera, etc. But they can't. Apple won't allow any code interpretation in apps. That means no JavaScript at all. Which means a browser that's pointless on today's internet.
Opera Mini isn't a true browser and offloads processing to external servers because they can't interpret JavaScript locally (thanks to Apple's anti-competitive app store rules). The off-device rendering makes for a less-than-desirable user experience.
Chrome and every other "browser" in the iOS app store is just a custom UI on top of Mobile Safari. And it's not even full-speed instance of it since it can't use the Nitro JavaScript engine. It's hobbled so it's slower than proper Mobile Safari. Chrome does add one other custom bit in that it inserts its own network stack underneath it. But it's still Mobile Safari within Chrome. It's not the Chrome/Blink engine and it likely never will be. Not unless those increasingly high walls start coming down.
I'm sure I'm missing something, but given how many there have been wouldn't you at least stick an `assert(!isPhoneLocked())` or similar on entry to anything that shouldn't be accessible while locked?
IIRC most of these bugs arise because of things that should be available while the device is unlocked: the dialler and camera for example. Camera is supposed to restrict gallery access and the dialler is supposed to only permit emergency calls. I'd expect that every app trusted with running while the device is locked will have these bugs as Apple goes forward too.
The bugs seem to a bit more nuanced than just testing for a locked device; the attacks seem to rely on performing actions simultaneously to exploit race conditions much like weird glitches in games. This class of bugs is really hard to test for due to the large search space. Model checking might offer a solution, but it's not a magic bullet by any means.
Speaking of games, that's exactly what the humble games tester spends a good chunk of time doing: uncovering bugs by coming up with weird things to try, like spamming input at unexpected moments.
With this in mind lock screens should be advertised as screensavers with passwords instead of actual lock screens; screens you tend to trust to protect your phone at all cost. Not screens which you can't be 100% certain of they actually lock your screen.
Perhaps this is a "feature" and not a bug. News like this just makes me want to go back to using "dumb" phones. adjusts tin-foil hat Apple knows what they're doing.
I showed this to my girlfriend and she thought it was a feature - seeing that if you /really/ need to phone someone, why not allow this in Emergency Mode, as it's probably an emergency anyway? Yeah, I am not sure about that logic.
Really? Any and all lockscreen bypass go straight to mainstream tech outlets. There have been plenty for Android. The real question is why does Apple have this problem with seemingly every major release? This is not a remote exploit and should be publicly shown.
Beyond that there are many that feel if Apple doesn't want to participate in having a more responsive approach towards security why should people go out of their way to play nice with them? Give and take, Apple has played out the "we don't respond unless it's in the interest of saving public face or potential sales losses" far too long. Being overly secretive is a bad thing today, especially with regard to consumers expectation of going to bat for them when it makes sense. They've continually lost face with me (in this particular regard) over the years in their elitist stance. It's of their own doing and approach. And it's completely in their control to change.
Probably because Apple has never acknowledged a problem with their platform, let alone rewarded one. Apple's outreach to any kind of dev community is nothing short of awful.
I guess the official statement from Apple that they're working on the lock screen bugs is a case of "Apple never acknowledging a problem with their platform"? I guess they don't have a security-announce list where they post many bugs a month[1]. I guess the message to go along with iOS 7 that lists a bunch of security researchers who disclosed bugs to apple shows their awful relationship with developers[2]. What a bunch of FUD.
Really? For all these years I follow such things, nothing you said it's true.
Apple regularly posts security updates and notices, and they aknowledge the people who find them.
Heck, even besides security, the claim that "Apple has never acknowledged a problem with their platform" is totally BS.
Steve Jobs himself apologized for the iPhone 4 antenna, and there was also a public statement from Apple about iOS Maps. An of course, they also have the usual recall programs, for things such as faulty batteries, HD and such.
May be because it is a bug not vulnerability? Also, if someone with malice intent can get physical access to your phone then may be you will have much more to worry about?
As usual with Apple, eye-candy is much more important than security. Their BSD foundation is pretty good, and then everything they add on top of it, pretty shoddy as far as security goes.
I'm guessing Gruber and the rest of the Apple-crowd is not going to try to spin this one as vividly as they would have done, had this been an Android-exploit.
