Editorial: Google's Android haunted by Steve Jobs' warnings on app signing security

1235710

Comments

  • Reply 81 of 194
    macbook promacbook pro Posts: 1,605member
    The latest version of Apple iOS offers industry leading security including: Address Space Layout Randomization (ASLR), Application Sandboxing, Code Signing, File System Encryption, Mobile Device Management (including Remote Wipe), Protected APIs and Secure Boot Chain.


    Apple iOS has several distinct and important advantages which make all the difference in the world:
    [LIST]
    [*] Software Updates are managed exclusively by Apple allowing security updates to be developed and deployed rapidly
    [*] No Multiple Abstraction Layers, i.e. Dalvik Virtual Machine on Linux kernel with every abstraction layer providing potential vulnerabilities
    [*] Centralized app Privacy and Security Management
    [*] Background Processes are managed by an strict API guidelines and managed through admission to the App Store to prevent errant applications
    [*] Fewer hardware ports offer fewer potential vulnerabilities (especially SD cards)
    [*] Integrated SSL, TLS and VPN support (per app in iOS 7) including automatic encryption for default apps such as Calendar, Mail and Safari
    [*] Integrated Parental Controls
    [*] Integrated device tracking and device reset restrictions
    [/LIST]



    The lack of consistently available software updates immediately upon release truly cripples Apple's competitors. The other major security flaws could almost be forgiven if Google hadn't crippled their product by not offering timely software updates and not managing app submissions to Google Play.
  • Reply 82 of 194
    v5vv5v Posts: 1,357member

    Quote:

    Originally Posted by Corrections View Post


     


    Step 1) click the link


    Step 2) read the date of the posting: (July 2 if you can't find it yourself)


    Step 3) compare the update added the next day July 3


    Step 4) do the math


    Step 5) apologize for being a dick who doesn't know what you're talking about



     


     


    READ THE DAMN POSTING!


     


    His first complaint to Apple was in MAY. Issue addressed in JULY. Figure out how that's MORE THAN ONE DAY then tell me who's a dick who doesn't know what he's talking about. Yeesh.


     


    Are you having a bad day? Everything you've posted on this thread has been insults and shots at others. Maybe you should turn off the computer and go outside.

  • Reply 83 of 194
    kdarlingkdarling Posts: 1,640member


    The basis of this article is correct:  Jobs was not categorically opposed to native apps.  He just wanted absolute control over them, and so sometimes made them out to be a big threat.  As he put it in an interview right after showing off the iPhone:


     


    Quote:


    We define everything that is on the phone,” he said. “You don’t want your phone to be like a PC. The last thing you want is to have loaded three apps on your phone and then you go to make a call and it doesn’t work anymore. These are more like iPods than they are like computers.”


     


    The iPhone, he insisted, would not look like the rest of the wireless industry.


     


    These are devices that need to work, and you can’t do that if you load any software on them,” he said. “That doesn’t mean there’s not going to be software to buy that you can load on them coming from us. It doesn’t mean we have to write it all, but it means it has to be more of a controlled environment.


     


    NY Times, Jan 11, 2007



     


    In another interview, he even mentioned the possibility of a bad app "bringing down all the West Coast towers".  (In an ironic twist, it was Apple-written software that actually "took down towers".   Recall their 3G code problem... it had a CDMA power ramp bug that would cause cells to overload and drop off users!  So much for a controlled environment preventing bugs.)


     


    Of course, Windows Mobile, Symbian, Blackberry, Palm OS etc all had had apps for years without causing such a problem.  (Blackberry apps required a signature that only registered developers had, btw.   That was not a new idea.)


     


    --


     


    Walter Isaacson's biography of Steve Jobs, written using interviews with him, also talked about Steve Jobs' resistance to third party apps at first.  According to the book, both Apple Board Director Art Levinson and marketing chief Phil Schiller kept after Jobs to allow apps, but Jobs didn't want to hear about it at first and shut down any discussions.


     


    However, Jobs was eventually won over.  (I suspect that the lukewarm reception to his declaration that web apps were "sweet" had a lot to do with that.)  And no, WebOS apps are not the same thing at all.


     


    Re: the SDK not starting in Oct 2007.  Well, yeah.  The iPhone programmers themselves needed an SDK to work on the device, so obviously one had been in use for a while. 


     


    Re: app prices.  It's true that the Apple App Store caused mobile software to dramatically drop in price.  Great for customers, but very few developers manage to make a living off 70 cent sale revenues.


     


    Re: OS bugs. Apparently few remember that the very FIRST iPhone software update came about because a researcher threatened to release code that would let anyone take over an iPhone, if Apple didn't put out a fix by a certain date.  Apple complied.

  • Reply 84 of 194
    dick applebaumdick applebaum Posts: 12,527member
    I remember now after reading this excellent weekend post by DED, but I had totally forgotten about the delay in allowing native apps by 3rd party developers for iOS. How times flies!

    Great article - very informative. Didn't know half that stuff, really appreciate the whole story. And from someone who isn't simply trying to hop on the bandwagon by recycling other news stories to create click bait. You've obviously written this article out of some deeper thought and research than many mainstream newspapers.

    Be very careful here... I followed DED's Roughly Drafted site for years -- as he seemed to believe many of the same things about Apple that I do.

    However, after a while I had this gnawing feeling that something was wrong. DED kept regurgitating all the same old refrains against Apple's rivals/competition, ad nauseam...

    Then I noticed that DED [usually] conveniently linked to prior articles/opinions written by DED himself * -- and elided or ignored contrary opinions.

    Later, when questioned on his opinions or conclusions, DED would often attack/ridicule the questioner or demean the question -- rather than discuss it without bias. **

    I would define what DED does as "Editorialising" -- it hardly fits the definition of "Journalism",


    Fool me once...


    * Most of the links in this article are to other articles written by DED

    ** On AI, DED uses a pseudonym. "Corrections" to challange anyone who disagrees and to further bolster his agenda/opinions.
  • Reply 85 of 194
    v5vv5v Posts: 1,357member

    Quote:

    Originally Posted by rjc999 View Post


    [...] I say let the end users decide. Some people will want a more controlled experienced, others may prefer more diversity.  The world is big enough for both platforms to co-exist.



     


    I fall on the side of convenience. Some things I want control over, others it's just easier to let someone else take care of it. Since this device isn't a "pet interest" I prefer to have a responsible curator manage security for me.


     


    That doesn't mean I blindly accept it as the ONLY Way, Truth and Light, or that I don't want people like Charlie testing the security, or that I don't still want some features the other guys have that I don't, or that I need to disparage others for having different preferences.


     


    It seems to some people that saying either "Apple is not perfect" or "I wish Apple would offer this feature/device/function" is the equivalent of saying "I mock your value system and deride you personally."

  • Reply 86 of 194
    disturbiadisturbia Posts: 563member


    Long time fan and reader ... but just registered to tell you how much I enjoy these editorials.


     


     


     


  • Reply 87 of 194
    tallest skiltallest skil Posts: 43,388member
    kiwik47 wrote: »
    rogifan, When Apple started working on iPhone they did not hire anyone one from outside...

    Who says?
    Project iWatch is not starting soon, it is ending soon. I reckon it will be in market later this year.

    If the world ran on that logic, we never would have exited the stone age.
  • Reply 88 of 194
    v5vv5v Posts: 1,357member

    Quote:

    Originally Posted by Dick Applebaum View Post



    ** On AI, DED uses a pseudonym. "Corrections" to challange anyone who disagrees and to further bolster his agenda/opinions.


     


    Holy Disingenuous Deception Batman! That sure explains a lot.


     


    I noted earlier how that particular poster was... <*Ahem*> uh, "somewhat less than civil." The fact that he, himself, poses to disguise his insults is reprehensible. If a reporter in our plant did that they'd be fired immediately upon discovery. I understand AI exists to make money, but so do actual NEWS organizations and they manage to do it while maintaining SOME degree of journalistic ethics.


     


    Of course, I suppose he'll now retire that disguise and just reappear under a new alias.

  • Reply 89 of 194
    rjc999rjc999 Posts: 69member

    Quote:

    Originally Posted by v5v View Post


     


    I fall on the side of convenience. Some things I want control over, others it's just easier to let someone else take care of it. Since this device isn't a "pet interest" I prefer to have a responsible curator manage security for me.


     


    That doesn't mean I blindly accept it as the ONLY Way, Truth and Light, or that I don't want people like Charlie testing the security, or that I don't still want some features the other guys have that I don't, or that I need to disparage others for having different preferences.


     


    It seems to some people that saying either "Apple is not perfect" or "I wish Apple would offer this feature/device/function" is the equivalent of saying "I mock your value system and deride you personally."



     


    Actually I don't mind Apple having a closed ecosystem as long as there is competition, there is still free choice, even if one firm controls a large platform. The problem with Microsoft when they had a platform was that the balanced was tipped too far, with 90+% of the market on a closed OS controlled by a single vendor, and MS using that leverage to strong-arm those who dissented.


     


    But Apple having a closed platform is fine. I have several Apple devices, my kids have been on iPads since the iPad 1, and now on Minis.


     


    If you've got a device and you like it, why do you give a shit what other people are using? Don't worry, be happy.


     


    My only other beef with iOS is if they'd open up more APIs, like system-wide pluggable sharing (not just locked to Facebook or Twitter). It would allow apps like Dropbox to work so much better.

  • Reply 90 of 194
    danoxdanox Posts: 3,210member

    Quote:

    Originally Posted by MacRulez View Post


    This "platform war" meme is for phone makers and fans, but the more successful devs don't generally buy into it, simply developing for both.


     


    How many of these popular iOS apps aren't available for Android?  Can you list even a dozen from the top 100 iOS apps that aren't also in Google Play?



     


    Djay, Vjay, Traktor DJ, Korg MS, Omnioutliner, most good games, audio apps and any real program that isn't that social media crap.

  • Reply 91 of 194
    tallest skiltallest skil Posts: 43,388member
    ** On AI, DED uses a pseudonym. "Corrections" to challenge anyone who disagrees and to further bolster his agenda/opinions.

    If that's the case, which we've never been able to prove, the account needs banned for most of what it has said to users here, as well as for the deception involved.

    And some morons actually wanted me to have a "separate account" for moderation. Like I'd fall into that trap. :no:
  • Reply 92 of 194
    euphoniouseuphonious Posts: 303member


    If you read this article and didn't know anything about mobile operating systems, you'd think that Android was in dire straits rather than commanding a majority of the market. The bias is laughable.

  • Reply 93 of 194
    michael scripmichael scrip Posts: 1,916member
    v5v wrote: »
    Which ones? That's what MacRulez was asking. If what you say is true, you should be able to specify WHICH apps haven't made the transition.

    It seems safe to assume that there may be some, but are they actually successful apps or just yet another flashlight?

    Twitter Music
    Tweetbot
    Clear
    Fantastical
    Camera+
    CardMunch
    (there are more... these are just the ones I found from doing a quick search for "iOS exclusive apps")

    Of course there are plenty more apps that eventually do end up on Android... but why did they start on iOS in the first place? That's the big question.

    Since it's iOS first, Android second (or sometimes not at all)... what does that say about Android? It sounds to me like iOS is where developers' heart and soul is... and where they make the big decision to launch their business.

    Android seems to be an afterthought... and not a priority.

    There are also a few examples of the Android version of an app not working as well as the iPhone version... or might only be compatible with a certain subset of Android phones.

    And then there's the little matter of iOS App Store revenues outpacing the Google Play Store revenues by a large margin.
  • Reply 94 of 194
    bullheadbullhead Posts: 493member

    Quote:

    Originally Posted by iOSx View Post



    Can we get more Apple news, and less Android hate?


     


    this is news. it is pointing out how crappy, insecure, fragmented, and generally awful the android cloner world is.  Why anyone would even consider a crappy android virus infected, insecure cloner phone is beyond me.

  • Reply 95 of 194


    "While Google was asking the community to replicate a license-free version of Sun's Java on Linux to serve as its ad-optimized mobile platform, Apple was actually engineering a new platform that learned from both the best practices of the industry's leaders as well as their mistakes. It's not surprising why Apple's App Store succeeded and Google Play hasn't; Apple did the work Google failed to do."


     


    Powerful statement. I think this about sums it all up when you look at it in the context of his last editorial as well.

  • Reply 96 of 194
    danoxdanox Posts: 3,210member

    Quote:

    Originally Posted by Euphonious View Post


    If you read this article and didn't know anything about mobile operating systems, you'd think that Android was in dire straits rather than commanding a majority of the market. The bias is laughable.



    Google just managed to recreate Windows on mobile and all the crap that goes with it. It's the OEM'S that are in trouble.

  • Reply 97 of 194
    dick applebaumdick applebaum Posts: 12,527member
    ** On AI, DED uses a pseudonym. "Corrections" to challenge anyone who disagrees and to further bolster his agenda/opinions.

    If that's the case, which we've never been able to prove, the account needs banned for most of what it has said to users here, as well as for the deception involved.

    And some morons actually wanted me to have a "separate account" for moderation. Like I'd fall into that trap. :no:

    I think if you check "Corrections" prior posts you will find:
    • they are all posted to articles written by DED
    • they support the content/opinion in the article
    • they ridicule/demean anyone/anything that does not agree
    • they often include ad homs
  • Reply 98 of 194

    Quote:

    Originally Posted by rjc999 View Post


     


    You mean like the half-done ASLR implementations Apple introduced into OSX which were incrementally upgraded over time. OSX didn't get full ASLR until Lion, and iOS didn't get ASLR until IOS 4.3. JellyBean has full ASLR. ICS had partial ASLR. Part of the reason why people find exploits in Android is because of AOSP which makes it far easier, the same way WebKit and Chromium flaws are forged in competitions by explicit knowledge in the source and the ability to run analysis tools on the source. iOS is closed source, security through obscurity, but the existence of continued jailbreaks proves that Apple is no different than anyone else in securing their system, they keep fixing exploits, and people keep finding others. Apple in fact, is quite behind other companies in some areas. The vast vast majority of WebKit bugs were found and fixed by Google engineers in old code from Apple when Google introduced ClusterFuzz, a massively scaled out fuzzing system. Most of Miller's attacks on OSX were found by fuzzing, indicating Apple likely lacks large-scale internal automated fuzzing tools.


     


    I get it, you're mad because someone showed one of your heroes to be someone who twists facts and shatters your world-view of Apple as some kind of outlier amongst software engineers. It doesn't help that you don't know what you're talking about, you're obviously not a security engineer. 



     


    Hardly mad at all, but thanks for making assumptions.


     


    BTW, I have been a software engineer since the 80's (as some here on AI know). I code for both Android and iOS. I can go as far down the rabbit hole as you'd like to, but we know you're just another drive-by-troll with a new account (of which at least 2-3 appear every time DED writes an article). I highly doubt you'll stick around long enough to even have a decent discussion and will disappear like all the others before you.


     


    When you give me a reason to write a detailed and informative response (instead of assuming I'm upset that my "hero" was supposedly put down by you) then I'll respond in kind.

  • Reply 99 of 194
    kdarling wrote: »
    The basis of this article is correct:  Jobs was not categorically opposed to native apps.  He just wanted absolute control over them, and so sometimes made them out to be a big threat.  As he put it in an interview right after showing off the iPhone:


    In another interview, he even mentioned the possibility of a bad app "bringing down all the West Coast towers".  (In an ironic twist<span style="line-height:1.231;">, it was Apple-written software that actually "took down towers".   Recall their 3G code problem... it had a CDMA power ramp bug that would cause cells to overload and drop off users!  So much for a controlled environment preventing bugs.)</span>


    <span style="line-height:1.231;">Of course, Windows Mobile, Symbian, Blackberry, Palm OS etc all had had apps for years without causing such a problem.  (Blackberry apps required a signature that only registered developers had, btw.   That was not a new idea.)</span>


    --

    <span style="line-height:1.231;">Walter Isaacson's biography of Steve Jobs, written using interviews with him, also talked about Steve Jobs' resistance to third party apps at first.  According to the book, both Apple Board Director Art Levinson and marketing chief Phil Schiller kept after Jobs to allow apps, but Jobs didn't want to hear about it at first and shut down any discussions.</span>


    However, Jobs was eventually won over.  (I suspect that the lukewarm reception to his declaration that web apps were "sweet" had a lot to do with that.)  And no, WebOS apps are not the same thing at all.

    Re: the SDK not starting in Oct 2007.  Well, yeah.  The iPhone programmers themselves needed an SDK to work on the device, so obviously one had been in use for a while. 

    Re: app prices.  It's true that the Apple App Store caused mobile software to dramatically drop in price.  Great for customers, but very few developers manage to make a living off 70 cent sale revenues.

    Re: OS bugs. Apparently f<span style="line-height:1.231;">ew remember that the very FIRST iPhone software update came about because a researcher threatened to release code that would let anyone take over an iPhone, if Apple didn't put out a fix by a certain date.  Apple complied.</span>
    KDarling, ever the anti-Apple troll.
  • Reply 100 of 194
    ejaviejavi Posts: 3member
    Android is an Open Source and I do not need the Google Market/Play Store to use and/or install apps. That is a wonderful and freedom feeling. If anyone is concern about installing apps outside the official Google Play Store just install an antivirus like in Windows OS. A good one for android is Avast. STOP EXCHANGING YOUR FREEDOM FOR SECURITY. Take control over your life and your technology and stop crying like little girls. Thank you Cyanogenmod for creating this Google Free version of android and all this new privacy features. :)
Sign In or Register to comment.