

Who says Apple Inc. doesn't have a heart?














Comments     Threshold


RE: End of Days
By omnicronx on 10/19/2007 10:11:15 AM , Rating: 4
Heh, funny.. Weird though how you don't hear about any Microsoft ppc phones being vulnerable to viruses. I've never heard of anyone having virus or security trouble with their WM5 or WM6 OS. Is the Iphone really that vulnerable?

RE: End of Days
By kelmon on 10/19/2007 10:19:47 AM , Rating: 3
I detect a degree of shit-stirring here but let's answer this by saying that if Apple is making security a priority then that can only be a good thing. I seriously doubt that the iPhone is vulnerable beyond being a highly visible target since so many people seem to love to hate it but it makes sense that they aren't taking chances.

RE: End of Days
By MrDiSante on 10/19/2007 11:32:42 PM , Rating: 2
I'm not sure that Apple is making security a priority. To me it seems more that Apple is making keeping a strangle-hold on the device a priority. Choosing which programs you can and can't run makes it harder to get free ring-tones, unlock and then iBrick your iPhone, and of course not pay for all those wonderful iApps.

RE: End of Days
By TomZ on 10/19/2007 10:32:46 AM , Rating: 3

I think maybe we misinterpreted what Jobs meant by "security." Probably he actually means making the iPhone more tamper-resistant to avoid hacks like those that unlock it. Because otherwise, I agree with you - I don't see why iPhone would be any more or less susceptable to attacks than any other smartphone.

But in any case, if they are truly going to "make it more secure" (in the normal sense of that phrase), then it can only be a good thing. So far they've only made a half-hearted attempt at security on the iPhone.

RE: End of Days
By GaryJohnson on 10/19/2007 12:00:23 PM , Rating: 2
There is malicious software that runs on windows mobile. It's not as prolific as it on windows desktop, but it is out there.

There are fewer points of entry for evil code though, no browser helper objects, no non-executable e-mail attachments that can run malicious code.

RE: End of Days
By omnicronx on 10/19/2007 12:04:30 PM , Rating: 2
you would have to essentially download a virus made specifically for ppc, and run it.. avoiding the 'do you want to run this unauthorized code' message ;)

RE: End of Days
By GaryJohnson on 10/19/2007 12:47:11 PM , Rating: 2
Yes exactly, but that does include malicious software disguised as something benign like freeware bust-a-move games or tip calculators. This is probably what you'd have to be concerned about with the iPhone as well.

There are other potential points of entry for bad code on windows mobile, like java midlets. I'm not sure exactly how malicious you can be with a midlet though.

RE: End of Days
By kelmon on 10/19/2007 1:15:16 PM , Rating: 2
Some people are going to hate this but I'm very much in favour of it. Rumor (yeah, OK...) has it that both Apple and Nokia are looking to provide central repositories of "blessed" applications that users can install from. The benefit of this is that all applications will have been vetted as being OK, both from a functional and security perspective. The downside of this is that developers won't be able to release applications that Apple doesn't like, either because they are bad applications or perhaps do something that is contrary to Apple's business model (definitely into iffy territory there). It very much depends on how heavy-handed Apple would be as to how well this would work, plus how quickly they can vet applications submitted to them before making them available to Joe Public. It remains to be seen whether this will happen (no doubt the arrival of the SDK will answer that) but there is a lot to be said for only downloading applications from a trusted source.

RE: End of Days
By TomZ on 10/19/2007 1:44:47 PM , Rating: 2
I think this is realistically the only way you can secure the platform - by having third-party apps certified in the way you describe.

That doesn't exclude, however, the possibility that Apple will allow non-certified apps to executed. In this case, the device might give some extra security warnings compared to certified apps.

RE: End of Days
By kelmon on 10/20/2007 6:08:40 AM , Rating: 2
I think that this is what is coming in Leopard and therefore probably already exists in the iPhone - digital signatures for applications. I guess the theory is that if you download an application that has been appropriately signed then you can feel safer about running it but if the application doesn't have such a signature (or a bad one) then it's a case of "buyer beware" and it's your own choice to take the risk or not.

I do wonder, however, what level of confidence can be assigned to a signed application. What will it take to get a signature and can they be spoofed? Again, I'm sure we'll be hearing much more about this towards the start of 2008.

RE: End of Days
By Ralph The Magician on 10/19/2007 9:28:06 PM , Rating: 2
Is the iPhone really that vulnerable?

Yes. Currently, everything on the iPhone runs as root. All 3rd party apps run as root. That is a HUGE security issue.

I suspect this may be one reason why it will take a while for an SDK. They will have to rewrite the iPhone OS in a way that allows for separate user profiles, and probably create a distinct user for 3rd party applications. I'd expect to see iPhone software update Version 2.0 before we see an SDK.

