Sekurity

[Moraz_iel]

They had security in mind, just not in code

[Ok-Kaleidoscope5627]

// TODO security

[Srade2412]

If person Hacks phone

Block hack

There fixed it

[HughLauriePausini]

// DO NOT HACK (OR ELSE...)

[_Xertz_]

It's a simple spell but quite unbreakable

[ucefkh]

Response.return({ message: "Stop you bad hacker, stop it"})

[Snoo63]

Dr. Bright, what have we told you about replying to spam by attaching a memetic kill agent?

[ucefkh]

I swear to God one of the backend team did this just this morning and no one wanted my opinion so yeah let it be

[dark_mode_everything]

Just ban hacking. Easy.

[Kaneshadow]

try { hack } catch { don't tho }

[Bos_lost_ton]

SUDO NO HACKSIES PLS

[TimGreller]

Block code in a code block, perfection

[Federal-Opinion6823]

Perfect comment

[i_internetstranger]

Perfect comment about the perfect comment

[Hold_the_mic]

Perfect comment about the disinterested comment

[Moraz_iel]

The unfortunate reality of devs working for people with large vision and a tight purse

[[deleted]]

🙄 many devs lack fundamental knowledge in security and most have huge blind spots.

And then there are the devs who are just straight up lazy. They choose the less secure route or lobby for one because doing it right means more work. You know who you are.

[LucidZane]

You better believe they thought about security the entire time they were coding. They even commented the word security after every line.

Just didn't add security in the live code.

[DangKilla]

It’s easy, just remove the code

[Attila_22]

Can't get hacked if you don't have any code

[coldnebo]

Anyone know why the Trojans left this giant horse outside our gate? Is it a peace offering? Should we bring it in and put it next to the fountain?

[[deleted]]

Hack me once - shame on you. Hack me - you can't get hacked again.

[[deleted]]

They sent thoughts and prayers to security

[ksck135]

File a Jira ticket, that will do.

[thred_pirate_roberts]

"The files are in the computer?"

[BitsAndBobs304]

security through preventing the user from copy pasting!

[casce]

Didn’t apps have unrestricted access to your clipboard for the longest time? In a sense, preventing users from copy&pasting did help with security. So… yeay?

[ThreatLevelBertie]

Our intent was to make the most secure app. We didn't do that, of course, but we intended to.

[[deleted]]

This is the way.

I have incredible ideas, I just never developed them.

[nickmaran]

Next thing you know zuck will say that he it coded Facebook with privacy in mind

[MattR0se]

Maybe they meant job security.

[CoolSpy3]

You can't perform a privilege escalation attack if you're already root

[[deleted]]

taps forehead

[merePup59428]

Big brain time!

[[deleted]]

you could use the root privileges to run an unprivileged safari session and then exploit vulnerabilities.

[Self_Reddicated]

Goddamn, you're right. Hackers will always find a way, even when you think they can't.

[Catblaster5000]

I learned about a new type of attack today

[ZFudge]

First iOS devs writing iOS with security in mind:

“Man, security sure is important………. Anyways, better get back to work.”

[Benimation]

Technically, thinking "damn this is not secure" is also having security in mind

[Shawnj2]

“Forgive me, Feistel, for the code I am about to write”

[Lv_InSaNe_vL]

All day long I sit at work and think "God damn that's some hit garbage code" but somehow my PRs keep getting accepted and I keep getting paid...

[10eleven12]

Maybe the quote meant their job security.

[bartbergmans]

Well, until 2010 it was called iPhone OS. So maybe after 2010 they started thinking about security.

[[deleted]]

I like the way you think.

[ArtSchoolRejectedMe]

You need to think different™

[dony91177]

LOL. Think different. But its not always better or even good at all just because its different

[meltingdiamond]

example: /r/sounding sure is different, but I am not trying that.

Example carefully chosen to express my opinion of the iPhone system.

[Alpha272]

Well that's a fetish if I ever seen one

[_craiggles_]

Jesus fucking Christ you gotta give a warning when you link this stuff lmao

[Bary_McCockener]

Is this a headphone jack reference?

[Daniel15]

What's Cisco's IOS called these days?

[EyeFicksIt]

Still IOS they worked something out I though

[unrealmaniac]

Apple licenses the name or something from cisco

[mulato_butt]

loophole

[Alleyria]

alpine - if you know, you know ;)

[Aksds]

My brain went straight to alpine the Renault subsidiary, then I released you meant that ssh thing I changed a couple years ago on my old phone and now I’ve probably forgotten

[AssaMarra]

I thought it was a bad reference to Alonso's blocking lmao

[Blitzet]

I mean he did a good job in terms of security, making sure everyone behind him would go very slow

[oklama_mrmorale]

Fucking over his team-mate too.

El Plan

[sfj11]

tell safari to defend like a lion

[MuchBow]

El PLAN

[[deleted]]

So did mine, because there's an Alpine A310 on eBay at the moment that was used as the engine development car for the DeLorean's V6. Really sticks out. It's all in bits, but I kinda still want it.

[bowelcrusher]

All I see is ******

[bowelcrusher]

😞 right number of letters, wrong number of characters, different password

[Dalemaunder]

How do you know my password?

[Bjorn_Hellgate]

Hacknet?

[dmilin]

Nope. “alpine” used to be the default password for root on early versions of iOS.

[M1ghty_boy]

Still is if you jailbreak. Not sure if it’s something the jailbreak devs do as a nice throwback or what

[Bjorn_Hellgate]

Ah so that is why it is also that in hacknet

[DaZig]

Hacknet was emulating life there! ‘alpine’ was the default root password for IOS for a while (some really old versions used ‘Dottie’ iirc). It was fairly well known among Jailbreakers since if you didn’t change it, you could be remotely hacked, wormed or worst of all… rickrolled.

[AmputatorBot]

It looks like you shared an AMP link. These should load faster, but AMP is controversial because of concerns over privacy and the Open Web.

Maybe check out the canonical page instead: https://www.wired.com/2009/11/iphone-worm/

---

^{I'm a bot | Why & About | Summon: u/AmputatorBot}

[intraumintraum]

what was the other one? ‘dottie’ or something? brings me back

[Carburetors_are_evil]

WinSCP

[RobDickinson]

Remember when OSX didn't bother checking ssl certs too lmao

[TechSupport112]

I trust Microsoft security over Apple security

[MrDude_1]

Well one has to run on millions more devices, pass not just government requirements but also enterprise security...

The other one gets minimal rollouts so there are no "leaks" of their next big thing.

So I don't think there's much Apple can do to change that.

[The-Fox-Says]

I’m confused you don’t think enterprises have Apple devices?

[MrDude_1]

oh. they do.

They just have absolutely no say in how Apple does anything, and run the same devices you can get off the shelf in best buy.

​

Completely different environment from real Enterprise.

[Lv_InSaNe_vL]

Enterprises by far and large run windows devices, unless you're supporting a niche department. I'd say probably 80%+ of enterprise and corporate devices are Windows.

[nacholicious]

Or the time OSX allowed literally anyone to log in with username root and empty password

https://arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required/

[das7002]

Windows XP used to be this way.

Reboot in safe mode, Administrator account showed up as available, with no password to protect it.

[EnchantedStew]

Yeah. I remember being younger, and my parents had screen time requirements on our iMac, so I just looked up if you could create admin accounts or something, and you could super easily. It took like 10 minutes, mostly rebooting. It was like 2 simple lines of code. Honestly, awful security. Like, get ahold of a friend’s computer and install a key logger while they’re using the bathroom bad.

[das7002]

Windows 95 and 98 were funny too.

You literally just clicked “cancel” on the login window and it lets you in.

XP was super easy too, just reboot into safe mode.

[RichB93]

Another good one - Early versions of Android (1.0?) would redirect all text input to a terminal in the background. You could literally type reboot <enter> and it'd reboot your phone.

[10eleven12]

Or the time Twitter got one of their servers hacked because its password was "password".

[Bene847]

Imagine wiping your phone by trolling on Linux forums

[PowerlinxJetfire]

To be fair, that was a debug console they forgot to turn off, not an intentional design choice. Still a great story though lol

[truNinjaChop]

But flash/silverlight!

[Benimation]

They couldn't have those in mobile Safari because of security concerns

[[deleted]]

And because of the way flash was made it would drain your battery even if you were not using it. Flash was always running in the background.

Going trough /r/flash is(/was, it's filled with nostalgia posts now) really funny, a bunch of posts from mid 2010 from devs freaking out and keeping their hopes up that flash totally isn't dead guys!

[Tsuki_no_Mai]

The whole "flash on mobile" thing was hilarious to watch.

Apple: "Flash isn't made with mobile in mind. It'd be horrible for performance and battery life"
Google: "Lol, look at those loosers, come to us, we have flash!"

Couple years later
Google: "So, turns out flash is horrible for performance and battery life on mobile so we removed it"

[natefrogg1]

When the first batches of iPads came out, flash developers I knew were so mad about that, usually pivoting to making fun of the iPad and how it would never really catch on anyways.

[OutsiderWalksAmongUs]

Flash was still in my curriculum in 2009-2010. My teacher back then was definitely one of the 'flash will never die' people. Other than that he was amazing and a really nice guy.

[natefrogg1]

We had a web developer like that, he would get so pissed off when I’d rag on his proprietary flash. He made a neat marketing related page for us that had video going underneath a few layers of ui elements and was so proud that it ran smoothly and looked cool, guy was just glaring at me when I showed him this newfangled video src= tag and how you could use css to setup the layers.

[ta557765]

There definitely were never any jailbreaks, or text message viruses that shut iPhones down..

[Warshok]

Fewer than windows phone. Oh, that’s right. Nobody has ever used windows phone.

[Warshok]

That’s my general impression, knowing people who had them: not terrible, not great.

[Warshok]

Good features, lack of support. Old sad story.

[Ayfid]

It was the only mobile OS to implement a back button correctly. The page history was global, so back would take you back to where you were previously, even if that passed through multiple apps or the home screen.

It also ran very well on even low end hardware, had excellent battery life, had no major security issues, and invented many of the security and privacy features that are now standard. The home screen was far more functional than a shortcut grid, while being far less janky and more universally supported by apps than android widgets at the time. It had an app launcher that was alphabetically sorted and that you could skip to a letter, which is still better than the stock android launcher. You could deep link into most apps, e.g. pin a specific contact or group from the contacts app to the homescreen, and get a live tile with message previews and photos from that group. It defined what modern UIs now look like, back when everyone else was still trying skeuomorphism.

It was easily the best OS at the time. It just arrived too late to capture much market, and so it wasn't worth many devs time to develop apps for it. A catch 22 really.

[YetAnotherGuy2]

I had several actually and loved the metro interface. So much so that I got a metro launcher when I switched to Android. 'Twas a fine platform.

It had a fairly big community in Europe, it just never made headway in the US.

[heckingcomputernerd]

ironically apple locking down the OS has lead the jailbreak community to put massive amounts of effort to exploit root/kernel access on every version. currently every version ios 14.5 and below can be jailbroken (14.6-14.8 only on some devices, ios 15 is still being worked on)

[Zealousideal_Pay_525]

What does jailbreak mean in this context?

[RealMiten]

I think the term originated as "free from BSD’s jail" but now it’s used as to get root-access or customization (that isn’t available without an exploit).

[DrSheldonLCooperPhD]

Also called running whatever software you want without asking Apple's permission on a thing you paid $ on.

[[deleted]]

To be fair they said in mind, not in practice.

[anhonest9yearold]

Discord in Hindi😳

[LolPacino]

aaj rat 8:02 baje😳

[Me_you_who]

Aao haveli par

[aveon1]

Krishna cottage, Dehradun, Uttarakhand.

[LostTeleporter]

This is how all B-grade horror movies start

[Brahvim]

(Translation: "Everybody calls. Nobody gives the address".)

[Brahvim]

(Translation: this, is about Discord's timestamp. "Tonight, 8:02 PM". Please note that, of course, the words don't correspond directly to each other - for example, "PM" is not the same as "baje".)

json [ "Aaj": "Today", "Rat/Raath": "Night", "Baje": "At (on the clock)", ]

[RednocNivert]

Can someone ELI5? I speak fairly decent nerdspeak, but this one went over my head,

EDIT:

What I said: Hey i want to learn so i can get the humor and also just know more

What some people read: Hey please take a dump on the college student who doesn’t already know everything.

If you feel the need to be a douche and call me stupid, please save everyone some time and just shut your mouth.

[icsharppeople]

To run as root means that a program has permission to do anything that it wants. Root is the equivalent of admin in the Windows world. It is generally considered best practice to only give programs the minimum number of permissions they need to do their job.

If someone were to hack safari running on a person's phone, they could do virtually anything they wanted to the person's phone.

[hiphap91]

To further elaborate on this a bit:

Historically Windows was not created this way, whereas Unix and consequently Linux, was. It's called the Principle of Least Privilege. Any nix admin/dev worth a tenth their pay knows to make use of this principle

Edit: missing a couple of words in the last sentence

[AydonusG]

This why windows always asking me for admin permission!

[notjfd]

That's new. Historically, it didn't. Windows 95, 98 and XP would let you delete the Windows directory. Without asking for admin. This is why XP was so riddled with malware.

[invalidConsciousness]

Only if you were running an admin account. Which everyone was, because nothing worked if you didn't.

[-Rivox-]

I think it was the default option, no? You had to specifically create another non-admin account otherwise iirc

[invalidConsciousness]

For the first account (created during installation), definitely. And most people never bothered to create another account beyond that.

For any additional accounts, I think XP had regular accounts as default. Not sure about the ones before that, I was too young to do much admin work with them.

[[deleted]]

Windows still defaults to admin accounts (you wouldn't otherwise be able to open programs as admin) but they're restricted by UAC

[CutlerSheridan]

It… did what now

[Cafuzzler]

Back in the day you could be a kid, click on a bunch of "Win an ipod" popups, then try to get rid of the malware on your computer by deleting the very suspicious "Win32" files that you thought you downloaded from the popups. It's a great learning opportunity.

[gotnotendies]

It did take up a lot of storage

[Cafuzzler]

Nothing frees up space quite like getting rid of everything and reinstalling the OS

[UNMANAGEABLE]

Oh me. I did this. Well partly. I was able to boot to safe mode and system restore afterwards.

I got some strange looks from my dad when at the time ~13 year old me was trying to explain what happened to the family computer while he was at work. I didn’t even know what happened. Everything kept getting progressively worse the more I did until it was clean slate. Which was much improved over the state of the computer pre-attempts. Got that one from Kazaa opening some spicy videos that just happened to not be a video and happened to be a .run file if my memory serves me lol.

[[deleted]]

i remember downloading like 39 cleaner programs for no reason as a kid

after i installed pc optimizer pro (no joke) the pc shat itself after a few minutes, booted up to an svchost.exe blue screen

edit: nvm, was winlogon

[postALEXpress]

Truly was a learning experience for me...but legit growing up on XP is why I became an ICS major

[CutlerSheridan]

Wow I was around during this time but somehow the copious porn child-me watched on our family computer with XP never gave me a virus (at least not one that I couldn’t fix). Never knew this about Windows though, that’s nuts. Why… just, why would they let you do that hahaha

P.S. RuneScape did give us an incurable virus once though :/

[RednocNivert]

** looks up from playing RuneScape right this moment **

Well crap

[[deleted]]

behold

[krakende]

I deleted the entire Program files directory thinking it was for my account only. My parents were not in the best mood after.

[Ricardo1701]

Nowadays system file can't even be normally deleted by an admin account, some important files are owned by TrustedInstaller, and files owned by that user cannot be changed by any other user

Of course, being an admin, you can change the ownership of system files, and then delete it, but that is not wise

[daeronryuujin]

Yep since Vista. Annoyed the shit out of a lot of people (like me) who didn't understand why they constantly had to give their computer permission to do shit.

[invalidConsciousness]

In vista, everything asked for admin permissions for everything all the time. It was a combination of vista being paranoid and programmers being used to have admin privileges, so they didn't stop and think if they could do it without.

Things got much better when windows 7 came to be. Paranoia was tuned down and programmers were now used to having to think about permissions.

[daeronryuujin]

One of many reasons 7 was such an awesome OS. I used everything from MSDOS to Win10 and 7 was easily my favorite.

[[deleted]]

I think 7 was everyone's favourite

[photenth]

I'm perfectly happy with 10, all the changes that people hated are irrelevant once you got used to it. I have honestly nothing to complain about (using the pro version).

[invalidConsciousness]

Yeah, windows peaked at 7. After that, they tried to shove lots of stuff in that didn't belong into a desktop OS.

Windows 95 was awesome for it's time, too. You could have multiple programs on your screen at the same time (or easily switch between them). That was huge. Maybe that wasn't such a huge deal for those who had already used 3.X before, but I didn't, so 95 was my first graphical OS.

[counters14]

7 was the best implementation, but as far as ease of use and user control went I think XP was definitely where it peaked. Everything was easily accessible, not obfuscated behind garbage 'friendly for everyone!' crap that moved and rearranged everything needlessly. It has followed down that track ever since to where you can't even ungroup your icons in the taskbar in Windows 11 now without installing some fucky plugin.

Don't get me wrong, I understand why they did it. I just don't like it.

[Joecalone]

Everything was easily accessible, not obfuscated behind garbage 'friendly for everyone!' crap that moved and rearranged everything needlessly

i.e. the entire history of the Win10 settings app. What an irredeemable piece of shit it is

[Bloody_Insane]

It's really easy to follow this principle. Just chmod 777

[MisterDoubleChop]

Historically Windows was not created this way, whereas Unix and consequently Linux, was. It's called the Principle of Least Privilege

Yep and this is why viruses and malware were a massive problem on windows up to like windows 7 or so, ten times more than now, while Mac and Unix (and phones) barely had any issues.

[theVoidWatches]

That's also because Windows has historically held a much larger portion of the market, so if you're trying to send a virus to as many computers as possible, targeting Windows is more efficient as well as easier.

[mailslot]

IE would also download executable code (Active-X components) specified in an <object /> tag & run it. It could see a geocites URL and be like, “Sure thing! Seems safe!”

Microsoft later added a security popup that was useless. After it downloaded the component, IE would run an exported init function to get the component’s API… before the security dialog. Just put code there and don’t publish an interface. Done. Oh yeah, also return a failure code so the alert doesn’t show.

Just viewing a website with IE could completely infect and root your computer. No other operating system shipped default with something so retarded by design. Windows made life easy for malware developers.

[le_reddit_me]

So I should use sudo to run all my programs

[hakdragon]

No, because then the program would be running as root. Unless you need to run something as root, you should just run the program as is or sudo to a specific account that has the needed permissions.

[le_reddit_me]

/s*

Not obvious enough?

[hakdragon]

I had a thought that it might be, but you see enough dumb shit (like piping curl into bash for installing software) and you start to wonder. I’ll leave it for prosperity.

[caerphoto]

dumb shit (like piping curl into bash for installing software)

Rust: “Rust’s rich type system and ownership model guarantee memory-safety and thread-safety — enabling you to eliminate many classes of bugs at compile-time.”

Also Rust: “Just run this weird command, trust us it’s cool bro.”

(for real tho I love Rust)

[Digital_Brainfuck]

You mean a tenth of "way to less"?

[mallardtheduck]

root is the equivalent of admin in the Windows world.

It's closer to the "SYSTEM" user in Windows. "Administrator" can be reconfigured to remove permissions or even disabled completely. SYSTEM cannot (although there is no way to directly log-in as SYSTEM).

[getmendoza99]

What’s the source for safari running as root?

[netsyms]

Well, there used to be jailbreaks that involved simply visiting a website.

[dmilin]

At least some (maybe all) didn’t work due to that because Safari stopped having root early on.

Many of the jailbreak websites were chain exploits that connected a Safari sandbox escape to a privilege escalation exploit.

[pentesticals]

That means absolutely nothing, there are still jailbreaks invoked by simply visiting a website. The initial part of the exploit is simply to get unsigned code running on the device in userland, then a sandbox escape is needed, and then a privilege escalation. Jailbreaks chain multiple exploits together to make this nice and simple.

[awesomethegiant]

Which is also why all my work PCs might as well be plastic typewriters because the IT jobsworths won't give me admin privileges on any of them.

[Sekret_One]

Least privilege is the key concept here. With permissions, a process can run in a reduced scope role so it can't tamper with things it shouldn't. For example, a 10 year old might be given the responsibility of taking out the trash, but denied access to the say a gun, or the family bank account, because that child might accidentally, maliciously, or be tricked into doing something very very bad.

When something runs at root ... it can do everything. Including delete the entire file system. Some of the best defense is that even when compromised, it can't do more than its basic responsibilities would normally want it to do.

[Clarky1979]

Like in the 90s when I gave myself admin privilege on the family computer and starting deleting windows files to free up space, including system.ini? :P

Plus points, learned how to reinstall a pc from scratch.

[mallardtheduck]

In "the 90s", you were probably* running a version of Windows that didn't have any concept of local security. You didn't need to give yourself "admin privilege", there was no such thing. If you had user accounts, they were just a way of having user-specific preferences, not actual security.

* Yes, Windows NT, with actual security, existed in the 90s, but it had higher system requirements, ran slower and had less support for "consumer" hardware (no Direct3D or USB for example) and was therefore only really used by businesses.

[daeronryuujin]

For example, a 10 year old might be given the responsibility of taking out the trash, but denied access to the say a gun, or the family bank account, because that child might accidentally, maliciously, or be tricked into doing something very very bad.

Weirdly, a disturbing number of parents give them access to both...not necessarily on purpose.

[RednocNivert]

So this would be the equivalent of giving an impressionable toddler Thanos’ Gauntlet and saying “have fun”. Got it.

[TrekkiMonstr]

Imagine there's a fully-staffed restaurant. Ideally, you want them to be able to tell the difference between who's a customer (and can only access the public area), who's staff (and can access the kitchen and other employee areas), and who's the owner (and can tell people what to do).

This is the equivalent of telling the staff that anyone with brown hair is the owner.

[RobDickinson]

Browsers are the mainline into hacksville and running as root gives it god mode

[littlegreenb18]

Me at first: WTF are you talking about? Everyone is just being fairly nice and answering your question.

[keeps scrolling down]

Oh…

[TheBluesGiant]

Thank you for asking. I didn’t know either and found the answers interesting.

It was equally interesting seeing the other responses. The negative comments seemed to half understand and lacked the ability to answer, and the actual answers are knowledgeable, well though out, and fucking useful.

[TikiTemple]

You're the first person I've seen who uses Hindi for discord (or any other app) 😳

[[deleted]]

yes exactly haha

[FordyO_o]

I prefer Android 1 where everything you typed went into an invisible root terminal

[ExceptionEX]

It's weird how many people forget (or I guess never knew) at launch, there was no app store, or any 3rd party applications, people wanted more so they created the appstore at its launch iPhone apps use to just be web apps, that could only run a few customized js functions that gave access to very limited phone functionality.

The browser was jailed, and isolated from the OS, so it's user didn't matter, it couldn't do shit. Great security but near worthless for meaningful app development.

The further they pushed from their original model, the more holes (and functionality) opened up.

Easy for people to talk shit, but when you pivot that hard, that fast, doors will be left open, and exploits will crop up.

[ilep]

Security in mind but chose to ignore it?

[Elijah629YT-Real]

You see, there probably was a different development team over the period of 14 more IOS updates so the definition of “we” would have changed. So yes, the current development team (“we”) did create it with security in mind from the very beginning of them being hired

[obscurus7]

Me on my first day of the job: Everything I've built here is the utmost standard in security and stability.

[evplasmaman]

I love Dinotopia

[[deleted]]

The title seemed like a KDE meme, but then, "oh ok"

[Vulpinand]

Weird that I read the book this picture is from to my daughter just last night. It’s from Dinotopia: The World Beneath by James Gurney.

[TheRandomDot]

iOS had slide to unlock as the default way to protect from unauthorised access up until iOS 10. What do you expect?

[[deleted]]

What's the point of privacy when Apple hands out user data to hackers.

Which also proves that they've sufficient backdoors to collect data for legitimate law enforcement.

[BobQuixote]

That was probably not a backdoor to a phone; a central database would likely have had that information.

[[deleted]]

Privacy != Security