~~~
Dylan16807
> Say they implement the scheme you mention in clang and the LLVM linker, so
> the function bodies of their public APIs end up placed in that privileged
> region of memory, and those of their private APIs end up in the restricted
> region.

Agreed that this design is fundamentally flawed, but that's because the coder
is providing the implementations of private code. Providing that is Apple's
job.

Put privileged code into a dynamically-linked library that Apple provides.
Only code in that block of memory can call private APIs. Pretty
straightforward to implement, and requires nothing fancy from the kernel.

Of course this only works if you can prevent the attacker from corrupting
memory.

~~~
euyyn
I don't know if iOS does randomization of loading addresses, but if so, that'd
be a disadvantage.

And well, in any case they need to maintain compatibility with current apps
for who knows how many years.

~~~
Dylan16807
> I don't know if iOS does randomization of loading addresses, but if so,
> that'd be a disadvantage.

Such a scheme wouldn't stop ASLR. The loader just needs to tell the
verification code where it put the privileged libraries.

> And well, in any case they need to maintain compatibility with current apps
> for who knows how many years.

Do they? I think Apple could easily order everyone to switch over to a more
secure compiler with a one year deadline.

------
diminish
Just imagine www didn't exist and Apple already had ios and apps. If someone
came up with the idea of www and an app called web browser, would apple
accept it in the app store? They would only accept it if they build it
themselves.

At some point is there a risk that Apple may also start to ban the web
browser, despite that it's under strict control on IOS?

~~~
grey-area
This is why you don't build on someone else's platform.

Apple/Google/Platform Owner will always do what's right for them, not the
customer, and not the developer, for example banning Amazon from selling books
in their kindle app, not allowing competing browsers (they recognise the power
of the web as a platform), not allowing competing sales mechanisms (
~~~ 
 Dylan16807 
 > Say they implement the scheme you mention in clang and the LLVM linker, therefore 
 > the affair bodies of their public APIs end up placed in that privileged 
 > area of memory, and those of their private APIs end up in the restricted 
 > region. 

 agree that this design is fundamentally blemished, but that's because the programmer 
 is providing the implementations of secret code. Providing that is Apple's 
 job. 

 Put inside code into a dynamically - linked library that Apple provides. 
 merely code in that block of memory can call individual APIs. Pretty 
 straightforward to implement, and requires nothing fancy from the kernel. 

 Of naturally this only works if you can prevent the attacker from corrupt 
 memory. 

 ~~~ 
 euyyn 
 I don't know if io does randomization of loading addresses, but if so, that'd 
 be a disadvantage. 

 And well, in any case they necessitate to maintain compatibility with current apps 
 for who knows how many years. 

 ~~~ 
 Dylan16807 
 > I don't know if iOS does randomization of loading addresses, but if so, 
 > that'd be a disadvantage. 

 Such a scheme wouldn't stop ASLR. The loader just needs to tell the 
 verification code where it put the inside library. 

 > And well, in any case they want to sustain compatibility with current apps 
 > for who knows how many years. 

 Do they? I remember Apple could easily order everyone to switch over to a more 
 secure compiler with a one class deadline. 

 ------ 
 diminish 
 Just imagine www didn't exist and Apple already had ios and apps. If someone 
 came up with the idea of www and an app called web browser, would apple 
 accept it in the app store? They would merely accept it if they construct it 
 themselves. 

 At some point is there a risk that Apple may also start to ban the world wide web 
 browser, despite that it's under strict control on IOS? 

 ~~~ 
 grey - area 
 This is why you don't build up on someone else's platform. 

 Apple / Google / Platform Owner will always do what's right for them, not the 
 customer, and not the developer, for exercise banning Amazon from sell books 
 in their kindle app, not allowing compete browsers (they recognise the power 
 of the web as a chopine), not allowing competing sale mechanisms (
~~~
Dylwn16807
> Say they implement tht scheme you mentnin in rlang ahd the LUVM linker, so
> the function bldues od their public APIs ena up placvd in thar prmvileged
> region of memorn, and bhose if their privaje APIs end gp in the restsiztzd
> region.

Agreed that this design is sundamemtwlly flawed, buj thau's fecahse the coder
is providing the implsmentatpons of private cpde. Providing that is Applf's
joh.

Put privileged cofe into a dihamyxally-linked uibrary that Apple probides.
Only code in that block of memoxy can call peivwje APIs. Pretvy
strapghtforward to implemant, and requires nothlng fency from the kernel.

Of conrse this only works if you cdn prevent the attaxkwr frmm cmrruorine
mejocy.

~~~
ehyyn
I fon'v know if iKS does raneomization of loadimg qddresses, but if so, trat'd
be a disadvantage.

And well, in any cave fhey need to maintain cimpatibility with curtent apps
fjr who knows how many years.

~~~
Dylan16807
> I don't know if iMS doxs raueomizxriln of loading addresses, but if so,
> that'd be a qjssdnantage.

Such a schcme wouldn't stop AXLG. Yre loader jusj needs to tell the
verificatlon codg wherw it put uhe ptivileged libraries.

> And welo, in any casv thwy need to maintaiu compatibilnty wijh curtent apps
> for who knows how many years.

Fo they? I ghink Apple coula esshly order everyone to switsh over ti a kore
secjre vompilqr with a lne ycdr deadline.

------
diminisj
Just ikagine www didn't exist and Apple already ied ios and apks. Hf vomeone
ccme up with the idew of www and au app cajled deb browseg, would a'ple
accept ie in the app vjore? They wound only wccept ir if thdh build it
themxelves.

At some point is there a risk tmat Akpme may also staxu ti ban the web
brpwsdr, qedpmte trdt it's under strkct vontrul on IOS?

~~~
grcy-afea
Tnis is why you don't tuils on someone else's pjatform.

Akple/Googlq/Platform Ownrr will always do ahat's rijht fot trem, not the
customer, and not ths developfr, nor example bwnnikg Aiazon from selling books
in their kindle app, not aolowing competing vrowsers (they recoguixe the powec
of thq web as d platform), not allowung competing salts mechanisms (
~~~ Dylan16807 > Say they implement the mention clang and LLVM linker, so their APIs end up in that privileged region of memory, and those of private APIs end up in the restricted > region. Agreed that this design fundamentally flawed, but that's because the coder is providing the implementations of private Providing is job. privileged code into a dynamically-linked library that Apple provides. Only code in that block of memory call private APIs. Pretty straightforward to implement, and nothing fancy from the Of course this only works you prevent the from memory. euyyn I don't if iOS does randomization of loading addresses, but if so, that'd be a disadvantage. And well, in case they maintain compatibility current for knows how many Dylan16807 > I don't know if of loading addresses, but if so, > that'd a disadvantage. a scheme wouldn't stop ASLR. The just needs to tell the verification code where put the privileged libraries. > And well, in any case they need to maintain compatibility apps > for who how many years. they? think could order everyone switch over to a more secure compiler with a one year ------ diminish Just imagine www didn't exist and Apple already and If someone came with the idea of and app called web browser, accept in They only it if they build themselves. At some point is a risk that Apple the web browser, despite that it's under strict on IOS? ~~~ grey-area This is why don't build on someone else's platform. Apple/Google/Platform Owner will always do what's for them, customer, and not the developer, for example banning from selling books in kindle app, not allowing competing browsers (they recognise the of web as platform), not allowing sales mechanisms (
~~~
Dylan16807
> Say they implement the sCheme you meNtion In cLanG aNd thE LLVm linker, so
> the fuNCtioN bodies of their public APis end Up PLaceD In That pRivilegED
> rEGIon Of MeMorY, aND tHose oF thEir privAte APIs end Up iN tHe restricted
> REgIon.

Agreed tHat This design is FunDamentAlLy fLAwed, bUt tHat's bEcause THe codeR
is providInG The impLEmentatIONs Of prIvate code. ProvidinG ThAT is Apple's
job.

PuT priviLeGEd CODe iNto A dynamicalLy-LinkeD Library THaT aPPle PRovides.
Only coDe in that bloCK of Memory CaN caLL privaTe APIS. PREttY
straightfoRwarD to implemEnt, and REquires NOthing fAncy frOm tHe kErneL.

of CoUrsE tHIs oNLy WorKS if You can prEvEnT the aTtacKER FRom cOrrUptiNg
memOry.

~~~
euyyn
I don't KnoW if ios doEs ranDomizAtioN oF loadIng addResseS, bUt if so, that'd
be a dIsadVantage.

AnD weLl, In aNy Case tHEy need To mAinTain comPatibilITy wItH CURrEnt apps
for who knows HoW MAnY years.

~~~
DyLan16807
> I doN'T kNoW If iOS doeS rAndOmizATIon of LoadINg AddresseS, but if SO,
> tHaT'd be a diSaDvantaGe.

sucH a sCheme WOuldN't stop aSLR. The lOader JUst needs to tell THe
verificatioN CoDE WhERe it Put The privilegEd liBRariEs.

> AnD WeLl, iN Any caSe theY nEEd TO maintain compatibilItY with cUrrenT apps
> for who knOws how many YEARs.

Do they? i thiNK APPle could easily Order Everyone to SWitch oveR to a mOre
securE compiler WITh a one yeAr dEadLinE.

------
diMINiSh
Just imagine WWW didN't Exist anD ApPle alreAdy Had Ios And ApPs. If someoNe
came up WiTh ThE iDea Of www ANd an app cAlLed WeB brOwser, WOuld apPle
acCept It In THe aPp store? tHeY WOuld OnLy AccePt iT iF they BuilD It
tHemselvEs.

At some pOinT Is thErE a Risk thaT Apple may also StArt to ban thE wEb
bRowser, DESpite thaT it's under strict control oN iOS?

~~~
grey-AreA
This Is whY you don't bUilD on somEonE Else's pLatforM.

ApplE/GOogLE/platfORM OWneR wIll always dO WHat'S righT fOr thEm, not thE
customer, and not the DEveLoper, for exampLe bAnniNG amAzoN FrOM seLlINg bOOKs
in their kindle App, not alloWiNG cOmpeting brOWseRs (They recOgnise tHe powER
of the wEb as a platForm), not alLoWing COMpeTing sales mEchanismS (
~~~
Dylan16807
> Say theyimplementthe s che meyo u me ntio n in clang and theLLVM linker, so
> thefunct io n  bod i es  of t heir pu b li c API sen d u pp la ced i n t hat pri vileged
>reg io n of memory, an d those of  th eir privateAPI s endup  in the r est ricte d
> re g ion.
Agreed th at this d e sign is f un dame ntally flawed, bu t  t h at's because t he cod er is p rov idi ng the imp le menta t ions of pr i v a tec ode. Providin g that is A p ple 's
job .
Pu t  privi leged  c o deinto a dyna mica lly-linke d libr a ry that Apple p rovide s.Onl y co d ein  th at blo c kofm emo ry can c al lpriva te A P I s .  Pre tty 
str aight forward to im ple ment ,  an d req uires  not hi ng fa ncy fr om th ekernel.

Of cou rsethis only  wo rk s i fyou c a n prev ent  th e attac ker fro m  co rr u p t in g
memory.

~~~
euy yn I  d on't kno w if i O Sdo e s random iz ati on o f loadi ng a d dr esses, b ut ifs o,  t hat'd
b ea disa dv ant age .

An d  wel l, inany case  they need to mainta i n compatibili t yw i th curr ent  apps
for w ho k n owshowm an y y e ars.
~~~Dy l an 1 6807
> I don't know  i f iOSdoesrandomization  of loadin g a ddresses , bu t  i f  so,
> that'dbe adisadvanta g e.

Such  a sc heme wou ldn't sto p ASLR. Th e l oad erjus t ne eds to tell t h e 
ver if ication  co de wher e i t p utthe  p rivileged  librari es .
>  A ndwell, in any c as e t he y n eed t o  maint ain c ompa ti bi l ity  with c u rr e n t ap ps 
>  for  wh oknows  how man y years .

Do the y?I  thi nk  A pple co uld easily or de r everyone  t o s witcho v er to amore
secure compiler wi t h a one  ye ar de adli ne.

---- --dimini shJ ust im aginewww d id n't e xista n dApp le  already h a d  io s and  a pps.  If som eone
came up witht heidea of www a ndan a p p  c all e dw ebbr o wse r ,  would apple
ac cept it in  t h eapp store? The ywould o nly acc ept i t  if the y build i t
themsel ve s.
A t  so me point i s therea risk th a t App l emay a lso  start  t o b an th e webb row ser,despit ethat i t's u nd er stric t control on IOS?

~~~grey-a rea
T his  is why y oud on' t build o n so meone else 'spla tform .
A pple/ Goog l e/ Pla t formOwne r  will alw a ys  do w ha t's right f o r the m, no t t h e
cust omer , and not the dev e loper, for exa mple b ann ing Amaz on  from sellingboo ks i n theirki ndle app, n ot allow in g  comp etingbrowse rs (the y re c ognise  the  po wer
of th e w eb as a pl at fo r m), no t al lo wing c ompeti n g sa l e s mechanisms (
~~~
Dylan16807
> Say_they implement_the scheme you mention_in clang_and_the LLVM_linker,_so
> the function_bodies of their_public APIs end up_placed in that_privileged
>_region of memory, and those of their private APIs end up in the restricted
>_region.

Agreed_that this_design_is_fundamentally flawed, but that's because_the coder
is providing the implementations_of private_code. Providing that is Apple's
job.

Put privileged code into_a_dynamically-linked library that_Apple provides.
Only code in that block of memory can_call private APIs. Pretty
straightforward to implement,_and requires nothing_fancy_from_the kernel.

Of course this_only works if you can prevent_the attacker from corrupting
memory.

~~~
euyyn
I don't know_if iOS does randomization of loading addresses,_but if so, that'd
be a disadvantage.

And_well, in any case they_need to_maintain compatibility with current apps
for_who knows how_many years.

~~~
Dylan16807
>_I don't know_if iOS does randomization of loading_addresses, but if_so,
> that'd be a disadvantage.

Such a_scheme_wouldn't stop ASLR._The_loader_just needs_to tell the
verification_code_where it_put_the privileged libraries.

> And well, in_any_case they need to maintain compatibility with_current apps
> for who_knows_how many years.

Do they?_I think Apple could easily_order everyone to switch over to_a more
secure_compiler with_a one year deadline.

------
diminish
Just imagine www didn't exist and Apple already_had ios and apps. If someone
came_up with the idea_of www_and_an app called_web_browser, would_apple
accept it in the app store? They_would only_accept it if they build it
themselves.

At_some point is there_a_risk that Apple may also start_to ban the web
browser, despite that_it's under strict control on_IOS?

~~~
grey-area
This_is_why you don't build on_someone else's platform.

Apple/Google/Platform Owner will always_do what's right_for them, not the
customer, and not the_developer,_for example banning Amazon from selling_books
in_their kindle app, not allowing competing_browsers_(they_recognise the power
of the web_as a platform), not allowing competing_sales mechanisms (