Ansil849

This was mentioned in the article from yesterday, https://theintercept.com/2023/02/14/whistleblower-image-crop...

It might stun you to learn that the US is part of the west and isn't blocking RT.

Golly gee, you sure got me there on that! Let's rephrase to "parts of the West", what impact does that have on the argument that Western powers engage in media censorship as well?

I don't want to stun you too much, but the west is not some uniform block of countries.

LOL. You understand it is _literally_ called the "Western Bloc", right? https://en.wikipedia.org/wiki/Western_Bloc

I'm in the US

That's great. The block is in the EU. Which is in...the West.

Sure:

RT- Russia Today English

RT- Russia Today UK

RT - Russia Today Germany

RT - Russia Today France

RT- Russia Today Spanish

Sputnik’

Source: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L...

Or here's a mass media summary if you don't want to read the official documentation: https://www.reuters.com/world/europe/eu-bans-rt-sputnik-bann...

I'm so tired of "whataboutism" being used to as some attempt to shut down an argument. It is perfectly valid to point out hypocritical arguments. And it might stun you to know that the West isn't solely composed of the US. Try going to RT from the EU - https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L...

Take special note not just of the block, but of the anticircumvention provisions.

The great firewall of China prevents most of their citizens from seeing news that isn’t the party line

Totally not like how access to Russian news outlets has been blocked by parts of the West.

You should not. But if it makes you feel any better, Americans do the same thing by allowing Chinese tech like Zoom and TikTok operate in their country.

Lockdown is literally presented by Apple as being for people targeted by APTs like those developed by NSO Group, therefore I expect it to prevent attack vectors used by these APTs, like exploitation of the Developer program to facilitate sideloading malicious apps. I don't feel like this is an unrealistic expectation, and not having the mode actually do that amounts to security theater, which is a far cry from decrying everything as such.

"What constitutes an enterprise that should be allowed to have 'enterprise apps'"

Apple has a list of requirements - https://developer.apple.com/programs/enterprise/ - for example, a company needs to have at least 100 employees. The issue, however, seems to be how stringently these requirements are enforced, or whether they are at all. In the case of Hermit, the Italian spyware company seems to have created a fake company and tricked Apple into granting the fake company access to the developer program. Now, the interesting question for me is whether the fake company actually managed to pass all of the requirements, like giving Apple a list of 100 fake employees, and whether Apple actually performed their due dilligence and checked whether the employee list was real, or whether they accepted it at face value, or didn't even require it.

In other words, I think a key takeaway from the latest incident is Apple needs to take accountability and harden their Enterprise program entry requirements, and I haven't seen anything about that being the case.

Running an enterprise app still is not a trivial single tap on iOS.

Yes, but still successful, as Hermit demonstrated. So my question is whether Lockdown mode would have prevented APTs like Hermit which it claims to prevent against. If not, then the move is security theater which doesn't address the actual flaws (like poor vetting into the Enterprise Program) being successfully leveraged in the wild.

High-level targets (for whom this mode is specifically advertised) are likely aware of the dangers of installing apps.

I firstly don't believe this is true at all, plenty of high-level targets are not tech savvy; but more to the point of Lockdown mode, you could then say the same thing about most of its other features ("High-level targets are likely to already be aware of the dangers of doing $thing_Lockdown_prevents").

So this would have prevented Hermit as you'd need to install a new configuration profile to allow sideloading of applications from that source.

Are you sure that's true? I haven't seen a Hermit sample firsthand, but from everything I've read about it targets did not need to install an MDM profile, they simply needed to click a link. Looking at Apple's distribution guidelines - https://support.apple.com/en-bw/guide/deployment/depce7cefc4... - MDM is listed as one option, and simply going to a link is listed as another:

There are two ways you can distribute proprietary in-house apps: Using MDM Using a website

It seems like the latter was used, so I don't think installation of a custom profile was required, which brings me back to my original question of whether Lockdown would have prevented it.

It's not clear to me if Lockdown Mode would have prevented Hermit, the latest mobile APT which targeted iOS via sideloading by enrolling in the Apple Developer Enterprise Program.

The list of lockdown features don't seem to explicitly list that in-house app sideloading is disabled - is it? If not, then this mode seems like security theater from Apple, in that it doesn't actually lock down the parts of the attack surface that are actively being leveraged. How about instead, or better yet alongside this, Apple explains how they granted entry in the Enterprise program to the spyware company, and what measures they're taking to prevent it from happening again.

Wanted to say thank you everybody for your nuanced responses, this has helped me understand the issue better.

You can't take back someone's education

Sure you could, you could rescind someone's diploma so that they no longer have the degree.

How failure to generate income on their degrees is a lender's problem? Clearly,there is an issue with inflated costs of getting a degree and finding a job with a low-demand degree, but why try solving it at the lender's expense?

Yeah, I've never really understood this logic either. If someone lends money from me to, let's say go buy a tow truck, and then is not able to repay the loan because there are too many other folks with tow trucks (or for whatever other reason), why should that be my problem? I gave money with the expectation that it would be paid back. That is by definition what lending is, yet student loans are somehow touted as an exception where repayment shouldn't be seen as compulsory.

An overworked population is precisely the one that needs thought-provoking cinema.

The only winning move is not to play.

Yes, this is by design: https://bugzilla.mozilla.org/show_bug.cgi?id=1369357

Privacy is at odds with usability, sometimes.

In practice, more details would be useful.

More details (the lists of whitelisted fonts per OS) are here: https://bugzilla.mozilla.org/show_bug.cgi?id=1336208

You can create a separate Firefox profile to effectively use as your PDF reader application.

To lessen font enumeration attacks in Firefox, you can go to about:config and make sure privacy.resistFingerprinting is set to True.

If 1000 big youtubers put $100/month toward an association or union of some kind, they could afford a $100,000/month legal team to combat this.

Millionaire youtubers can already afford high-priced lawyers if they want to, I'm not worried about that.

Who I am worried about are regular people who create content but don't have large followers and don't make to it to the frontpage of HN, but still get hit by copyright trolls.

For what it's worth, the work of an few engineers implementing the business decisions of their employer does not make those people inherently evil

I think when people do unethical actions, it makes the person doing the unethical action unethical. People are defined by their actions. I'm also tired of this 'need to pay the bills somehow' excuse. Someone who has an engineering job at Facebook has vast career options.

Comparing American football and hockey and other brutal sports to a high five is what dilutes the meaning of the word. These are sports where men aggressively assault each other. They are institutionalized violence.

The answer to this is sports. War is competition through violence.

Absolutely not. Sports is competition through violence, as well. Watch a game of American football, or ice hockey, or basketball for that matter and be able to say otherwise with a straight face.

The answer is cooperative, not competitive, activities.

This seems unrealistic. Especially because, as I pointed out in another comment, there are tons of other far easier ways for someone to get someone's first name at the airport. I think perhaps people are misunderstanding how this tech works: you need to be standing in specific coordinates for the information to be visible to you.

Sorry, I have zero interest in discussing some nonexistent hypothetical. Obviously, a technology that 1) was not opt-in, but universal, and 2) broadcast your information to not just you but everyone, would be problematic. You might as well add that this hypothetical system also broadcasts your credit card number while you're at it, and say that you would find this quite troubling indeed.

That being said, I think it would be totally fair for a person to feel embarrassed about any personal information being displayed publicly on a monitor without their consent.

OK, but this is a pure fantasy, if not outright delusion. The way this display works is 1) it requires your consent, and 2) the information is only visible to a person standing in specific coordinates, i.e. you.

hold up your boarding pass for everyone to see, which is what is implied by a big screen.

I feel like you missed the part where only the person standing at specific coordinates can see your name, i.e. you. That's the whole point of this tech.