Apple Releases iOS 9.3.5 With Fix for Three Critical Vulnerabilities Exploited by Hacking Group

[smacrumon]

Because how do you update lower level system libraries that are in use and/or are encrypted? I mean this is like asking why can't we already land on the Sun because it's 2016 and we have all kinds of heat and fire retardant materials and all that, while just conveniently ignoring reality that we just can't do that even in 2016 with what we have now.

C DM, think big, just like the sun! This is system software, not the solar system. We have control over system software. Just because things have been done one way for a long time, doesn't mean it can't be done another way in the future. In fact, patching without rebooting is already a solved problem:
http://www.zdnet.com/article/no-reboot-patching-comes-to-linux-4-0/
http://www.linuxjournal.com/content/no-reboot-kernel-patching-and-why-you-should-care
I'm done for the day. Good day and good evening to all.

 

[C DM]

C DM, think big, just like the sun! This is system software, not the solar system. We have control over system software. Just because things have been done one way for a long time, doesn't mean it can't be done another way in the future. In fact, patching without rebooting is already a solved problem:
http://www.zdnet.com/article/no-reboot-patching-comes-to-linux-4-0/
http://www.linuxjournal.com/content/no-reboot-kernel-patching-and-why-you-should-care
I'm done for the day. Good day and good evening to all.

It seems like you've missed an easier reply about this. That said, seems like putting this to bed is about where we are at when it comes to it all.

 

[Shirasaki]

Where is iOS 8 and earlier security fix? Not all of us can run iOS 9&10

All iOS 8 devices can run iOS 9 so, Apple will not patch iOS 8 anymore.

 

[sbailey4]

Apple has released about a dozen updates to iOS 9 this year. That's a lot more than in recent years. Sure, security is a must, but do users need to be disrupted in the process? There's got to be a better way when it comes to security updates vs fancy new feature updates. Apple can't keep annoying users with updates, regular users interpret these requests as annoying experiences, some don't even understand the reasons for the constant updates. About 12 this year for iOS 9, there's got to be a much better way that "just works".

You are aware there is a "install later" option and it will install while you are asleep yes? So you wake up and you are all nice and updated and were not "inconvenienced" for the 10 minutes it takes to install, other than to select the "do it later" button for 1.5 seconds.

 

[Shirasaki]

I wonder if users wider are used to erratic updates or just find it another annoying pop up message from Apple? Remember the little thing called user experience?

There is always a point where user experience is secondary. And this security update could be such a point.
[doublepost=1472167163][/doublepost]

Absolutely. This is the point I'm trying to make. Apple is moving further away from their mantra, they are acting more reactive than proactive.

Then how people fix a security flaw if it is remained unseen? How to be "proactive"? Even in PC system, proactive antivirus and anti malware is still a hot topic.

 

[HEK]

Yep, I'd be screaming "invasion of privacy" or something like that because I'm a big hypocrite and completely inconsistent. ... No I wouldn't.

BTW, It shouldn't reboot. Why is a reboot needed in 2016? (Errr, err, please wait while Windows 95 restarts.)

This is all part of the design and the continual finessing of iOS I'd like to see Apple improve on. iMessage balloons are cute, but these other things matter too.

So you want to alter the operating system that a computer is currently running. Change the code, but not restart using the new code. But expect the new code to supersede the old code. Neet trick, and why is this important to you again?

 

[sbailey4]

I think you know what I mean. Mainstream consumers (regular users) and then super interested high tech people who live partly at MacRumors.

Yeah like my 83 yr old uncle who has 2 iPhones and iPad and 2 macs. He doesn't seem to be to annoyed that he has to press OK when it tells him there is an update. Even though he isn't real sure what the update is for but assumes Apple has a good reason to provide it and is happy all he needs to do is press ok. Would he count as a "regular user"?

 

[duffman9000]

Waiting for someone to send out link disguised as Apple IOS Update. Now that would be a helluva link.

True. "Hey honey this is a critical iPhone update please install ASAP!"

That's why I always check for updates from within the Settings app. If that fails I guess I'm screwed regardless.

 

[mdelvecchio]

What's remarkable and sad is that some still view this as a negative and an opportunity to criticize Apple. Not a shocker I suppose.

only on MR, now an apple site infested by people who hate apple. sad.

 

[MoXoM]

Volume hitting Apple servers. People on east coast getting home, all updating at once

Thankfully it worked for me at around Midnight (in the UK)...

 

[Shirasaki]

This. And the last minor iOS update straight up wiped my phone, so I'm not updating anymore.

Even without that problem, excessively frequent updates are annoying. Each requires installation time, re-setup of iCloud (which poses its own risks), etc. For those who'd rather wait a bit and get every second or third update, there are annoying popups that bug you every few hours. This is almost Windows 10 level.

And you have no way to shut it down. Oh, you can install tvOS profile to shut down automatic update for quite a while.

 

[Keirasplace]

True. But is there a new OS needed every 12 month? I say no. We had way longer life cycles back in the days of OS X and nevertheless high quality operating systems. Right now the OS development nearly reached the state of rapid prototyping. So it's getting tougher day by day to not open any new security holes if you must redesign and innovate (the latter is welcome of course) permanently. Of course this is the fate of software development, but one should question if the release cycles are just perfect as they are right now...I just assume a potential delay like we faced with e.g. Leopard would be a no-go these days, perhaps with the risk of potential security holes...

Well, what's in a yearly release is totally arbitrary of course. How much it actually changes is left to to Apple.
It seams Apple is spreading out feature add ons throughout the year instead doing a big release (probably going from waterfall (or variant) to rapid dev). Parts of the systems can be devellopped at different speeds, its only when there is a dependency that pressure from one a new feature would impact an already established and debugged part of the system.

But, even under the hood, Apple has been changing A LOT in the last 3 years. It is surprising there are not more bugs considering the breadth of those changes. IOS was a much different OS initially than it is now.

 

[sbailey4]

In other news the 9.3.5 doesnt seem to be having any issues for anyone?

 

[robertcoogan]

Would someone please copy+paste this into their iMessage and see if Apple's patch works?

xcrun swift all_your_base_are_belong_to_us.swift

 

[C DM]

All the complaining here about iOS updates, while in the alternatives section there are posts like the following when it comes to Android updates:

Google has got to do something about this update problem. I know you can just buy a Nexus but we really should be aspiring to more in 2016.

I'm seriously considering switching back to iOS because I really am fed up with it now.

 

[Retired Cat]

Given the personal targeted nature of the malware using these exploits, is it reasonable to say that most iOS users haven't been hacked by NSO Group (the company that sells the malware) in the past 2 weeks?

In other news the 9.3.5 doesnt seem to be having any issues for anyone?

No issues on my iPhone 5.

 

[Glideslope]

Is it odd that Apple would release so many updates to iOS over a year? We're at iOS 9.3.5 now.

Think back to iOS 7, we got to 7.1.2.

Think back to Mac OS 7.1.2

 

[VanNess]

Think back to Mac OS 7.1.2

And Mac OS 7 - System 7 - went to 7.6.1 (from 7.0)

 

[HEK]

only on MR, now an apple site infested by people who hate apple. sad.

I'm discusted with this site. I'm heading over to Samsung site and piss on their parade.

 

[citysnaps]

only on MR, now an apple site infested by people who hate apple. sad.

What's really sad, is that continually tearing down someone or some company is likely the only way they can feel good about themselves, creating a feeling of power.

 

[Glideslope]

And Mac OS 7 - System 7 - went to 7.6.1 (from 7.0)

Sure did. I wonder how many of the complainers on these forums actually lived through System 7. I still have nightmares over 7.1.2 (ok, I'm exaggerating.)

 

[Sefstah]

Yes, never tried an Android device, but I see when people use an Android phone right in front of me, or they give it to me to read something or talk to somebody. On occasion I did have to help somebody figuring something out.
Just not using Android on a daily basis.

You avoid mentioning the "innovative features" iOS does not have and say you don't mention any in fear I would read them.

Then you say Android has what is missing in iOS, so if they are in Android they are hardly a secret and no longer innovative if out for a while. BTW: Both iOS and Android have already copied plenty from each other.

If YOU have innovative features for iOS which nobody but you has thought of, maybe go to a developer and create an app.

If you are just complaining about iOS not having some Android features you like, that is not a discussion of "innovation" missing in iOS. Everybody uses their phone in a different way for different tasks.

There is just no "innovative feature" in iOS that I am missing. Actually for me it has too many options in the attempt to make it customizable.

I am very basic, so I do not need any "tweaks or eye candy" to something that is working fine for me.

If you do not like iOS why are you using an iPhone or even on this forum?

Use whatever makes you happy, but don't complain about "innovative features" if you can't even name one.

If your idea of innovation is "Live Photos" then thats great. Unlike you, I use both Android and iOS. I love some things and hate some things on both of them. Im not going to waste my time writing about what Android can do that iOS cant(google it) because you just have to experience for yourself. Like I said three times already. In case you still don't get it!!

 

[RedOrchestra]

What's really sad, is that continually tearing down someone or some company is likely the only way they can feel good about themselves, creating a feeling of power.

Sounds like RLA, the Ryan Lochte Approach.

 

[Glideslope]

only on MR, now an apple site infested by people who hate apple. sad.

Not true. I don't hate Apple at all. I am very dissatisfied with the direction of the current CEO. I use almost every product they create, and enjoy the ecosystem a great deal.
One can be critical of a companies Leadership and not be a "Hater" of the company. You need to separate the two.

"Agitate him and ascertain the pattern of his movement. Determine his dispositions and so ascertain the field of battle. Probe him and learn where his strength is abundant and where deficient." Sun Tzu

This is not "Apple Hate."

 

[TheMadCow]

Hmmm. Really? "pushing forward with more fixes"? What about push forward with a release that doesn't require fixes when released. Isn't this like "a ship with a hole in the bottom, leaking water, and [the] job is to get the ship pointed in the right direction"?

Apparently you don't know what you're saying, so I'll make this simple for you. These are exploits that were discovered. Exploits are NOT uncovered in beta testing and are frequently NOT bugs in the software. Usually they're a combination of how the software interacts with the hardware in way that causes a crash in a unique way. These are fairly rare. What is even more rare are those instances that allow you to interact with the hardware after one of these crashes that allows you inject code that the phone or device executes. This is what is commonly called a "jailbreak" for those that use them. Those that find these very rare instances can also sell them to a security company (or now, to Apple with their new bug bounty) that can exploit this without anyone being aware they can do this. This is what the NSA and such all are constantly on the search for. Why? Because they frequently get patched or invalidated with new software versions, some don't and they're even more valuable.

Since Apple was alerted to these exploit holes, they were able to patch and fix them. This has nothing to do with releasing "bad" software. Finding an exploit hole is like going to Vegas and hoping you hit it big. It's almost that much of a long shot to discover one.