Why? This is about a security flaw in Apple's system and it should be judged by Apple's standards. Other systems are completely irrelevant to the issue.
Agreed. Shouldn't be hard to implement either. I would also like them to bring back the separate warning if an app bundle attempts to install an embedded provisioning profile, and to make provisioning profiles visible in the settings again as it was before iOS 8. I see no point in hiding them from the end user.
Nope. No password required, and no mention of "malicious things" that may "harm your phone". All you see on iOS 8 is a dialog box saying "<url> would like to install <app>", and then you can tap "cancel" or "Install".
No. I have installed an enterprise app from my employer. There is no mention whatsoever about enterprise profiles or malicious code. When you try to install, all you get is the prompt I mentioned above. Then, when you run the app for the first time, you get a prompt saying "Do you trust the developer <name> to run apps on your phone?". That is all you ever see.
Nothing ever is, right?
And then there is the real world where security needs to be designed with real people in mind, however technology-illiterate they might be ...Yes. Enterprise profiles are commonly used to enable installation of unapproved apps like emulators and "free movie" streaming apps.
It can affect any device, jailbroken or not. That said it doesn't mean that it's actually affecting any device out there in the real world or that it would affect many, just that the flaw is there and can be exploited.
Silly media making this a big deal.
This is exactly the same as if you click something online, download an application, and application asks you for your admin password, then the OS tells you explicitly that THIS MAY HARM YOUR COMPUTER, and you still click OK.
It's giving the car keys to a random person and being surprised when they take your car. Silly.
Security researchers agree that this is NOT a big deal and does not pose a security risk. It was shown at a large security conference a year ago and even then researchers agreed it wasn't something to worry about. Now someone else reports it and the media (MacRumors included) grabs hold and blows it up into a big deal that it isn't.
----------
They're allowed but it gives a big warning to not install anything you don't know where it's coming from and tells you very clearly that it may harm your phone or allow malicious things to be installed then you have to give it your passcode and then confirm it again. If you're that stupid it's really your own fault. It's no different than doing the same on your desktop OS.
This pretty much summarizes it fairly well. A lot of people seem to concentrate and discuss something else entirely and not the actual flaw and potential exploit. And then there are also people who either blow it out of proportion or talk about it being blown out of proportion when neither one of those things is true either.
