Apple Says Recently Discovered iOS Mail Vulnerabilities Pose No Immediate Threat, But a Patch Is in the Works

[I7guy]

On every project you prioritise what you want to deliver and resource/talent allocation is only part of that.

Both are essential and probably noncompeting resources. What gets prioritized imo is what gets fixed, updated or added by the engineers. Those are competing resources. So don’t make it emojis or development. Both are important but each can move independently.

 

[otternonsense]

Both are essential and probably noncompeting resources. What gets prioritized imo is what gets fixed, updated or added by the engineers. Those are competing resources. So don’t make it emojis or development. Both are important but each can move independently.

I'm with you, but here's an example to hopefully illuminate my point a bit better: say you have the dedicated FaceTime dev team, and management demands adding the feature of swapping your face with a Memoji (on a crushing deadline I'm sure). The designers can only hand over the assets and the integration of this demanding ask falls squarely to the dev team along with everything else in the backlog. Then, upon release the new version of FaceTime is so broken that it has to be pulled for a few months. Is it the devs' fault? The designer's fault? The product lead's fault? Or the iOS chief's fault? At the end it still is Federighi who signs off the work and presents it in WWDC. Did you ever see him stutter?

I totally doubt it's so clean IRL, having a dedicated team per app (except perhaps Messages that Apple just loves to bloat with bells & whistles). So imagine having those devs being pulled left right and center for pet-projects-turn-main-features like Memoji, also knowing how deeply Tim "respects" design and engineering (company culture has a habit of cascading from the top).

Another culprit is the annual self-imposed delivery deadline. Good design & engineering take time. I don't think anyone will lose their marbles if Apple moves to a 2-year OS delivery cadence and really deliver, ironing out issues some of which should have been fixed years ago and instead just carry over. They've already slowed their momentum to a grind when it comes to physical/industrial engineering, so why keep iOS/macOS at this frenetic pace if they demonstrably underperform and need patches weekly?

PS. I never made it a design vs dev matter so please don't pin it on me

 

[sparkso]

I hope they can fix this problem too : Mac Mail on Mac keeps rearranging mailboxes randomly

 

[ned1]

I raised this issue on Apple Community yesterday after reading articles on both the BBC and Guardian web sites.

within 20minutes I received an email from apple stating .....We removed your post "iOS 13.4.1 mail vulnerability" because it was speculative.

 

[Jandalf]

„Apple downplayed...“
I‘m afraid it must be quite serious, as the BSI as the Federal Cyber Security Authority in Germany strongly warned its citizens Of the use of the Mail app in iOS - and I cannot recall an upper federal agency warning of a threat lightly on mere suspicion. 🤨

 

[timduck]

yeah sure apple, i have to believe what you said but after reading mr post i think there is a risk

i don’t know but it seems to me that one word here, doesn’t go with the other two

exploit, vulnerability, no risk

 

[I7guy]

I'm with you, but here's an example to hopefully illuminate my point a bit better: you have the dedicated FaceTime dev team, and management demands adding the feature of swapping your face with a Memoji (on a crushing deadline I'm sure). The designers can only hand over the assets and the integration of this demanding ask falls squarely to the dev team along with everything else in the backlog. Then, upon release the new version of FaceTime is so broken that it has to be pulled for a few months. Is it the devs' fault? The designer's fault? The product lead's fault? Or the iOS chief's fault? At the end it still is Federighi who signs off the work and presents it in WWDC. Did you ever see him stutter?

In this hypothetical situation is a process failure, which is ripe for being examined for where the failure was and improve the process. One can't succeed unless one fails.

I totally doubt it's so clean IRL, having a dedicated team per app (except perhaps Messages that Apple just loves to bloat with bells & whistles).[/quote]
Side note: bloat to you, necessary and essential features for the demographics the iphone serves.

So imagine having those devs being pulled left right and center for pet-projects-turn-main-features like Memoji, also knowing how deeply Tim "respects" design and engineering (company culture has a habit of cascading from the top).

Some projects are important to show off technology. Memoji was one of those projects and differentiates Apple from the competitors. Calling it a 'pet-project' is a bit disingenuous.

Another culprit is the annual self-imposed delivery deadline. Good design & engineering take time. I don't think anyone will lose their marbles if Apple moves to a 2-year OS delivery cadence and really deliver, ironing out issues some of which should have been fixed years ago and instead just carry over. They've already slowed their momentum to a grind when it comes to physical/industrial engineering, so why keep iOS/macOS at this frenetic pace if they demonstrably underperform and need patches weekly?

The yearly release cycle is not going to go away. It's common across consumer electronic devices manufacturers.

PS. I never made it a design vs dev matter so please don't pin it on me

Ok. /offtopic

Was pleasantly surprised to find this patched in 13.4.5. Reminds me of the windows gif bug, which persisted for years until Microsoft patched it. Shows how code persists from one release to another, sometimes year after year.

 

[otternonsense]

In this hypothetical situation is a process failure, which is ripe for being examined for where the failure was and improve the process. One can't succeed unless one fails.

Is it hypothetical though? FaceTime did get pulled for months because of calls blending into one another and other ridiculously basic bugs last year. That's miles beyond a learning experience that leads to success. It showed the process is broken.

Side note: bloat to you, necessary and essential features for the demographics the iphone serves.

Indeed, confetti and balloons have been indispensable features across demographics.

Some projects are important to show off technology. Memoji was one of those projects and differentiates Apple from the competitors. Calling it a 'pet-project' is a bit disingenuous.

If you say so. For users outside of the US for whom Messages is not the go-to texting platform it's been irrelevant for years. Also, shoehorning ani/memoji into the emoji keyboard and then making it optional following user outcry kinda has "pet project" written all over it.

The yearly release cycle is not going to go away. It's common across consumer electronic devices manufacturers

Then I guess mediocrity isn't going away either.

 

[GadgetBen]

Mail has been a joke for so long.

Apple can you please innovate this app?! Sentence and word suggestions like Gmail have would be a start.

 

[1144557]

Here's the better course of conversation, what are YOU doing about it if you arent required by work to use Mail? What solution/app are you using then.

And do you feel a 3rd party app, not the Gmail app for Gmail (1st party apps) is a bigger or lesser security hole than this issue

Bashing on/arguing about Apple employees is getting nowhere, no one has any idea who is to blame (could be multiple people or teams, and Apple doesn't really care what anyone here thinks of them.

 

[I7guy]

Is it hypothetical though? FaceTime did get pulled for months because of calls blending into one another and other ridiculously basic bugs. That's miles beyond a learning experience that leads to success. It showed the process is broken.

What it showed, is maybe it took a while to fix and test. That's as much of guess, maybe a bit more realistic than the process is broken.

Indeed, confetti and balloons have been indispensable features across demographics.

If indispensable is the low bar of what constitutes a needed feature, might as well use a flip phone, imo. There is a demographic, like me, that does us it on occasion.

If you say so. For users outside of the US for whom Messages is not the go-to texting platform it's been irrelevant for years. Also, shoehorning ani/memoji into the emoji keyboard and then making it optional following a user outcry kinda has "pet project" written all over it.

Ok, if you say so as well, since it seems now your opinion is right. If one doesn't use imessage than all the functionality in the world is irrelevant. Right? My comment still stands, but if it's your opinion of a pet project, then go with that.

Then I guess mediocrity isn't going away either.

Of course, mediocrity like many other adjectives (innovation comes to mind), has a moving personal definition. Where you see mediocrity I see excellence.

 

[otternonsense]

Of course, mediocrity like many other adjectives (innovation comes to mind), has a moving personal definition. Where you see mediocrity I see excellence.

It all boils down to this sentence. Even when Apple drops the ball hard, you see a ball drop full of excellence and grace. They can do no wrong even when they evidently do. ¯\_(ツ)_/¯
[automerge]1587734966[/automerge]

Here's the better course of conversation, what are YOU doing about it if you arent required by work to use Mail? What solution/app are you using then.

I'm using Spark for my private mail, but for work mail is non negotiable.

And do you feel a 3rd party app, not the Gmail app for Gmail (1st party apps) is a bigger or lesser security hole than this issue

Not too confident honestly

Bashing on/arguing about Apple employees is getting nowhere, no one has any idea who is to blame (could be multiple people or teams, and Apple doesn't really care what anyone here thinks of them.

I thought forums are there to have a conversation regardless if Apple cares. The people here clearly do care.

 

[I7guy]

Looks like it all boils down to this sentence. Even when Apple drops the ball, you see a ball drop full of excellence and grace. They can do no wrong even when they evidently do. ¯\_(ツ)_/¯

The above is a moving the goal posts. Bugs are bugs. Apple has them and makes some mistakes, however, in my opinion, that does not equate to mediocrity. However, even when Apple delivers the pot of gold at the end of the rainbow and earns its' excellence title you see it as mediocrity. They can do no right even when they do. ¯\_(ツ)_/¯

 

[otternonsense]

The above is a moving the goal posts. Bugs are bugs. Apple has them and makes some mistakes, however, in my opinion, that does not equate to mediocrity. However, even when Apple earns its' excellence title you see it as mediocrity. They can do no right even when they do. ¯\_(ツ)_/¯

I'm not moving any goal posts. I find the way that you dismiss the e.g. iOS 13 FaceTime fiasco, or similar fundamental security and integrity breaks that keep coming up as nothing more than a tangential learning experience and not a red flag of serious underlying issues and incompetent management, to be heavily biased in favour of the company. I'm speaking plainly and with clear examples. If you think there is no reason for concern and it's all fine/normal, great, power to you, especially if you're a shareholder.

 

[citysnaps]

On every project you prioritise what you want to deliver and resource/talent allocation is only part of that.

You may not be aware that Apple, being a large company, employs different groups of people, for different projects within the company. And different groups are able to operate and work on different projects in parallel, simultaneously.

 

[I7guy]

I'm not moving any goal posts. I find the way that you dismiss the e.g. iOS 13 FaceTime fiasco, or similar fundamental security and integrity breaks that keep coming up as nothing more than a tangential learning experience and not a red flag of serious underlying issues and incompetent management, to be heavily biased in favour of the company. I'm speaking plainly and with clear examples. If you think there is no reason for concern and it's all fine/normal, great, power to you, especially if you're a shareholder.

Nothing like saying management is incompetent because of some bugs, that's hyperbole. If that is the benchmark then Microsoft CEO would be out of a job, because windows o/s is the benchmark here and they have had their share of disastrous bugs. As far as bias, let's not forget bias run all ways in all people. If you believe there is reason for concern and management is incompetent, there are avenues to follow shareholder or not and certainly no one has to buy Apple products. Competition is great these days, or so we're told here on MR.

 

[GlenK]

SO they just discovered issues with mail!! May want to take a glance at the feedback from their users!!

 

[timduck]

people ask for facts, you give them facts but they still have a tough time proccesing the truth and still want to fight and arguee what is right in front of them, you guys wants to defend apple when apple screw up, that’s why apple takes for ever to fix bugs and vulnerabilities because you guys act like is all right, apple get the wrong message and they think is all right because you guys accept mediocresy, we in the other hand like things to be the way it should be, the closest thing to perfection, i know no os is perfect, i know most os have bugs, but apple fix a bug but then replace it with another new bug, this sound like microsoft years ago, now it seems like microsoft is the old apple and apple is the old microsoft. if apple do something good i say yes that’s good but don’t expect me to say that is good when is really bad and unacceptable

if is a strike i’m not going to call it a low ball

if is a strike then it is a strike, let’s be fair

this is not about i like apple, i’m an apple fan, this about calling it like it is

apple is running out of time and they only have afee years left to start doing things right once again or the ship will sink to the bottom of the sea

who’s responsable for that, the sailors or the captain?

 

[otternonsense]

You may not be aware that Apple, being a large company, employs different groups of people, for different projects within the company. And different groups are able to operate and work on different projects in parallel, simultaneously.

I wonder if you read anything I wrote above. It's a luxury to have dedicated teams, and Apple could theoretically afford them.

Regardless, the proof is in the pudding, and the reality is a constant whack-a-mole with bugs and languishing core apps, some cosmetic and some quite serious, on a weekly basis. I said "I presume" it's happening because of a workforce spread thin on tasks with highly pet-project like goals in a company that's now defined more by politics than commitment to design & engineering. Probably they're still under the illusion they're delivering the same quality as back when Steve would decapitate the dev lead for getting an icon wrong.

I don't know what's happening in Cupertino. Neither do you. What's making you so "aware" in ways that I am not?

 

[ElectricPotato]

We removed your post "iOS 13.4.1 mail vulnerability" because it was speculative.

That's what happens when protecting the brand is more important than communicating useful information or solving problems.

 

[1144557]

I thought forums are there to have a conversation regardless if Apple cares. The people here clearly do care.

How is guessing what Apple exec to blame helpful? There is a bug, bottom line. All the consumer can do is react now.

"Who dun it" isn't relevant as no one here has any influence who Apple hires or fires. Read the 3-4 posts below yours, explains it well. If employees were on the chopping block for bugs, there would be no one left

 

[KJL3000]

What about older devices? Like the iPhone 5? Lost forever?

 

[gnasher729]

How come iOS 5 and earlier users are free from that exploit?

Find a device first to reproduce it that is still working.

 

[otternonsense]

How is guessing what Apple exec to blame helpful? There is a bug, bottom line. All the consumer can do is react now.

"Who dun it" isn't relevant as no one here has any influence who Apple hires or fires. Read the 3-4 posts below yours, explains it well. If employees were on the chopping block for bugs, there would be no one left

It would be unfair to put devs on the chopping block for bugs. But it would be perfectly fair to hold the division head accountable for consistently iffy performance across the board (iOS/macOS) for years. The fish rots from the head down and that's no guesswork.

 

[citysnaps]

I wonder if you read anything I wrote above. It's a luxury to have dedicated teams, and Apple could theoretically afford them.

Regardless, the proof is in the pudding, and the reality is a constant whack-a-mole with bugs and languishing core apps, some cosmetic and some quite serious, on a weekly basis. I said "I presume" it's happening because of a workforce spread thin on tasks with highly pet-project like goals in a company that's now defined more by politics than commitment to design & engineering. Probably they're still under the illusion they're delivering the same quality as back when Steve would decapitate the dev lead for getting an icon wrong.

I don't know what's happening in Cupertino. Neither do you. What's making you so "aware" in ways that I am not?

.

"I don't know what's happening in Cupertino. Neither do you. What's making you so "aware" in ways that I am not?"

Being a systems, hardware, and software engineer for many years in Silicon Valley for a handful of both large and small companies.

If you want to believe Apple's "emoji implementation team" and the group that handles the Mail application are the same or share responsibilities and compete for resources, please feel free. I think more knowledgeable people who work in tech in this area would have a good laugh, though.