The Rigorous-Sandbox Edition Tuesday, September 10, 2019

How Safari And iMessage Have Made iPhones Less Secure, by Andy Greenberg, Wired

The problem with making WebKit mandatory, according to security researchers, is that Apple's browser engine is in some respects less secure than Chrome's. Amy Burnett, a founder of security firm Ret2 who leads trainings in both Chrome and WebKit exploitation, says that it's not clear which of the two browsers has the most exploitable bugs. But she argues that Chrome's bugs are fixed faster, which she credits in part to Google's internal efforts to find and eliminate security flaws in its own code, often through automated techniques like fuzzing.


More fundamentally, iMessage has innate privileges in iOS that other messaging apps are denied. In fact, non-Apple apps are cordoned off from the rest of the operating system by rigorous sandboxes. That means that if a third-party app like WhatsApp is compromised, for instance, a hacker still has to break through its sandbox with another, distinct technique to gain deeper control of the device. But Project Zero's Silvanovich noted in her writeup of the iMessage flaws that some of iMessage's vulnerable components are integrated with SpringBoard, iOS's program for managing a device's home screen, which Silvanovich writes has no sandbox at all.

Apple Software Boss Explains Why You Can't Schedule iMessages, by Buster Hein, Cult of Mac

A Reddit user recently posted an email exchange he had with Apple VP of software Craig Federighi asking for a scheduled iMessage feature for iPhone and iPad. Federighi revealed that Apple has actually considered and is still considering the feature. However, there are a couple of issues with how scheduled iMessages are received that has caused Apple to hold back on the idea for now.


Parallels 15 Review: Key Refinements Lead The Way For Windows 9to5Mac, by Bradley Chambers, 9to5Mac

The headline features of version 15 are the adoption of Apple’s Metal API and support for Microsoft DirectX 11. Version 15 users can run several CAD apps plus PC game titles as new options for Mac. Now, Autodesk 3ds Max 2020, Lumion, ArcGIS Pro, Master Series, FIFA 19, Age of Empires, Fallout 4 and more can all run through Parallels. I know for people who use Autodesk products, they have often preferred the PC versions over the native Mac ones due to various optimizations. My sister-in-law is a landscape architect, and she prefers to use the PC versions on low spec hardware over the Mac version on a souped-up iMac. With the continued enhancements to Parallels, she could easily run the PC version on top of macOS without much slowdown.

Microsoft Unveils All New To Do App To Replace Wunderlist, by Chance Miller, 9to5Mac

Microsoft today has officially unveiled an all-new version of its To Do application as it continues to integrate features of the Wunderlist platform it acquired in 2015. The company touts that the new To Do application is a major upgrade, with a new design, deeper integration with other platforms, and more.

Postbox 7.0, by Agen Schmitz, TidBITS

Postbox 7.0 now enables you to insert pre-formatted blocks of HTML into messages that also allows insertion of CSS into the \ region of a message and use of default clips on a per identity basis. Postbox comes with a library of pre-formatted clips, including checked and numbered bullets, callouts, quotes, image blocks, tables, and social follow blocks.


Changing Defaults, by Mike Schmitz, The Sweet Setup

The goal is to live your life by design, not by default. And if your current defaults are not in alignment with your vision and values, then it’s time to make some changes. Want to write more? Put Ulysses on your home screen so you see it every time you unlock your iPhone. Want to start a journaling habit? Put Day One in your dock. Define for yourself what you’d like to make the default, then make it as easy as possible.


The Dazzling Iridescence Of Apple’s Rainbow Cube On Fifth Avenue, by Jay Peters, The Verge

The new look is gorgeous, but also not permanent. Apple told The Verge that the iridescence is caused by a wrap covering the glass that is “temporary,” so see it while you can.

Bottom of the Page

As usual, I'll be sleeping through Apple's event. Oh, and for reporters and reviewers attending the event, please don't touch anything hidden underneath your chair. Apple is using them for the demonstration of the new Find My app. :-)


Thanks for reading.