I agree with @chronic. There was no attempt to verify facts or claims with our team. There is no demo or proof of concept.
For example, the timeline in ironpeak post has many inaccurate or misleading claims, and it is not even in chronological order.
For example, the timeline in ironpeak post has many inaccurate or misleading claims, and it is not even in chronological order.
https://twitter.com/chronic/status/1313476691184947200
To be clear, the public @checkra1n jailbreak does not currently have any SEP exploit or mitigation bypass whatsoever for any device. Ironpeak claims that it does.
When we write things for public consumption, it is important that we are clear, accurate, and get basic facts right.
When we write things for public consumption, it is important that we are clear, accurate, and get basic facts right.
Good writing about deeply technical topics requires collaboration with subject-matter experts. It requires editing and peer review. There is no way around it.
I do not know what "vulnerability details" ironpeak emailed to Apple, but it was most likely a low quality bug report.
I do not know what "vulnerability details" ironpeak emailed to Apple, but it was most likely a low quality bug report.
A quality bug report includes a proof-of-concept or a demo and accurate information about the discovery.
microsoft.com/en-us/msrc/bou…
Ironpeak blog post has none of the above. It would be surprising if their email to Apple was any better or more useful than the blog post.
microsoft.com/en-us/msrc/bou…
Ironpeak blog post has none of the above. It would be surprising if their email to Apple was any better or more useful than the blog post.
To communicate clearly, good writing should also put things in context:
Are there any Macs that are safe to use "if left alone and physical access was possible"?
The answer is no, but most modern computer hardware, including all Macs, is not safe in that scenario.
Are there any Macs that are safe to use "if left alone and physical access was possible"?
The answer is no, but most modern computer hardware, including all Macs, is not safe in that scenario.
A well-intentioned blog post seeking to inform the reader would avoid any appeal to fear.
Ironpeak does the opposite. These quotes are verbatim:
"I have sources that say more news is on the way in the upcoming weeks. I quote: be afraid, be very afraid."
en.wikipedia.org/wiki/Fear,_unc…
Ironpeak does the opposite. These quotes are verbatim:
"I have sources that say more news is on the way in the upcoming weeks. I quote: be afraid, be very afraid."
en.wikipedia.org/wiki/Fear,_unc…
More:
"Crouching T2, Hidden Danger"
"Let’s talk about a vulnerability that’s completely exposing your macOS devices while most are declining to act nor report about the matter."
"Be angry at news websites & Apple for not covering this issue"
"be prepared to replace your Mac"
"Crouching T2, Hidden Danger"
"Let’s talk about a vulnerability that’s completely exposing your macOS devices while most are declining to act nor report about the matter."
"Be angry at news websites & Apple for not covering this issue"
"be prepared to replace your Mac"
For the record, I do not know what "more news is on the way in the upcoming weeks" that we should be afraid of.
I agree that Apple should have issued an official security advisory as soon as possible, and it is unacceptable that they have not done that yet. It has been months.
I agree that Apple should have issued an official security advisory as soon as possible, and it is unacceptable that they have not done that yet. It has been months.
Apple should inform readers about #checkm8 and #blackbird in Apple Platform Security Guide, identify the potential security threats, and let us know how to prevent or mitigate them.
en.wikipedia.org/wiki/Threat_mo…
en.wikipedia.org/wiki/Threat_mo…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
