Interesting how all of these "security content" documents frame the bug fixes as "improvements." For example, in this one:
This issue was addressed with improved data protection.
An out-of-bounds write issue was addressed with improved input validation.
A logic issue was addressed with improved checks.
The issue was addressed with improved memory handling.
Makes it sound like data protection, input validation, checks, and memory handling were fine. But now they are better. Whereas the truth is that they were bad and led to data leaks and remote code execution.
As it goes with improvements, they keep coming.
Wouldn't it be better for Apple to own up to the fact that these defects are indeed defects, and be transparent about what measures they are implementing that prevent such defects from being added to the code base or from being exploited?
Google wrote about the former a couple weeks ago[1] and Apple itself is not doing badly in the latter department.[2]
[1] https://security.googleblog.com/2022/12/memory-safe-language...
[2] See Luca Todesco's talk from October: https://www.youtube.com/watch?v=8mQAYeozl5I
As it goes with improvements, they keep coming.
Wouldn't it be better for Apple to own up to the fact that these defects are indeed defects, and be transparent about what measures they are implementing that prevent such defects from being added to the code base or from being exploited?
Google wrote about the former a couple weeks ago[1] and Apple itself is not doing badly in the latter department.[2]
[1] https://security.googleblog.com/2022/12/memory-safe-language...
[2] See Luca Todesco's talk from October: https://www.youtube.com/watch?v=8mQAYeozl5I