Posted by psxuaw 14 hours ago
I am worried that the sluggishness appeared about the same time on both devices
Regular phone reboots are a security measure at this point.
These days most exploits can not persist through a reboot due to secureboot and other bootchain attestations. In the boot process, everything loaded gets checksummed and compared to signed signatures from Apple, but this only helps at load time, not while the phone is running. Of course if the phone is not patched, the exploit could be reloaded, but this would require revising a malicious website or reopening a malicious bit of media.
I don't remember where I read it, but it basically boils down to need vs want.
I've used that rule for deciding between a new car or used. A fancy vacuum or basic.
A shiny new gadget.
Bringing new things into the tech stack.
Picking a new tech stack.
It means you skip supply chain attacks but may miss fresh vulnerability patches too.
Even worse are the “extension packs” that combine some normal things and one wonky thing nobody’s ever heard of…
I personally switched away from macOS with this being one of the reasons, after having realized brew will eventually compromise my system with their antics.
Behaviours matter more than OS security primitives.
If you have code execution, you can attack the OS.
This is exactly why some (including me) don't take these projects seriously. Like you claim to design a language for security, and this is how you tell me to install it????
curl|sh has the truncated shell script concern. It's possible to mitigate this concern. Did they? If so, it's no different from downloading and running any other installer.
For supply chain attacks that simply bide their time, or for dependencies which involve interacting with other subsystems, it's possible you miss a critical security update by doing this. Of course, the maintainers of the crates should yank known bad releases, but that's putting trust in a third-party that may have already been compromised.