Slashdot Mirror
iPhone 3.0 Update Delivers Prodigious Patch Batch
CWmike writes "Apple patched 46 security vulnerabilities in the iPhone and iPod Touch, half of them in the Safari browser and its WebKit rendering engine, as it released iPhone OS 3.0 on Wednesday. One of the patched WebKit vulnerabilities stands out because of the attention it received in March, when a German college student, Nils, walked away with a $5,000 cash prize for hacking Safari at the Pwn2Own challenge. Nils used a bug in WebKit's handling of SVGList objects to crack Safari."
Boo ya!
First Post!!!
Had the dev version on the phone which was great, but at one point bricked my phone.
I've never seen a portable device add so much functionality on a regular basis.
Does it support copy & paste?
Frankly I don't know what all the hoopla about iPhone OS 3.0 is about. I was hoping to use compass with google map after the update on my iPhone 3G, but all I got was a lousy voice-memo software.
And before anyone points out that iPhone 3G didn't have compass built into the hardware - It is supposed to be apple! I expect nothing sort of miracles from Steve Jobs!!
On a serious note, tethering was supposed to be there without the need to jailbreak your phone, but it is not available in US, and it is not available in Germany. Could someone tell me where it is available? Phone companies are the scum that are only slightly worse than the music industry.
But when are they going to patch these security flaws on my 2.1 ipod? Paying for an update is ridiculous, especially when it fixes critical security flaws. I sure hope apple does the right thing.
Maybe I am missing something, but the article linked in the summary (about Pwn2Own's prize for hacking Safari) appears to be about someone hacking IE, not Safari.
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
I wonder why the iPhone doesn't see more patches and updates. If the iPhone OS is a branch of Mac OS why isn't the phone patches as much as the desktop OS? Do Windows Mobile machines patch every Tuesday? I never updated my CrackBerry. Perhaps Apple doesn't want the iPhone to appear to need patches more often than it's competitors.
I have an iPod touch, i was wondering if it was worth it to upgrade. I also wonder if these Safari bugs will be fixed in a 2.x update. Sucks to have to pay $10 to be secure.
Although if i don't, it's easier to pWn and run cydia on it I guess.
GoPhone subscribers warned the upgrade will be the end of the service.
AT&T Narrows Prepaid Plan Options
"AT&T currently offers two types of prepaid plans: GoPhone, its "pay as you go" plan, and Pick Your Plan, its "prepay once a month" plan. AT&T's statement says that GoPhone will not be available for either original iPhones or iPhone 3Gs; Pick Your Plan will only continue to work for existing subscribers using the original iPhone, as long as they have an unlimited data plan. Current Pick Your Plan users who don't have an unlimited data plan will be asked to add one. iPhone 3G users are not eligible for Pick Your Plan.
According to Erica Sadun at TUAW, who's been investigating this issue, all pay-as-you-go users are being strongly encouraged to sign up for a postpaid plan, which includes making a new two-year commitment."
Looks like I'll be waiting a year for the Apple/AT&T agreement to time-out. I'll not do a two year agreement again, ever.
A feeling of having made the same mistake before: Deja Foobar
... oh hai it's meh jobs guys, i forgets dis 1 bug, 10$ for fixes plox.
"Sorrow is better than laughter, for by sadness of face the heart is made glad." [Ecclesiastes 7:3]
is required to upgrade to 3.0. While its not a big deal for individual computers, in an office environment its not as trivial..another one of Apples (not so) subtle schemes to get you using a particular software version whether you like it or not? And the "new" features are pretty pathetic really, more like they should have been in the 2.0 version of the software.
Fellow pirates,
I implore you to continue your campaign on Slashdot to make me feel less guilty. I know that not paying someone for their work is wrong, but if Slashdot posts enough articles bashing the RIAA/MPAA/copyright law/whatever, it's easier for me to accept what I'm doing emotionally by visualizing someone else as the bad guy. Once on the forefront of relevant IT news, Slashdot is now a lame repository of mainstream pseudoscience links and pro-piracy articles to appease a dwindling readership. I am overjoyed.
Even though the open source community is about giving back as much as it is taking, I'm just going to take. I'm a human leech with self-serving beliefs and an inability to empathize with content creators who are trying to make a living.
I don't believe John Carmack should be paid for his work. I'm going to sit on my ass while he spends years coding the next advanced 3D engine from id Software. When their game comes out, I'm going to pirate it without giving a second thought about paying John Carmack for his work. I'm just so used to pirating things now that I take it for granted. If anyone mentions John Carmack to make me feel guilty, I'll look for Slashdot articles that bolster my viewpoint, such as this one, amusingly posted in the Your Rights Online section even though none of my rights are being violated.
According to that study, it's okay to not pay people for their work because there's some vague hope that they'll make up the difference in income through "concerts and speaking tours." Artists are now forced to take time out of doing what they want to do. John Carmack must stop programming in order to make money from programming. It's genius. The study does exactly what I need it to--make me feel less guilty when I pirate. We've managed to stretch the truth so far that we're actually telling ourselves that we're helping artists by not paying them for their work. Excellent job.
I look forward to Slashdot telling me everyday who the bad guys are. Even though Slashdot has sued websites in the past for copyright infringement, and they've pretended to care about plagiarism, we're supposed to go along with Slashdot's anti-copyright agenda. I'm okay with that hypocrisy because it serves me. It makes me feel less guilty when I pirate something. Remember, I'm not the bad guy--the RIAA/MPAA/whatever is. That makes it okay for me to not pay people for their work.
EULAs and copyright licenses are wrong, yet the GPL is good. Piracy isn't theft, yet GPL violations are referred to as "stolen GPL code." I accept all of these double-standards because it serves me. I pretend not to notice when someone points out that the GPL relies on copyright law, and if I want to get rid of copyright, my beloved open source code will no longer be protected by the GPL. I don't care, because I'm too busy concerning myself with what I want for free, not about the consequences. I want to get rid of copyrights because I've been told that copyrights are the bad guy, and they are an obstacle to my rampant piracy.
Fellow pirates, let us continue our selfish leeching. Let us paint others as the bad guys to absolve us of our emotional guilt. Our goal is to convince people that piracy is something the good guys are doing in a fight with the evil corporations. Making money is wrong, even though Slashdot displays ads, and it cost me money to buy the computer I'm using to pirate stuff.
Yours truly,
A fellow Slashbot
If Apple wasn't so hard on itself on the DRM scene, then they would have these embedded computers behaving more than their ellusive handprint has effected; they should have a modular patch system that doesn't break any existing applications and development. You'ld think Apple would have learned from the success of OSX Liger edition, but instead they are trying to keep it all bottled-up with DRM'd precision so they don't have a developmental moving target (so to speak). It's only a matter of time before Richard Matthew STALLMAN vents his pretended frustration to call for unity in this feudal tenancy of copyright GPL'd software to make a special half-ass distribution for iPh1ne and ickeePod.
If you have a data plan of 1 gig per month or better, tethering data comes out of your regular monthly allowance - no extra charge. I must say that this was a pleasant surprise. The fine print in the agreement is that Rogers / Fido may rethink the current arrangement in the new year after assessing the actual hit to the network that tethering may or may not incur.
Fingers crossed...
blah, blah, blah...
my iTunes isn't seeing any update from the original 3.0 upgrade yesterday.
i can barely fucking feed myself, you are obsessed with hacking a mult-hundred dollar product that just came out.
dont you people fucking get it? a 6 foot steel fence is not going to stop massive hordes of starving homeless people, and your fucking iphone 3g jailbreak bluetooth ass blaster 2000 is not going to save you.
AT&T actually discontinued its unlimited prepaid data plan in general back in November. I still have it, because I'm grandfathered in, but my understanding is that there's no new ones.
Still... half my reason for keeping it around has been in case the iPhone became more appealing to me. If they drop prepaid data for the iPhone, I think I'm done with them. I'd guess you can still make it work by unlocking, but if I'm going to have to unlock, there's nothing so compelling about their service that would keep me from using T-mobile prepaid instead.
Tweet, tweet.
I have an iPod touch, i was wondering if it was worth it to upgrade.
Probably for some of the improvements playing media, you should check a number of the lists and see if anything appeals. Also a number of new apps are going to take advantage of 3.0 and you'll quickly find you would like to upgrade.
I also wonder if these Safari bugs will be fixed in a 2.x update. Sucks to have to pay $10 to be secure
But that's the beauty of a system where a large majority (80%+) upgrades to new OS. You may have security exploit that could be used, but the reality is anyone looking to write an exploit would do so against 3.0 now as there will be hardly anyone using 2.x to attack...
A security vulnerability is a combination of the ease of performing the exploit and the desirably of doing so by an attacker. A Touch is already less likely to be exploited because it doesn't make a good zombie client (network shuts down with the screen). Then on top of that you'd have to trick a user to come to your site... in combination the odds against anyone taking advantage of this are astronomical.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
If you think about it, while they don't happen at exactly the same time OS X does see about as many patches issued as the iPhone.
One thing throwing you off is that the newer Leopard has taken longer to come out with newer iPhone OS versions (like 1.x to 2.x).
They do, of course, share the same base OS but tend to sort of leapfrog each other a little as to versions of components used.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I must not be geeky enough, I'm tired of Iphone stories.
21st Century Renaissance Man
this upgrade is amazingly troublesome for user.i tried it today, and it was painful no end.
first they make you upgrade itunes (it must be that iphoneos3 requires special super-puper method of uploading that only itunes8.2 supports).
then they backup everything on the handset, but upon upgrade it breaks (it said something about device being lost, unexpectedly disconnected or something).
so the device is bricked, well, being restarted it shows "itunes and usb cable". when it's connected, itunes says "oh, the device is dead you need to restore it"... yeah, no shit!
when "restore" is pressed, it says "hey there's a new version, do you want to restore and update?". and there's no escape! there's no button "thanks but no thanks, just return me to yesterday". you either restore+update it or have it bricked. WTF?!!
once i upgraded itunes and started update, i cannot return back! and yeah, restore didn't work, i saw "preparing for restore" for 5 minutes and then bah "unknown error #1604, have a nice day". windows' restart usually heals everything, but not in this case! their web page offers to clean usb socket, re-install windows' usb drivers, yeah, right...
lucky me, i had co-worker with older itunes and iphoneos2.2 so i was able to return it to 2.2. i think it's enough of experience. mms and rotated keyboard... well i hope i'll get it with 3.1, by that time it maybe will update.
Originally I was getting this message as well, which is why I called them in the first place. The techs told me that they were enabling the feature gradually (pushing some sort of update to the phone?) and that it would be available nationwide tomorrow (Friday).
end, we nned you deEper into the
I know... this doesn't change the fact they charge for iPod firmware updates -- and Apple's reasoning is certainly open to well-deserved criticism -- but they lay the blame squarely on the Sarbanes-Oxley act.
From what I understand, SOX is a law that intends to make public companies more accountable to share holders. Apple has interpreted SOX in such a way that it feels as though it *must* charge for updates which unleash new features that substantially increase the potential value of the device. This appears to be applicable to virtually all hardware-enabling features and reasonably 'novel' software features. 3.0 is such an update.
Why doesn't this affect the iPhone? That's because the iPhone is a subscription-based device. As such, it continually generates profit for the company and its shareholders. The iPod Touch has no subscription, meaning that anytime Apple unleashes a new set of big features for free, they supposedly have "cheated" shareholders by not releasing a new product instead. To generate revenue, they charge for the update. The idea is this keeps them in compliance with SOX by generating extra revenue for 'shareholders'. Obviously, Apple is making a profit, but I understand SOX compliance also costs big companies millions of dollars in fees (lawyers, accountants and God knows what else)... Who knows. And remember: Minor updates are supposedly fine; major updates are supposedly not fine -- although I'm not sure who the legally viable arbiter of that decision would be, exactly.
Like it or not... Believe it or not... It's the way Apple has dealth with this. Incidentally, it's the same reason they charged $2.99 for 802.11n support on Macbooks through Software Updater.
Fact: Everything I say is fiction.
.
In other news, for at least 3 months, hackers exploiting Nils technique walked away with a few hundred thousand via identity theft, atm fraud, password access, etc...
OF AMERICA (GNAA) your own beer sinc3 then. More 1. Therefore there
Apple: iPhone 3.0 Update Delivers Pompous Patch Batch There, all better now. Continue commenting.
I have a G3 iPhone and I just upgraded to the 3.0 software. Anybody else done this and notice that about 99% of your apps do not work? You select them the phone goes to a dark screen and then back to the app desktop. Is there any way to step back from the 3.0 software?