Intego's Mac security blog covers Apple vulnerabilities, patching policies, Mac malware, and privacy issues for macOS and iOS users.
HN links it for reports on Apple security flaws, including an old iOS font-based jailbreak and criticism of Apple's patching.
I would argue that Android is safer, specifically from 0days.
Anyone with Android 6.0 or later (a 2015 OS) gets Chrome updates. Those updates are fast, automatic, and transparently happen in the background, with no user input or downtime (e.g. need to restart). They're also not arbitrarily delayed to fit into with some rigid OS update release schedule, like iOS or macOS.
That's especially important in this era where people are skeptical of updates, or just too busy, and keep delaying and skipping updates. Every time I use a family member's device, and check the version, I see they haven't updated in months. Many aren't even aware there are updates available.
I told the story before, but my grandma only has 4G, no Wi-Fi, and only has an iPhone, no laptop to download IPSWs from (and obviously average users can't do that); therefore she only gets iOS updates when I visit once or twice a year. Is Apple happy with that? Provocatively: is that the best they can do? Google proves it's not.
Sure, the Android OS update situation isn't great, but your biggest 0day exposures will be apps exposed to the internet (Chrome, chat apps) and those all get regular, transparent background updates with no user input; and Android users are much safer for it, than they'd be if Google imitated Apple's OS update strategy.
This is an Apple-wide problem, not just iOS. Anyone with OS X El Capitan 10.11 or later (again, a 2015 OS) is running the latest Google Chrome. Yet their Safari version is…
To play the devil's advocate, does a volunteer have more incentive to keep your data private, or a company whose very business and reputation relies on keeping it private? Is a network that can readily and easily be infiltrated by malicious parties "for free" more trustworthy, or a private network locked down to trusted machines by security engineers, audited by third parties?
Because there is enormous incentive to deanonymize Tor. In 2020, nearly 25% of the network was controlled by a malicious attacker. [1] You had, then, a 1.5% chance of complete and total deanonymization by a single party - a near-certain chance of deanonymization if you heavily used Tor. And this is without any traffic correlation antics.
Turning off the devil's advocate, most "trustworthy" VPNs are almost certainly intelligence gathering operations, claiming "no logs" in court but in reality being a tool for parallel construction. It's too valuable a position for the 3LAs of the world to not have some ownership and stake in major VPNs. Crypto AG-style.
IMHO there is no hope for modern anonymity. Interesting connections will be logged for future deanonymization with quantum computers. In the meantime, mixnets like Nym [2] might emerge to be our saving grace.
[1]: https://www.intego.com/mac-security-blog/why-tor-is-bad-for-your-privacy-and-security/
[2]: https://nymtech.net/
>There's nothing moral about using "silent updates" (updates the user has no opportunity to decide whether to adopt).
There's nothing accurate about this description.
The user can turn off all update checking, or use the granular permissions to just turn off silent security updates.
>To allow macOS to update automatically, go to System Preferences > Software Update, then check Automatically keep my Mac up to date. The Mac offers some more granular update options than iOS. If you click Advanced…, you see a number of options:
https://www.intego.com/mac-security-blog/everything-you-need-to-know-about-software-updates/
If you only want to turn off silent security updates, the option to uncheck is "Install system data files and security updates".
>2013: iSeeYou: Disabling the MacBook Webcam Indicator LED https://jscholarship.library.jhu.edu/handle/1774.2/36569
... applies only to older Mac notebooks from like 2008 period which are long since obsolete according to Apple's announced support policy.
>2016: Your Mac’s Camera Can Be Hacked https://www.intego.com/mac-security-blog/your-macs-camera-ca...
... refers specifically the exploit above.
>2016: Former NSA employee: This hack gains access to your Mac's webcam https://www.cnet.com/news/mac-webcam-hack-ex-nsa-employee/
... is an attack that depends on the camera already being in use by another application and therefore has nothing to do with the camera indicator.
> The author states that security updates on earlier iOS versions give a false sense of security.
The author links to this article which provides more detail:
https://www.intego.com/mac-security-blog/apples-poor-patching-policies-potentially-make-users-security-and-privacy-precarious/
I wouldn't take everything that's written in a random tech article for granted. Fear inducing titles generate more clicks. As soon as you do something in this world, there's a risk. Even if you do nothing, there's a risk. Nobody will be able to be completely safe using any device under the sun. And if a tech company tries to make you believe otherwise, run.
Apparently photos can be taken with the Mac camera and trigger the green light so briefly that it is not noticeable [1]. It would be good if Apple set a minimum activation period for the green light, so that even if the camera is only on for a millisecond, the green light is on for 5 seconds or something. In the meantime, there are tools that can alert you to any activations [2].
1: https://www.intego.com/mac-security-blog/your-macs-camera-can-be-hacked/
2: https://www.macworld.com/article/3129449/security/how-to-keep-your-macs-camera-from-spying-on-you-no-tape-required.html