iPhone’s Lack of SDK Explained?
Ars Technica has published a very thorough review of the iPhone. Well worth reading for a balanced perspective on what it does and doesn’t do well.
There was one thing in there that caught my eye, though. Something that I hadn’t seen previously, and that might explain why Apple hasn’t released an SDK:
Some disturbing revelations from these discoveries and analysis of crash logs from the iPhone reveal that Apple are using SUID root executables inside their Cocoa apps (everything is effectively running as root) and that the real root account is enabled (and has a weak password that everyone knows now). As several individuals have noted, all it would take is a single nefarious exploit to gain root access to the iPhone and begin wreaking havoc. The fact that a few of the applications on the iPhone have been a little crash-prone for some (Safari?) means that exploits will probably surface quicker.
If it is true that apps need to run with setuid, then any native third party apps would have unfettered access to the entire system. It may take Apple quite some time to fix the iPhone architecture to work around these problems.
Shebanator 
alternatively the crashdump app for the iPhone is just buggy and also excludes information that makes no sense on the iPhone (ie, a uid of 0 being the same as NULL)
to expand, the iPhone is using a forked version of the 10.5 crashdump. And it just doesn’t need to get values for things that aren’t necessary (like the bundle id of a framework or the effective uid of a process).
In other words, there is no evidence that apps actually run as any specific user. And the ARM processor the iPhone uses allows for secure memory zones (for sandboxing and whatnot). So no, there is no evidence an app like MobileSafari has permissions to do anything. Hell, it can’t even download files so there’s no reason to give it write (or read) access to anything but prefs and caches.
I agree that the evidence is open to question, which is why I was careful to say “if it is true”. I think it is going a bit far to say there is “no evidence”, though. Can you say for certain that your theory that they just don’t fetch the value is actually a fact?
[…] iPhone’s Lack of SDK Explained? Ars Technica has published a very thorough review of the iPhone. Well worth reading for a balanced perspective on what […] […]
Top Posts « WordPress.com said this on 11Jul07 at 17:01
try these articles for an overview of iPhone OS X and why running as root, if being done, is not the security problem it is with a multiuser system. You’ll also get a bit more insight into why Apple is restricting third-party apps for now:
http://www.roughlydrafted.com/RD/RDM.Tech.Q3.07/4F7A7875-05C6-4018-AD86-6DC5A410D108.html
http://www.roughlydrafted.com/RD/RDM.Tech.Q3.07/FB61F893-BE64-46C5-9B16-7F3AE485C162.html
http://www.roughlydrafted.com/RD/RDM.Tech.Q3.07/43022C02-3D78-491B-887E-537260E176CD.html
http://www.roughlydrafted.com/RD/RDM.Tech.Q3.07/3B84E3A4-A6F6-4EA1-A48E-149BE29AB107.html
Hey just wondering what theme/designer your using for your wordpress? looks fantastic!
Thanks! The theme is unsleepable by Ben Gray (http://sunburntkamel.archgfx.net/2006/08/13/unsleepable-for-wordpresscom/), with tweaks by myself and my wife. See this post from last April when I put this design in place:
http://shebanation.com/2007/04/23/new-site-design-and-logo/
[…] terribly hurt that I didn’t get any linkage on the whole ‘iPhone runs as root’ thing. I was way ahead of the curve on that one, and I wasn’t even “hysterical” about it… [this is a joke, for those not […]
The Cynical Side of The iPhone SDK Announcement « Shebanation said this on 19Oct07 at 05:54