Hacker News Reader

Comment by benmarks | Hacker News Reader

> "With access to proprietary guides and tools, hackers can more easily circumvent security protections, harming not only the product owner but also everyone who shares their network"

Of the many consumer insults present in this entire topic, this one really shows the ridiculousness of Apple's position.

View on HN

For that matter, if more altruistic people had access to these tools, couldn't you argue that security bugs would be found quicker as well? As of right now, it's possible that there are a million security bugs that black-hat hackers are sitting on that the average person doesn't have the tools to know about.

Isn't security-through-obscurity considered the worst kind of security?

Security-through-obscurity can be very effective by using it to throw up a smoke screen.

Case: you need to protect a web server. If you can successfully hide/spoof your OS/software fingerprint, an attacker won't know whether your server has vulnerable software. This makes exploit selection extremely difficult.

You can protect an already secure system from 0-day or unknown exploits by hiding whether you're running windows/linux/bsd/whatever with IIS/apache/nginx/traefik/caddy.

Of course this should not be used as an argument to introduce laws that limit the rights of repair shops, users or even security researchers.

Really? Software detection techniques are so sophisticated these days, you need to put a lot of effort into that, and it all can be defeated by something very simple that doesn't even depend on you. Experts will find the way and newbies will just throw at you everything they have.

Exactly, like the guides do not leak anyway.

The way I read GP's comment, is that security researchers have been able to find security vulnerabilities even without access to information.

That is true, but in this case Apple statement is ridiculous because if Apple relies on security by obscurity the problem is that the guides are shared with many employees and contractors and they arrive on the internet anyway.

Reply on news.ycombinator.com