Hacker News Reader

At this point, I think Apple's platform security teams have to seriously [edit: by default] start mitigating attachment exploits in ways that affect UX – _not_ rendering message previews, or blacklisting formats by defaults. Given Apple's pro-privacy messaging – and acceptance of things like Signal auto delete – think Apple's user base might now be comfortable with taking hits to UX in the name of security.

View on HN

Lockdown mode does this. Preventing weird attachment types entirely. Preventing most of the “edge case” things. Like you also can’t be added to an icloud album, or install new configuration profiles.

Although it’s a bit extreme. It disables almost all web-fonts which breaks a lot of websites. (It’s easy to toggle this, but you have to do so per-site) It’s really not designed for the average user.

I think lockdown mode is fine for most people. Yes, some websites are broken because they assume their font always loads, but I've never really felt bothered by issues like that. Then again, I've never really used iCloud, so maybe I'm missing out on something there.

Many edge cases covered, like not being able to add configuration profile, are fixes to insecure defaults IMO.

Reply on news.ycombinator.com