undefined | Better HN

0 pointsconcinds6h ago0 comments

I wonder how well Apple has deployed these tools internally for security research.

Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has deployed this tooling as much as Google.

0 comments

guessmyname3h ago

I am part of Apple's SEAR (Security Engineering and Architecture) organization and can’t attest that we have been using Anthropic models, including, but not limited to, Mythos, as part of our participation in Project Glassing and previous private partnerships with different frontier AI labs for years. We simply don’t talk about it because there’s no benefit to talk about it, and also NDA’s, but mostly because there’s no benefit to talk about it other than to satiate people’s curiosity about what we do or don’t do internally.

riffraff2h ago

You wrote "can't attest" but the rest of what you wrote seems like you're actually attesting it.

Typo, or I am just misreading?

isomorphic2h ago

The heavily ironic implication is that they're under NDA, so they can't attest to it, while more or less attesting it. Senator, I cannot confirm or deny that we definitely do this.

This could also be an unofficial-official way for Apple to "leak" that yes, they do this--which is on brand for how Apple handles "rumors" etc.

qsxfthnkp2322new28m ago

Imagine working there with a boss who talks like this.

pbgcp2026new19m ago

"I am part of Apple's SEAR" LOL mate, you are full of it, are you? Can you allocate your time to actually fix the bug instead of publishing here unreadable legalese salad to impress us and to feel good about yourself? I bet you are part of great mid-management class too.

JCattheATM5h ago

I'd guess they haven't even begun to really utilize them. They've never been a terribly security conscious company, despite the marketing.

krisbolton1h ago

I think Apple became much better at security in recent years. One example which I think is indicative of their approach to security - they bothered to add a hardware microphone disconnect when a macbook is closed. Source: https://support.apple.com/en-gb/guide/security/secbbd20b00b/...

xyzzy1234h ago

What's your thinking on this? From my perspective Apple security go pretty hard. They have a strong track record of being able to ship architectural mitigations like PACs / MIE / Exclaves first. I guess because Apple control the stack from silicon to userspace.

JCattheATM4h ago

My thinking was in a historical context, and for their desktop OS's. I know they've been pretty on top of things with iPhones, and MacOS has become a lot better, but for the longest time MacOS was pretty lacking, coasting very much on promoting how much PCs have viruses and macs didn't, which was a marketshare thing more than a security thing. I don't think they got ASLR until later than pretty much everyone else, for example.

They've improved a lot, especially their phones, but I'd still never consider them a company that has a really strong focus on security.

2 more replies

AnthonyMouse3h ago

> I guess because Apple control the stack from silicon to userspace.

People always say this but there is no real relationship there. When hardware vendors add security technologies to the hardware, the major third party operating systems add support to use it pretty much immediately, and in many cases before the hardware even ships because the hardware vendor publishes the documentation ahead of time.

Try to name something where Apple was the first to support something (by a non-trivial amount of time) not because they were the first to add hardware support but because they released the combination of hardware and software in the time between when e.g. Intel or Qualcomm added hardware support and when Linux or Windows added software support to use it.

j / k navigate · click thread line to collapse