configure your iPhone to be secure and private

Upstate1618 No, there isn't an equivalent strong feature on iPhone. There may be other not so effective memory safety feature on iPhone.

I think Apple thinks pointer authentication is an important security feature. Is MTE strictly better?

Upstate1618 GrapheneOS developers don't like it, but that doesn't make it a bad system since targeted and attacked people receive a notification that their devices are compromised. Unfortunately, things are not white or black.

I read a discussion between security researchers a few days ago where they said, in short, that the MTE would significantly increase the number of CVEs and push people to take Apple products.

Locart I read a discussion between security researchers a few days ago where they said, in short, that the MTE would significantly increase the number of CVEs and push people to take Apple products.

I'm not sure I follow. If the argument were that MTE crash reports might alarm users more than necessary, maybe... though a fair fraction of overruns and uses-after-free are exploitable, so it's not clear it would be excessive alarm. But if the argument is that too many CVE's, meaning validated issues, would excessively alarm users, I am not following. To the extent that MTE (like PAC) is uncovering actual vulnerabilities, I think that is good.

Locart GrapheneOS developers don't like it, but that doesn't make it a bad system since targeted and attacked people receive a notification that their devices are compromised.

As far as I know, both PAC and MTE are enabled on GrapheneOS. And both will tell you if there was a memory safety issue detected. Neither will be able to tell whether the memory safety violation was because of an attack or just an innocent bug.

From my limited understanding of PAC and MTE, MTE detects memory safety violations before they happen, whereas PAC only detects signs of maliciously overwritten memory after it has already happened. MTE is also able to detect more memory safety violations than PAC, but they work in different ways, so having both might still be beneficial.

Locart I read a discussion between security researchers a few days ago where they said, in short, that the MTE would significantly increase the number of CVEs and push people to take Apple products.

If people move away from a product because more security vulnerabilities gets found and fixed, they are stupid.

ryrona A person who is told that a product has 500 CVE and another product has 300, the idiot will take the one who has 500?

How many people have good digital hygiene in the world? I think 99.99% of people don't care at all.

If people move away from a product because more security vulnerabilities gets found and fixed, they are stupid.

Reminds me, I just read a blog post from a major company marketing their products as privacy-respecting, where they argued that Google downprioritises users' privacy (which could of course be a legit assertion if argued convincingly), with reference to the number of security vulnerabilities in Android that got patched this month.

It should be obvious that the number of CVEs in a security bulletin is hardly evidence of anything.

Upstate1618 If you are getting an iPhone, first of all make sure that the model is still supported with iOS updates, and look up for how long it will be supported. I'm not familiar with iOS development so don't really understand what all of the instructions you provide actually imply, so can't comment on that, but I think using a supported device is the bare minimum for security/privacy.

Locart A person who is told that a product has 500 CVE and another product has 300, the idiot will take the one who has 500?

You mean the number of patched vulnerabilities? Or the number of reported but unpatched vulnerabilities? If the latter, I agree there would be grounds for major concern if a company shows a tendency to not patch reported security issues.

Upstate1618 Again, it isn't clear what that accomplishes. WHY? How does that help keep apple from walking all through your phone?

I believe this conversation has run its course.