Top all-time · #18107
Dataflow Forensics
Company blog · df-f.com/blogsecuritysystems
Dataflow Forensics is the company blog at df-f.com, writing about security and systems. Since 2023, 4 different Hacker News readers have linked it 16 times, most often “iOS 17: New Version, New Acronyms”. No feed was found, so read it on the site itself.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN commenters link this blog for its technical analysis of Apple's iOS security architecture, such as its iOS 17 post on how the system is built. Comments cite it as a source for hardware and virtualization security questions.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Dataflow Forensics builds consent-based mobile threat detection systems for government and national security organizations. Flagship product DFFIND detects threats outside the mobile OS sandbox.
Most-linked posts?
- iOS 17: New Version, New Acronyms4 people · 4 mentions · first linked 2023-09-14
- Will macOS and iOS Merge: running iOS binaries on macOS3 people · 3 mentions · first linked 2024-01-26
- Tracing Back to the Source – SPTM Round 32 people · 3 mentions · first linked 2025-03-09
- iOS 17: New Version, New Acronyms – Round 22 people · 2 mentions · first linked 2023-12-10
What Hacker News says?
For more detail, there's a 3-part series on iOS SPTM and TXM: Aug 2023, https://www.df-f.com/blog/ios17 Nov 2023, https://www.df-f.com/blog/ios-17round2 Feb 2025, https://www.df-f.com/blog/sptm3
Comment linking /blog/sptm3
on “Apple Exclaves”Submitted iOS 17: New Version, New Acronyms as a story · 3 points
HN discussion> SK runs on the same high speed application processors as XNU/iOS. To make this possible, additional processor privilege levels are required — likely supported by virtualization extensions Recent Apple phone and laptop SoCs include hardware support for nested virtualization, including the M4 iPad Pro where an exclave is used for the camera LED. Hopefully the next revision of the Apple Platform Security guide will c…
Comment linking /blog/sptm3
on “Apple Exclaves”Submitted Will macOS and iOS Merge: running iOS binaries on macOS as a story · 2 points
HN discussionI stand corrected. The best info I've been able to find about the architecture is https://www.df-f.com/blog/ios17 Is there more info available, yet? Might this be related to Apple's recent sponsorship of seL4-- https://sel4.systems/news/#member-apple ?
Comment linking /blog/ios17
on “Apple M4 iPad Pro OS Has New Security Exclave for Camera and Microphone Activity”Submitted Will macOS and iOS merge? Running iOS binaries on macOS as a story · 2 points
HN discussionVirtualization does not have a security/freedom tradeoff, as VMs have more isolation/security and more user freedom to install software. https://www.df-f.com/blog/ios17
Comment linking /blog/ios17
on “Nice Things that Apple doesn't let us have (on an iPad)”Submitted Darwin: Libsystem_malloc .dylib and XZone as a story · 1 points
HN discussionPart 1 summary: PPL as we knew it is no longer. TXM, the Trusted eXecution Monitor, runs in GL0, and handles code signing and entitlements, much as PPL used to. SPTM, the Secure Page Table Monitor, runs in GL1/2 The refactoring and relocation of this security critical code to GXF makes it far less likely that an attacker with arbitrary kernel r/w privileges could potentially compromise the security posture of the sy…
Comment linking /blog/ios-17round2
on “iOS 17: New Version, New Platform Security Acronyms”Submitted Tracing Back to the Source – SPTM Round 3 as a story · 1 points
HN discussionSubmitted 'Tis the Season as a story · 1 points
HN discussionSubmitted Will macOS and iOS Merge? as a story · 1 points
HN discussionSubmitted iOS 17: New Version, New Platform Security Acronyms as a story · 1 points
HN discussionSubmitted iOS 17: New Version, New Acronyms – Round 2 as a story · 1 points
HN discussion