Rendered at 08:16:17 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
alt227 2 days ago [-]
If you sign up to this program and use one of their devices for 'research', then you are bound by contract to report any security bugs to them and only them (unless the bug is in a 3rd party app). I see this as a pretty sneaky way of avoiding your security vulnerabilities going public and all the bad media exposure that goes along with it.
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
halJordan 2 days ago [-]
It's important to not ignore the preexisting context before making these negative inferences. There was huge outcry that iOS exploits were being made and sold for millions of dollars each and white hats had no way to do their own research bc of Apple's behavior. So this was created to mollify that outcry. So it makes sense that you're required to report vulns and also required to not sell them to the highest bidder.
alt227 2 days ago [-]
The entire security community uses and trusts the 90 day disclosure model. You are correct it it makes sense to report it to only Apple and not sell to the highest bidder. However it doesnt make sense to then muzzle that security researcher to never be able to disclose what they found to anybody else ever.
Fraterkes 2 days ago [-]
The page only mentions that you're obligated to report it to them, not that you're not allowed to further publicize it (unless I missed something).
gumby 2 days ago [-]
This is an important comment given the wild (though conceivable) speculations in other comments.
The subsequent sentence on the page also says that if you find a vulnerability in a third-party app you have to tell the third party.
alt227 2 days ago [-]
"you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability."
> For a reported security vulnerability affecting any Apple platform to be eligible for an Apple Security Bounty award, you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability.
Which does not have the meaning of prohibiting disclosure to third parties or the public; it only means that you forfeit the bounty.
alt227 2 days ago [-]
The catch is, if you sign up to the Apple Security Research Device Program then every bug you find on that device has to submitted that way. Therefore if you choose to 'only forfeit the bounty' as you put it, then:
"Apple reserves the right to immediately end your participation in the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple"
otterley 1 days ago [-]
It’s not a violation of the terms to choose to forfeit the bounty in exchange for early disclosure. The terms explicitly allow that.
scratcheee 1 days ago [-]
I mean, I’d assume that’s the case regardless of the wording. They’re giving you a device on a repeating lease. If you piss them off (ie release publicly when they’re not ready, regardless of who’s at fault for screwing up the disclosure timing), then they’ll take their toys away in a huff.
Aurornis 2 days ago [-]
> until after
Entirely reasonable.
They can report it but have to wait until it’s fixed.
I think anyone angry about this is just looking for reasons to be angry. I also doubt the people complaining the loudest are even the targets of this program.
I’m not detecting any anger or complaining from this post. Maybe some disappointment. He’s saying they’re choosing to opt out in order to preserve their right to disclose.
pizlonator 2 days ago [-]
> I see this as a pretty sneaky way of avoiding your security vulnerabilities going public and all the bad media exposure that goes along with it.
No, it's a way of making sure that Apple can fix the security issue and deliver the fix to customers before it can be exploited.
gehsty 2 days ago [-]
Or they won’t give you a device if your intention is not to share back any exploits? Is the expectation that Apple gifts black hats research devices?
alt227 2 days ago [-]
The expectation is that Apple plays ball with the rest of the security community if they are expecting the security community to actually give them bug reports instead of selling them.
pixl97 2 days ago [-]
Why? If no one signs up then no one signs up. The people that do sign up play by those rules. No one is forcing them to apply to this program.
Aurornis 2 days ago [-]
The program says they can’t disclose until it’s fixed.
How is that not playing ball?
This manufactured outrage is getting ridiculous.
schiffern 2 days ago [-]
Paid bounties. Device program. Early access. How is Apple not "playing ball" here? Isn't that exactly what researchers asked for?
Apple has safeguards to avoid selling exploits to criminals that attack Apple's own customers. Good. I wouldn't want Apple to "play ball" like that.
alt227 2 days ago [-]
Have you ignored all the conversation about the standard security industry 90 day disclosure period which the entire community is built on but apple refuses to use?
jareklupinski 2 days ago [-]
> Apple gifts black hats research devices
this is the unintended consequence that whoever came up with this policy missed: it effectively leaves only bad actors in your pool
Aurornis 2 days ago [-]
> It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
The text says they can’t disclose until after it’s fixed.
That’s reasonable. Calling this sneaky bribery and leaving out the fact that the agreement is only to wait until it’s fixed is really distorting the facts for maximum outrage.
kevincox 2 days ago [-]
What if they never fix it? Is there at least a deadline where the researcher's are ungagged? What if the exploit is being used in the wild, can the researcher warn people then?
giwook 2 days ago [-]
They also presumably don't want the exploits to fall into the wrong hands.. which might be a slightly less nefarious and equally plausible interpretation of the program.
Probably both things are true.
Either way, consumers ultimately win in that the products and services they use will be made more secure.
greggsy 2 days ago [-]
Bribery applies to people in power or authority.
It’s not a ‘sneaky way of avoiding vulnerabilities going public’, it’s a responsible disclosure agreement between two consenting parties.
otterley 2 days ago [-]
You make it sound like there’s something wrong with the conditions.
runjake 2 days ago [-]
Is it really “sneaky” when the whole process, purpose of the SRD, and those requirements are clearly laid out on the front page?
2 days ago [-]
theoreticalmal 2 days ago [-]
What’s the difference between bribery and a simple agreement? Secrecy?
greggsy 2 days ago [-]
One involves illegitimate benefits to someone in a position of power or authority.
sneak 1 days ago [-]
First off, that's not true. Secondly, even if it were, it's not bribery - the only way to get the type of access the SRD offers is via this route, so it's an offer of specific terms for specific privileged access that is not otherwise available.
turtlesdown11 2 days ago [-]
Its unconscionable that if you voluntarily sign up for a company's program you'll be bound by terms!
ACCount39 2 days ago [-]
Create a problem, and then heroically fight to make a solution.
This shouldn't exist in the first place. There would be no need for it if Apple didn't insist on "we own all the iPhones, our users just get to tap at them".
If you could just unlock the bootloader, re-enable SWD and do what you want with an iPhone that you actually own, there would be no need for this restrictive program at all.
orf 2 days ago [-]
It wouldn’t be the most secure consumer phone then, would it?
lrvick 2 days ago [-]
The fact so many technical people believe that security and freedom are mutually exclusive, and pay for that lie, is proof the Apple propaganda is working exactly as intended.
throw0101a 2 days ago [-]
> The fact so many technical people believe that security and freedom are mutually exclusive, and pay for that lie, is proof the Apple propaganda is working exactly as intended.
My Aunt Millie's iPhone is secure against herself because she can't install random garbage off the Internet and is in a walled garden.
As someone who works in IT: users are often their (and their organization's) own worst enemy. We've tried training and blacklisting (with anti-virus) for decades, and it appears that whitelisting and locking things down is what actually works.
I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
lrvick 2 days ago [-]
Chromebooks had a screw you could remove on the motheboard to fully unlock them to do whatever you want. Something no one would do by accident. This was a reasonable solution from the less-evil Google days.
a022311 2 days ago [-]
> I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
You just described what Samsung does with their phones. You can unlock them, but even if you later switch back to the normal OS, some features are permanently disabled by that fuse.
devsda 2 days ago [-]
IIRC, Samsung OneUI updates for the past one year have been removing the unlock option even from the devices that supported it.
KetoManx64 7 hours ago [-]
That is correct. Samsung OneUI 8 removed the ability to unlock the bootloader to any device that installed it. It removed the toggle and also removed the functionality from the codebase as well.
I got screwed by this by buying a used Samsung Tablet for the purpose of rooting it and made the mistake of letting it update after I factory reset it. Never buying a Samsung product again.
wildzzz 2 days ago [-]
I've seen malware popups that give detailed steps on how to install the app on Android. You can put up all the scary warnings you want but if someone really wants to install some scam app, they will click past everything.
I really wish we could have a simple "don't bother me, I know what I'm doing" switch on these phones but I can certainly understand the reasons why Apple and Google are putting in as many roadblocks as possible to protect users from themselves.
999900000999 2 days ago [-]
Which is why Google is getting ready to lock down Android.
I wouldn’t mind phones having “Adult” mode that intentionally fails secure net and is completely split off from the standard user space. In adult mode I install what I want.
illiac786 1 days ago [-]
Maybe we should be specific when we mean “secure”. What you mean is like “secure MDM”, when the adversary is the user.
The parent meant “secure against external adversaries”.
devsda 2 days ago [-]
Lumping consumer devices with the need for secure business devices and often offloading that to personal devices is the problem.
I wish they stop finding ways to lock down the device in the name of security and/or release different SKUs for the more secure use cases, provided by the organizations themselves if they deem it necessary.
tclancy 2 days ago [-]
Calling a phone a simple “consumer device” is a lot of hand waving. It’s my bank account, my access to a number of services, an identity provider, etc. I don’t trust myself to secure an open phone and I do this kind of thing for a living. It’s the asymmetric problem: I need to be right 24/7 forever, a bad actor only needs me to slip up once.
devsda 1 days ago [-]
The need for you to do banking, and employees do MFA on a phone and thinking that doing requires a secure and closed phone is again a spillover of offloading costs to users.
We did have hardware tokens for corporate logins and banking needs.
There is no real reason why an open phone cannot be secure for sensitive applications.
lrvick 2 days ago [-]
I do not even own a cell phone and have not for approaching a decade. I live a modern life as a founder and tech worker.
I have a house full of servers and self host virtually my entire digital life and even my own usage of AI, but when I leave home I typically carry no electronics at all.
We convince ourselves we need phones, but I promise you, they are optional. Being offline a few hours a day is also good for your brain.
throw0101a 1 days ago [-]
> We convince ourselves we need phones, but I promise you, they are optional.
Many people's employer's use of MFA (including my own) says otherwise.
For many people ensuring their spouse and/or their children's school be able to reach them for emergencies and sudden matters says otherwise. Or an elderly parent (e.g., location tracking).
lrvick 1 days ago [-]
> Many people's employer's use of MFA (including my own) says otherwise
yubikey/nitrokey. Much more secure by a mile and works when your phone battery is dead. I switched multiple past employers from apps to these, joining as an SWE.
meshtastic asset tracking tag which will work even in emergencies when cell towers are down.
> children's school be able to reach them for emergencies
call-to-one-way-pager bridge, or voip-to-meshtastic bridge. Cheap to free solutions that will also work when cell towers are down.
Hit me with more perceived blockers if you are actually interested. Give me your gotchas. I have probably heard it all and am passionate about engaging people on this topic.
My wife and I have lived without a cell phone subscription for going on a decade and live a modern life as silicon valley tech workers.
Most have the choice to enjoy mostly the same lifestyle they have today, without Apple or Google or proprietary software or cell phones or even debit cards. There are reliable solutions for everything outside of the US surveillance capitalism bubble for those that actually want them.
Exiting surveillance capitalism is possible without major lifestyle changes.
Read Digital Vegan by Andy Farnell.
jen20 1 days ago [-]
> Exiting surveillance capitalism is possible without major lifestyle changes.
It really isn't - credit rating agencies are the most egregious examples by far, and next to impossible to opt out of.
lrvick 13 hours ago [-]
Plenty of ways to build credit without revealing where you live or what locations you frequent and what you buy at the drug store. You can get a line of credit, take it out as cash, spend it privately, then pay it back. They learn nothing about you except you pay back your loans, which is the signal they need to give you more credit.
jen20 6 hours ago [-]
Where will give you a line of credit without knowing where you live? I'd be interested in _specific_ examples - I did not find any when attempting to actually build US credit when I moved here.
tclancy 1 days ago [-]
Not everyone’s life is your life. Not everyone living not your life is doing it wrong.
devsda 1 days ago [-]
> I don’t trust myself to secure an open phone and I do this kind of thing for a living
> Not everyone’s life is your life. Not everyone living not your life is doing it wrong.
The irony.
tclancy 20 hours ago [-]
What’s the irony? You have a tendency to appear in any thread about phones preaching the Gospel of Digital Detox without seeming to consider the level of privilege required to be able to live like that. Could I do it? Sure. Is life too goddamn short from my perspective to do it? Also sure.
devsda 18 hours ago [-]
I don't remember advocating digital detox anywhere. Are you mistaking me for someone else?
But I do advocate pretty strongly for open phones because they are becoming indispensable for leading a normal life without becoming a digital hermit.
They should be either open and indispensable or closed and dispensable, not indispensable and closed at the same time.
tclancy 15 hours ago [-]
Ah sorry, mistook you for OP.
lrvick 13 hours ago [-]
Never claimed otherwise. I just want to always make it clear people have a valid third choice in threads where people are talking as though Apple and Google are the only options. It is a prolific false dichotomy and I do not mind being That Guy.
I make an actual case for the things I advocate for and actually live my convictions.
Why everyone would is better off electing Apple or Google or Meta to decide what software we are allowed to install, what content we can share with our friends, when our data should be deleted, and when it should be sold to the highest bidder that wishes to manipulate us at scale?
I am convinced surveillance capitalism is a net negative for society, but if you really think otherwise, please make an actual case for your own view instead of complaining about me making mine.
jeroenhd 2 days ago [-]
It's true! The EU forced Apple to make it so you can install apps from third parties and every day iPhones are found haunted by malware! That's why root exploits only exist in Europe!
Well, except that one-click PDF persistent root exploit American researchers found, and there not being any sort of iOS malware wave in the EU.
jmull 2 days ago [-]
"mutually exclusive" isn't a good way to think of it. "Tradeoffs" is much better.
iPhones are aimed at the many millions/billions of technically unsophisticated users who don't care about rooting their phone, but would be very unhappy to get phished out of their life savings.
lrvick 2 days ago [-]
Ah. So Apple -must- take freedoms away from everyone to install any software they want, to protect us. They could not possibly have a "format and void your warranty to unlock all features" switch on the motherboard like chromebooks have. Or the "get a one time warranty-voiding code from manufacturer" code like Samsung and other Android vendors have. Apple must make sure the path to freedom does not exist, for Grandma.
Grandma does not need the freedom to install the DeFlock or ICEBlock to help protect herself and her neighbors, right? Tim Cook is a Trump doner but of course has no political bias, and remains confident ICE and law enforcement always behave ethically so there is nothing to fear.
A corporation takes away basic freedoms of people over the tools they use to communicate with society, and then consumers get on the internet in public forums and -defend- them for it. Unbelievable.
I really hope you do not vote with this type of thinking.
jmull 2 days ago [-]
Why not just buy the device you want to buy, and let other people buy the device they want to buy?
You can muddy the waters with strawmen and politics, but I doubt you'll convince many people around here.
lrvick 2 days ago [-]
So rather than address the substance of my comment, you hand waive it away and argue we should just let people give up freedoms to choose what software they install without even trying to educate them on risks or alternatives.
Tech CEOs will always do the right thing and act in public interest before profits or political favors, right?
They would never censor an app that the public largely wanted, right?
Fortnite did not pay their Apple tax, so no one got to install Fortnite. For safety.
To be clear, Google is just as bad. I do not use or recommend any products from either company.
I use laptops, desktops, or nothing, and get along just fine.
whh 2 days ago [-]
My Mac's very secure and I can install whatever I want. But it wouldn't be secure or private to do that on iPhone, because profit.
tom-9999 2 days ago [-]
Except “my Mac’s very secure and I can install whatever I want” is a complete fallacy. It isn’t secure - case in point Muse recently trawling through people’s messages. Or Mac cleaner like apps that trick users into installing them and giving liberal access.
I think if you don’t get the point of protecting a device against the user, you’ve not had to help un-tech savvy relatives get out of situations where dark or confusing UI practices have got themselves into a mess.
jonathanstrange 2 days ago [-]
It would be a piece of cake to create a device that can be permanently downgraded for the un-tech savvy. It would be interesting to see how many customers would voluntarily choose that mode. My guess is that it would once and for all put Apple's security theater into the graveyard of stupid, annoying, and patronizing ideas where it in my opinion belongs.
otterley 2 days ago [-]
It’s a useful exercise to visit your infosec teams and see whether they’re carrying an iPhone or an Android phone.
lrvick 2 days ago [-]
I have interviewed countless infosec workers who have never compiled an operating system from source, or even comfortable installing an OS on their own hardware, let alone any clue how to harden one or how basic Linux syscalls work... these are mostly not people we should be looking to for operating system advice.
As an serial OS architect and infosec worker myself with over two decades of experience in OS hardening, and many critical public finds impacting nearly every fortune 500 company, I do not use Apple or Google products at all. They are both complete shit at security and privacy, among other reasons.
otterley 2 days ago [-]
So, what are you using?
lrvick 1 days ago [-]
I do not carry or use a cell phone at all, and most people are probably better off with a dumb phone or no phone either over the current options, IMO.
I rarely leave home with any electronics at all. Sometimes a portable music player.
My only portable computers are sub 10 inch laptops running QubesOS, but will be replacing that with an OS of my own design soon based on stagex, which I founded.
Any software I absolutely need to -trust- is built with stagex and run in dedicated enclaves, servers, and VMs.
> most people are probably better off with a dumb phone or no phone either over the current options, IMO.
...if you're primarily concerned with security.
Most people are not. They're primarily concerned with convenience, staying connected to people in their lives, and entertaining themselves.
And guess what? The iPhone does a pretty good job at this, while also being very good (not perfect) at security.
In general, if you start thinking of anything in the mode of "most people would be better off doing X the way I do it, but they don't", you need to start thinking about a) in what way they would be better off (because in 99% of cases, it's not going to be "universally, with no tradeoffs"), and b) what differences in understanding and priorities "most people" might have from you that would cause them to make those choices.
lrvick 13 hours ago [-]
> ...if you're primarily concerned with security. Most people are not.
Obviously. Most people also were once not concerned with basic sanitation at hospitals, or with avoiding lead paint, or avoiding giving their kids alcohol to help them sleep.
The evidence these things were really bad came decades before public behavior changes.
Humans are so tribal that most will put fitting in and social norms before objective evidence to the point of killing themselves, and even their kids, so we should never assume the popular choices are the least harmful and well informed ones.
It is an evolutionary advantage that some of us do not weigh social norms so much.
otterley 17 hours ago [-]
The reason I asked is that knowing which brand used by infosec experts might lend some insight as to which phone has a better reputation for security among experts in the field.
lrvick 13 hours ago [-]
My argument is there actually are very few actual experts in the field because there are very few standards in this industry. Anyone can call themselves an infosec worker and probably even get a job as one if they learned burp suite a few months ago and did a CTF that one time.
But look at people like Bunnie that actually reverse engineer things down to the metal. He made his own mobile device from scratch, from OS to metal, exactly because all existing options are garbage. These are the types people we should be paying attention to IMO.
otterley 6 hours ago [-]
That’s pretty dismissive and insulting to a wide swath of people who in fact are experts and have decades of professional practice under their belts. I don’t think you get a very good reception if you went to a DefCon or B-Sides and said that aloud.
2 days ago [-]
pixl97 2 days ago [-]
Become a technical person long enough and you'll realize neither exist.
lrvick 2 days ago [-]
Skill issue.
I do not own a cell phone, but I build my operating systems from 386 bytes of machine code all the way up to dual hardware anchored remotely attestable servers with memory encryption and hardware anchored disk encryption, and can do whatever I want on them with confidence.
I even rack my own GPUs at home and own my own AI and "Cloud" too for less than the price of a used car.
The motivated and technical can do virtually anything with tech with total sovereignty and privacy. It has never been easier.
pixl97 2 days ago [-]
"Bla bla bla bla"
You keep posting this stupid crap that's meaningless. The second you step out of your house nearly everything you do is being logged by someone. Your internet connection is being spied on at multiple levels.
You cranking out at autist level 11 and thinking this is somehow normal and won't get you put on your own list.
lrvick 1 days ago [-]
Go to Defcon or even Linux Summit in the US and you see nothing but Macbooks and people that agree with you. Go to FOSDEM or CCC or European conferences, and almost exclusively Linux machines and most I talk to self-host anything they can. They must all be autists too.
You read to me as someone in an American tech bubble suffering from cognitive dissonance so profound you cannot even engage with the substance of a single viewpoint not shared by you or those in your bubble, except to mock and insult.
pixl97 10 hours ago [-]
>They must all be autists too.
Almost certainly. Nero divergent people make up a large part of the tech crowd.
It's not mocking and insulting. It's pointing out you are atypical and therefore any solution you have is not global.
UltraSane 2 days ago [-]
Security and freedom are mutually exclusive for the vast majority of non-technical people who will happily infect themselves over and over with malware.
lrvick 1 days ago [-]
So make it kid mode by default, and require technical expertise to unlock it. Stop making excuses for corpos stripping freedoms from everyone because tech illiterate people exist.
lotsofpulp 2 days ago [-]
In my case, it is the fact that a secure and free (as in speech) alternative does not exist that leads me to believe that. And not in the sense that it’s theoretically secure, I mean in the practical sense that I cannot trust my parents to use any currently available “free” device and not immediately load it up with malware.
collabs 2 days ago [-]
> In my case, it is the fact that a secure and free (as in speech) alternative does not exist that leads me to believe that.
I don't think that is a logical statement.
Just something doesn't exist, does not prove that it can't exist.
You need a stronger proof than that to show that in my opinion.
At some point, you have to empower your users and trust them to do the right thing.
lotsofpulp 2 days ago [-]
>I don't think that is a logical statement. Just something doesn't exist, does not prove that it can't exist.
Let me expand the claim to include the caveats:
>The fact so many technical people believe that security and freedom are mutually exclusive [under current technological/financial/political constraints]
>At some point, you have to empower your users and trust them to do the right thing.
All I know is, my and my parents’ quality of life is far better after switching them to devices where they are not empowered.
danaris 24 hours ago [-]
Well, let's examine this a bit.
Let's assume for the moment that such a thing can exist. Why does it not exist?
What do we know about free (as in speech) software?
- It tends to be written by people on their own time, or funded by companies that want to make sure it continues to exist (though generally, AFAIK, such companies only support existing projects; they don't fund people to create new open-source projects that wouldn't be under their control).
- Largely because of this and the Unix philosophy, it tends to be created as individual projects each made to do one job well, which can then be glued together to do larger jobs.
- It tends to be much less user-friendly than commercial software.
Putting all this together, it is not too hard to see why there aren't widely-adopted free-as-in-speech phone OSes. A phone OS is a large project, which needs to bring a lot of smaller components together within it in a consistent and predictable way; it is a very significant undertaking, requiring a high number of person-hours of work to make usable; and vitally, in order to be commercially viable, it needs to be user-friendly.
So it is very likely that such a project could, theoretically exist, but in practice never will, unless some very wealthy person or group decides to fund its creation without hope of commercial ROI.
boxed 2 days ago [-]
You need to have a stronger argument than "it has never existed and doesn't exist now, but it MIGHT exist IN THEORY". That's an enormously weak argument. Borderline dishonest really.
throwa356262 2 days ago [-]
How do we know it is, besides apple marketing?
Given how many high profile politicians, journalists and businessmen have gotten their phones hacked, the iPhone is not unhackable.
tarpitt 2 days ago [-]
It would be. You would have more eyeballs if you had an open bootloader instead of this program they're offering.
sjtgraham 2 days ago [-]
It's not that secure anyway, as evidenced by the multiple 1-click exploits going around on X this week.
stingraycharles 2 days ago [-]
Compared to what, all the open source projects having exploits this week?
This is a silly argument to make. By pretty much any standard, the iPhone has really good security.
throw0101a 2 days ago [-]
> It's not that secure anyway, as evidenced by the multiple 1-click exploits going around on X this week.
Anyone know if those exploit(s) worked on iPhones with Lockdown Mode enabled?
"Lockdown Mode" is something the user enables. If the user wants to trade functionality for security, it can happen. Good.
The "no root access, no bootloader unlock, no installing your own Apple-unapproved software" bullshit is mandated by Apple, with no opt-out.
tancop 2 days ago [-]
Why not? In the default locked state it's just as secure as before, and unlocking it would require both physical access and your Apple ID.
ankurdhama 1 days ago [-]
It would still be a secure consumer phone if the process to unlock bootloader requires connecting to mac and running some commands along with accepting 10 different warnings.
paxy 2 days ago [-]
That’s exactly what NSO group and governments worldwide want you to keep believing.
nicce 2 days ago [-]
By definition, it could be more secure if people actually would be able to inspect it. Is it regardless the most secure? Hard to say. GrapheneOS is quite secure, probably more.
lrvick 2 days ago [-]
GrapeheneOS are both operating systems where a single party has the signing keys to run any software they want on your device at any time, and even remotely brick it.
I for one am not comfortable with anyone having that much power over something that is supposed to be mine, so they are the same to me. Untrustable black boxes.
HybridStatAnim8 6 hours ago [-]
That is how most software works. If you do not wish for GrapheneOS to hold the signing keys to your OS, you may build the OS yourself.
GrapheneOS is 100% open source and supports reproducible builds. It is in no way a black box.
If you do not want anyone to hold your signing keys, you will need to stop using nearly all modern hardware and software.
imkac 2 days ago [-]
The difference between GrapheneOS and iOS is that it is 100% open source, replicable, able to self-sign, and only <1% of the part has dynamic code loading, which is incredibly low compared to any major OS.
lrvick 2 days ago [-]
You are still having to trust a pile of binary blobs even if you built and self signed every release yourself, which I used to do, but at 240gb of source code it is not practical for most individuals even if you do trust all those dozens of blobs from random vendors, which I do not.
This one is not really a fault of GrapheneOS, and more a reality that Android is not actually an open platform and never will be. I require a lot more control of a device I need to be able to trust than anything in the android ecosystem can offer anymore.
Replicant was the right approach but sadly never got the resources to pursue it at the required scale to support new devices.
Vaushite 2 days ago [-]
It's not replicable or open source since your build won't pass attestation
grapheneos 4 hours ago [-]
GrapheneOS is open source with reproducible builds. Android key attestation isn't specific to GrapheneOS and is OS independent. It mainly exists to check that a key was generated in a hardware keystore. There's no pass or fail based on having an official or unofficial build of GrapheneOS. The hardware can sign public key certificates with metadata on device security including verified boot state (green, yellow or orange), verified boot key hash, verified boot hash (hash of the core OS) and patch levels. That's not nefarious and is useful to end users. Our Auditor app uses it to help users protect their devices. GrapheneOS doesn't use it to require people to use an official build for any purpose. Some banks have regulations requiring them to verify the hardware, OS and app which means they need to specifically allow each non-Google-certified OS. There are only around 3 banking apps are known to permit GrapheneOS that way and without it they'd ban using any non-Google-certified OS.
HybridStatAnim8 6 hours ago [-]
Not passing attestation for certain services has no bearing on software being open source or supporting reproducible builds.
Vaushite 4 hours ago [-]
It proves that you haven't built an equivalent binary.
grapheneos 4 hours ago [-]
Software doesn't stop being open source because the releases are signed to be able to verify those. Any OS can be installed on the supported device. The verified boot key hash shown at boot will be different for an unofficial build and so will a query to the hardware asking it to provide it. Auditor and AttestationServer are open source. Those work fine with unofficial builds and forks of GrapheneOS after making builds of those with the correct key.
306bobby 2 days ago [-]
Isn't apple also a "single party that has the signing keys to run any software..." ?
306bobby 2 days ago [-]
I missed the "both" on the top of your message sorry!
lrvick 2 days ago [-]
my bad for forgetting the key word to go with the both, apple.
2 days ago [-]
ajjahs 2 days ago [-]
what an insane comment.
You can litteraly build and sign GrapeheneOS yourself and you can audit it, if this is your concern.
While in the chain of trust there is still Google Root key first, is this far away from "run any software they want on your device at any time, and even remotely brick it"
(and ofc you could also block updates on grapheneOS, which would also prevent this aswell)
And a black box is not something that you dont understand, applying that logic anything becomes a black box.
Also what setup are you using then ?
edit: and i mean i understand the idea of not trusting devices, but this is just a false equivalence.
While at the same time, if you dont want to live with technology from like 100 years ago, at some point do you have to trust a black box, if you want to call it that.
realusername 2 days ago [-]
It isn't, the most secure phone is GrapheneOS.
And if you only take into account stock phones, stock Pixels are still above it as per exploit costs.
So they are basically 3rd or 4th place if you add some other Android flagships into the list.
kube-system 2 days ago [-]
GrapheneOS isn’t a phone
306bobby 2 days ago [-]
I can't help but feel you're intentionally missing the point. An iPhone itself isn't secure without iOS, iOS is what supplies the limitations
Graphene is iOS
kube-system 1 days ago [-]
The OS is only part of the attack surface and part of the security features of a smartphone.
realusername 2 days ago [-]
I've covered that in the second part of my comment, even if you deliberately exclude GrapheneOS (not sure why you would as it's used by high profile targets), Apple still isn't #1
slashdave 2 days ago [-]
Unlocking is the exact opposite of security.
What problem are you trying to "solve"?
2 days ago [-]
numpad0 2 days ago [-]
iPhone supports making and receiving credit card payments. Payment infrastructures demand tamper proofing for devices that handle payments.
jeroenhd 2 days ago [-]
> Payment infrastructures demand tamper proofing for devices that handle payments
It wasn't that long ago that my bank's app had its own NFC payment feature that worked perfectly fine on a rooted phone. Unfortunately, they killed that feature and moved to Google Wallet.
As it turns out, payment infrastructure only requires tamper proofing if that's part of the arbitrary requirements of the app you're using.
gregoriol 2 days ago [-]
Yeah, that's why most common credit card skimming happens at public ATMs or gas stations...
holsta 2 days ago [-]
I make credit card payments from Linux Mint and OpenBSD regularly.
carlosjobim 2 days ago [-]
At your local grocery store or bakery?
trombuance 2 days ago [-]
This is also why my current Macbook will be my last, I'm going back to Linux. No matter how superior M-series chips are the amazing hardware can't make up for the unbearable nanny software. So tired of Apple machines telling me what I should do. It's supposed to be the other way around.
lrvick 2 days ago [-]
Almost every employer in my career ignored that I want to choose my hardware, and gave me a macbook, and I got them to compromise by giving me a pass to run whatever software I wanted. Every time I installed Linux on it, sometimes porting it myself with custom patches, on their time.
The greatest middle finger to Apple is freeing their hardware. Been at it since I built and booted a uCLinux kernel on my first iPod I got as a kid.
fleroviumna 2 days ago [-]
[dead]
lrvick 2 days ago [-]
Surely everyone sees this as an obvious trap to get researchers to sign NDAs for all research in advance, right?
Do not fall for it. Publish everything publicly after appropriate embargo periods.
Aurornis 2 days ago [-]
The program allows publishing after the bug is fixed.
There are some really ridiculous attempts to be outraged about this program.
lrvick 1 days ago [-]
And if Apple decides not to fix it? Like when I have multiple times broken their DRM to help users have more freedom? I would never agree not to share such things as I like.
They have windows they're open for every year, someone usually submits one during the window, I suspect. I submitted this in case anyone would find it useful, given the window is closing soon.
alt227 2 days ago [-]
I wasnt saying anything negative, just linking the previous conversation for reference.
potatoproduct 2 days ago [-]
The title should be "Apple bribes security researchers with free devices"
ta8903 2 days ago [-]
Cool. Where can I buy one.
birdman3131 2 days ago [-]
Just gotta sign away your soul.
sysguest 2 days ago [-]
well that's cheaper than expected!
m463 2 days ago [-]
the periodic terms and conditions updates are hell though.
tamimio 2 days ago [-]
Lol is this a joke? So you are leased a device to find vulnerabilities, that you can’t report anywhere but to apple? Mostly for free?! Why would anyone do that? If I found one sure i will give sometime to the vendor to patch it out of courtesy, then I will publish my own results, I own it, no one works for free, touch some grass, apple.
test080 2 days ago [-]
[dead]
test080 2 days ago [-]
[dead]
userbinator 2 days ago [-]
[flagged]
sbseitz 2 days ago [-]
[flagged]
close04 2 days ago [-]
Israel can probably pwn any normal mobile phone because they invested a lot in this area, and has no reason to be afraid to do it. They are always shielded from consequences.
jubilee33 2 days ago [-]
[flagged]
cromka 2 days ago [-]
People also are not willing to even open a link these days before they comment on it
angulardragon03 2 days ago [-]
> any vulnerabilities that you discover with the SRD are automatically considered for Apple Security Bounty — including bonus awards for preview and beta software programs.
Did you read the linked page? Any vuln you find with the device, you can report and receive the bounty you would’ve received otherwise. The idea of the SRD is that you can focus on bugs that you’d otherwise need to build a whole exploit chain just to get to.
alt227 2 days ago [-]
The only issue is Apple doesnt follow normal 90 day public disclosure procedures, so if you enter into this program you are contractually obliged not to tell anybody but Apple about any security issue you find until they fix it. If they choose not to fix it (as they regularly do with these bugs) then you are never allowed to tell anybody about it under NDA. Many security researchers consider this a restrictive muzzle and so do not join the program.
Here is an example from a security expert from when the program originally launched:
> Many security researchers consider this a restrictive muzzle and so do not join the program.
And many researchers still do. Apple doesn’t care about those who don’t participate.
The point was never to make all security researchers happy.
You’re coming across as though Apple (or anyone else) owes you a duty and that you need to be made personally satisfied, and it’s incredibly off-putting.
alt227 1 days ago [-]
Feel free not to read my posts if you find them offputting.
I wont be so rude as to tell you how you are coming across.
otterley 1 days ago [-]
You are going to get feedback regardless of whether you like it, whether it be from me or someone else. That’s the price of being here.
Manufacturing outrage isn’t cool, dude.
alt227 14 hours ago [-]
I'm fine with feedback, it was yourself who started saying things are off-putting. If things put you off maybe you should avoid them.
You are completely missing the point, now accusing me of things, and calling me dude. Please dont do any of those things, it just shows you up more.
otterley 14 hours ago [-]
It is you who doesn’t get the point. The feedback is meant to help you consider behaving differently. You don’t have to accept it, but telling people to ignore you if they disagree is unavailing. It tells us you’re not receptive. Peace out.
jubilee33 2 days ago [-]
Yes that's exactly my point, the phrasing of that is that nothing is guaranteed just "will be considered" but regardless they own your work, even if they considered and ultimately gave it no importance or just silently fixed it.
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
The subsequent sentence on the page also says that if you find a vulnerability in a third-party app you have to tell the third party.
https://security.apple.com/terms-and-conditions/
> For a reported security vulnerability affecting any Apple platform to be eligible for an Apple Security Bounty award, you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability.
Which does not have the meaning of prohibiting disclosure to third parties or the public; it only means that you forfeit the bounty.
"Apple reserves the right to immediately end your participation in the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple"
Entirely reasonable.
They can report it but have to wait until it’s fixed.
I think anyone angry about this is just looking for reasons to be angry. I also doubt the people complaining the loudest are even the targets of this program.
https://x.com/benhawkes/status/1286021329246801921
No, it's a way of making sure that Apple can fix the security issue and deliver the fix to customers before it can be exploited.
How is that not playing ball?
This manufactured outrage is getting ridiculous.
Apple has safeguards to avoid selling exploits to criminals that attack Apple's own customers. Good. I wouldn't want Apple to "play ball" like that.
this is the unintended consequence that whoever came up with this policy missed: it effectively leaves only bad actors in your pool
The text says they can’t disclose until after it’s fixed.
That’s reasonable. Calling this sneaky bribery and leaving out the fact that the agreement is only to wait until it’s fixed is really distorting the facts for maximum outrage.
Probably both things are true.
Either way, consumers ultimately win in that the products and services they use will be made more secure.
It’s not a ‘sneaky way of avoiding vulnerabilities going public’, it’s a responsible disclosure agreement between two consenting parties.
This shouldn't exist in the first place. There would be no need for it if Apple didn't insist on "we own all the iPhones, our users just get to tap at them".
If you could just unlock the bootloader, re-enable SWD and do what you want with an iPhone that you actually own, there would be no need for this restrictive program at all.
My Aunt Millie's iPhone is secure against herself because she can't install random garbage off the Internet and is in a walled garden.
As someone who works in IT: users are often their (and their organization's) own worst enemy. We've tried training and blacklisting (with anti-virus) for decades, and it appears that whitelisting and locking things down is what actually works.
I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
You just described what Samsung does with their phones. You can unlock them, but even if you later switch back to the normal OS, some features are permanently disabled by that fuse.
I got screwed by this by buying a used Samsung Tablet for the purpose of rooting it and made the mistake of letting it update after I factory reset it. Never buying a Samsung product again.
I really wish we could have a simple "don't bother me, I know what I'm doing" switch on these phones but I can certainly understand the reasons why Apple and Google are putting in as many roadblocks as possible to protect users from themselves.
I wouldn’t mind phones having “Adult” mode that intentionally fails secure net and is completely split off from the standard user space. In adult mode I install what I want.
I wish they stop finding ways to lock down the device in the name of security and/or release different SKUs for the more secure use cases, provided by the organizations themselves if they deem it necessary.
We did have hardware tokens for corporate logins and banking needs.
There is no real reason why an open phone cannot be secure for sensitive applications.
I have a house full of servers and self host virtually my entire digital life and even my own usage of AI, but when I leave home I typically carry no electronics at all.
We convince ourselves we need phones, but I promise you, they are optional. Being offline a few hours a day is also good for your brain.
Many people's employer's use of MFA (including my own) says otherwise.
For many people ensuring their spouse and/or their children's school be able to reach them for emergencies and sudden matters says otherwise. Or an elderly parent (e.g., location tracking).
yubikey/nitrokey. Much more secure by a mile and works when your phone battery is dead. I switched multiple past employers from apps to these, joining as an SWE.
> tracking elderly parent (e.g., location tracking)
meshtastic asset tracking tag which will work even in emergencies when cell towers are down.
> children's school be able to reach them for emergencies
call-to-one-way-pager bridge, or voip-to-meshtastic bridge. Cheap to free solutions that will also work when cell towers are down.
Hit me with more perceived blockers if you are actually interested. Give me your gotchas. I have probably heard it all and am passionate about engaging people on this topic.
My wife and I have lived without a cell phone subscription for going on a decade and live a modern life as silicon valley tech workers.
Most have the choice to enjoy mostly the same lifestyle they have today, without Apple or Google or proprietary software or cell phones or even debit cards. There are reliable solutions for everything outside of the US surveillance capitalism bubble for those that actually want them.
Exiting surveillance capitalism is possible without major lifestyle changes.
Read Digital Vegan by Andy Farnell.
It really isn't - credit rating agencies are the most egregious examples by far, and next to impossible to opt out of.
> Not everyone’s life is your life. Not everyone living not your life is doing it wrong.
The irony.
But I do advocate pretty strongly for open phones because they are becoming indispensable for leading a normal life without becoming a digital hermit.
They should be either open and indispensable or closed and dispensable, not indispensable and closed at the same time.
I make an actual case for the things I advocate for and actually live my convictions.
Why everyone would is better off electing Apple or Google or Meta to decide what software we are allowed to install, what content we can share with our friends, when our data should be deleted, and when it should be sold to the highest bidder that wishes to manipulate us at scale?
I am convinced surveillance capitalism is a net negative for society, but if you really think otherwise, please make an actual case for your own view instead of complaining about me making mine.
Well, except that one-click PDF persistent root exploit American researchers found, and there not being any sort of iOS malware wave in the EU.
iPhones are aimed at the many millions/billions of technically unsophisticated users who don't care about rooting their phone, but would be very unhappy to get phished out of their life savings.
Grandma does not need the freedom to install the DeFlock or ICEBlock to help protect herself and her neighbors, right? Tim Cook is a Trump doner but of course has no political bias, and remains confident ICE and law enforcement always behave ethically so there is nothing to fear.
A corporation takes away basic freedoms of people over the tools they use to communicate with society, and then consumers get on the internet in public forums and -defend- them for it. Unbelievable.
I really hope you do not vote with this type of thinking.
You can muddy the waters with strawmen and politics, but I doubt you'll convince many people around here.
Tech CEOs will always do the right thing and act in public interest before profits or political favors, right?
They would never censor an app that the public largely wanted, right?
Fortnite did not pay their Apple tax, so no one got to install Fortnite. For safety.
To be clear, Google is just as bad. I do not use or recommend any products from either company.
I use laptops, desktops, or nothing, and get along just fine.
I think if you don’t get the point of protecting a device against the user, you’ve not had to help un-tech savvy relatives get out of situations where dark or confusing UI practices have got themselves into a mess.
As an serial OS architect and infosec worker myself with over two decades of experience in OS hardening, and many critical public finds impacting nearly every fortune 500 company, I do not use Apple or Google products at all. They are both complete shit at security and privacy, among other reasons.
I rarely leave home with any electronics at all. Sometimes a portable music player.
My only portable computers are sub 10 inch laptops running QubesOS, but will be replacing that with an OS of my own design soon based on stagex, which I founded.
Any software I absolutely need to -trust- is built with stagex and run in dedicated enclaves, servers, and VMs.
https://stagex.tools
...if you're primarily concerned with security.
Most people are not. They're primarily concerned with convenience, staying connected to people in their lives, and entertaining themselves.
And guess what? The iPhone does a pretty good job at this, while also being very good (not perfect) at security.
In general, if you start thinking of anything in the mode of "most people would be better off doing X the way I do it, but they don't", you need to start thinking about a) in what way they would be better off (because in 99% of cases, it's not going to be "universally, with no tradeoffs"), and b) what differences in understanding and priorities "most people" might have from you that would cause them to make those choices.
Obviously. Most people also were once not concerned with basic sanitation at hospitals, or with avoiding lead paint, or avoiding giving their kids alcohol to help them sleep.
The evidence these things were really bad came decades before public behavior changes.
Humans are so tribal that most will put fitting in and social norms before objective evidence to the point of killing themselves, and even their kids, so we should never assume the popular choices are the least harmful and well informed ones.
It is an evolutionary advantage that some of us do not weigh social norms so much.
But look at people like Bunnie that actually reverse engineer things down to the metal. He made his own mobile device from scratch, from OS to metal, exactly because all existing options are garbage. These are the types people we should be paying attention to IMO.
I do not own a cell phone, but I build my operating systems from 386 bytes of machine code all the way up to dual hardware anchored remotely attestable servers with memory encryption and hardware anchored disk encryption, and can do whatever I want on them with confidence.
I even rack my own GPUs at home and own my own AI and "Cloud" too for less than the price of a used car.
The motivated and technical can do virtually anything with tech with total sovereignty and privacy. It has never been easier.
You keep posting this stupid crap that's meaningless. The second you step out of your house nearly everything you do is being logged by someone. Your internet connection is being spied on at multiple levels.
You cranking out at autist level 11 and thinking this is somehow normal and won't get you put on your own list.
You read to me as someone in an American tech bubble suffering from cognitive dissonance so profound you cannot even engage with the substance of a single viewpoint not shared by you or those in your bubble, except to mock and insult.
Almost certainly. Nero divergent people make up a large part of the tech crowd.
It's not mocking and insulting. It's pointing out you are atypical and therefore any solution you have is not global.
I don't think that is a logical statement. Just something doesn't exist, does not prove that it can't exist. You need a stronger proof than that to show that in my opinion. At some point, you have to empower your users and trust them to do the right thing.
Let me expand the claim to include the caveats:
>The fact so many technical people believe that security and freedom are mutually exclusive [under current technological/financial/political constraints]
>At some point, you have to empower your users and trust them to do the right thing.
All I know is, my and my parents’ quality of life is far better after switching them to devices where they are not empowered.
Let's assume for the moment that such a thing can exist. Why does it not exist?
What do we know about free (as in speech) software?
- It tends to be written by people on their own time, or funded by companies that want to make sure it continues to exist (though generally, AFAIK, such companies only support existing projects; they don't fund people to create new open-source projects that wouldn't be under their control).
- Largely because of this and the Unix philosophy, it tends to be created as individual projects each made to do one job well, which can then be glued together to do larger jobs.
- It tends to be much less user-friendly than commercial software.
Putting all this together, it is not too hard to see why there aren't widely-adopted free-as-in-speech phone OSes. A phone OS is a large project, which needs to bring a lot of smaller components together within it in a consistent and predictable way; it is a very significant undertaking, requiring a high number of person-hours of work to make usable; and vitally, in order to be commercially viable, it needs to be user-friendly.
So it is very likely that such a project could, theoretically exist, but in practice never will, unless some very wealthy person or group decides to fund its creation without hope of commercial ROI.
Given how many high profile politicians, journalists and businessmen have gotten their phones hacked, the iPhone is not unhackable.
This is a silly argument to make. By pretty much any standard, the iPhone has really good security.
Anyone know if those exploit(s) worked on iPhones with Lockdown Mode enabled?
* https://support.apple.com/en-ca/105120
* https://arstechnica.com/tech-policy/2026/02/fbi-stymied-by-a...
The "no root access, no bootloader unlock, no installing your own Apple-unapproved software" bullshit is mandated by Apple, with no opt-out.
I for one am not comfortable with anyone having that much power over something that is supposed to be mine, so they are the same to me. Untrustable black boxes.
GrapheneOS is 100% open source and supports reproducible builds. It is in no way a black box.
If you do not want anyone to hold your signing keys, you will need to stop using nearly all modern hardware and software.
This one is not really a fault of GrapheneOS, and more a reality that Android is not actually an open platform and never will be. I require a lot more control of a device I need to be able to trust than anything in the android ecosystem can offer anymore.
Replicant was the right approach but sadly never got the resources to pursue it at the required scale to support new devices.
You can litteraly build and sign GrapeheneOS yourself and you can audit it, if this is your concern. While in the chain of trust there is still Google Root key first, is this far away from "run any software they want on your device at any time, and even remotely brick it"
(and ofc you could also block updates on grapheneOS, which would also prevent this aswell)
And a black box is not something that you dont understand, applying that logic anything becomes a black box.
Also what setup are you using then ?
edit: and i mean i understand the idea of not trusting devices, but this is just a false equivalence. While at the same time, if you dont want to live with technology from like 100 years ago, at some point do you have to trust a black box, if you want to call it that.
And if you only take into account stock phones, stock Pixels are still above it as per exploit costs.
So they are basically 3rd or 4th place if you add some other Android flagships into the list.
Graphene is iOS
What problem are you trying to "solve"?
It wasn't that long ago that my bank's app had its own NFC payment feature that worked perfectly fine on a rooted phone. Unfortunately, they killed that feature and moved to Google Wallet.
As it turns out, payment infrastructure only requires tamper proofing if that's part of the arbitrary requirements of the app you're using.
The greatest middle finger to Apple is freeing their hardware. Been at it since I built and booted a uCLinux kernel on my first iPod I got as a kid.
Do not fall for it. Publish everything publicly after appropriate embargo periods.
There are some really ridiculous attempts to be outraged about this program.
https://news.ycombinator.com/item?id=23919175
Did you read the linked page? Any vuln you find with the device, you can report and receive the bounty you would’ve received otherwise. The idea of the SRD is that you can focus on bugs that you’d otherwise need to build a whole exploit chain just to get to.
Here is an example from a security expert from when the program originally launched:
https://x.com/benhawkes/status/1286021329246801921
And many researchers still do. Apple doesn’t care about those who don’t participate.
The point was never to make all security researchers happy.
You’re coming across as though Apple (or anyone else) owes you a duty and that you need to be made personally satisfied, and it’s incredibly off-putting.
I wont be so rude as to tell you how you are coming across.
Manufacturing outrage isn’t cool, dude.
You are completely missing the point, now accusing me of things, and calling me dude. Please dont do any of those things, it just shows you up more.