Apple Security Research Device
security.apple.comIf you sign up to this program and use one of their devices for 'research', then you are bound by contract to report any security bugs to them and only them (unless the bug is in a 3rd party app). I see this as a pretty sneaky way of avoiding your security vulnerabilities going public and all the bad media exposure that goes along with it.
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
Create a problem, and then heroically fight to make a solution.
This shouldn't exist in the first place. There would be no need for it if Apple didn't insist on "we own all the iPhones, our users just get to tap at them".
If you could just unlock the bootloader, re-enable SWD and do what you want with an iPhone that you actually own, there would be no need for this restrictive program at all.
It wouldn’t be the most secure consumer phone then, would it?
The fact so many technical people believe that security and freedom are mutually exclusive, and pay for that lie, is proof the Apple propaganda is working exactly as intended.
My Mac's very secure and I can install whatever I want. But it wouldn't be secure or private to do that on iPhone, because profit.
In my case, it is the fact that a secure and free (as in speech) alternative does not exist that leads me to believe that. And not in the sense that it’s theoretically secure, I mean in the practical sense that I cannot trust my parents to use any currently available “free” device and not immediately load it up with malware.
> In my case, it is the fact that a secure and free (as in speech) alternative does not exist that leads me to believe that.
I don't think that is a logical statement. Just something doesn't exist, does not prove that it can't exist. You need a stronger proof than that to show that in my opinion. At some point, you have to empower your users and trust them to do the right thing.
It's not that secure anyway, as evidenced by the multiple 1-click exploits going around on X this week.
Compared to what, all the open source projects having exploits this week?
This is a silly argument to make. By pretty much any standard, the iPhone has really good security.
It would be. You would have more eyeballs if you had an open bootloader instead of this program they're offering.
How do we know it is, besides apple marketing?
Given how many high profile politicians, journalists and businessmen have gotten their phones hacked, the iPhone is not unhackable.
Why not? In the default locked state it's just as secure as before, and unlocking it would require both physical access and your Apple ID.
By definition, it could be more secure if people actually would be able to inspect it. Is it regardless the most secure? Hard to say. GrapheneOS is quite secure, probably more.
GrapeheneOS are both operating systems where a single party has the signing keys to run any software they want on your device at any time, and even remotely brick it.
I for one am not comfortable with anyone having that much power over something that is supposed to be mine, so they are the same to me. Untrustable black boxes.
The difference between GrapheneOS and iOS is that it is 100% open source, replicable, able to self-sign, and only <1% of the part has dynamic code loading, which is incredibly low compared to any major OS.
iPhone supports making and receiving credit card payments. Payment infrastructures demand tamper proofing for devices that handle payments.
This is also why my current Macbook will be my last, I'm going back to Linux. No matter how superior M-series chips are the amazing hardware can't make up for the unbearable nanny software. So tired of Apple machines telling me what I should do. It's supposed to be the other way around.
Almost every employer in my career ignored that I want to choose my hardware, and gave me a macbook, and I got them to compromise by giving me a pass to run whatever software I wanted. Every time I installed Linux on it, sometimes porting it myself with custom patches, on their time.
The greatest middle finger to Apple is freeing their hardware. Been at it since I built and booted a uCLinux kernel on my first iPod I got as a kid.
Surely everyone sees this as an obvious trap to get researchers to sign NDAs for all research in advance, right?
Do not fall for it. Publish everything publicly after appropriate embargo periods.
The title should be "Apple bribes security researchers with free devices"
Dupe from 2020:
Does this include... Israel being able to pwn any Apple device ?
Israel can probably pwn any normal mobile phone because they invested a lot in this area, and has no reason to be afraid to do it. They are always shielded from consequences.
"Help us make the nooses we put around your necks tighter."
Cool. Where can I buy one.
Just gotta sign away your soul.
well that's cheaper than expected!
the periodic terms and conditions updates are hell though.