5 ms·

Naturally "can't create" is better than "won't create", but this case is about the precedent and not this particular iPhone. If a court can force a company to

by panarky 11y ago

Naturally "can't create" is better than "won't create", but this case is about the precedent and not this particular iPhone. If a court can force a company to create new technology that didn't exist before, what other tools might they be forced to build? 1) Stream keystrokes, audio, video, location to law enforcement prior to encryption 2) Replace actual search results with government-approved results 3) Force Apple to create target lists of suspects based on their location, apps installed, sites visited, keywords typed Bad things happen when the government can force private companies and individuals to create new tools for law enforcement. There is no technology that prevents Apple from subverting Apple's security. If Apple loses, the new precedent could open Pandora's box.

dangirsh 11y ago
"There is no technology that prevents Apple from subverting Apple's security." That's just in this universe. If users truly owned their devices, with full knowledge of the hardware and control of the software + data, we would never have this discussion. In this world, you have to jump through flaming hoops just to prevent Apple from automatically swapping out your OS!
- cmdkeen 11y ago
  For what values of "full knowledge" - you bootstrapped your compiler and verify every line of source code you've downloaded. But then if you're up against nation state actors they can probably force your source code source to be compromised for you and only you - so those "many eyes" are seeing different code. You are after all checking that other people have the same hashes for the download that you use... Then we're getting into compromised hardware, you verified that the chips actually are the same as the circuit diagrams after all. There is only so much tinfoil you can deploy. If an advanced nation state truly has you in its sights there isn't much you can do about it, and to be honest that's the way it should be. We sacrifice individual liberties for the advantages of being part of an organised society, and the limitation of coercive power to the state is a key part of that. A well regulated state in which the right people get targeted, with an acceptably low false positive rate that scales based on the degree of privacy violation of the targeting seems to be a perfectly sensible state of affairs. Apple's argument that they are being asked to do something that isn't justified fits just fine into that.
  - CaptSpify 11y ago
    tl;dr: "it's hard to verify code. therefore, we shouldn't even try!"
    - freehunter 11y ago
      Not hard. Impossible. Have you seen obfuscated C? Is it possible for enough people to read it and understand it that it would make a difference? What about if you can read it but I can't? Do I trust you? How many people have to verify it before a non-expert can trust it? Theoretically, none. Everyone could be in on the conspiracy except me. And how do I verify that the code I've just read is what shipped on my computer? If I install it myself, how do I verify the CD or ISO I have is what I read? If I compiled it myself, how do I verify the compiler didn't change anything? What about the system that compiled the code, do I trust that? How far back do I have to go before I have trusted everything? And then what about hardware? Is there a chip that changes some of the code that's running? Can I verify every piece of hardware in my system, a 16-core CPU with 64GB of RAM and a high-end video card? How do I even do that? And what are the odds I am a world class C coder and a world-class hardware expert? And then what about client code? Am I a world-class Javascript expert too, with full source access to the Django backend? And the system that is running that server code, do I have access to that hardware to make sure it's not going to compromise my security? No. Fully trusting a computer is impossible. It doesn't mean we shouldn't try, we should at least make it as hard as possible for the bad guys to trick us. But what's better, IMO, is to create an environment where it's detrimental to companies to trick their users like that. Apple seems to have gotten a lot of great press for standing up in this situation. There's a market for it. Can you trust Apple tech? Maybe not. But can you trust it more than Google or Microsoft or Samsung or Facebook or Amazon etc etc? It does seem that way. Without being a world-class expert in everything, eventually you have to trust someone.
      - CaptSpify 11y ago
        > No. Fully trusting a computer is impossible. It doesn't mean we shouldn't try, we should at least make it as hard as possible for the bad guys to trick us. I completely agree. I liken it to something like world-peace: It's an ideal, and we'll probably never get there. Doesn't mean we shouldn't try to get there though.
- stcredzero 11y ago
  > If users truly owned their devices, with full knowledge of the hardware and control of the software + data, we would never have this discussion. We should have a series of standardized trusted execution modules which are open source hardware and open source software. There should be a public process by which these are vetted. Watchdog groups could disassemble samples of the chips and place them under electron microscopes and otherwise examine them for tampering. The effect of this would be to place individuals and grassroots organizations on an even playing field with corporations and governments with regards to such tools. It's a disaster for large organizations to have access to individual private information, yet it's a societal boon for such organizations to be open and for individuals to know what they are doing. The same asymmetry applies to trusted execution. It's a disaster when big organizations use it against individuals, but it would be a societal good if individuals could revoke access to their information from corporations when they break goodwill.

by panarky 11y ago

dangirsh 11y ago

"There is no technology that prevents Apple from subverting Apple's security." That's just in this universe. If users truly owned their devices, with full knowledge of the hardware and control of the software + data, we would never have this discussion. In this world, you have to jump through flaming hoops just to prevent Apple from automatically swapping out your OS!

cmdkeen 11y ago
For what values of "full knowledge" - you bootstrapped your compiler and verify every line of source code you've downloaded. But then if you're up against nation state actors they can probably force your source code source to be compromised for you and only you - so those "many eyes" are seeing different code. You are after all checking that other people have the same hashes for the download that you use... Then we're getting into compromised hardware, you verified that the chips actually are the same as the circuit diagrams after all. There is only so much tinfoil you can deploy. If an advanced nation state truly has you in its sights there isn't much you can do about it, and to be honest that's the way it should be. We sacrifice individual liberties for the advantages of being part of an organised society, and the limitation of coercive power to the state is a key part of that. A well regulated state in which the right people get targeted, with an acceptably low false positive rate that scales based on the degree of privacy violation of the targeting seems to be a perfectly sensible state of affairs. Apple's argument that they are being asked to do something that isn't justified fits just fine into that.
- CaptSpify 11y ago
  tl;dr: "it's hard to verify code. therefore, we shouldn't even try!"
  - freehunter 11y ago
    Not hard. Impossible. Have you seen obfuscated C? Is it possible for enough people to read it and understand it that it would make a difference? What about if you can read it but I can't? Do I trust you? How many people have to verify it before a non-expert can trust it? Theoretically, none. Everyone could be in on the conspiracy except me. And how do I verify that the code I've just read is what shipped on my computer? If I install it myself, how do I verify the CD or ISO I have is what I read? If I compiled it myself, how do I verify the compiler didn't change anything? What about the system that compiled the code, do I trust that? How far back do I have to go before I have trusted everything? And then what about hardware? Is there a chip that changes some of the code that's running? Can I verify every piece of hardware in my system, a 16-core CPU with 64GB of RAM and a high-end video card? How do I even do that? And what are the odds I am a world class C coder and a world-class hardware expert? And then what about client code? Am I a world-class Javascript expert too, with full source access to the Django backend? And the system that is running that server code, do I have access to that hardware to make sure it's not going to compromise my security? No. Fully trusting a computer is impossible. It doesn't mean we shouldn't try, we should at least make it as hard as possible for the bad guys to trick us. But what's better, IMO, is to create an environment where it's detrimental to companies to trick their users like that. Apple seems to have gotten a lot of great press for standing up in this situation. There's a market for it. Can you trust Apple tech? Maybe not. But can you trust it more than Google or Microsoft or Samsung or Facebook or Amazon etc etc? It does seem that way. Without being a world-class expert in everything, eventually you have to trust someone.
    - CaptSpify 11y ago
      > No. Fully trusting a computer is impossible. It doesn't mean we shouldn't try, we should at least make it as hard as possible for the bad guys to trick us. I completely agree. I liken it to something like world-peace: It's an ideal, and we'll probably never get there. Doesn't mean we shouldn't try to get there though.
stcredzero 11y ago
> If users truly owned their devices, with full knowledge of the hardware and control of the software + data, we would never have this discussion. We should have a series of standardized trusted execution modules which are open source hardware and open source software. There should be a public process by which these are vetted. Watchdog groups could disassemble samples of the chips and place them under electron microscopes and otherwise examine them for tampering. The effect of this would be to place individuals and grassroots organizations on an even playing field with corporations and governments with regards to such tools. It's a disaster for large organizations to have access to individual private information, yet it's a societal boon for such organizations to be open and for individuals to know what they are doing. The same asymmetry applies to trusted execution. It's a disaster when big organizations use it against individuals, but it would be a societal good if individuals could revoke access to their information from corporations when they break goodwill.