> Question for HN in general: Is it possible in principle (for Apple or someone else) to construct a smartphone that can accept software/firmware updates, but t

> Question for HN in general: Is it possible in principle (for Apple or someone else) to construct a smartphone that can accept software/firmware updates, but that Apple cannot push malware to at some later time? I've been thinking about a related question: how to construct an update system so the updater cannot push malware to a specific phone, without making it visible and available to everyone else? My answer would be something like Certificate Transparency (https://en.wikipedia.org/wiki/Certificate_Transparency https://en.wikipedia.org/wiki/Certificate_Transparency). The update system would only accept an update if it's signed by several independent entities, spread all over the world (in many independent jurisdictions), and the signing system in these entities would be designed in such a way that every signature is written to an append-only log which is published to everyone to see, and these entities would also publish a copy of every update they signed. That way, Apple could still push malware to a phone, but they couldn't push malware to a phone without making that fact public, at least to security researchers who can reverse-engineer firmware updates.