12 ms·

As Apple is not developing this software in the public, it would not make sense to put it on GitHub or any other code hosting site. The usual approach is that A

by raimue 9y ago

As Apple is not developing this software in the public, it would not make sense to put it on GitHub or any other code hosting site. The usual approach is that Apple throws bits over the wall where you can pick them up months after the end-user release. And even these code drops will be thoroughly cleaned before, so that for example kernel sources do not contain any trace of support for ARM or anything else related to the iPhone – all of that is strictly closed source. Software they take in from BSD, other open source projects, or some common Linux tools might also get patched. However, such patches are never actively submitted back to the projects, but only published on this website. The sources published for macOS on this website are mostly licensed any variant of the BSD/MIT licenses, or the Apple Public Source License, or the GPLv2. Apple avoids the GPLv3 for legal reasons due to its patent clause. That is why they often ship only the most recent GPLv2 release and ignore all later updates, for example GNU make 3.81 or bash 3.2. There might also be some other licenses in the mix, such as the Artistic License for Perl and related software.

eridius 9y ago
> Apple avoids the GPLv3 for legal reasons due to its patent clause. The patent clause is bad, but the anti-TiVoization clause is actually worse. According to that, if Apple accidentally ships any GPLv3 on iOS then they'll have to release their root signing keys to the world, which would be disastrous (it would destroy the security model of the OS).
- phh 9y ago
  Nope, GPLv3 doesn't break any security model other than security by obscurity. Android could very well use GPLv3 and have no consequence on its security model. As long as the bootloader is open-able, the Tivo-ization rule of GPLv3 is respected. If Apple uses GPLv3, it will piss them off quite a lot, but it won't impact their security at all.
  - eridius 9y ago
    Of course it will. The iOS security model fundamentally depends on everything from the bootloader up being codesigned. Releasing the root signing keys completely destroys this. Nothing on the system can be trusted anymore if that happens. Edit: Well, I guess the secure enclave can be trusted. But nothing else can be.
    - asveikau 9y ago
      IANAL, but if they had a way for a legit owner of the device (for some definition of being able to prove that) to use their own keys in addition to the apple ones then no security is compromised and gpl3 is satisfied. It bothers me that you are confusing Apple's policy choices, which are not inevitabilities nor are they without dissenting opinions, with security, suggesting there is no possibility to satisfy the latter without making the same choices as the former.
    - slrz 9y ago
      It can still require signed code. I just want to swap Apple's key for mine. As the owner of the device, by definition, I am the sole arbiter on what is considered trustworthy. Executing only programs that I have personally approved (and thus carry my signature) is the perfect implementation of that policy. Now, I might be lazy or busy and delegate that responsibility to Apple or some other third party. There may be mismatches between my preferred policy and what is enforced by my proxy, but it might still work reasonably well overall. We humans do it all the time. No reason the CEO has to make every single decision themselves. When the stakes are high and I don't want to risk that nuances of my set policy get lost in translation or when it's about things that are totally outside my proxy's area of expertise, I'd prefer to make the decision myself. With iDevices, I can't. There's only the delegate model and the only available proxy to choose from is Apple. PS: Releasing secret signing keys to the whole world is an obviously bogus suggestion. Please stop beating up this strawman.
      - eridius 9y ago
        It's not a strawman. It's what would have to happen according to the GPLv3. The fact that you could design a system that allows for user-replaceable keys doesn't change the fact that iOS is not that system, and that if GPLv3 code gets into iOS then, according to the terms of that license, owners of existing devices would need to be allowed to replace the code. And the only way to do that is to release the root signing keys. You can't say "well they could design a future device to allow this", because that hypothetical future device isn't what we have today.
  - geofft 9y ago
    It's a bit more complicated, since you don't want a third party (e.g., your local police or your abusive ex) to be able to open your bootloader and run a modified OS that dumps your private data the next time you log in. This is completely straightforward on a modern desktop (unless you're using something like Bitlocker with TPM), but is supposed to be impossible on iOS.
    - JoshTriplett 9y ago
      This is exactly why switching a Chromebook into developer mode wipes all user data.
  - coldtea 9y ago
    >security by obscurity Don't confuse having secret keys as "security by obscurity". That's not what the phrase means. Else SSH private keys are "security by obscurity" too...
- geofft 9y ago
  Upvoted because this is accurate, but it should be mentioned that "bad" means "bad for Apple", not "objectively morally bad". In particular, it's pretty easy to design an iOS-like security model which doesn't give you GPLv3 problems -- e.g., when you factory-reset the device, if a certain button is being held down, generate a new keypair and display the private key. If you don't actually write it down, nothing stores the private key, and your security model stays entirely intact. And because you can only do it on factory reset, it also ensures that you can't get a signing key that gives you access to any existing user data on the device, while allowing people to resell their iPhones and still comply with GPLv3. There are some complexities here (and for Apple's goals with iOS, I totally understand them not wanting to work through those complexities), but for a team that has built the most secure general-purpose computing platform in the world, this isn't an unsolvable problem.
  - eridius 9y ago
    It's worth pointing out that this solution neuters Activation Lock, because the thief can now put the phone into DFU, then factory reset it, and then use the new private key to disable Activation Lock. Compared to destroying the security model of iOS in general this is pretty tame, but it is still a non-trivial downside.
    - geofft 9y ago
      Huh, good point, I didn't know about Activation Lock. I think this design still works if you only allow generating a signing keypair if Activation Lock is disabled? I think that still satisfies the requirements of GPLv3 sect. 6, although we're probably in territory extremely far from settled caselaw. > “Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. The "method"/"procedure" is signing out of iCloud, doing a factory reset, and holding down the button. It doesn't interfere with the continued functioning of the modified object code, i.e., of the OS itself, just with any user data present before you started the procedure.
- zeveb 9y ago
  > According to that, if Apple accidentally ships any GPLv3 on iOS then they'll have to release their root signing keys to the world, which would be disastrous (it would destroy the security model of the OS). Were I an iOS device owner, I would want the ability to replace the root signing keys on any device I'd own. It'd be my device: why should Apple have the unique privilege of determining what software may run on it?
  - namelost 9y ago
    Apple wants to protect you from attackers, who may have physical access to your device, who want to install a rootkit on your phone. It's fair to say that the GPLv3, which predates the iPhone, did not anticipate the nuances of people storing all their secrets on a tiny little computer that they keep with them at all times, including when they pass through international borders.
    - richardfontana 9y ago
      Actually, the iPhone and GPLv3 were first released on the same date, June 29th 2007.
      - jakelazaroff 9y ago
        Even so, GP's assertion stands up: being released on the same day, GPLv3 certainly wasn't written with the knowledge of how personal our phones would become.
        AgentME 9y ago
        The GPL is written with the idea that being able to write and modify software on your own devices is good; our devices becoming more personal only makes GPLv3's additions more critical. (As others have said, there's ways to make GPLv3 work with the iphone's security model, mainly along the lines of requiring a factory reset whenever you want to add an allowed signing key to the device.)
    - pritambaral 9y ago
- captainmuon 9y ago
  I guess in that case they would just break the license rather than complying with the "penalty" clause. As in "we never agreed to this license, we just used the source illegally. So sue us for that." - and if they are sued, settle for a million or so, peanuts. Now, I don't know if there is any provision in US law that makes you automatically enter a binding contract if you use code that is accompanied by a license file. It is certainly possible, as you demonstrate intent to enter the agreement. But OTOH, this would be too easy to abuse. Just sneakily replace the LICENSE.txt and add "you agree to pay 50% of your income and your firstborn child"... I don't think many would catch that. We say "this code is under this license", but actually beneath the hood this means "this code is available for license under these terms". (In Germany at least the hurdle to enter a contract is rather high. For a time, you were able to get on a bus without paying, and if caught argue that you never agreed to the terms of the bus company... so they had to make a special law against fraudently leeching services.)
  - eridius 9y ago
    > I guess in that case they would just break the license rather than complying with the "penalty" clause. Probably. > Just sneakily replace the LICENSE.txt and add "you agree to pay 50% of your income and your firstborn child"... I don't think many would catch that. A clause like that is completely unenforceable in the US. Any judge would throw it out.
- deleted 9y ago
  [deleted]
- bobcallme 9y ago
  > According to that, if Apple accidentally ships any GPLv3 on iOS then they'll have to release their root signing keys to the world, which would be disastrous (it would destroy the security model of the OS). Stop spreading this FUD. They would not need to release their root singing keys in this case, just provide a mechanism to allow for other keys to be used (there are various ways to go about doing this without compromising security). The main requirement is that the compiled software can be run on the device.
  - eridius 9y ago
    This is not FUD. This is the actual position of Apple Legal.
    - Moocat87 9y ago
      Those can both be true.
      - EGreg 9y ago
        How exactly?
    - chungy 9y ago
      It's not the position of the FSF who actually wrote the license. GPLv3 requires that users be able to install their own copies of the program onto the device. The device can allow a user-settable key in order to accomodate the requirement. No Apple keys need to be published.
      - eridius 9y ago
        User-settable keys also compromise the security of the device. The most plausible approach is one outlined in another comment in this thread wherein you get a new key when factory-resetting the device and if you don't write it down it's gone forever, but even that approach will likely cause problems with Activation Lock. And in general it's risky to introduce stuff like this because the potential for unforeseen security compromises is very high, and the upside is very low (the number of people who'd actually take advantage of this is extremely low relative to the number of iPhone users).
- benchaney 9y ago
  IIRC this hasn't been the case since the iPhone 6 because it switched to relying on a TPM.
- vbernat 9y ago
  Another way to comply with the license is to remove the accidently shipped GPLv3 software. No need to release source code or keys if you don't want to.
carussell 9y ago
There's too much cargo cult information getting repeated in this thread and going unquestioned. Apple doesn't care about the patent grant parts of GPLv3. The Apple Public Source License was an early pioneer in granting patent rights. Most modern commentary FOSS licenses are modeled after the grant from the APSL, starting with Apache 2.0, and including MPL2 and GPLv3. There's nothing in the GPLv3 for Apple to quibble about wrt patents; it has everything to do with the GPL's Tivoization stance.
codemac 9y ago
> As Apple is not developing this software in the public, it would not make sense to put it on GitHub or any other code hosting site No, the reason they don't put it on GitHub is that they have no intention of participating in the community that made the software they are using. All of these tools already have sites, communities, repositiories, etc. Apple could easily participate as many other companies do who also have proprietary patches. Apple actively chooses this over being a member of the software community it takes so much from.
- sooheon 9y ago
  Because Github is not equal to open source. It is a company out for profits like any other, why should Apple host what they choose to make open on that specific platform?
  - jeena 9y ago
    GitHub is not the issue here, Apple choses not to upstream anything, it doesn't matter where the upstream project hosts their code, bugtracker, etc.
- trapperkeeper74 9y ago
  Apple also doesn't fulfill all of its GPL obligations (eg components used in iOS, example: libstdc++) and their OSS releases lag a month or more behind software releases.
  - raimue 9y ago
    What kind of obligations do you think of? Are you even sure Apple is using libstdc++ at all and not libc++ as on macOS?
  - ethomson 9y ago
    I'm surprised to see you downvoted here. As a maintainer of an open source project, libgit2, which is GPL licensed and used by Apple, I am rather frustrated by Apple's behavior. The source for libgit2 itself is not present on their opensource site, though they use it in Xcode. (Git itself is present, but is sometimes out of date compared to what they're actually shipping.) I've emailed them about this and they offered to provide me the source they used. This feels like they're trying to do the bare minimum of compliance - and making even that nonobvious (since they have an obvious distribution mechanism.) This complaint is not a claim that they're violating our license, but it's definitely not an ideal situation, and I'm sympathetic to your frustration.

by raimue 9y ago

eridius 9y ago

> Apple avoids the GPLv3 for legal reasons due to its patent clause. The patent clause is bad, but the anti-TiVoization clause is actually worse. According to that, if Apple accidentally ships any GPLv3 on iOS then they'll have to release their root signing keys to the world, which would be disastrous (it would destroy the security model of the OS).

phh 9y ago
Nope, GPLv3 doesn't break any security model other than security by obscurity. Android could very well use GPLv3 and have no consequence on its security model. As long as the bootloader is open-able, the Tivo-ization rule of GPLv3 is respected. If Apple uses GPLv3, it will piss them off quite a lot, but it won't impact their security at all.
- eridius 9y ago
  Of course it will. The iOS security model fundamentally depends on everything from the bootloader up being codesigned. Releasing the root signing keys completely destroys this. Nothing on the system can be trusted anymore if that happens. Edit: Well, I guess the secure enclave can be trusted. But nothing else can be.
  - asveikau 9y ago
    IANAL, but if they had a way for a legit owner of the device (for some definition of being able to prove that) to use their own keys in addition to the apple ones then no security is compromised and gpl3 is satisfied. It bothers me that you are confusing Apple's policy choices, which are not inevitabilities nor are they without dissenting opinions, with security, suggesting there is no possibility to satisfy the latter without making the same choices as the former.
  - slrz 9y ago
    It can still require signed code. I just want to swap Apple's key for mine. As the owner of the device, by definition, I am the sole arbiter on what is considered trustworthy. Executing only programs that I have personally approved (and thus carry my signature) is the perfect implementation of that policy. Now, I might be lazy or busy and delegate that responsibility to Apple or some other third party. There may be mismatches between my preferred policy and what is enforced by my proxy, but it might still work reasonably well overall. We humans do it all the time. No reason the CEO has to make every single decision themselves. When the stakes are high and I don't want to risk that nuances of my set policy get lost in translation or when it's about things that are totally outside my proxy's area of expertise, I'd prefer to make the decision myself. With iDevices, I can't. There's only the delegate model and the only available proxy to choose from is Apple. PS: Releasing secret signing keys to the whole world is an obviously bogus suggestion. Please stop beating up this strawman.
    - eridius 9y ago
      It's not a strawman. It's what would have to happen according to the GPLv3. The fact that you could design a system that allows for user-replaceable keys doesn't change the fact that iOS is not that system, and that if GPLv3 code gets into iOS then, according to the terms of that license, owners of existing devices would need to be allowed to replace the code. And the only way to do that is to release the root signing keys. You can't say "well they could design a future device to allow this", because that hypothetical future device isn't what we have today.
- geofft 9y ago
  It's a bit more complicated, since you don't want a third party (e.g., your local police or your abusive ex) to be able to open your bootloader and run a modified OS that dumps your private data the next time you log in. This is completely straightforward on a modern desktop (unless you're using something like Bitlocker with TPM), but is supposed to be impossible on iOS.
  - JoshTriplett 9y ago
    This is exactly why switching a Chromebook into developer mode wipes all user data.
- coldtea 9y ago
  >security by obscurity Don't confuse having secret keys as "security by obscurity". That's not what the phrase means. Else SSH private keys are "security by obscurity" too...
geofft 9y ago
Upvoted because this is accurate, but it should be mentioned that "bad" means "bad for Apple", not "objectively morally bad". In particular, it's pretty easy to design an iOS-like security model which doesn't give you GPLv3 problems -- e.g., when you factory-reset the device, if a certain button is being held down, generate a new keypair and display the private key. If you don't actually write it down, nothing stores the private key, and your security model stays entirely intact. And because you can only do it on factory reset, it also ensures that you can't get a signing key that gives you access to any existing user data on the device, while allowing people to resell their iPhones and still comply with GPLv3. There are some complexities here (and for Apple's goals with iOS, I totally understand them not wanting to work through those complexities), but for a team that has built the most secure general-purpose computing platform in the world, this isn't an unsolvable problem.
- eridius 9y ago
  It's worth pointing out that this solution neuters Activation Lock, because the thief can now put the phone into DFU, then factory reset it, and then use the new private key to disable Activation Lock. Compared to destroying the security model of iOS in general this is pretty tame, but it is still a non-trivial downside.
  - geofft 9y ago
    Huh, good point, I didn't know about Activation Lock. I think this design still works if you only allow generating a signing keypair if Activation Lock is disabled? I think that still satisfies the requirements of GPLv3 sect. 6, although we're probably in territory extremely far from settled caselaw. > “Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. The "method"/"procedure" is signing out of iCloud, doing a factory reset, and holding down the button. It doesn't interfere with the continued functioning of the modified object code, i.e., of the OS itself, just with any user data present before you started the procedure.
zeveb 9y ago
> According to that, if Apple accidentally ships any GPLv3 on iOS then they'll have to release their root signing keys to the world, which would be disastrous (it would destroy the security model of the OS). Were I an iOS device owner, I would want the ability to replace the root signing keys on any device I'd own. It'd be my device: why should Apple have the unique privilege of determining what software may run on it?
- namelost 9y ago
  Apple wants to protect you from attackers, who may have physical access to your device, who want to install a rootkit on your phone. It's fair to say that the GPLv3, which predates the iPhone, did not anticipate the nuances of people storing all their secrets on a tiny little computer that they keep with them at all times, including when they pass through international borders.
  - richardfontana 9y ago
    Actually, the iPhone and GPLv3 were first released on the same date, June 29th 2007.
    - jakelazaroff 9y ago
      Even so, GP's assertion stands up: being released on the same day, GPLv3 certainly wasn't written with the knowledge of how personal our phones would become.
      - AgentME 9y ago
        The GPL is written with the idea that being able to write and modify software on your own devices is good; our devices becoming more personal only makes GPLv3's additions more critical. (As others have said, there's ways to make GPLv3 work with the iphone's security model, mainly along the lines of requiring a factory reset whenever you want to add an allowed signing key to the device.)
  - pritambaral 9y ago
captainmuon 9y ago
I guess in that case they would just break the license rather than complying with the "penalty" clause. As in "we never agreed to this license, we just used the source illegally. So sue us for that." - and if they are sued, settle for a million or so, peanuts. Now, I don't know if there is any provision in US law that makes you automatically enter a binding contract if you use code that is accompanied by a license file. It is certainly possible, as you demonstrate intent to enter the agreement. But OTOH, this would be too easy to abuse. Just sneakily replace the LICENSE.txt and add "you agree to pay 50% of your income and your firstborn child"... I don't think many would catch that. We say "this code is under this license", but actually beneath the hood this means "this code is available for license under these terms". (In Germany at least the hurdle to enter a contract is rather high. For a time, you were able to get on a bus without paying, and if caught argue that you never agreed to the terms of the bus company... so they had to make a special law against fraudently leeching services.)
- eridius 9y ago
  > I guess in that case they would just break the license rather than complying with the "penalty" clause. Probably. > Just sneakily replace the LICENSE.txt and add "you agree to pay 50% of your income and your firstborn child"... I don't think many would catch that. A clause like that is completely unenforceable in the US. Any judge would throw it out.
deleted 9y ago
[deleted]
bobcallme 9y ago
> According to that, if Apple accidentally ships any GPLv3 on iOS then they'll have to release their root signing keys to the world, which would be disastrous (it would destroy the security model of the OS). Stop spreading this FUD. They would not need to release their root singing keys in this case, just provide a mechanism to allow for other keys to be used (there are various ways to go about doing this without compromising security). The main requirement is that the compiled software can be run on the device.
- eridius 9y ago
  This is not FUD. This is the actual position of Apple Legal.
  - Moocat87 9y ago
    Those can both be true.
    - EGreg 9y ago
      How exactly?
  - chungy 9y ago
    It's not the position of the FSF who actually wrote the license. GPLv3 requires that users be able to install their own copies of the program onto the device. The device can allow a user-settable key in order to accomodate the requirement. No Apple keys need to be published.
    - eridius 9y ago
      User-settable keys also compromise the security of the device. The most plausible approach is one outlined in another comment in this thread wherein you get a new key when factory-resetting the device and if you don't write it down it's gone forever, but even that approach will likely cause problems with Activation Lock. And in general it's risky to introduce stuff like this because the potential for unforeseen security compromises is very high, and the upside is very low (the number of people who'd actually take advantage of this is extremely low relative to the number of iPhone users).
benchaney 9y ago
IIRC this hasn't been the case since the iPhone 6 because it switched to relying on a TPM.
vbernat 9y ago
Another way to comply with the license is to remove the accidently shipped GPLv3 software. No need to release source code or keys if you don't want to.

carussell 9y ago

There's too much cargo cult information getting repeated in this thread and going unquestioned. Apple doesn't care about the patent grant parts of GPLv3. The Apple Public Source License was an early pioneer in granting patent rights. Most modern commentary FOSS licenses are modeled after the grant from the APSL, starting with Apache 2.0, and including MPL2 and GPLv3. There's nothing in the GPLv3 for Apple to quibble about wrt patents; it has everything to do with the GPL's Tivoization stance.

codemac 9y ago

> As Apple is not developing this software in the public, it would not make sense to put it on GitHub or any other code hosting site No, the reason they don't put it on GitHub is that they have no intention of participating in the community that made the software they are using. All of these tools already have sites, communities, repositiories, etc. Apple could easily participate as many other companies do who also have proprietary patches. Apple actively chooses this over being a member of the software community it takes so much from.

sooheon 9y ago
Because Github is not equal to open source. It is a company out for profits like any other, why should Apple host what they choose to make open on that specific platform?
- jeena 9y ago
  GitHub is not the issue here, Apple choses not to upstream anything, it doesn't matter where the upstream project hosts their code, bugtracker, etc.
trapperkeeper74 9y ago
Apple also doesn't fulfill all of its GPL obligations (eg components used in iOS, example: libstdc++) and their OSS releases lag a month or more behind software releases.
- raimue 9y ago
  What kind of obligations do you think of? Are you even sure Apple is using libstdc++ at all and not libc++ as on macOS?
- ethomson 9y ago
  I'm surprised to see you downvoted here. As a maintainer of an open source project, libgit2, which is GPL licensed and used by Apple, I am rather frustrated by Apple's behavior. The source for libgit2 itself is not present on their opensource site, though they use it in Xcode. (Git itself is present, but is sometimes out of date compared to what they're actually shipping.) I've emailed them about this and they offered to provide me the source they used. This feels like they're trying to do the bare minimum of compliance - and making even that nonobvious (since they have an obvious distribution mechanism.) This complaint is not a claim that they're violating our license, but it's definitely not an ideal situation, and I'm sympathetic to your frustration.