3 ms·

Nope, GPLv3 doesn't break any security model other than security by obscurity. Android could very well use GPLv3 and have no consequence on its security model.

by phh 9y ago

Nope, GPLv3 doesn't break any security model other than security by obscurity. Android could very well use GPLv3 and have no consequence on its security model. As long as the bootloader is open-able, the Tivo-ization rule of GPLv3 is respected. If Apple uses GPLv3, it will piss them off quite a lot, but it won't impact their security at all.

eridius 9y ago
Of course it will. The iOS security model fundamentally depends on everything from the bootloader up being codesigned. Releasing the root signing keys completely destroys this. Nothing on the system can be trusted anymore if that happens. Edit: Well, I guess the secure enclave can be trusted. But nothing else can be.
- asveikau 9y ago
  IANAL, but if they had a way for a legit owner of the device (for some definition of being able to prove that) to use their own keys in addition to the apple ones then no security is compromised and gpl3 is satisfied. It bothers me that you are confusing Apple's policy choices, which are not inevitabilities nor are they without dissenting opinions, with security, suggesting there is no possibility to satisfy the latter without making the same choices as the former.
- slrz 9y ago
  It can still require signed code. I just want to swap Apple's key for mine. As the owner of the device, by definition, I am the sole arbiter on what is considered trustworthy. Executing only programs that I have personally approved (and thus carry my signature) is the perfect implementation of that policy. Now, I might be lazy or busy and delegate that responsibility to Apple or some other third party. There may be mismatches between my preferred policy and what is enforced by my proxy, but it might still work reasonably well overall. We humans do it all the time. No reason the CEO has to make every single decision themselves. When the stakes are high and I don't want to risk that nuances of my set policy get lost in translation or when it's about things that are totally outside my proxy's area of expertise, I'd prefer to make the decision myself. With iDevices, I can't. There's only the delegate model and the only available proxy to choose from is Apple. PS: Releasing secret signing keys to the whole world is an obviously bogus suggestion. Please stop beating up this strawman.
  - eridius 9y ago
    It's not a strawman. It's what would have to happen according to the GPLv3. The fact that you could design a system that allows for user-replaceable keys doesn't change the fact that iOS is not that system, and that if GPLv3 code gets into iOS then, according to the terms of that license, owners of existing devices would need to be allowed to replace the code. And the only way to do that is to release the root signing keys. You can't say "well they could design a future device to allow this", because that hypothetical future device isn't what we have today.
geofft 9y ago
It's a bit more complicated, since you don't want a third party (e.g., your local police or your abusive ex) to be able to open your bootloader and run a modified OS that dumps your private data the next time you log in. This is completely straightforward on a modern desktop (unless you're using something like Bitlocker with TPM), but is supposed to be impossible on iOS.
- JoshTriplett 9y ago
  This is exactly why switching a Chromebook into developer mode wipes all user data.
coldtea 9y ago
>security by obscurity Don't confuse having secret keys as "security by obscurity". That's not what the phrase means. Else SSH private keys are "security by obscurity" too...

by phh 9y ago

eridius 9y ago

Of course it will. The iOS security model fundamentally depends on everything from the bootloader up being codesigned. Releasing the root signing keys completely destroys this. Nothing on the system can be trusted anymore if that happens. Edit: Well, I guess the secure enclave can be trusted. But nothing else can be.

asveikau 9y ago
IANAL, but if they had a way for a legit owner of the device (for some definition of being able to prove that) to use their own keys in addition to the apple ones then no security is compromised and gpl3 is satisfied. It bothers me that you are confusing Apple's policy choices, which are not inevitabilities nor are they without dissenting opinions, with security, suggesting there is no possibility to satisfy the latter without making the same choices as the former.
slrz 9y ago
It can still require signed code. I just want to swap Apple's key for mine. As the owner of the device, by definition, I am the sole arbiter on what is considered trustworthy. Executing only programs that I have personally approved (and thus carry my signature) is the perfect implementation of that policy. Now, I might be lazy or busy and delegate that responsibility to Apple or some other third party. There may be mismatches between my preferred policy and what is enforced by my proxy, but it might still work reasonably well overall. We humans do it all the time. No reason the CEO has to make every single decision themselves. When the stakes are high and I don't want to risk that nuances of my set policy get lost in translation or when it's about things that are totally outside my proxy's area of expertise, I'd prefer to make the decision myself. With iDevices, I can't. There's only the delegate model and the only available proxy to choose from is Apple. PS: Releasing secret signing keys to the whole world is an obviously bogus suggestion. Please stop beating up this strawman.
- eridius 9y ago
  It's not a strawman. It's what would have to happen according to the GPLv3. The fact that you could design a system that allows for user-replaceable keys doesn't change the fact that iOS is not that system, and that if GPLv3 code gets into iOS then, according to the terms of that license, owners of existing devices would need to be allowed to replace the code. And the only way to do that is to release the root signing keys. You can't say "well they could design a future device to allow this", because that hypothetical future device isn't what we have today.

geofft 9y ago

It's a bit more complicated, since you don't want a third party (e.g., your local police or your abusive ex) to be able to open your bootloader and run a modified OS that dumps your private data the next time you log in. This is completely straightforward on a modern desktop (unless you're using something like Bitlocker with TPM), but is supposed to be impossible on iOS.

JoshTriplett 9y ago
This is exactly why switching a Chromebook into developer mode wipes all user data.

coldtea 9y ago

>security by obscurity Don't confuse having secret keys as "security by obscurity". That's not what the phrase means. Else SSH private keys are "security by obscurity" too...