6 ms·

Apple wants to protect you from attackers, who may have physical access to your device, who want to install a rootkit on your phone. It's fair to say that the

Apple wants to protect you from attackers, who may have physical access to your device, who want to install a rootkit on your phone. It's fair to say that the GPLv3, which predates the iPhone, did not anticipate the nuances of people storing all their secrets on a tiny little computer that they keep with them at all times, including when they pass through international borders.

richardfontana 9y ago
Actually, the iPhone and GPLv3 were first released on the same date, June 29th 2007.
- jakelazaroff 9y ago
  Even so, GP's assertion stands up: being released on the same day, GPLv3 certainly wasn't written with the knowledge of how personal our phones would become.
  - AgentME 9y ago
    The GPL is written with the idea that being able to write and modify software on your own devices is good; our devices becoming more personal only makes GPLv3's additions more critical. (As others have said, there's ways to make GPLv3 work with the iphone's security model, mainly along the lines of requiring a factory reset whenever you want to add an allowed signing key to the device.)
pritambaral 9y ago
> Apple wants to protect you from attackers, who may have physical access to your device, who want to install a rootkit on your phone. How does the ability to wipe the phone (and thus the data, and the code compiled and signed by Apple) and replace its signing keys with your own allow an attacker to surreptitiously install a rootkit? The dangers of physical access to one's devices existed before mobile computing, let alone before GPLv3 or the iPhone.
- labcomputer 9y ago
  How do you prevent an attacker from installing a bootloader which loads (while injecting a rootkit, of course) Apple's signed binaries? Nobody could be certain if they were running a trusted version of iOS.
  - pritambaral 9y ago
    Don't allow bootloader modifications. Keep the bootloader dumb, with the singular purpose of booting the OS from images verified using user-configurable keys. This problem has been solved outside of Apple's garden.
    - natch 9y ago
      Apple needs to solve it in Apple's garden, which runs by different rules. Unlike other mobile operating systems, iOS prioritizes protecting the user's privacy. The real user, not just any household member or employer who might have physical access to the device. In your described solution, what prevents an abusive/sneaky household member from posing as the user and supplying those "user-configurable" keys without the knowledge of the real user? Nothing? That answer wouldn't be good enough for the Apple "garden" as you call it.
      - belorn 9y ago
        If a sneaky household member went and wiped the phone to install those new keys, would the real user not notice that all their data is gone? The function "replace keys" can have any other programmable feature attached to it. Wiping out all preexisting data, reseting the phone to factory settings, and sending a message to the original owner is all possible and would make any sneaky behavior very un-sneaky. They could even require some form of 2auth or other technique that people use to authorize themselves to banks in order to get the unit-unique key to make the TPM memory rewritable. GPLv3 don't require that installing new keys are easy, but the real owner must have a method to do it.
        9y ago

richardfontana 9y ago

Actually, the iPhone and GPLv3 were first released on the same date, June 29th 2007.

jakelazaroff 9y ago
Even so, GP's assertion stands up: being released on the same day, GPLv3 certainly wasn't written with the knowledge of how personal our phones would become.
- AgentME 9y ago
  The GPL is written with the idea that being able to write and modify software on your own devices is good; our devices becoming more personal only makes GPLv3's additions more critical. (As others have said, there's ways to make GPLv3 work with the iphone's security model, mainly along the lines of requiring a factory reset whenever you want to add an allowed signing key to the device.)

pritambaral 9y ago

> Apple wants to protect you from attackers, who may have physical access to your device, who want to install a rootkit on your phone. How does the ability to wipe the phone (and thus the data, and the code compiled and signed by Apple) and replace its signing keys with your own allow an attacker to surreptitiously install a rootkit? The dangers of physical access to one's devices existed before mobile computing, let alone before GPLv3 or the iPhone.

labcomputer 9y ago
How do you prevent an attacker from installing a bootloader which loads (while injecting a rootkit, of course) Apple's signed binaries? Nobody could be certain if they were running a trusted version of iOS.
- pritambaral 9y ago
  Don't allow bootloader modifications. Keep the bootloader dumb, with the singular purpose of booting the OS from images verified using user-configurable keys. This problem has been solved outside of Apple's garden.
  - natch 9y ago
    Apple needs to solve it in Apple's garden, which runs by different rules. Unlike other mobile operating systems, iOS prioritizes protecting the user's privacy. The real user, not just any household member or employer who might have physical access to the device. In your described solution, what prevents an abusive/sneaky household member from posing as the user and supplying those "user-configurable" keys without the knowledge of the real user? Nothing? That answer wouldn't be good enough for the Apple "garden" as you call it.
    - belorn 9y ago
      If a sneaky household member went and wiped the phone to install those new keys, would the real user not notice that all their data is gone? The function "replace keys" can have any other programmable feature attached to it. Wiping out all preexisting data, reseting the phone to factory settings, and sending a message to the original owner is all possible and would make any sneaky behavior very un-sneaky. They could even require some form of 2auth or other technique that people use to authorize themselves to banks in order to get the unit-unique key to make the TPM memory rewritable. GPLv3 don't require that installing new keys are easy, but the real owner must have a method to do it.
      - 9y ago