5 ms·

Sorry, iOS is a closed source OS and nobody can verify what's exactly happening under the hood, this article is shallow and unverifiable. I disagree that Apple'

by neya 8y ago

Sorry, iOS is a closed source OS and nobody can verify what's exactly happening under the hood, this article is shallow and unverifiable. I disagree that Apple's product is privacy without being able to verify that there isn't some code that's processing my personal info. Nobody here can prove or disprove it without access to the source code.

jaegerpicker 8y ago
A huge portion of iOS/macOS is open source (nearly as much as Android) and anyone can verify what it's doing. Darwin is the kernel and underlying libraries. It's heavily based on FreeBSD and is available to download and read.
- decebalus1 8y ago
  That means absolutely NOTHING in this context. I can base my product on some Linux distro and add just about the right tracking libraries. It is closed source proprietary software, period. Also, this [1]. They definitely do have tracking. Please point me to the source code for this. [1] https://techcrunch.com/2013/06/17/apple-nsa/ https://techcrunch.com/2013/06/17/apple-nsa/
- floatboth 8y ago
  > nearly as much as Android nah. AOSP is actually a full OS. All the GUI stuff and whatnot is open source. Apple only publishes the kernel sometimes. Not nearly as much. > heavily based on FreeBSD Not that heavily. There is a mix of Mach and various BSDs in there, but also a lot, a looooot of custom Apple weirdness on top.
bhj 8y ago
Reading the source code is not the only way to determine software's behavior, and few can read every line of every piece of software we run anyway.
jamesgeck0 8y ago
What about access to network traffic?
inapis 8y ago
You can? Just monitor the network traffic. Should be very easy on Wifi. Might not work if they’re using HSTS for iCloud. That said there’s still blackbox hardware when it comes to the baseband. All devices which I’m aware of come with binary blobs for the baseband. So in that sense there’s no truly open mobile device.
- gmiller123456 8y ago
  Monitoring network traffic isn't going to help if that traffic is encrypted in transit. You can see data is going out, and to which IP address, but you can't really determine what's going out. You're not really going to be able to distinguish spyware from checking for updates unless there's an unreasonably size of data being sent up.
  - saagarjha 8y ago
    You can drop traffic you find fishy, though.
  - inapis 8y ago
    Uhm you can? As I said if they’re not using HSTS or Certificate pinning you just need to use an MITM proxy like Charles or mitproxy with a trusted certificate. You might not be able to intercept traffic for FAANG apps but for a vast chunk of apps it should be easy.
fpoling 8y ago
Have you looked at the source of Linux kernel or Chromium? Can you really tell what is going there without spending years working with it? Most likely you cannot. Moreover, as never ending stream of bugs indicates, neither engineers that work on the code can tell what the code does precisely. Open source is very nice for tinkering, less so for security assurance. For the latter sound architecture is essential, and one can understand that without having the source for all the components.
- kgwxd 8y ago
  The fact that a single person couldn't possibly fully understand a complex system is all the more reason to get more eyes on it. Besides, security is not the same as privacy, There's a huge difference between spotting where a network connection is being created, what data is sent and where to vs completely understanding an entire code base and spotting cleverly obfuscated code or low level bugs. With closed source, only employees get to see the code, their goals align with the company. Open source, anyone can see it and raise stink about things they don't like on behalf of all users. It only takes 1 person for all users to get the benefits. Granted, open source doesn't prevent all privacy issues, MS still does telemetry in OSS projects, sometimes not even allowing to opt-out, and they just ignore the countless complaints, and enough people still use it. Such is the state of the world I guess. But imagine one day MS decides to say they're no longer collecting telemetry but they've actually put in some cleaver code that looks like it does one thing but actually sends telemetry data. Getting caught doing that would be a way bigger PR issue that would, hopefully, cause far more users to completely stop trusting them, even if all their code was open source. I don't expect companies that want to stay in business for long would attempt such a thing.
  - fpoling 8y ago
    There are literally thousands of eyes that look at kernel sources. Google even pays 1e5 usd if one finds exploitable bugs in their code. Yet security-related bugs stil pop up regularly. Even to prove things formally source is not that essential. One stil needs to know details how code is translated into the machine instructions. But then to show, for example, absence of code path that copies user location into network packet one may analize machine instructions.
bunderbunder 8y ago
iOS is closed source, yes. From my perspective, so is every other mobile OS. I'm not going to take on the effort involved in manually installing my own firmware that'd been built from verified sources. You could argue that's simple laziness on my part, but, for the fast majority of people, they simply lack the ability to do otherwise. So, while I can read some version of the Android source code, I still can't be sure of exactly what code is actually running on my device. I have to place some trust in the vendor. So, who would I rather trust: The company that took the risk of publicly standing up to the US Government over a privacy issue where even public opinion was at best only arguably on their side, and that boots 3rd parties off of its platform if they're caught trying to siphon users data without permission? Or the company that happily collaborates with surveillance states, makes most its revenue by engaging in surveillance capitalism, and encourages other companies to do the same? That said, if anyone wants to see about bringing FirefoxOS back to life, that'd be cool.
guitarbill 8y ago
There's a lot of security research going on. Stuff like that can and is found without source code access. And the fewer number of iPhone models benefits Apple here, simply because there's less to cover (compared to the number of Android devices).
scarface74 8y ago
Everything that makes Android "Android" to most people includes a lot of closed source Google parts and binary blob drivers. Google has been closing up more of Android over the years.
- kodablah 8y ago
  That has nothing to do with the comment you're responding to.
  - saagarjha 8y ago
    It has everything to do with that comment, since the obvious point being made was that "Android is open"–to which the poster responded with that Google's services, which the majority of Android users use, are not.
scarface74 8y ago
Sorry, iOS is a closed source OS and nobody can verify what's exactly happening under the hood, this article is shallow and unverifiable. Are you able to verify all of the closed source parts of Android -- not AOSP the actual Android implementation with Google closed source apps that most people use? What about the binary drivers?

by neya 8y ago

jaegerpicker 8y ago

A huge portion of iOS/macOS is open source (nearly as much as Android) and anyone can verify what it's doing. Darwin is the kernel and underlying libraries. It's heavily based on FreeBSD and is available to download and read.

decebalus1 8y ago
That means absolutely NOTHING in this context. I can base my product on some Linux distro and add just about the right tracking libraries. It is closed source proprietary software, period. Also, this [1]. They definitely do have tracking. Please point me to the source code for this. [1] https://techcrunch.com/2013/06/17/apple-nsa/ https://techcrunch.com/2013/06/17/apple-nsa/
floatboth 8y ago
> nearly as much as Android nah. AOSP is actually a full OS. All the GUI stuff and whatnot is open source. Apple only publishes the kernel sometimes. Not nearly as much. > heavily based on FreeBSD Not that heavily. There is a mix of Mach and various BSDs in there, but also a lot, a looooot of custom Apple weirdness on top.

bhj 8y ago

Reading the source code is not the only way to determine software's behavior, and few can read every line of every piece of software we run anyway.

jamesgeck0 8y ago

What about access to network traffic?

inapis 8y ago

You can? Just monitor the network traffic. Should be very easy on Wifi. Might not work if they’re using HSTS for iCloud. That said there’s still blackbox hardware when it comes to the baseband. All devices which I’m aware of come with binary blobs for the baseband. So in that sense there’s no truly open mobile device.

gmiller123456 8y ago
Monitoring network traffic isn't going to help if that traffic is encrypted in transit. You can see data is going out, and to which IP address, but you can't really determine what's going out. You're not really going to be able to distinguish spyware from checking for updates unless there's an unreasonably size of data being sent up.
- saagarjha 8y ago
  You can drop traffic you find fishy, though.
- inapis 8y ago
  Uhm you can? As I said if they’re not using HSTS or Certificate pinning you just need to use an MITM proxy like Charles or mitproxy with a trusted certificate. You might not be able to intercept traffic for FAANG apps but for a vast chunk of apps it should be easy.

fpoling 8y ago

Have you looked at the source of Linux kernel or Chromium? Can you really tell what is going there without spending years working with it? Most likely you cannot. Moreover, as never ending stream of bugs indicates, neither engineers that work on the code can tell what the code does precisely. Open source is very nice for tinkering, less so for security assurance. For the latter sound architecture is essential, and one can understand that without having the source for all the components.

kgwxd 8y ago
The fact that a single person couldn't possibly fully understand a complex system is all the more reason to get more eyes on it. Besides, security is not the same as privacy, There's a huge difference between spotting where a network connection is being created, what data is sent and where to vs completely understanding an entire code base and spotting cleverly obfuscated code or low level bugs. With closed source, only employees get to see the code, their goals align with the company. Open source, anyone can see it and raise stink about things they don't like on behalf of all users. It only takes 1 person for all users to get the benefits. Granted, open source doesn't prevent all privacy issues, MS still does telemetry in OSS projects, sometimes not even allowing to opt-out, and they just ignore the countless complaints, and enough people still use it. Such is the state of the world I guess. But imagine one day MS decides to say they're no longer collecting telemetry but they've actually put in some cleaver code that looks like it does one thing but actually sends telemetry data. Getting caught doing that would be a way bigger PR issue that would, hopefully, cause far more users to completely stop trusting them, even if all their code was open source. I don't expect companies that want to stay in business for long would attempt such a thing.
- fpoling 8y ago
  There are literally thousands of eyes that look at kernel sources. Google even pays 1e5 usd if one finds exploitable bugs in their code. Yet security-related bugs stil pop up regularly. Even to prove things formally source is not that essential. One stil needs to know details how code is translated into the machine instructions. But then to show, for example, absence of code path that copies user location into network packet one may analize machine instructions.

bunderbunder 8y ago

iOS is closed source, yes. From my perspective, so is every other mobile OS. I'm not going to take on the effort involved in manually installing my own firmware that'd been built from verified sources. You could argue that's simple laziness on my part, but, for the fast majority of people, they simply lack the ability to do otherwise. So, while I can read some version of the Android source code, I still can't be sure of exactly what code is actually running on my device. I have to place some trust in the vendor. So, who would I rather trust: The company that took the risk of publicly standing up to the US Government over a privacy issue where even public opinion was at best only arguably on their side, and that boots 3rd parties off of its platform if they're caught trying to siphon users data without permission? Or the company that happily collaborates with surveillance states, makes most its revenue by engaging in surveillance capitalism, and encourages other companies to do the same? That said, if anyone wants to see about bringing FirefoxOS back to life, that'd be cool.

guitarbill 8y ago

There's a lot of security research going on. Stuff like that can and is found without source code access. And the fewer number of iPhone models benefits Apple here, simply because there's less to cover (compared to the number of Android devices).

scarface74 8y ago

Everything that makes Android "Android" to most people includes a lot of closed source Google parts and binary blob drivers. Google has been closing up more of Android over the years.

kodablah 8y ago
That has nothing to do with the comment you're responding to.
- saagarjha 8y ago
  It has everything to do with that comment, since the obvious point being made was that "Android is open"–to which the poster responded with that Google's services, which the majority of Android users use, are not.

scarface74 8y ago

Sorry, iOS is a closed source OS and nobody can verify what's exactly happening under the hood, this article is shallow and unverifiable. Are you able to verify all of the closed source parts of Android -- not AOSP the actual Android implementation with Google closed source apps that most people use? What about the binary drivers?