14 ms·

Well, no, shit - Corellium, from what I can tell from other articles I’ve had to read, (their website is a virtual drought of information about the product) see

Well, no, shit - Corellium, from what I can tell from other articles I’ve had to read, (their website is a virtual drought of information about the product) seems to have literally built its own virtualization platform to emulate specific iOS devices - and is likely literally just throwing IPSW files (the actual iOS releases from Apple themselves) onto this emulator and selling it as a service. As much as I believe in the open and free exchange of ideas I can’t actually agree with iFixit here. The excuse of it being sold as a ‘security product’ contradicts the only statement on their website - that its a tool for development. John Deere locking farmers out of repairing their own hardware? Awful, shitty behaviour. But this is literally stealing Apple’s OS, shoving it in an emulator and charging people for it. This article also makes the fallacious argument that Apple ‘gives away’ iOS with the purchase of an iPhone or iPad. That’s silly - the cost of the OS is built into the purchase price. The R&D and development time and money that goes into iOS or MacOS is part of what we are paying for when we purchase a device from Apple. When we purchase a computer from Dell with Windows 10, the cost of the OS is bundled with the purchase - but Microsoft still gets paid from that - unless, of course we might order the specific subset of Dell computers with Linux on them. I expect better from iFixit. This article reads like a sob story from the CEO of the company. You stole their software. What did you expect? How is this any different from a company that would sell you a preconfigured hackintosh? Or selling a DVD player with an unlicensed movie on it? :/ We can bitch about iOS and MacOS being closed platforms all we want - but for myself and many others the hardware/software package-as-a-unit is actually a huge part of the point.

FDSGSG 7y ago
> and is likely literally just throwing IPSW files Actually they go a bit beyond that. From the apple filing: >The Corellium Apple Product makes modifications to iOS that allows it to be installed on, and run from, Corellium-developed or Corellium-operated hardware. Such modifications include disabling loadable firmware validation, disabling self-verification of the FIPS module, adding Corellium software to the “trust cache,” and instructing the restore tool not to contact Apple servers for kernel / device tree / firmware signing. This doesn't seem too different from a cloud hosting provider selling VMs running cracked copies of Windows.
- lostgame 7y ago
  >> This doesn't seem too different from a cloud hosting provider selling VMs running cracked copies of Windows. Alright, so I’m not going crazy, then. I added an edit to my first post making the comparison to a company selling preconfigured hackintoshes. It’s literal theft and resale in a different package. That they had the balls to even do this, especially to the extent you are talking about, is shocking.
  - kelnos 7y ago
    > It’s literal theft No, it's copyright infringement. Apple has not "lost" a copy of iOS every time someone spins up a Corellium VM.
- Marsymars 7y ago
  Corellium could, hypothetically, mandate that every user has a number of legitimate iOS licenses equal to their number of VM instances. (e.g. by making the user mail in a functional iOS device for each VM instance they want) They'd still be running afoul of the licensing terms and DMCA, but it would feel less egregiously like "stealing".
  - vineyardmike 7y ago
    MacOS (and presumably iOS ?) avoid "legal hackintosh" by adding to the EULA that you can only receive a license to run macOS on mac hardware, not just by owning a mac hardware separately.
- saagarjha 7y ago
  The filing makes it sound like this is for piracy, but these actually make it easier for Corellium’s users to do what they’re using it for: security research and device testing. Those features make it difficult to modify and introspect the OS.
zozbot234 7y ago
> How is this any different from a company that would sell you a preconfigured hackintosh? The difference is that Corellium is very explicitly doing this to promote interoperability. Adversarial interoperability is a good thing for the market, and copyright laws generally recognize this. If DMCA 1201 does not, that's a problem with the law - not with what this firm did.
- lostgame 7y ago
  Promoting interoperability with theft doesn't make interoperability very appealing to me. :/ If it was an FOSS project, instead of being sold to intelligence agencies, I would call them gods instead of thieves and agree with what you’re saying.
  - zozbot234 7y ago
    "Theft"? You think people are going to run Corellium VM's on their phones instead of buying iOS devices? The markets are entirely separate, Apple does not lose any appreciable revenue to Corellium VM's.
    - vineyardmike 7y ago
      Just because you wouldn't buy an iphone instead, doesn't make it not theft.
      - sudosysgen 7y ago
        The only argument for copyright abuse bring theft that is even remotely reasonable is that it possibly causes lost revenue/sales. If it doesn't, and in this case it can't, then there is absolutely no argument for it being theft that holds any more water than a sieve.
      - tomrod 7y ago
        Eh, this is pretty myopic if not outrightly idealistic. Corellium likely adds value to Apple because they help to harden the ecosystem, something Apple clearly can't do 100%. Rather than open sourcing their OS, this really is a next best option security-wise. Therefore, Corellium's niche expands the Apple brand. Really just sounds like they're getting knocked for dealing with intelligence agencies.
ChrisMarshallNY 7y ago
The article seems a bit shrill. I can understand advocacy, but as lostgame says, Corellium is basically riding Apple's coattails. If they were helping Apple, then I doubt Apple would be suing them. I understand the way that Apple thinks on this. It isn't "bullying." It's brand protection. I worked for years for a corporation with a legendary brand, and they went to great lengths to protect the integrity of that brand. Part of protecting the integrity is to prevent others from diluting it; even if what they do is net positive, monetarily, it may damage the brand. A company that values its brand can't let that happen. Branding is a very different world from what most tecchies do. The priorities are drastically different, and a lot harder to "pin down." A well-curated brand can be unbelievably valuable, though. Apple's brand is one of the top five brands in the world.
- saagarjha 7y ago
  > If they were helping Apple, then I doubt Apple would be suing them. There are a number of security researchers who use Corellium to find bugs in iOS. Corellium themselves have submitted vulnerabilities using Apple’s bug bounty program.
  - Despegar 7y ago
    Corellium may have developed an excellent product technically, and they might be selling a useful service, but they still infringed Apple's intellectual property. It's up to Apple to decide if they want to make a virtualized iOS available for security researchers on the web.
    - saagarjha 7y ago
      How exactly did they infringe on Apple’s property? Does VirtualBox get in trouble if you run pirated Windows on it?
      - bauerd 7y ago
        They run virtualised iOS for you without having licensed it from Apple.
saagarjha 7y ago
This is very clearly development/security software: Apple isn’t losing any sales to it, because Apple literally does (did) not make anything comparable available to the public. Corellium simply provides emulation services; I don’t think they distribute the IPSW themselves.
- Wowfunhappy 7y ago
  > I don’t think they distribute the IPSW themselves. Does anyone know more about exactly how Corellium works in this regard? To me, it makes all the difference. Where does the IPSW come from? Do they pull a new copy off of Apple's servers each time a customer spins up an instance? Does the customer download the IPSW and upload it to their account? Speaking more broadly, I feel Corellium would have a much stronger case if their product was running on end-user machines. As long as it's running on Corellium's servers, they're "retransmitting" Apple's software, for lack of a better word.
  - kick 7y ago
    This is a dead thread, but: According to their docs, they do provide the IPSW.
    - cenal 7y ago
      If they provide the ipsw, modify the ipsw, and don’t have permission from Apple to do that, then it’s all over for them. Didn’t work for Psystar and it won’t work for them.
      - alexis_fr 7y ago
        Isn’t there an exception in US law for security and compatibility purpose, with even the ability to decompile software? Especially if Apple doesn’t provide any way to do it legally, then they can have a chance at trying to convince a jury. I agree hosting and reselling the service is pushing the question a bit far, but it may be deemed legit depending on the jury. IANAL, obviously, just asking the question.
saurik 7y ago
I don't really understand your argument here, and I definitely don't understand your ire. Apple releases an OS, which anyone can download, without any authorization, from their website, seemingly for free... these downloads aren't even encrypted. Corellium developed an emulator for Apple's hardware that, if you load an Apple OS onto it, can run that OS. As Apple allows anyone, without any kind of authorization to just download the OS from their website, it would seem like Corellium should be able to make this emulator, no? This emulator product doesn't actually compete with any service or technology that Apple provides except maybe the small handful of research devices that Apple is willing to hand to a very very very small number of blessed bug bounty program members, and that's (frankly) a stretch.
- vineyardmike 7y ago
  You have to accept EULAs to download it, surely.
  - saurik 7y ago
    Actually, no. You have to accept an EULA to "activate" the software (something Corellium's emulator can't even do, which means you don't have access to iCloud, iTunes, the App store, etc.), but you don't have to accept an EULA to download the software. Oracle, to contrast, allows anyone to download their Java SDK, but you first have to accept an EULA (something they changed from how Sun previously had it set up, where anyone could download the software without first accepting the EULA); Apple has no such restriction on their downloads. https://updates.cdn-apple.com/2019FallFCS/fullrestores/061-08602/B90B0666-C875-11E9-BEDD-DD1D6F0C6FF0/iPhone_4.7_13.0_17A577_Restore.ipsw https://updates.cdn-apple.com/2019FallFCS/fullrestores/061-0...
    - FDSGSG 7y ago
      So how did you get that link without accepting any EULAs? Apple does not make IPSW download links publicly available.
- FDSGSG 7y ago
  > Apple releases an OS, which anyone can download, without any authorization, from their website, seemingly for free Microsoft does the same with Windows. Can I rent out VMs running cracked copies of Windows now?
ProAm 7y ago
It's amazing how people on HN can support companies like AirBNB, Uber, Lyft who flagrantly break laws to bring a new product to market that is arguable better than the old way of doing things, and then at the same time not support a company like Corellium for doing the same thing because it's Apple. This is clearly a sorely needed product, Apple even agrees because they tried to BUY the company and when they said no they want to take their ball and go home.
- dgzl 7y ago
  >because it's Apple. I think you're being assuming here.
  - ProAm 7y ago
    You might be right, but I believe the main sentiment still holds about hypocritical support of one vs the other.
    - dgzl 7y ago
      I don't think so. In my experience, people here are just as critical to Apple as other companies.
      - saagarjha 7y ago
        From some very crude statistical sentiment analysis, they're somewhat more critical of Apple.
        big_chungus 7y ago
        Link to said analysis?
        saagarjha 7y ago
        I wrote a script for this a while back to analyze them with nltk: #!/usr/bin/env python3 import nltk import nltk.sentiment.vader import json import urllib.request companies = [ "apple", "google", "microsoft", "amazon", "facebook", ] sample_size = 10 def get_json(url): request = urllib.request.Request(url) request.add_header("User-Agent", "Python") return json.load(urllib.request.urlopen(request)) def allcomments(json): comment = json["text"] comments = comment if comment else "" for child in json["children"]: comments += allcomments(child) return comments if __name__ == "__main__": for company in companies: sentiments = [] print(company) for item in get_json("https://hn.algolia.com/api/v1/search?query=" + company + "&tags=story")["hits"][:sample_size]: tokens = nltk.tokenize.sent_tokenize(allcomments(get_json("https://hn.algolia.com/api/v1/items/" + item["objectID"]))) sia = nltk.sentiment.vader.SentimentIntensityAnalyzer() scores = sum([sia.polarity_scores(token)["compound"] for token in tokens]) sentiment = scores / len(tokens) print("\t" + item["title"] + ": " + str(sentiment)) sentiments.append(sentiment) print("Average: " + str(sum(sentiments) / len(sentiments))) Apple gets low scores because of China, mainly. Plus they lack the many open source projects that buoy up companies like Microsoft.
deleted 7y ago
[deleted]
fierarul 7y ago
I don't know the specifics but it sounds to me like making a VirtualBox product that is fine-tuned for macOS, including guest drivers for smooth integration (like VirtualBox Guest Additions). If the user provides the IPSW files, I don't see what's the problem. If I were Corellium I would open-source the product and see about licensing to corporate customers. What will Apple do then? Send a DMCA to GitHub?
- toyg 7y ago
  You cannot legally run MacOS on non-Apple hardware.
  - rowanG077 7y ago
    What? This is patently false. Can you point me to a single case where a judge ruled it's illegal to run MacOS on non-Apple hardware
    - Wowfunhappy 7y ago
      Pystar comes to mind, but that's a bit different, they were selling fully set up Hackintosh machines. I think GP is referring to the fact that Apple's EULA forbids running macOS on non-Apple hardware. But whether that's legally enforceable (if you're doing it on a personal machine rather than selling it) is not at all clear to me.
kelnos 7y ago
Completely disagree here. All Corellium has done is virtualize hardware that can run iOS. How is that possibly copyright infringement (outside of the DMCA's brain-dead bullshit, anyway)? If Corellium is distributing the IPSWs that can run on their emulator, then sure, that would be out of bounds (presumably Apple has not licensed other entities to distribute iOS)[0]. But if the user provides the IPSW to run, this is analogous to a version of VirtualBox that can boot iOS. It's absurd to think that should be illegal. If this suit doesn't go well for Corellium, I really hope they open-source their tech. Good luck to Apple trying to ban that from existence. [0] Regardless, this is not what Apple appears to be suing them about.
- toyg 7y ago
  Apple forbids in its EULAs to run their software on non-Apple hardware, including any virtualization platform if it’s not running on Apple hardware, and I doubt Corellium is running their saas on repurposed MacPros.
  - coldtea 7y ago
    So? EULAs are not exactly legally binding in most countries, and even in the US it's complicated whether they are or not: https://superuser.com/questions/30940/is-an-eula-enforceable https://superuser.com/questions/30940/is-an-eula-enforceable The enforceability of an EULA depends on several factors, one of them being the court in which the case is heard. Some courts that have addressed the validity of the shrinkwrap license agreements have found some EULAs to be invalid, characterizing them as contracts of adhesion, unconscionable, and/or unacceptable pursuant to the U.C.C.—see, for instance, Step-Saver Data Systems, Inc. v. Wyse Technology,[6] Vault Corp. v. Quaid Software Ltd..[7] Other courts have determined that the shrinkwrap license agreement is valid and enforceable: see ProCD, Inc. v. Zeidenberg,[8] Microsoft v. Harmony Computers,[9] Novell v. Network Trade Center,[10] and Ariz. Cartridge Remanufacturers Ass'n v. Lexmark Int'l, Inc.[11] may have some bearing as well. No court has ruled on the validity of EULAs generally; decisions are limited to particular provisions and terms. (Wikipedia)
    - 7y ago
DyslexicAtheist 7y ago
it's not as simple though and the security arguments are real. Some counterpoints [1]: > Corellium submitted 8 vulnerabilities under Apple’s bug bounty program, many of them were fixed in iOS releases. But Apple never paid out. It’s hard to see how Apple can spin: Apple: “we will pay you bug bounty money to fund your company.” Corellium: loadsa bugs Apple: Thanks for the bugs, about that bounty? lol j/k p.s. now we’re suing you, and we want all your bugs. [1] https://twitter.com/thegrugq/status/1189063534790922240 https://twitter.com/thegrugq/status/1189063534790922240
willis936 7y ago
How times have changed. The world applauded Compaq for reverse engineering IBM’s OS and selling it for profit.
fluffything 7y ago
> But this is literally stealing Apple’s OS, shoving it in an emulator and charging people for it. That's a long shot. When I buy an iphone, I get a license to use the OS the iphone comes with. If the license is for one device, I can't use it on many devices simultaneously, that much is clear. However, for what Corellium is doing to be debatable, the license must say that one can only use the OS copy bundled with the device on the device itself, which sounds against "fair-use", and maybe even "anti-trust" worthy. > How is this any different from a company that would sell you a preconfigured hackintosh? Selling a pre-configured hackintosh isn't illegal on any jurisdiction as long as you have a valid license for the OS that you ship, in the same way that selling any laptop on ebay isn't illegal either, as long as the copy of the OS is legal. If Corellium has one iPhone with iOS for every VM that's running at all times in a warehouse somewhere, then what they are doing is against Apple's EULA, which at most means that Apple doesn't need to give them support, but definitely not illegal. Also, the real sad thing is that Apple is not providing this service themselves, and instead have killed emulation on XCode.
- nickles 7y ago
  > Selling a pre-configured hackintosh isn't illegal on any jurisdiction as long as you have a valid license for the OS that you ship This theory was tested a decade ago by a company named Psystar and didn’t work. [0] https://en.m.wikipedia.org/wiki/Psystar_Corporation https://en.m.wikipedia.org/wiki/Psystar_Corporation
- crtlaltdel 7y ago
  > Also, the real sad thing is that Apple is not providing this service themselves, and instead have killed emulation on XCode. Is this new? I swear I was emulating and iPhone SE a couple of months ago for a react-native project. Or are you referring to something else? Something i’m missing here?
  - fluffything 7y ago
    Yes, this functionality is deprecated in the latest Xcode, the next Xcode version won't support it AFAIK.
jakeashacks 7y ago
First off it's a VM, not an emulator. Second, they're charging for the VM, not for iOS. The VM is purely their work.
Red_Leaves_Flyy 7y ago
Corellium would have a much better argument if they weren't for profit and closed source. I'm honestly surprised it's taken this long.
- jakeashacks 7y ago
  It's closed source and paid for some very obvious reasons: - Corellium is the result of years of research, throwing it away for free would be stupid - If Corellium released their tools, Apple would so something to break it, starting a cat and mouse war like they already do with jailbreaking - Not much people can use the thing anyways. It requires arm64 computers. Most of computers use x86(-64)
  - Red_Leaves_Flyy 7y ago
    I don't have sympathy for a company experiencing hardship because their entire existence is predicated on doing things to the software of another company (Apple) that (Apple) does not like. They brought this upon themselves. I think it is a necessary service, however their for profit nature creates perverse incentives. Corelliums refusal to be bought by Apple likely shows their continued attempts to profit off of exploiting the work of another company. Corellium could take the mongodb approach, or I don't know, actually work with Apple on Apple's terms, since their financially dependent on their ability to provide re tools for Apple's proprietary software. Apple actually creates economic value. Corellium are greedy pirates leeching off of sketchy markets for exploits sometimes used by authoritarian regimes to abuse the human rights of minorities and citizens alike.
    - jakeashacks 7y ago
      > Corelliums refusal to be bought by Apple likely shows their continued attempts to profit off of exploiting the work of another company. The only reason Apple wanted to buy Corellium was to shut them down. Apple doesn't need Corellium's technologies, they can do the same things and better. > actually work with Apple on Apple's terms Apple's terms are stupid. "Give us every vulnerability you and your clients find with the service", and it's not like Apple's paying them back anyway. Corellium already submitted many bugs to Apple and Apple didn't keep their promise of paying the bounty but instead decided to sue them.

FDSGSG 7y ago

> and is likely literally just throwing IPSW files Actually they go a bit beyond that. From the apple filing: >The Corellium Apple Product makes modifications to iOS that allows it to be installed on, and run from, Corellium-developed or Corellium-operated hardware. Such modifications include disabling loadable firmware validation, disabling self-verification of the FIPS module, adding Corellium software to the “trust cache,” and instructing the restore tool not to contact Apple servers for kernel / device tree / firmware signing. This doesn't seem too different from a cloud hosting provider selling VMs running cracked copies of Windows.

lostgame 7y ago
>> This doesn't seem too different from a cloud hosting provider selling VMs running cracked copies of Windows. Alright, so I’m not going crazy, then. I added an edit to my first post making the comparison to a company selling preconfigured hackintoshes. It’s literal theft and resale in a different package. That they had the balls to even do this, especially to the extent you are talking about, is shocking.
- kelnos 7y ago
  > It’s literal theft No, it's copyright infringement. Apple has not "lost" a copy of iOS every time someone spins up a Corellium VM.
Marsymars 7y ago
Corellium could, hypothetically, mandate that every user has a number of legitimate iOS licenses equal to their number of VM instances. (e.g. by making the user mail in a functional iOS device for each VM instance they want) They'd still be running afoul of the licensing terms and DMCA, but it would feel less egregiously like "stealing".
- vineyardmike 7y ago
  MacOS (and presumably iOS ?) avoid "legal hackintosh" by adding to the EULA that you can only receive a license to run macOS on mac hardware, not just by owning a mac hardware separately.
saagarjha 7y ago
The filing makes it sound like this is for piracy, but these actually make it easier for Corellium’s users to do what they’re using it for: security research and device testing. Those features make it difficult to modify and introspect the OS.

zozbot234 7y ago

> How is this any different from a company that would sell you a preconfigured hackintosh? The difference is that Corellium is very explicitly doing this to promote interoperability. Adversarial interoperability is a good thing for the market, and copyright laws generally recognize this. If DMCA 1201 does not, that's a problem with the law - not with what this firm did.

lostgame 7y ago
Promoting interoperability with theft doesn't make interoperability very appealing to me. :/ If it was an FOSS project, instead of being sold to intelligence agencies, I would call them gods instead of thieves and agree with what you’re saying.
- zozbot234 7y ago
  "Theft"? You think people are going to run Corellium VM's on their phones instead of buying iOS devices? The markets are entirely separate, Apple does not lose any appreciable revenue to Corellium VM's.
  - vineyardmike 7y ago
    Just because you wouldn't buy an iphone instead, doesn't make it not theft.
    - sudosysgen 7y ago
      The only argument for copyright abuse bring theft that is even remotely reasonable is that it possibly causes lost revenue/sales. If it doesn't, and in this case it can't, then there is absolutely no argument for it being theft that holds any more water than a sieve.
    - tomrod 7y ago
      Eh, this is pretty myopic if not outrightly idealistic. Corellium likely adds value to Apple because they help to harden the ecosystem, something Apple clearly can't do 100%. Rather than open sourcing their OS, this really is a next best option security-wise. Therefore, Corellium's niche expands the Apple brand. Really just sounds like they're getting knocked for dealing with intelligence agencies.

ChrisMarshallNY 7y ago

The article seems a bit shrill. I can understand advocacy, but as lostgame says, Corellium is basically riding Apple's coattails. If they were helping Apple, then I doubt Apple would be suing them. I understand the way that Apple thinks on this. It isn't "bullying." It's brand protection. I worked for years for a corporation with a legendary brand, and they went to great lengths to protect the integrity of that brand. Part of protecting the integrity is to prevent others from diluting it; even if what they do is net positive, monetarily, it may damage the brand. A company that values its brand can't let that happen. Branding is a very different world from what most tecchies do. The priorities are drastically different, and a lot harder to "pin down." A well-curated brand can be unbelievably valuable, though. Apple's brand is one of the top five brands in the world.

saagarjha 7y ago
> If they were helping Apple, then I doubt Apple would be suing them. There are a number of security researchers who use Corellium to find bugs in iOS. Corellium themselves have submitted vulnerabilities using Apple’s bug bounty program.
- Despegar 7y ago
  Corellium may have developed an excellent product technically, and they might be selling a useful service, but they still infringed Apple's intellectual property. It's up to Apple to decide if they want to make a virtualized iOS available for security researchers on the web.
  - saagarjha 7y ago
    How exactly did they infringe on Apple’s property? Does VirtualBox get in trouble if you run pirated Windows on it?
    - bauerd 7y ago
      They run virtualised iOS for you without having licensed it from Apple.

saagarjha 7y ago

This is very clearly development/security software: Apple isn’t losing any sales to it, because Apple literally does (did) not make anything comparable available to the public. Corellium simply provides emulation services; I don’t think they distribute the IPSW themselves.

Wowfunhappy 7y ago
> I don’t think they distribute the IPSW themselves. Does anyone know more about exactly how Corellium works in this regard? To me, it makes all the difference. Where does the IPSW come from? Do they pull a new copy off of Apple's servers each time a customer spins up an instance? Does the customer download the IPSW and upload it to their account? Speaking more broadly, I feel Corellium would have a much stronger case if their product was running on end-user machines. As long as it's running on Corellium's servers, they're "retransmitting" Apple's software, for lack of a better word.
- kick 7y ago
  This is a dead thread, but: According to their docs, they do provide the IPSW.
  - cenal 7y ago
    If they provide the ipsw, modify the ipsw, and don’t have permission from Apple to do that, then it’s all over for them. Didn’t work for Psystar and it won’t work for them.
    - alexis_fr 7y ago
      Isn’t there an exception in US law for security and compatibility purpose, with even the ability to decompile software? Especially if Apple doesn’t provide any way to do it legally, then they can have a chance at trying to convince a jury. I agree hosting and reselling the service is pushing the question a bit far, but it may be deemed legit depending on the jury. IANAL, obviously, just asking the question.

saurik 7y ago

I don't really understand your argument here, and I definitely don't understand your ire. Apple releases an OS, which anyone can download, without any authorization, from their website, seemingly for free... these downloads aren't even encrypted. Corellium developed an emulator for Apple's hardware that, if you load an Apple OS onto it, can run that OS. As Apple allows anyone, without any kind of authorization to just download the OS from their website, it would seem like Corellium should be able to make this emulator, no? This emulator product doesn't actually compete with any service or technology that Apple provides except maybe the small handful of research devices that Apple is willing to hand to a very very very small number of blessed bug bounty program members, and that's (frankly) a stretch.

vineyardmike 7y ago
You have to accept EULAs to download it, surely.
- saurik 7y ago
  Actually, no. You have to accept an EULA to "activate" the software (something Corellium's emulator can't even do, which means you don't have access to iCloud, iTunes, the App store, etc.), but you don't have to accept an EULA to download the software. Oracle, to contrast, allows anyone to download their Java SDK, but you first have to accept an EULA (something they changed from how Sun previously had it set up, where anyone could download the software without first accepting the EULA); Apple has no such restriction on their downloads. https://updates.cdn-apple.com/2019FallFCS/fullrestores/061-08602/B90B0666-C875-11E9-BEDD-DD1D6F0C6FF0/iPhone_4.7_13.0_17A577_Restore.ipsw https://updates.cdn-apple.com/2019FallFCS/fullrestores/061-0...
  - FDSGSG 7y ago
    So how did you get that link without accepting any EULAs? Apple does not make IPSW download links publicly available.
FDSGSG 7y ago
> Apple releases an OS, which anyone can download, without any authorization, from their website, seemingly for free Microsoft does the same with Windows. Can I rent out VMs running cracked copies of Windows now?

ProAm 7y ago

It's amazing how people on HN can support companies like AirBNB, Uber, Lyft who flagrantly break laws to bring a new product to market that is arguable better than the old way of doing things, and then at the same time not support a company like Corellium for doing the same thing because it's Apple. This is clearly a sorely needed product, Apple even agrees because they tried to BUY the company and when they said no they want to take their ball and go home.

dgzl 7y ago
>because it's Apple. I think you're being assuming here.
- ProAm 7y ago
  You might be right, but I believe the main sentiment still holds about hypocritical support of one vs the other.
  - dgzl 7y ago
    I don't think so. In my experience, people here are just as critical to Apple as other companies.
    - saagarjha 7y ago
      From some very crude statistical sentiment analysis, they're somewhat more critical of Apple.
      - big_chungus 7y ago
        Link to said analysis?
        saagarjha 7y ago
        I wrote a script for this a while back to analyze them with nltk: #!/usr/bin/env python3 import nltk import nltk.sentiment.vader import json import urllib.request companies = [ "apple", "google", "microsoft", "amazon", "facebook", ] sample_size = 10 def get_json(url): request = urllib.request.Request(url) request.add_header("User-Agent", "Python") return json.load(urllib.request.urlopen(request)) def allcomments(json): comment = json["text"] comments = comment if comment else "" for child in json["children"]: comments += allcomments(child) return comments if __name__ == "__main__": for company in companies: sentiments = [] print(company) for item in get_json("https://hn.algolia.com/api/v1/search?query=" + company + "&tags=story")["hits"][:sample_size]: tokens = nltk.tokenize.sent_tokenize(allcomments(get_json("https://hn.algolia.com/api/v1/items/" + item["objectID"]))) sia = nltk.sentiment.vader.SentimentIntensityAnalyzer() scores = sum([sia.polarity_scores(token)["compound"] for token in tokens]) sentiment = scores / len(tokens) print("\t" + item["title"] + ": " + str(sentiment)) sentiments.append(sentiment) print("Average: " + str(sum(sentiments) / len(sentiments))) Apple gets low scores because of China, mainly. Plus they lack the many open source projects that buoy up companies like Microsoft.

deleted 7y ago

[deleted]

fierarul 7y ago

I don't know the specifics but it sounds to me like making a VirtualBox product that is fine-tuned for macOS, including guest drivers for smooth integration (like VirtualBox Guest Additions). If the user provides the IPSW files, I don't see what's the problem. If I were Corellium I would open-source the product and see about licensing to corporate customers. What will Apple do then? Send a DMCA to GitHub?

toyg 7y ago
You cannot legally run MacOS on non-Apple hardware.
- rowanG077 7y ago
  What? This is patently false. Can you point me to a single case where a judge ruled it's illegal to run MacOS on non-Apple hardware
  - Wowfunhappy 7y ago
    Pystar comes to mind, but that's a bit different, they were selling fully set up Hackintosh machines. I think GP is referring to the fact that Apple's EULA forbids running macOS on non-Apple hardware. But whether that's legally enforceable (if you're doing it on a personal machine rather than selling it) is not at all clear to me.

kelnos 7y ago

Completely disagree here. All Corellium has done is virtualize hardware that can run iOS. How is that possibly copyright infringement (outside of the DMCA's brain-dead bullshit, anyway)? If Corellium is distributing the IPSWs that can run on their emulator, then sure, that would be out of bounds (presumably Apple has not licensed other entities to distribute iOS)[0]. But if the user provides the IPSW to run, this is analogous to a version of VirtualBox that can boot iOS. It's absurd to think that should be illegal. If this suit doesn't go well for Corellium, I really hope they open-source their tech. Good luck to Apple trying to ban that from existence. [0] Regardless, this is not what Apple appears to be suing them about.

toyg 7y ago
Apple forbids in its EULAs to run their software on non-Apple hardware, including any virtualization platform if it’s not running on Apple hardware, and I doubt Corellium is running their saas on repurposed MacPros.
- coldtea 7y ago
  So? EULAs are not exactly legally binding in most countries, and even in the US it's complicated whether they are or not: https://superuser.com/questions/30940/is-an-eula-enforceable https://superuser.com/questions/30940/is-an-eula-enforceable The enforceability of an EULA depends on several factors, one of them being the court in which the case is heard. Some courts that have addressed the validity of the shrinkwrap license agreements have found some EULAs to be invalid, characterizing them as contracts of adhesion, unconscionable, and/or unacceptable pursuant to the U.C.C.—see, for instance, Step-Saver Data Systems, Inc. v. Wyse Technology,[6] Vault Corp. v. Quaid Software Ltd..[7] Other courts have determined that the shrinkwrap license agreement is valid and enforceable: see ProCD, Inc. v. Zeidenberg,[8] Microsoft v. Harmony Computers,[9] Novell v. Network Trade Center,[10] and Ariz. Cartridge Remanufacturers Ass'n v. Lexmark Int'l, Inc.[11] may have some bearing as well. No court has ruled on the validity of EULAs generally; decisions are limited to particular provisions and terms. (Wikipedia)
  - 7y ago

DyslexicAtheist 7y ago

it's not as simple though and the security arguments are real. Some counterpoints [1]: > Corellium submitted 8 vulnerabilities under Apple’s bug bounty program, many of them were fixed in iOS releases. But Apple never paid out. It’s hard to see how Apple can spin: Apple: “we will pay you bug bounty money to fund your company.” Corellium: loadsa bugs Apple: Thanks for the bugs, about that bounty? lol j/k p.s. now we’re suing you, and we want all your bugs. [1] https://twitter.com/thegrugq/status/1189063534790922240 https://twitter.com/thegrugq/status/1189063534790922240

willis936 7y ago

How times have changed. The world applauded Compaq for reverse engineering IBM’s OS and selling it for profit.

fluffything 7y ago

> But this is literally stealing Apple’s OS, shoving it in an emulator and charging people for it. That's a long shot. When I buy an iphone, I get a license to use the OS the iphone comes with. If the license is for one device, I can't use it on many devices simultaneously, that much is clear. However, for what Corellium is doing to be debatable, the license must say that one can only use the OS copy bundled with the device on the device itself, which sounds against "fair-use", and maybe even "anti-trust" worthy. > How is this any different from a company that would sell you a preconfigured hackintosh? Selling a pre-configured hackintosh isn't illegal on any jurisdiction as long as you have a valid license for the OS that you ship, in the same way that selling any laptop on ebay isn't illegal either, as long as the copy of the OS is legal. If Corellium has one iPhone with iOS for every VM that's running at all times in a warehouse somewhere, then what they are doing is against Apple's EULA, which at most means that Apple doesn't need to give them support, but definitely not illegal. Also, the real sad thing is that Apple is not providing this service themselves, and instead have killed emulation on XCode.

nickles 7y ago
> Selling a pre-configured hackintosh isn't illegal on any jurisdiction as long as you have a valid license for the OS that you ship This theory was tested a decade ago by a company named Psystar and didn’t work. [0] https://en.m.wikipedia.org/wiki/Psystar_Corporation https://en.m.wikipedia.org/wiki/Psystar_Corporation
crtlaltdel 7y ago
> Also, the real sad thing is that Apple is not providing this service themselves, and instead have killed emulation on XCode. Is this new? I swear I was emulating and iPhone SE a couple of months ago for a react-native project. Or are you referring to something else? Something i’m missing here?
- fluffything 7y ago
  Yes, this functionality is deprecated in the latest Xcode, the next Xcode version won't support it AFAIK.

jakeashacks 7y ago

First off it's a VM, not an emulator. Second, they're charging for the VM, not for iOS. The VM is purely their work.

Red_Leaves_Flyy 7y ago

Corellium would have a much better argument if they weren't for profit and closed source. I'm honestly surprised it's taken this long.

jakeashacks 7y ago
It's closed source and paid for some very obvious reasons: - Corellium is the result of years of research, throwing it away for free would be stupid - If Corellium released their tools, Apple would so something to break it, starting a cat and mouse war like they already do with jailbreaking - Not much people can use the thing anyways. It requires arm64 computers. Most of computers use x86(-64)
- Red_Leaves_Flyy 7y ago
  I don't have sympathy for a company experiencing hardship because their entire existence is predicated on doing things to the software of another company (Apple) that (Apple) does not like. They brought this upon themselves. I think it is a necessary service, however their for profit nature creates perverse incentives. Corelliums refusal to be bought by Apple likely shows their continued attempts to profit off of exploiting the work of another company. Corellium could take the mongodb approach, or I don't know, actually work with Apple on Apple's terms, since their financially dependent on their ability to provide re tools for Apple's proprietary software. Apple actually creates economic value. Corellium are greedy pirates leeching off of sketchy markets for exploits sometimes used by authoritarian regimes to abuse the human rights of minorities and citizens alike.
  - jakeashacks 7y ago
    > Corelliums refusal to be bought by Apple likely shows their continued attempts to profit off of exploiting the work of another company. The only reason Apple wanted to buy Corellium was to shut them down. Apple doesn't need Corellium's technologies, they can do the same things and better. > actually work with Apple on Apple's terms Apple's terms are stupid. "Give us every vulnerability you and your clients find with the service", and it's not like Apple's paying them back anyway. Corellium already submitted many bugs to Apple and Apple didn't keep their promise of paying the bounty but instead decided to sue them.