4 ms·
Not to be paranoid, but with this change what stops Apple from silently shipping libraries with backdoors/surveillance if requested by law enforcement. How woul
by AlexandrB 6y ago
Not to be paranoid, but with this change what stops Apple from silently shipping libraries with backdoors/surveillance if requested by law enforcement. How would a security researcher catch the change without being able to examine the library files?
- hellcow 6y agoThey don't need to ship a backdoor because all files in iCloud (photos, documents, etc.) aren't E2E encrypted anyway. According to Reuters they readily share that with the government, despite all their FBI-thwarted-yet-again posturing in the press. Not to mention they could just backdoor the kernel, and since that's not open-source, good luck detecting that.
- chungus_khan 6y agoAnd of course they do, surveillance is the law in the US. They are expected to comply.
- admax88q 6y agoIf you're worried about those types of things you shouldn't be using proprietary operating systems, there's a million ways Apple can backdoor your system without you knowing
- chrisseaton 6y ago> How would a security researcher catch the change without being able to examine the library files? How would you know that Apple was loading what was on disk, before this change?
- loeg 6y agoAfter dlopen() you are free to examine the in-memory contents, including writing them out to disk if you like. Apple as an attacker could easily hide a backdoor in either model.
- Hackbraten 6y agoIt’s pretty trivial to re-extract the dylibs from the cache. For example, jtool2 does it for iOS, where Apple has already purged system dylib files.