4 ms·

Apple is putting a lot of efforts into securing its hardware but I don't feel it's reflected in their marketing and I don't feel like people are buying Apple pr

Apple is putting a lot of efforts into securing its hardware but I don't feel it's reflected in their marketing and I don't feel like people are buying Apple products for their secure hardware (people from HN and elsewhere excluded). So why are they doing so much and not advertising it more ?

kevincox 6y ago
Probably because it allows them to extert control over their hardware even when users hold it in their hands. Given System Integrity Protection this allows them to enforce rules on the client and trust them on the server. For example shipping apps from the app store that can't be pirated and trusting that iMessage clients are actual hardware owners with unmodified clients. It is basically a DRM system.
josephcsible 6y ago
Because Apple only cares about keeping devices secure from their owners, not about security that benefits the device's owner.
- compiler-guy 6y ago
  Apple’s problems are multitude, and I’m no fanboy, but they do work pretty hard to keep their devices secure from government hacking. https://epic.org/amicus/crypto/apple/ https://epic.org/amicus/crypto/apple/
  - hu3 6y ago
    Apple's unwillingness to implement e2e encryption of user iCloud data says otherwise. https://www.reuters.com/article/us-apple-fbi-icloud-exclusive-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
    - EricE 6y ago
      Unwillingness? That's a big assumption. Not that I'm defending it. And I also expect Apple to do better and not just pay lip service. On the other hand, who is doing as much or more? Again, not saying that to excuse them but just point out there is likely far more going on than them just making an arbitrary decision here. Just saying...
      - hu3 6y ago
        > who is doing as much or more? Google does end-to-end encryption for Android for free. Just saying...
    - compiler-guy 6y ago
      There is a big difference between “doesn’t care at all” (which was what the GP said) and “hasn’t done everything” which is what you are arguing. Has Apple done absolutely everything? No. Have they done a lot? Yes.
mistercow 6y ago
This is total speculation, but here’s one reason the strategy might be smart: You can be held legally responsible for your specific marketing claims, but not for your reputation. Since security is difficult, aggressively marketing your products as secure is fraught with liability. Sooner or later, some oversight is likely to bite you, and if you’ve made promises, you’re now on the hook for those promises. But if, instead, you just talk about what technical steps you’ve taken to improve security, and then let enough time pass, you can get a reputation for being secure without ever having made any guarantees. You just let people notice how you respond to security issues, and the relative frequency with which you have breaches. That strategy takes longer to work, but it’s harder to sue you for a public perception which you never actually endorsed. Assuming this is the strategy, I don’t even think it’s particularly nefarious. It’s fairly incentive-aligned, since it only works if your track record is cleaner than your competitors, and it hacks around the fact that consumers aren’t willing to pay the price for actual security guarantees (which would probably involve SLAs, and Apple essentially acting as both a vendor and an insurance broker).
VLM 6y ago
They're saying something like "We're doing everything we can to eliminate the hackintosh, now please do not google the phrase or do badthink of even merely thinking about the concept of a hackintosh."
Spooky23 6y ago
More people do than you think. Apple doesn’t have a significant historical presence in Washington DC for the weather and easy traffic situation.
floatingatoll 6y ago
They may have chosen to let the annual 150-200 page PDF security technical reports speak for themselves, especially if their research suggests that the average United States consumer doesn't care about any of this. One recent time they went to the press to say "we defend against state-sponsored attackers", the United States FBI sued them for defending against the state-sponsored attacker Cellebrite. These prior posts may offer more context: https://news.ycombinator.com/item?id=26184793 https://news.ycombinator.com/item?id=26184793 https://news.ycombinator.com/item?id=11135201 https://news.ycombinator.com/item?id=11135201

kevincox 6y ago

Probably because it allows them to extert control over their hardware even when users hold it in their hands. Given System Integrity Protection this allows them to enforce rules on the client and trust them on the server. For example shipping apps from the app store that can't be pirated and trusting that iMessage clients are actual hardware owners with unmodified clients. It is basically a DRM system.

josephcsible 6y ago

Because Apple only cares about keeping devices secure from their owners, not about security that benefits the device's owner.

compiler-guy 6y ago
Apple’s problems are multitude, and I’m no fanboy, but they do work pretty hard to keep their devices secure from government hacking. https://epic.org/amicus/crypto/apple/ https://epic.org/amicus/crypto/apple/
- hu3 6y ago
  Apple's unwillingness to implement e2e encryption of user iCloud data says otherwise. https://www.reuters.com/article/us-apple-fbi-icloud-exclusive-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
  - EricE 6y ago
    Unwillingness? That's a big assumption. Not that I'm defending it. And I also expect Apple to do better and not just pay lip service. On the other hand, who is doing as much or more? Again, not saying that to excuse them but just point out there is likely far more going on than them just making an arbitrary decision here. Just saying...
    - hu3 6y ago
      > who is doing as much or more? Google does end-to-end encryption for Android for free. Just saying...
  - compiler-guy 6y ago
    There is a big difference between “doesn’t care at all” (which was what the GP said) and “hasn’t done everything” which is what you are arguing. Has Apple done absolutely everything? No. Have they done a lot? Yes.

mistercow 6y ago

This is total speculation, but here’s one reason the strategy might be smart: You can be held legally responsible for your specific marketing claims, but not for your reputation. Since security is difficult, aggressively marketing your products as secure is fraught with liability. Sooner or later, some oversight is likely to bite you, and if you’ve made promises, you’re now on the hook for those promises. But if, instead, you just talk about what technical steps you’ve taken to improve security, and then let enough time pass, you can get a reputation for being secure without ever having made any guarantees. You just let people notice how you respond to security issues, and the relative frequency with which you have breaches. That strategy takes longer to work, but it’s harder to sue you for a public perception which you never actually endorsed. Assuming this is the strategy, I don’t even think it’s particularly nefarious. It’s fairly incentive-aligned, since it only works if your track record is cleaner than your competitors, and it hacks around the fact that consumers aren’t willing to pay the price for actual security guarantees (which would probably involve SLAs, and Apple essentially acting as both a vendor and an insurance broker).

VLM 6y ago

They're saying something like "We're doing everything we can to eliminate the hackintosh, now please do not google the phrase or do badthink of even merely thinking about the concept of a hackintosh."

Spooky23 6y ago

More people do than you think. Apple doesn’t have a significant historical presence in Washington DC for the weather and easy traffic situation.

floatingatoll 6y ago

They may have chosen to let the annual 150-200 page PDF security technical reports speak for themselves, especially if their research suggests that the average United States consumer doesn't care about any of this. One recent time they went to the press to say "we defend against state-sponsored attackers", the United States FBI sued them for defending against the state-sponsored attacker Cellebrite. These prior posts may offer more context: https://news.ycombinator.com/item?id=26184793 https://news.ycombinator.com/item?id=26184793 https://news.ycombinator.com/item?id=11135201 https://news.ycombinator.com/item?id=11135201