A long, long time ago I recall it being tied to device UDIDs, then it moved to "whoever got their hands on the .mobileconfig leaked from the Apple dev portal".

A long, long time ago I recall it being tied to device UDIDs, then it moved to "whoever got their hands on the .mobileconfig leaked from the Apple dev portal". It was a race after WWDC announced the next iOS as to who'd have the .mobileconfig to share first.