3 ms·

> If you can come up with a version of Right to Repair that eliminates this practice but which doesn’t give gangs of thieves a 10000% higher interest in stealin

> If you can come up with a version of Right to Repair that eliminates this practice but which doesn’t give gangs of thieves a 10000% higher interest in stealing my phone at a concert to send it to Shenzhen, I’d be all for it. Uh... you could just let the user authorize repairs. If your iPhone's root-of-trust is registered with your iCloud account, then users could authorize themselves to make repairs by just putting in the password. Entirely offline, retains Apple's DRM scheme, and even thwarts the Chinese boogeymen that you're so scared of. It just removes the part where Apple has absolute control over the feature instead of the hardware owner.

derefr 3y ago
Huh? What user? I think you misunderstand the pipeline. When they steal my phone, they’re not refurbishing my phone to resell it. They’re scrapping my phone — taking all the expensive components out of my phone: the screen, the touch sensor, etc — and selling them to repair shops to be used as parts to repair other people’s phones. People who, obviously, authorize those repairs. But I don’t! (If you know what an illegal car “chop shop” is, they operate under the same business model: stolen preowned product as an input, replacement parts sold to repair shops — or used in their own “repair shop” — as an output.) The exact point of “hardware DRM” is that it allows me to retroactively revoke my consent for the parts of my phone to ever be used again inside some other person’s phone, through the cloud, at the moment I realize my phone has already been stolen. (Also, FYI, there’s nothing specifically Chinese about this pipeline. It’s not like this is a scam being run by the Triads or anything. Rather, it’s just unchecked capitalism. The gangs that go around stealing phones are small-time local groups of thieves, who have realized they can make a buck by selling and delivering wholesale lots of these phones to amoral “phone chop-shops” who happen to reside in Shenzhen. Those “phone chop-shops” are only in Shenzhen because that’s where all the demand is for the huge number of parts generated by scrapping a phone, and because they can’t sell these parts on without cash-only handshake deals.) To be clear, the “phone chop-shop” never ask any gangs to steal phones for them, either. They just say they’ll “buy phones in any condition.” (Which is why I say they’re amoral, not immoral.) Everything that happens from then on is the natural consequence of a market optimizing for profitability. On a related topic, the true point of Apple’s “authorized repair” program, was to penalize any repair shop who knowingly purchased parts from a “phone chop-shop” by disallowing them from ever again purchasing genuine parts; thus creating a disincentive from ever buying these grey-market parts.
- smoldesu 3y ago
  > Huh? What user? You. You are the user. So, imagine the hardware DRM exactly the way it is now, but with my modifications. The super bad-guys in Shenzhen dismantle my iPhone and try to turn it into a new phone. Oh no! The DRM on the other person's phone says that their parts are paired to my iPhone. Since I never manually un-paired those parts with my iCloud account (or Hardware root-of-trust), they cannot perform the evil deed of scrapping my iPhone for parts. They are thwarted by the exact same system, in the exact same way, except hardware owners hold the keys instead of Apple. > The exact point of “hardware DRM” is that it allows me to retroactively revoke my consent for the parts of my phone Minus retroactive control, that's the point of my implementation. The same DRM system that you are describing can be designed so the user can authorize repairs and de-couple parts without Apple's blessing. The only difference is that it would proactively lock all parts to your iPhone and only uncouple them when the user authorizes it. In that way, it's almost more secure than Apple exclusively holding the keys. > the true point of Apple’s “authorized repair” program, was to penalize any repair shop who knowingly purchased parts from a “phone chop-shop” by disallowing them from ever again purchasing genuine parts Fun fact! Secondhand chop-shop components and genuine Apple-issued replacements are not the only two options. You can buy a lot of Apple components from TI and Foxconn if you browse their piecemeal catalog. On top of that, there are many people who sell hardware as "for parts" to be used as donor hardware by third parties. It almost feels like Apple created this system to punish anyone who competes with their first-party offerings...
  - derefr 3y ago
    Without retroactive control, there’s basically zero chance of any phone being recyclable. A phone being able to be used for parts should be a default-allow condition; otherwise e.g. any phone owned by someone who dies — which is a large percentage of phones that get genuinely recycled these days! — will consider its parts non-reusable.
    - smoldesu 3y ago
      A default-allow scenario is dangerous, and won't help you if your thief-in-question chucks your iPhone into a Faraday bag. If you want secure hardware DRM, I'd argue it's all-or-nothing. You can't count on the benevolence of every thief or the reaction speed of every iPhone owner. The only secure hardware DRM is the one that works when it's offline, out of power or even when the user is unaware it was stolen. Anything less isn't Magic, it's a half-measure. Now, if that sort of security doesn't matter to you; good! Me neither. My original thesis was that Apple can reconcile their current DRM scheme with users that want to repair their hardware themselves, via third-parties. I still believe that, and I don't think Apple can prove that their solution is entirely necessary to secure iPhones.

derefr 3y ago

Huh? What user? I think you misunderstand the pipeline. When they steal my phone, they’re not refurbishing my phone to resell it. They’re scrapping my phone — taking all the expensive components out of my phone: the screen, the touch sensor, etc — and selling them to repair shops to be used as parts to repair other people’s phones. People who, obviously, authorize those repairs. But I don’t! (If you know what an illegal car “chop shop” is, they operate under the same business model: stolen preowned product as an input, replacement parts sold to repair shops — or used in their own “repair shop” — as an output.) The exact point of “hardware DRM” is that it allows me to retroactively revoke my consent for the parts of my phone to ever be used again inside some other person’s phone, through the cloud, at the moment I realize my phone has already been stolen. (Also, FYI, there’s nothing specifically Chinese about this pipeline. It’s not like this is a scam being run by the Triads or anything. Rather, it’s just unchecked capitalism. The gangs that go around stealing phones are small-time local groups of thieves, who have realized they can make a buck by selling and delivering wholesale lots of these phones to amoral “phone chop-shops” who happen to reside in Shenzhen. Those “phone chop-shops” are only in Shenzhen because that’s where all the demand is for the huge number of parts generated by scrapping a phone, and because they can’t sell these parts on without cash-only handshake deals.) To be clear, the “phone chop-shop” never ask any gangs to steal phones for them, either. They just say they’ll “buy phones in any condition.” (Which is why I say they’re amoral, not immoral.) Everything that happens from then on is the natural consequence of a market optimizing for profitability. On a related topic, the true point of Apple’s “authorized repair” program, was to penalize any repair shop who knowingly purchased parts from a “phone chop-shop” by disallowing them from ever again purchasing genuine parts; thus creating a disincentive from ever buying these grey-market parts.

smoldesu 3y ago
> Huh? What user? You. You are the user. So, imagine the hardware DRM exactly the way it is now, but with my modifications. The super bad-guys in Shenzhen dismantle my iPhone and try to turn it into a new phone. Oh no! The DRM on the other person's phone says that their parts are paired to my iPhone. Since I never manually un-paired those parts with my iCloud account (or Hardware root-of-trust), they cannot perform the evil deed of scrapping my iPhone for parts. They are thwarted by the exact same system, in the exact same way, except hardware owners hold the keys instead of Apple. > The exact point of “hardware DRM” is that it allows me to retroactively revoke my consent for the parts of my phone Minus retroactive control, that's the point of my implementation. The same DRM system that you are describing can be designed so the user can authorize repairs and de-couple parts without Apple's blessing. The only difference is that it would proactively lock all parts to your iPhone and only uncouple them when the user authorizes it. In that way, it's almost more secure than Apple exclusively holding the keys. > the true point of Apple’s “authorized repair” program, was to penalize any repair shop who knowingly purchased parts from a “phone chop-shop” by disallowing them from ever again purchasing genuine parts Fun fact! Secondhand chop-shop components and genuine Apple-issued replacements are not the only two options. You can buy a lot of Apple components from TI and Foxconn if you browse their piecemeal catalog. On top of that, there are many people who sell hardware as "for parts" to be used as donor hardware by third parties. It almost feels like Apple created this system to punish anyone who competes with their first-party offerings...
- derefr 3y ago
  Without retroactive control, there’s basically zero chance of any phone being recyclable. A phone being able to be used for parts should be a default-allow condition; otherwise e.g. any phone owned by someone who dies — which is a large percentage of phones that get genuinely recycled these days! — will consider its parts non-reusable.
  - smoldesu 3y ago
    A default-allow scenario is dangerous, and won't help you if your thief-in-question chucks your iPhone into a Faraday bag. If you want secure hardware DRM, I'd argue it's all-or-nothing. You can't count on the benevolence of every thief or the reaction speed of every iPhone owner. The only secure hardware DRM is the one that works when it's offline, out of power or even when the user is unaware it was stolen. Anything less isn't Magic, it's a half-measure. Now, if that sort of security doesn't matter to you; good! Me neither. My original thesis was that Apple can reconcile their current DRM scheme with users that want to repair their hardware themselves, via third-parties. I still believe that, and I don't think Apple can prove that their solution is entirely necessary to secure iPhones.