4 ms·

Touche. Does this refute my claim that Apple can reconcile their current DRM scheme with users that want to repair their hardware themselves, though?

derefr 3y ago
I would say that, given the particular set of solutions Apple has used to stamp out this pickpocket-to-chop-shop pipeline, the way for "Apple [to] reconcile their current DRM scheme with users that want to repair their hardware themselves" looks exactly like what Apple have implemented: A scheme where individuals can repair phones, but where every user who wants to order non-device-bound replacement parts must first be vetted to not themselves be a chop shop, or someone working with chop-shops; where non-device-bound replacement parts may only be shipped to such vetted individuals; and where such replacement parts must be end-to-end inventory managed (via e.g. phone activation time pairing of the replacement part with the phone) to ensure that parts are not being "leaked" out of this process via "overstock" or "shrinkage" into the grey-market pipeline. And where previously device-bound parts may become non-device-bound replacement parts, but only through the phone first being sent to Apple (or in theory some other "authorized recycler") to extract and de-pair the parts, so that those parts can't leak into the grey-market pipeline, either.
- smoldesu 3y ago
  Well again, now you're conflating two separate things. As I've demonstrated before, there are legal repairs with non-stolen parts that Apple would prevent today. Apple considers those repairs wrongful, because they do not include brand-new OEM components or allow the user to designate that a handset can be used for repairs. This is an arbitrary decision, made by them, and justified by a non-technical, unrelated reason. That is wrong. The Shenzhen boogeyman can be dealt with in ways that don't give Apple the de-facto iron fist over repairs. This is an obvious, bald-faced power grab no different than using terrorism to explain why encryption is a bad technology. Any reasonable jury would conclude that the value of monopolizing your second-hand supply chain far exceeds any profit recouped from snuffing out chop-shop iPhones.
  - derefr 3y ago
    > there are legal repairs with non-stolen parts that Apple would prevent today Yes, but as I was attempting to emphasize, the problem is that these same repairs represent "supply chain leaks." If the operation available to users was to "release their device and all the parts inside it from tracking, such that these parts can then be used to repair any other device" — then these parts would disappear off the face of the earth from a supply-chain perspective, where they could then be stolen from the recycler, from the repair shop, or any number of other intermediaries, before finally making their way into a new device. (The exception to this "leak" being the one kind of "recycling" that's already permitted: the one where you're releasing the parts from tracking because you're sending them back to the first-party OEM integrator, who can then keep internal supply-chain security for where the parts go from there. I.e., the Apple recycling program.) The obvious way to prevent the "supply chain leak" would be to change the operation being permitted: rather than "de-identifying" parts so that they're owned by nobody indefinitely until put in a new device; instead, only permit instantaneous transfers, authorized by the current owner at point of transfer, from one device directly into another, such that at all points in time, every part that's left the factory has a legal owner. I'm a decentralized-systems nerd, so I do realize that you can do something like this without there being one central party who keeps the current supply-chain state of all parts in their own proprietary database. You can use a federated "supply chain transparency" blockchain; design the system so that the validators of this system can elect third-party companies as delegated oracles to then enforce KYC-like identity verification upon signers before they're allowed to perform transactions; etc. But decentralization in this direction is pointless toward your stated goals, because either it's not decentralized enough to permit individuals as participants (so you inevitably have to lean on some professional, "authorized" repair shop, meaning there is still no actual "right to repair" for individuals); or it's so decentralized that it allows individuals not motivated to repair entry into the system — at which point those individuals have a valuable good (their identity-stake in the system) that they can sell to malicious actors who want to use their identities as "burner identities" (see also: Amazon + eBay sellers buying "aged" and "brushed" accounts to use to perpetrate fraud; people who sell their own email/Discord/etc accounts on carding forums for about a dollar each; etc.) Note how none of the companies talking about "supply chain transparency" are proposing it for the secondary market — only for the primary factory-to-OEM-to-consumer logistical pipeline. For the primary market, it works, because there are a set of known actors who are supposed to be participants in the system, and anyone else is supposed to be kept out. But for the secondary market, this paradigm falls apart.

derefr 3y ago

I would say that, given the particular set of solutions Apple has used to stamp out this pickpocket-to-chop-shop pipeline, the way for "Apple [to] reconcile their current DRM scheme with users that want to repair their hardware themselves" looks exactly like what Apple have implemented: A scheme where individuals can repair phones, but where every user who wants to order non-device-bound replacement parts must first be vetted to not themselves be a chop shop, or someone working with chop-shops; where non-device-bound replacement parts may only be shipped to such vetted individuals; and where such replacement parts must be end-to-end inventory managed (via e.g. phone activation time pairing of the replacement part with the phone) to ensure that parts are not being "leaked" out of this process via "overstock" or "shrinkage" into the grey-market pipeline. And where previously device-bound parts may become non-device-bound replacement parts, but only through the phone first being sent to Apple (or in theory some other "authorized recycler") to extract and de-pair the parts, so that those parts can't leak into the grey-market pipeline, either.

smoldesu 3y ago
Well again, now you're conflating two separate things. As I've demonstrated before, there are legal repairs with non-stolen parts that Apple would prevent today. Apple considers those repairs wrongful, because they do not include brand-new OEM components or allow the user to designate that a handset can be used for repairs. This is an arbitrary decision, made by them, and justified by a non-technical, unrelated reason. That is wrong. The Shenzhen boogeyman can be dealt with in ways that don't give Apple the de-facto iron fist over repairs. This is an obvious, bald-faced power grab no different than using terrorism to explain why encryption is a bad technology. Any reasonable jury would conclude that the value of monopolizing your second-hand supply chain far exceeds any profit recouped from snuffing out chop-shop iPhones.
- derefr 3y ago
  > there are legal repairs with non-stolen parts that Apple would prevent today Yes, but as I was attempting to emphasize, the problem is that these same repairs represent "supply chain leaks." If the operation available to users was to "release their device and all the parts inside it from tracking, such that these parts can then be used to repair any other device" — then these parts would disappear off the face of the earth from a supply-chain perspective, where they could then be stolen from the recycler, from the repair shop, or any number of other intermediaries, before finally making their way into a new device. (The exception to this "leak" being the one kind of "recycling" that's already permitted: the one where you're releasing the parts from tracking because you're sending them back to the first-party OEM integrator, who can then keep internal supply-chain security for where the parts go from there. I.e., the Apple recycling program.) The obvious way to prevent the "supply chain leak" would be to change the operation being permitted: rather than "de-identifying" parts so that they're owned by nobody indefinitely until put in a new device; instead, only permit instantaneous transfers, authorized by the current owner at point of transfer, from one device directly into another, such that at all points in time, every part that's left the factory has a legal owner. I'm a decentralized-systems nerd, so I do realize that you can do something like this without there being one central party who keeps the current supply-chain state of all parts in their own proprietary database. You can use a federated "supply chain transparency" blockchain; design the system so that the validators of this system can elect third-party companies as delegated oracles to then enforce KYC-like identity verification upon signers before they're allowed to perform transactions; etc. But decentralization in this direction is pointless toward your stated goals, because either it's not decentralized enough to permit individuals as participants (so you inevitably have to lean on some professional, "authorized" repair shop, meaning there is still no actual "right to repair" for individuals); or it's so decentralized that it allows individuals not motivated to repair entry into the system — at which point those individuals have a valuable good (their identity-stake in the system) that they can sell to malicious actors who want to use their identities as "burner identities" (see also: Amazon + eBay sellers buying "aged" and "brushed" accounts to use to perpetrate fraud; people who sell their own email/Discord/etc accounts on carding forums for about a dollar each; etc.) Note how none of the companies talking about "supply chain transparency" are proposing it for the secondary market — only for the primary factory-to-OEM-to-consumer logistical pipeline. For the primary market, it works, because there are a set of known actors who are supposed to be participants in the system, and anyone else is supposed to be kept out. But for the secondary market, this paradigm falls apart.