3 ms·

A lot of this sounds like Apple has been 10-20 years behind the state of the art and now wants to tell you that they partially caught up. Verifiable hardware ro

A lot of this sounds like Apple has been 10-20 years behind the state of the art and now wants to tell you that they partially caught up. Verifiable hardware roots of trust and end-to-end software supply chain integrity are things that have existed for a while. The interesting part doesn't come until the end where they promise to publish system images for inspection.

ethbr1 2y ago
Do you have analogous search terms for Microsoft, Alphabet, Google, and Amazon's approaches? Your comment makes me curious on how guarantee-to-guarantee looks (and associated architectures).
- candiddevmike 2y ago
  Most of the stuff in the blog post reads like common security precautions: don't run as root, stateless immutable nodes, use secure boot, etc. All wrapped up in some Apple marketing pizzazz.
  - ignoramous 2y ago
    > common security precautions ... marketing pizzazz. If it were this common, Meta, Google, and others would have announced or launched something similar for its consumer apps/services; I can't seem to recall anything of note.
- bowmessage 2y ago
  https://cloud.google.com/docs/security/binary-authorization-for-borg https://cloud.google.com/docs/security/binary-authorization-... is one example
  - threeseed 2y ago
    Apple's system goes further by having incoming requests choose and verify a server and then encrypt itself using the public key of the node to prevent MITM attacks. And a one-time credential to prevent replay attacks. As well as minor things like obfuscating IP addresses, metadata etc.
    - aaomidi 2y ago
      Apples system is also the entire pipeline. Borg SREs can still change behavior here. It’s a lot better than what most places have but does not go far enough.
  - sodality2 2y ago
    None for consumer-facing products, though
- wmf 2y ago
  https://cloud.google.com/blog/products/identity-security/confidential-vms-on-intel-cpus-your-datas-new-intelligent-defense https://cloud.google.com/blog/products/identity-security/con... https://cloud.google.com/blog/products/identity-security/expanding-confidential-computing-for-ai-workloads-next24 https://cloud.google.com/blog/products/identity-security/exp...
7e 2y ago
This is not true at all. Apple is the first to roll out end to end remote attestation of an enclave that includes an ML accelerator in the root of trust, with public verifiability of the entire stack. They are way ahead.
saagarjha 2y ago
Perhaps one of these days we'll get a 'jeffbee that realizes that Google is not actually ahead of everyone in everything all the time. But not today, I guess.

ethbr1 2y ago

Do you have analogous search terms for Microsoft, Alphabet, Google, and Amazon's approaches? Your comment makes me curious on how guarantee-to-guarantee looks (and associated architectures).

candiddevmike 2y ago
Most of the stuff in the blog post reads like common security precautions: don't run as root, stateless immutable nodes, use secure boot, etc. All wrapped up in some Apple marketing pizzazz.
- ignoramous 2y ago
  > common security precautions ... marketing pizzazz. If it were this common, Meta, Google, and others would have announced or launched something similar for its consumer apps/services; I can't seem to recall anything of note.
bowmessage 2y ago
https://cloud.google.com/docs/security/binary-authorization-for-borg https://cloud.google.com/docs/security/binary-authorization-... is one example
- threeseed 2y ago
  Apple's system goes further by having incoming requests choose and verify a server and then encrypt itself using the public key of the node to prevent MITM attacks. And a one-time credential to prevent replay attacks. As well as minor things like obfuscating IP addresses, metadata etc.
  - aaomidi 2y ago
    Apples system is also the entire pipeline. Borg SREs can still change behavior here. It’s a lot better than what most places have but does not go far enough.
- sodality2 2y ago
  None for consumer-facing products, though
wmf 2y ago
https://cloud.google.com/blog/products/identity-security/confidential-vms-on-intel-cpus-your-datas-new-intelligent-defense https://cloud.google.com/blog/products/identity-security/con... https://cloud.google.com/blog/products/identity-security/expanding-confidential-computing-for-ai-workloads-next24 https://cloud.google.com/blog/products/identity-security/exp...

7e 2y ago

This is not true at all. Apple is the first to roll out end to end remote attestation of an enclave that includes an ML accelerator in the root of trust, with public verifiability of the entire stack. They are way ahead.

saagarjha 2y ago

Perhaps one of these days we'll get a 'jeffbee that realizes that Google is not actually ahead of everyone in everything all the time. But not today, I guess.