3 ms·

Strikes me as bizarre that payment code would be sensitive, unless it's a security by obscurity thing (which would also be concerning). Keys, secrets, etc. yes

Strikes me as bizarre that payment code would be sensitive, unless it's a security by obscurity thing (which would also be concerning). Keys, secrets, etc. yes. But code? What am I missing here?

HWR_14 5mo ago
The code revealed the existence of Apple Pay, which had not been publicly confirmed.
juancn 5mo ago
It's kinda like that, there could be a proprietary fraud detection heuristic in there that you don't want to get out.
hk__2 5mo ago
Maybe that’s some scoring to decide if you should be able to pay or not with some method.
kurthr 5mo ago
Because it's Apple. They are huge, have scary lawyers, write scary contracts, and want to "delight the user" with features only when they announce them. They hate leaks, and demand separate teams for basically any/all development.
danudey 5mo ago
As others have said, it's Apple and they do not take kindly to other people leaking their technology/announcements ahead of time. See also: the time that ATI's CEO told his employees that their chips would be powering Apple's to-be-announced hardware a few days before the announcement. Steve Jobs responded by pulling all of ATI's hardware from its demo units at the announcement, not mentioning ATI at all, cancelling a joint demonstration of the Radeon card that was going to be in the system, and never partnering with ATI again. https://web.archive.org/web/20001216031800/https://www.zdnet.com/zdnn/stories/news/0,4586,2605858,00.html https://web.archive.org/web/20001216031800/https://www.zdnet...
- formerly_proven 5mo ago
  > and never partnering with ATI again. Except of course shipping ATI hardware for years afterwards, then also using nvidia, then dropping nvidia and only using ATI/AMD until transitioning to Apple Silicon.
  - NewJazz 5mo ago
    Also Steve Jobs Apple is probably much different than today's Apple.
  - danudey 5mo ago
    Well: 1. They kept existing designs, since even Jobs wasn't so crazy as to demand a complete re-architecture of existing laptop models on a whim; plus they probably also had contractual obligations/pre-purchase arrangements 2. They switched to nvidia, but from everything I know they also hated working with nvidia (IIRC Jobs accused nvidia of stealing Pixar tech) 3. AMD is a different company than ATI (technically), and Apple of that era was different than the Steve Jobs temper tantrum era. But yes, relevant details.
- ifh-hn 5mo ago
  Sounds like a bit of a dick...
  - yonatan8070 5mo ago
    One word: "Courage"
    - ifh-hn 5mo ago
      Not sure I understand? Sounds like a temper tantrum to me.
      - kenferry 5mo ago
        Inside joke. Apple's marketing guy used the word "courage" as an explanation when removing the headphone jack.
zer00eyz 5mo ago
> security by obscurity thing... What am I missing here? You are looking at the problem from the wrong direction. If you build a honeypot, to trap hackers, does it behove you to explain what the bait is, and how the trap works? Know your customer, fraud detection heuristics, finger prints, behavioral triggers are all areas where banks, and financial institutions need to keep the sauce secret. Telling the other party "how" you catch them just gives them the steps of what not to do.
- necovek 5mo ago
  Alternatively, you can also just try not to have security issues, and resolve them with urgency when they do pop up.
user_of_the_wek 5mo ago
It seems this wasn’t about the code itself, it was about Apple Pay not being announced yet. So only people under NDA would be allowed to even know what they are working on.
arianvanp 5mo ago
Yes Apple Pay relies on security through obscurity even today. See the Veritasium recently made a video about it https://youtu.be/PPJ6NJkmDAo?is=iUuJ0W9xUHF_6gTU https://youtu.be/PPJ6NJkmDAo?is=iUuJ0W9xUHF_6gTU
edoceo 5mo ago
There is a bunch of mundane stuff in the banking/finance world masked off by paperwork. It's not sensitive in the leaking state secrets sense it's sensitive in the risk adverse lawyers on both sides think it's sensitive. The Bureaucracy exists to perpetuate the Bureaucracy.
kazinator 5mo ago
The non-strawman version of "security through obscurity" is the belief that a system is secured by means of keeping its mechanisms secret. Suppose an organization doesn't believe such a thing; it's still more secure to keep code secret than not. Obscurity is a valid layer of security, just not a valid corner stone or linchpin of security. In particular, when code operates as a service (end users don't have the executable code on their machines) then protecting the source code is a real security measure. Without it, attackers can only probe the service as a black box, guessing about what it is doing.

Strikes me as bizarre that payment code would be sensitive, unless it's a security by obscurity thing (which would also be concerning). Keys, secrets, etc. yes. But code? What am I missing here?

HWR_14 5mo ago

The code revealed the existence of Apple Pay, which had not been publicly confirmed.

juancn 5mo ago

It's kinda like that, there could be a proprietary fraud detection heuristic in there that you don't want to get out.

hk__2 5mo ago

Maybe that’s some scoring to decide if you should be able to pay or not with some method.

kurthr 5mo ago

Because it's Apple. They are huge, have scary lawyers, write scary contracts, and want to "delight the user" with features only when they announce them. They hate leaks, and demand separate teams for basically any/all development.

danudey 5mo ago

As others have said, it's Apple and they do not take kindly to other people leaking their technology/announcements ahead of time. See also: the time that ATI's CEO told his employees that their chips would be powering Apple's to-be-announced hardware a few days before the announcement. Steve Jobs responded by pulling all of ATI's hardware from its demo units at the announcement, not mentioning ATI at all, cancelling a joint demonstration of the Radeon card that was going to be in the system, and never partnering with ATI again. https://web.archive.org/web/20001216031800/https://www.zdnet.com/zdnn/stories/news/0,4586,2605858,00.html https://web.archive.org/web/20001216031800/https://www.zdnet...

formerly_proven 5mo ago
> and never partnering with ATI again. Except of course shipping ATI hardware for years afterwards, then also using nvidia, then dropping nvidia and only using ATI/AMD until transitioning to Apple Silicon.
- NewJazz 5mo ago
  Also Steve Jobs Apple is probably much different than today's Apple.
- danudey 5mo ago
  Well: 1. They kept existing designs, since even Jobs wasn't so crazy as to demand a complete re-architecture of existing laptop models on a whim; plus they probably also had contractual obligations/pre-purchase arrangements 2. They switched to nvidia, but from everything I know they also hated working with nvidia (IIRC Jobs accused nvidia of stealing Pixar tech) 3. AMD is a different company than ATI (technically), and Apple of that era was different than the Steve Jobs temper tantrum era. But yes, relevant details.
ifh-hn 5mo ago
Sounds like a bit of a dick...
- yonatan8070 5mo ago
  One word: "Courage"
  - ifh-hn 5mo ago
    Not sure I understand? Sounds like a temper tantrum to me.
    - kenferry 5mo ago
      Inside joke. Apple's marketing guy used the word "courage" as an explanation when removing the headphone jack.

zer00eyz 5mo ago

> security by obscurity thing... What am I missing here? You are looking at the problem from the wrong direction. If you build a honeypot, to trap hackers, does it behove you to explain what the bait is, and how the trap works? Know your customer, fraud detection heuristics, finger prints, behavioral triggers are all areas where banks, and financial institutions need to keep the sauce secret. Telling the other party "how" you catch them just gives them the steps of what not to do.

necovek 5mo ago
Alternatively, you can also just try not to have security issues, and resolve them with urgency when they do pop up.

user_of_the_wek 5mo ago

It seems this wasn’t about the code itself, it was about Apple Pay not being announced yet. So only people under NDA would be allowed to even know what they are working on.

arianvanp 5mo ago

Yes Apple Pay relies on security through obscurity even today. See the Veritasium recently made a video about it https://youtu.be/PPJ6NJkmDAo?is=iUuJ0W9xUHF_6gTU https://youtu.be/PPJ6NJkmDAo?is=iUuJ0W9xUHF_6gTU

edoceo 5mo ago

There is a bunch of mundane stuff in the banking/finance world masked off by paperwork. It's not sensitive in the leaking state secrets sense it's sensitive in the risk adverse lawyers on both sides think it's sensitive. The Bureaucracy exists to perpetuate the Bureaucracy.

kazinator 5mo ago

The non-strawman version of "security through obscurity" is the belief that a system is secured by means of keeping its mechanisms secret. Suppose an organization doesn't believe such a thing; it's still more secure to keep code secret than not. Obscurity is a valid layer of security, just not a valid corner stone or linchpin of security. In particular, when code operates as a service (end users don't have the executable code on their machines) then protecting the source code is a real security measure. Without it, attackers can only probe the service as a black box, guessing about what it is doing.