3 ms·

I'm not sure what the US government is complaining about. If the baseband has direct memory access, they should be able to grab any cryptographic key off the ph

I'm not sure what the US government is complaining about. If the baseband has direct memory access, they should be able to grab any cryptographic key off the phones without Apple or the user ever noticing, that is unless Apple has been getting stroppy lately about who gets to talk on their PCI bus. As for Apple doing the right thing, even if they manage to keep the government out of people's business today, they still hold the key to the universal back door and might give it away tomorrow. Apple certainly has the resources to develop a completely liberated phone, but NeXT and post-merger Apple has always been incredibly hostile to software freedom, and this speech doesn't change any of that. I don't think they are afraid that they won't be able to spy on people, but they are worried about maintaining the public opinion that privacy is for creeps and terrorists. But another interesting effect of closing every back door but the baseband is that there will likely be a power struggle within the intelligence and law enforcement agencies. Only the highest ranking officers will be able to push malicious firmware updates, regular police will have no choice but to stick with traditional police work.

comboy 12y ago
> they still hold the key to the universal back door and might give it away tomorrow Care to elaborate? Do you mean assumption that they can have it if they want to, or is there some information about it?
- meric 12y ago
  Your encrypted iMessages is one iOS update from being non-encrypted. As far as I can tell.
  - epistasis 12y ago
    And one iOS update from a TLS implementation with low entropy in key generation, allowing the NSA to decrypt all traffic with minimal computational effort. As is Windows, Linux, all open source projects, and all proprietary projects. All software is one update away from completely changing it's purpose, so I think your point is far more general than just Apple's messaging app.
    - A_COMPUTER 12y ago
      It would be nice if the updates came from a source that wasn't directly under the thumb of the US government as all commercial businesses are, and wasn't amoral and beholden to profit motive. Not having to worry about intentional subterfuge would free up my time to worry about implementation flaws.
    - schoen 12y ago
      I've been happy to see (and participate in) a recent discussion on software update transparency, which I think could change this situation someday -- assuming software users and publishers have enough interest in reducing the publishers' power. Some publishers understand that a reason to try to do this is to be less vulnerable to coercion, and also to be seen to be less vulnerable to coercion -- like when distributing software to foreigners who think that your local government might try to force you to backdoor it. A recent example I heard along these lines was a Chinese vendor who was interested in pursuing a means to help customers confirm that the software updates they got hadn't been backdoored at the behest of the Chinese government. Technology distributors who are based in other countries might face similar concerns.
    - shiggerino 12y ago
      While you can certainly bribe, coerce or trick an upstream maintainer to accept a malicious patch, there's still a whole network of downstream maintainers that all want to have their say, and there's usually ample time for the community to form their own opinions about what's going on, even if that sometimes leads to a lot of silly polemics. I don't know of any free operating system that forces updates, and even if Apple doesn't they still have excellent means to coerce users to accept those updates by withholding all their centralized services. Which is precisely what Sony already did with the PlayStation 3 update in 2010. This is where the Affero GPL comes in. If the users of one service find the terms and conditions to be onerous, they can simply launch a replacement service using the same software on the same day, preferably without breaking a sweat.

comboy 12y ago

> they still hold the key to the universal back door and might give it away tomorrow Care to elaborate? Do you mean assumption that they can have it if they want to, or is there some information about it?

meric 12y ago
Your encrypted iMessages is one iOS update from being non-encrypted. As far as I can tell.
- epistasis 12y ago
  And one iOS update from a TLS implementation with low entropy in key generation, allowing the NSA to decrypt all traffic with minimal computational effort. As is Windows, Linux, all open source projects, and all proprietary projects. All software is one update away from completely changing it's purpose, so I think your point is far more general than just Apple's messaging app.
  - A_COMPUTER 12y ago
    It would be nice if the updates came from a source that wasn't directly under the thumb of the US government as all commercial businesses are, and wasn't amoral and beholden to profit motive. Not having to worry about intentional subterfuge would free up my time to worry about implementation flaws.
  - schoen 12y ago
    I've been happy to see (and participate in) a recent discussion on software update transparency, which I think could change this situation someday -- assuming software users and publishers have enough interest in reducing the publishers' power. Some publishers understand that a reason to try to do this is to be less vulnerable to coercion, and also to be seen to be less vulnerable to coercion -- like when distributing software to foreigners who think that your local government might try to force you to backdoor it. A recent example I heard along these lines was a Chinese vendor who was interested in pursuing a means to help customers confirm that the software updates they got hadn't been backdoored at the behest of the Chinese government. Technology distributors who are based in other countries might face similar concerns.
  - shiggerino 12y ago
    While you can certainly bribe, coerce or trick an upstream maintainer to accept a malicious patch, there's still a whole network of downstream maintainers that all want to have their say, and there's usually ample time for the community to form their own opinions about what's going on, even if that sometimes leads to a lot of silly polemics. I don't know of any free operating system that forces updates, and even if Apple doesn't they still have excellent means to coerce users to accept those updates by withholding all their centralized services. Which is precisely what Sony already did with the PlayStation 3 update in 2010. This is where the Affero GPL comes in. If the users of one service find the terms and conditions to be onerous, they can simply launch a replacement service using the same software on the same day, preferably without breaking a sweat.