News for hackers. Stuff that matters.
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by jballanc on Saturday February 10, 2018 @05:28AM (#16346723)
When I worked at Apple, the culture of secrecy was enforced primarily by fear of MarCom (Marketing and Communications) and Legal. It might sound ominous, but I always felt it was quite the opposite.

Instead of being treated like children, with hands tied and every interesting piece of technology locked behind layer upon layer of approval and access restrictions, probably 80% of all of Apple's source was available to anyone within the company. This promoted a sense of ownership, a feeling that no matter what your "product" was, we all worked on the entire OS, together. It also allowed for the free exchange of ideas and enabled engineers to be self motivated when faced with a challenge. More than once, when I was stuck, I would dive into the code archives and look to find some bit of code that someone else wrote that might do what I needed, and then I'd call them up and see if we couldn't work on a common solution.

All of this was possible because Apple made it very clear on day 1 that we were being entrusted with the secrecy that is such a core facet of who Apple is, and that if we violated that trust, there would be consequences.

I feel sorry for this "Low-Level" employee, because I suspect they are soon going to find out just how much of a price tag Apple puts on their trust and valued secrecy. On the bright side, they're probably too young to have any real estate holdings Apple could go after, and Chapter 7 gets wiped out after, what? 10 years?

Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by jarjoura on Saturday February 10, 2018 @01:38PM (#16348752)
Ah yes, Purplefish <3. A very magical tool for us OS peeps.

Not sure of the breadth of code in there though, as it seemed every org had its own way of managing its own source code. At the beginning, iPhone OS was basically a mono-repo, but I don't think you could find the iBoot source code in there. Plus, there was this whole hyperbolic "security clearance" leveling that only those working closely with Forstall and Jobs were given full access to UI code. Everyone else had some janky non-ui variant that worked well enough to test the lower level code. To be fair, factory workers were known sources of leaks, so it was a smart move to hide upcoming features.

At every software job I've ever worked, you were entrusted to take care of the companies IP. It's a lot of responsibility when you think about it, because so much of the worlds most powerful IP sits on laptops all over the place. How many of those get stolen or hacked and still thankfully never have things leak?! I've always been impressed. This is another reason we get paid so well when you think about it.

Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by w0de0 on Saturday February 10, 2018 @03:38PM (#16349441)
Send some your thanks to Apple itself & its commitment to device/encryption & privacy; most importantly, send some thanks to all the Silicon Valley Macadmins/Macops/CPE/IT teams. No doubt their work has prevented more leaks than we can now!
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by ksec on Saturday February 10, 2018 @05:43AM (#16346753)
>On the bright side, they're probably too young to have any real estate holdings Apple could go after, and Chapter 7 gets wiped out after, what? 10 years?

It is hard to imagine one could get penalty of bankruptcy instead of going into Jail for this.

I actually value this working model a lot. The comment below suggest this is culture of fear, instead I call this a culture of utmost trust. ( Well he did say he hate Apple, haters are going to hate whether it is rational or not )

Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by jballanc on Saturday February 10, 2018 @05:51AM (#16346780)
> It is hard to imagine one could get penalty of bankruptcy instead of going into Jail for this.

IANAL, but I believe for a charge of grand larceny you'd have to show intent to steal, and the "Low-Level" employee seems to have a pretty legitimate case that this was negligence, not theft. On the other hand, I think it's a pretty straight-line open-n-shut case for Apple to sue for damages, and I'm not sure that ruining a young software engineer's financial life for a decade is less of a deterrent than jail.

Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by mseebach on Saturday February 10, 2018 @06:02AM (#16346807)
The negligence was only in losing control of the code. I guess successfully maintaining tight control of the code would be a mitigating factor (or, more likely, lead to not getting caught), but taking the code from Apple for the purpose of sharing it with these researchers in the first place is clearly premeditated (so, showing intent) theft.
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by yeukhon on Saturday February 10, 2018 @10:07AM (#16347573)
Yes, it’s stealing afterall. Taking screenshots using one’s phone is still possible to steal the code, although the effort would be tedious for a large codebase. But for an active adversary, if that’s the only method, he/she would do it. I fear there is no way around that, even with logging enabled (there will be thousands of accessing the codebase per day). If the proposal is to lock down the repository and requires approval, that will make the development very slow. Not even in the banking would a manager want to ask “why” all the time...
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by mseebach on Saturday February 10, 2018 @12:01PM (#16348141)
I have no idea what they might do, but it's not a law of nature that they have to crack down on access. They have tens of thousands of employees, a single breach isn't evidence that a trusting, open environment doesn't work.
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by usaphp on Saturday February 10, 2018 @10:41AM (#16347737)
> and I'm not sure that ruining a young software engineer's financial life for a decade is less of a deterrent than jail.

Did I understand you correctly? Are you saying that being in jail is almost the same as having a bad credit with bankruptcy record?

Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by leetcrew on Saturday February 10, 2018 @01:17PM (#16348622)
jail is pretty bad, but it's not infinitely bad. that is, there almost certainly exists a sum $X for which you would be willing to go to jail for Y duration of time.

if you're struggling to stay afloat and have no credit/assets, a short time in jail is way worse than bankruptcy. on the other hand, if you've worked as a SWE for a few years, loosing all your money and having terrible credit for years is pretty awful. you're broke, so you can't buy anything outright, and your losses are compounded by the fact that you pay much more interest on things you buy on credit (if you can even get financing at all). it's not hard to see that this could be worse than a short time in jail. it all depends on the length of the sentence and your total losses from bankruptcy.

Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by usaphp on Saturday February 10, 2018 @04:57PM (#16349856)
You do realize that there is life without good credit report? You don’t need to borrow money from somebody else/bank to live good life. Most of the world lives without an obsession with credit reports and borrowing.
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by leetcrew on Sunday February 11, 2018 @10:25PM (#16356304)
yes but (at least in the US), your credit score affects stuff other than borrowing. often landlords will perform a credit check before approving your application; even employers will sometimes check an applicant's credit.

also keep in mind we are talking bad credit and all your assets seized by creditors. i'm not saying a bad credit score is literal hell on earth, but if you have no money and no credit you are gonna have a really bad time for a while.

Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by jballanc on Sunday February 11, 2018 @04:56PM (#16355049)
Most of the world, yes. Silicon Valley? Not so much.
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by bahmboo on Saturday February 10, 2018 @12:52PM (#16348486)
It would be a civil not criminal case if it ever came to that and they would have to prove actual damages. Pursuing it by way of setting an example to employees could very well backfire.
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by mattnewton on Saturday February 10, 2018 @12:28PM (#16348330)
A coworker put it this way to me: “You can do anything you want, on your last day at Apple”
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by fooker on Saturday February 10, 2018 @01:14PM (#16348610)
>probably 80% of all of Apple's source was available to anyone within the company.

This hasn't been true for quite a while.

I worked on developer tools a few years ago and had a lot of trouble finding internal code written in swift to test my tools on. This was when Apple had a few dozens (that we knew of) sort of mature swift codebases.

Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by Bromskloss on Saturday February 10, 2018 @10:41AM (#16347740)
> the secrecy that is such a core facet of who Apple is,

I wasn't aware. What's so secret?

[dead]
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by simonh on Saturday February 10, 2018 @07:42AM (#16347066)
Suppose you were an author and had recently completed a manuscript for a new book. You hire a company to help you move house and one of them copies the manuscript and publishes it on the internet. Or maybe some other personal, private and damaging records or material, such as images of you naked or making love, or compromising images of your son or daughter. If you went to the police, would you be fine if they refused to investigate because "this isn't some police state and we're not the Stasi"? Where would you draw the line on the responsibilities of people you pay to protect your privacy?
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by nextlevelwizard on Saturday February 10, 2018 @05:45AM (#16346765)
>Replace MarCom with Stasi and I know why I have a profound dislike for all things Apple. Culture of fear, not my cup of tea.

Replace fear with love. Why you hate love man?

Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by sgift on Saturday February 10, 2018 @05:59AM (#16346798)
You mean the love of loosing all you have if you "misbehave"? Funny.
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by pdpi on Saturday February 10, 2018 @08:34AM (#16347227)
Replacing fear with love was about as reasonable as replacing MarCom with Stasi. They were only carrying on playing a game of your choosing.
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by dkersten on Saturday February 10, 2018 @09:14AM (#16347340)
Suggesting that there should be no consequences for violating the NDA doesn’t seem reasonable to me.
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by SmellyGeekBoy on Saturday February 10, 2018 @06:33AM (#16346876)
Are Apple the only tech company who will take legal action for violating an NDA? I'm not Apple fan either but this stance is ridiculous.
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by mempko on Saturday February 10, 2018 @11:40AM (#16348027)
The only thing Apple has to worry about with the release of any source code is if that code does something harmful to their customers. Apple should open source all their software.
Re:How a Low-Level Apple Employee Leaked Some of the iPhone'... by username8884547 on Saturday February 10, 2018 @11:35AM (#16348001)
>>I feel sorry for this "Low-Level" employee, because I suspect they are soon going to find out just how much of a price tag Apple puts on their trust and valued secrecy

Maybe there's no better way but this is a bad security policy. With thousands of employees with such access, odds are that one might do it, either because he can, bragging, ideology, $$ from competitor or NSA /FSB etc etc.

Punishment is a possibly but "I will not get caught" etc