"Apple's goal in many cases is to protect their software, not you."

Seems like it is easy to trick the public into confusing one goal for another.

There seems to be an implicit rule in the Apple software scheme: Apple itself is "pre-certified" as trustworthy. Not only at the time point of hardware purchase, but endlessly into the future.

The user of course cannot revoke that "certification". The way these systems are structured today, the user effectively cannot decide after purchase "Thanks Apple, I got this. I'll take it from here." This is sort of implicit trustworthiness of hardware vendor as software vendor also underlies the contemporary concept of "updates". There is no genuine (viable) option for the user to say "no, thank you". Saying no would be deemed as ill-advised for a variety of reasons.

The one-time hardware purchase is transformed into an ongoing dependent relationship that can be, and in fact is, exploitive. Its primary reason for existence is as you suggest not to "protect" or otherwise benefit the user, but it can be contrued that way.

Yes, this is exactly how Apple's security model operates; at least for their embedded devices. On Macs it seems like you at least get the choice between "I trust Apple" and "I don't check anything", which is still annoying because clearly the option people want is "I trust me" but Apple is not willing to provide this.

Apple still requires notarization and thus checks for viruses for non-app store apps.

The notarization process also filters out apps that give users greater control of their hardware, because they might touch things like private APIs. When the user goes to run the software they chose to download, macOS will treat it as if it's radioactive, giving the user the impression that the application either doesn't work or is malicious.

The end result is that users are left being unable to use their computers in ways that Apple doesn't like.

The notarization process does not scan for the use of private APIs. That only happens if you submit an app to App Store.

From the macOS Mojave for Users, Administrators, and Developers book:

> The Notary service will also perform some additional checks on the application. These include security checks that verify the application is doing what it indicates as well as the check for private API usage, similar to Mac App Store apps.

[1] https://www.waynedixon.com/2019/05/16/new-notarization-requi...

Notarization does not stop you from using private APIs. Source: have notarized multiple applications that link against them.

From the documentation.

https://developer.apple.com/documentation/xcode/notarizing_m...

> For example, if a plug-in employs deep integration with the host executable via C function pointer overrides, or uses a JavaScript engine for custom workflows, the host executable must declare the Allow Unsigned Executable Memory Entitlement or Allow Execution of JIT-compiled Code Entitlement, respectively. In some cases, a plug-in fails to even load if the host executable lacks the proper entitlement.

This is the best documentation I could find with a quick Google search. But basically, if you can use C function pointers, you can call anything you want and there is no way that an automated scan can detect it with the right level of indirection.

I also couldn’t find anything from the official documentation about not being able to code sign anything that uses private APIs.

But even simpler for apps that don’t actually get manually reviewed, it’s really easy to bypass.

https://medium.com/swlh/calling-ios-and-macos-hidden-api-in-...

Even if they did do something like scan for text strings in PerformSelector, that’s also easy to obfuscate.

Right, so that is OP's point. Either you trust Apple to do notorization, or you disable signature checks by turning off Gatekeeper.

(Or you let specific apps through Gatekeeper, or you go even further and turn off SIP... there are a lot of in-between states, but they fall somewhere on the spectrum between "trust Apple" and "don't verify trust". There's no "trust Mozilla" option.)

> "the App Store has a spotty record of stopping malware from reaching your phone"

Source?

Apple's App Store has in fact a really good track record for stopping malware from reaching phones. Some mallware still got in, but AFAIK Apple has reacted promptly on discovery, and it would be a logical fallacy to conclude that their track record has been "spotty", and as implied, useless, because it isn't.

There are thousand of Windows PCs infected by botnet malware, per day.

Yes, if you'd remove the App Store, iOS devices would still be more secure because of the sandboxing. What Apple does however is a multi-layered approach to security. Which is why iOS devices are in fact the safest devices for consumers on the market.

You and I may not like it. I actually think Apple should allow third party sources, just like Android. But let's not pretend that there aren't security benefits to their App Store.

> There is custom silicon in every recent iPhone that does nothing but stop modification of kernel code, even in the face of code execution and arbitrary read/write in EL1: interesting from an academic standpoint, but if you stop and think about it for more than a second it's entirely useless for actually protecting users.

Every single malware (or jailbreak) wants to modify EL1 code, it's not just interesting from an academic standpoint.

Malware has no need to modify EL1 code if it can grab your iMessages without doing so; exploit chains found in the wild grab the kernel task port (or equivalent) instead. Jailbreaks do want to modify EL1 code, but this comes back to the point I was making about this protecting Apple's software and not their users.

To be fair, malware could also modify the kernel and achieve the same effect, so it does provide one step towards security and protecting the user.

There's no reason for malware to do this, though. It's like putting reinforcing your back door so people can't kick it in while leaving the front door with a pickable lock.

Except the front door doesn’t have a pickable lock, and this is just one of many overlapping security mechanisms. It’s like installing a metal back door and front door, bolting them, and also locking your windows.

Just because the windows can be broken more easily by an invader doesn’t mean there isn’t also value in the other steps you took.

> It’s like installing a metal back door and front door, bolting them, and also locking your windows.

Except Apple hasn't done that, they have just reinforced the back door and left the front door (which has periodically been picked) open. As it stands now it mostly just exists to annoy jailbreakers.

iOS has probably the best security record of any widespread consumer operating system in history. Certainly better than Windows and Android.

Apple Software is not secure either. Apple has just marketed themselves as being more secure.

https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...

No platform is perfectly secure and every single piece of software is potentially vulnerable to zero-day exploits. The important question, as the previous commenter said, is what is the security record of each platform? And iOS is miles ahead of everyone else:

Among smartphones, Android™ devices are the most commonly targeted by malware. In mobile networks, Android devices were responsible for 47.15% of the observed malware infections, Windows©/ PCs for 35.82%, IoT for 16.17% and iPhones© for less than 1%.

Source: Nokia's latest threat intelligence whitepaper (https://onestore.nokia.com/asset/205835)

Apple also has a much better track record when it comes to providing long term security updates for the devices it sells.

While I agree that iPhones are more secure, one should also take into account that they represent around 20% of deployed phone devices across the world.

Fair enough, but that doesn't really explain the difference. (5x as many devices but 47x as many malware incidents.)

I wouldnt assume install base is linear to malware incidence. I'd expect something supralinear as you observe here, after all, this type of dev in particular is after cost vs benefit ratio, so to first order only the largest ecosystem is worth your effort.

> This is a bit inaccurate; first because the App Store has a spotty record of stopping malware from reaching your phone

Spotty relative to what? The App Store hasn’t had a 100% perfect record, but it’s pretty darn close to it. I really can’t think of any other software distribution channels for general purpose computing devices (including the open web) that have had a better security track record than the App Store

Have there been widespread instances of malicious software in Linux repos? It might just be that Linux distros are lower value targets than apple phones, but they do seem be pretty good in terms of both keeping out actual viruses (which Apple is pretty good at keeping out) and also keeping out shady advertisement/snooping based software (which Apple seems to have done less good at keeping out than the repos. Although, they are doing good for a private company, right?)

Also, Steam seems to do all right as far as I can tell.

With 1% desktop market, there are more juicy targets to exploit.

Like the server market; high bandwidth, always on and likely running and endpoint for z mobile service.

Those are easier to bring down with DoS attacks.

Denial of service is just one of many potential goals.

> I really can’t think of any other software distribution channels for general purpose computing devices (including the open web) that have had a better security track record than the App Store

GNU/Linux packaging systems? F-Droid?

The open web is a distant second at that - perhaps third if you think the google play store is relatively malware-free compared to the open web.

Why is it useless for actually protecting users? Is it easily circumventable or is it just that there are simpler attack vectors that don't require modifying kernel code?

Most iPhone attacks that users care about are those where attackers target sensitive user information and exfiltrate it–other ones don't really make sense on the platform. For this, typical attack vectors are a messaging app exploit (which is entirely outside of the control of Apple, FWIW), a web browser exploit coupled with a sandbox escape, or perhaps a bug in a Wi-Fi or Bluetooth driver; none of which typically require modifying kernel code in order to implement. The group of people that wants to patch the kernel, or extend it, is essentially nobody but security researchers and jailbreakers for whom the rationale to do something like this is often "because I should be able to do this". Thus, the feature is ineffective at addressing or preventing actual attacks that users care about and very effective at preventing people from tinkering with iPhones.

I think you're conflating 'attacks possible and thus more often seen in the wild' with 'attacks users don't care about'. People would very much care about exploits that become persistent if those happened.

Attacks against iOS that become persistent do not exist in the wild to my knowledge, nor did attacks that overwrote kernel text. They just do not exist because there is no reason to do this because it's substantially easier to find other things to exploit.

I just don't see how 'preventing such attacks is just to annoy jailbreakers' follows from any of this, though. Like, it's a narrative but the logic doesn't add up to me. There are really good reasons to also defend against complex attacks, attacks that require physical access, you name it. I don't want my iMessages leaking stuff because someone sent it a funny message, I also want my phone to remain reasonably secure if I hand it to a TSA agent.

Perhaps Apple has some sort of model where this is helping, but as it stands this makes the lives of security researchers and jailbreakers annoying and it does not close a hole that previous attacks were using (they are still using the same techniques!) Neither of your examples involve patching the kernel–the first is finding a bug in iMessage in userspace, and the second is handled by an entirely separate chip. My perspective is literally just "I want Apple to prevent exploits against my iPhone, and also not make jailbreaking worse for no reason" and this feature is "makes exploits no harder because no attacker cares that this exists" and "makes jailbreaking way more annoying". There's no balance between the two here, it's just negatives all around.

I didn't say either of these patched the kernel (one is in userspace, the other one is, well, you don't know where it since I didn't describe one) just that the difficulty and complexity of some potential exploit doesn't mean the exploit isn't important both to Apple and end-users.

You were arguing that some of Apple's mitigations are only aligned Apple's business interests and not those of end-users. I don't think you've said much to really show this is true, other than in your specific case. Not wanting the phone to be jailbreakable, to provide some assurance that when you buy an Apple phone, it's running Apple's software as designed by Apple and that it can't easily and surreptitiously replaced with something else is a perfectly reasonable consumer expectation very much in line with what Apple explicitly sells and promises of the product and services it comes with. The 'for no reason' bit just seems obviously inaccurate.

Apple's goal is to protect their share price.. Nothing else.

Everything Apple does is in service of that goal.

This is why they are hardline on AppStore policies, and why they are hardline against Independent repair.

Any PR they have about protecting the user is just marketing

I’ve been seeing this idea on the Internet a lot more for months now and I’ve been trying to put my finger on what I think is wrong with it I think I finally figured it out.

I work for a corporation, it’s not a massive corporation, when I first started it was a midsize family owned company and we never did work in service to the bottom line at least not solely. First and foremost we were interested in customers and providing value to them. I think that any major corporation or business small large whatever also has that same responsibility and probably also the same drive. Any organization is made up of multiple people and there’s definitely going to be some actors that are completely bottom line driven but you’re going to also have individuals whose purpose is meeting customer needs and providing customer value. I’m not saying Apple is an altruistic corporation or doesn’t have concern for the bottom line, but making such a broad generalization to say that Apple only serves their bottom line perhaps sets you and others up with a pessimistic attitude where the people doing good work are missed.

This is mostly a bit of introspection on the thought that I’ve been trying to flesh out for the last few months and it’s not meant as a criticism of your comment in anyway I understand the sentiment of where you’re coming from because I’ve also been in that same place. I think my views are just changing a little bit and I thought I’d take this opportunity to write them down hope you have a great day.

syshum's post is definitely cynical, but I can see it being true in the sense that companies are not likely to make moves which lower their share price, even if they think it is ultimately good for the consumer, if they know consumers will think it is a net loss for them. For example, it may be possible to raise the security level of their devices 100 fold, but if it causes their products to cost 10x as much, no consumer will feel it is worth the price, and so the product will not sell and their stock prices will fall, even if it's ultimately in the consumer's interest.

But still, they are more consumer interest oriented than their sole competitor. At least this is a big part of their marketing. Talking share price, Apple could have gone with user data mining and targeted ad business which is very profitable, but they chose not to.

Yes, emphasizing their privacy focus as their differentiation is definitely part of Apple's brand identity and marketing strategy. However, Apple is in a different vertical and has a different business model than FB and Google, and may not have the DNA to succeed in businesses such as advertisement.

My claim was not "Every worker at Apple"

But Apple the organization, Apple CEO and Board for sure, and probally all of the C-Level are looking at the share price...

Every public company would be the same

Every Private company would be looking at some other Shareholder value, be it dividends or some other Shareholder ROI metric

Many if not most of the employees would be shielded from that in some ways, and often presents itself in frustation over company policies, public statements, or actions because they feel the company should be looking to something other than Shareholder value because many companies present publicly to be doing something other than that, present to their employees as "we are all a family" and other platitudes because if a company came out with the hard reality people would recoil from that as most people do not desire to exist in reality but instead a nice delusion (this is also why we get the politicians we get)

Like all companies Apple does well when it looks after its users.

In the case of both the App Store and third party repairers that involves protecting users against bad actors. I have downloaded dodgy apps in the early days of the store and have had repairers use counterfeit, defective components for my Mac.

Unfortunately protecting against bad actors inevitably comes at the cost of openness.

Please don't post in the flamewar style to Hacker News.

https://news.ycombinator.com/newsguidelines.html

> first because the App Store has a spotty record of stopping malware from reaching your phone

Can you elaborate on this with more detail about what you're specifically referring to?

Apple let a jailbreak app on the App Store once: https://9to5mac.com/2016/08/29/reddit-jailbreak-dribbble-cli.... And Charlie Miller got his developer account revoked because he showed it was easy to get malware past App Store review. In general, it's trivial to get things that break the rules past the review team; I think almost every large app is probably doing it to some extent.

I'm not sure I would consider a handful of examples of developers sneaking apps past the review team evidence of a "spotty record of stopping malware". Yes, you can trivially sneak things past app review by temporarily disabling disallowed features and re-enabling them once the app is released, this is literally what Epic did to get their payment processing system into Fortnite.

But the fact that all app distribution goes through the App Store means that malicious apps can be disabled once discovered, and bad actors can be banned. This is important.

If you compare the situation on iOS to the situation on Android the difference is night and day.

https://arstechnica.com/information-technology/2020/04/solve...

https://www.theverge.com/2019/7/10/20688885/agent-smith-andr...

https://www.kaspersky.com/blog/skygofree-smart-trojan/20717/

https://arstechnica.com/information-technology/2016/07/virul...

This type of malware is far more pernicious than an app getting snuck past review, for example rooting your phone and burying itself so deep it survives factory resets. And all of these examples were distributed directly via the web or from third-party app stores, so Google can't simply remove them from the Play Store either.

If you think the App Store has a spotty record when it comes to malware I wonder how you'd describe Android or Windows.

This is not a benefit of the App Store but a benefit of a tight boot chain that largely prevents persistence.

No, it's a benefit of the fact that side-loading (the most common malware attack vector on Android devices) is not possible on iOS.

Sideloading is totally possible. It is just ordinary customers don't have the right to do so.

I suppose that depends on how exactly you define side-loading. I'll go ahead and clarify that I meant having a platform-sanctioned method of bypassing the default app store and instead downloading and installing third-party apps from the internet. But I think you could probably tell that from the context of the sentence.

we need apps that can tell the difference between normal use, and a review process so as to hide functionality when appropriate and release functionality to the control of an actual user

Funny thing is my jailbroken iPhone 3GS was probably more secure because it had a firewall and adblocker installed. A PDF exploit got fixed faster as well.

That was 10 years ago though.