Could someone tell me how that inspection works? Are there researchers who are given the source code?
(I posted this on another thread [0] earlier, but it's more relevant here) [0]: https://news.ycombinator.com/item?id=28175619
In this way, third party security researchers can verify their claims. It actually works out pretty well for them since third party security researchers often find pretty severe vulnerabilities through this program.
That makes this program particularly useless for the purpose of auditing whether Apple is adhering to its promises.
Meanwhile, researchers have gotten wise to notary techniques (like publishing document hashes to twitter) which would let them severely and publicly shame Apple should they sit on something that ultimately turns out to be a zero day, with much delight from/participation by the media.
For privacy/societal issues where Apple is a deliberate bad actor, they would presumably either directly be willing to break the terms of the agreement to go public, or would release information indirectly and rely on herd privacy with other researchers.
For example, as soon as an OS update is released, people will take it apart.
Having source might be nice but it’s not necessary.
Could someone tell me how that inspection works? Are there researchers who are given the source code?
[0]: https://developer.apple.com/programs/security-research-devic...
[1]: https://www.theverge.com/2021/8/11/22620014/apple-corellium-...