Hacker News Reader

Comment by tshaddox | Hacker News Reader

If the CCP says “put this arbitrary software into your next iPhone software update or we will halt all iPhone sales in China,” what do you think Apple is going to do? Isn’t the answer to both questions the same?

View on HN

So we should simply accept systems with a high potential for abuse because of the possibility that something bad is already being done?

What has more potential for abuse than the fact that Apple can push any software they want to iPhones at any time?

Can they force install updates? I think it’s been over a year since I updated my iPhone’s os.

Well, no, I don't think they have any way of force install updates, but that would also apply to this update to add CSAM hashing.

If your wifi is enabled and the phone is attached to power, apple updates without any request. I've been trying not to update my iPhone, but recently I left the wifi on when charging and it updated.

Yeah, it's not a practical way to use your iPhone. For all practical purposes, Apple has unrestricted ability to push updates to iPhones.

Do you think this changed since 14.0.1 (which is from Sept 10 2020)? Mine is still on 14.0.1 , and I leave it plugged in with wifi every night.

It's a fair question, but I think the answer is no: the questions are not the same.

As much as Apple wants access to the Chinese market, it would (presumably) draw a line at some point where it would (presumably) have to choose between that market and the US market, if only because the latter is both its legal domicile and the source of most of its talent.

Version A: CCP wants to exploit the hash database, there are lots of ways to do that, bullying Apple is one, any other way gives Apple a "we are looking into it" excuse. "We must comply with local laws, but we will not change our software bla bla."

Version B: CCP wants to exploit iOS, only way to do it is to bully Apple, this forces Apple's hand and very possibly Apple moves production (not just sales) out of China because they no longer trust they will be offered "plausible deniability."

I'm sure there are lots of reasons for that absurd cash reserve, but my best guess is it's to cover the eventuality of B. above; Apple talking about that publicly would be tricky.

https://www.cnbc.com/2020/07/30/apple-q3-cash-hoard-heres-ho...

> very possibly Apple moves production (not just sales) out of China

As a matter of fact, I am not sure that would be possible: It might well be that no other country has the capacity (machines and labour) to churn out that many iPhones. Would be interesting to hear if anyone has insight on that. (Tim Cook presumably knows...)

This has been Apple's line for quite a while, but over the last ten years I can't believe Mr Cook has not come up with a Plan B, given that the volatility in US-China relations is much more likely to affect iPhones than most other Walmart goods.

I admit it's total speculation, but I think the massive cash reserves are for that: to weather a disruption in production facilities and move production to a more US-friendly location.

If they do one of those, it will be obvious it happened, because people can at least reverse engineer iOS and see that it’s different.

If they add some new hashes I presume that would be harder to spot and isn’t going to be advertised

Software vulnerabilities can go undetected for years, why would this necessarily be any different?

the hashes are also shipped with every device and can be inspected.

A few bytes changed in a binary blob that would enable a backdoor would be almost impossible to detect.

The answers are probably the same. What different is how hard it is to discover.

It apparently wasn't hard to "discover" the fact that this CSAM database can and will change over time. In fact, Apple explained this in detail as well as how they are attempting to avoid the problem of governments abusing the system. Are you suggesting that a different software update might be even easier to discover?

What makes us think that that isn’t exactly what this is already?

This is already happening to phones. The baseband blobs are proprietary and most devices permit DMA.

Nobody really knows what the blobs do. They likely have paved the way for Stingrays and other devices.

In Android yes, but Apple has an advantage here that they control the whole device.

If Apple really wanted to they could secure the iPhone. Just offer a 2x higher bug bounty than any government and things like stingray would not work.

Apple is using Qualcomm modems today. Their own chip won’t be ready until 2023.

Although I think recent iphone designs don’t give the modem DMA so it’s still better than Android but I wouldn’t consider it secure.

Reply on news.ycombinator.com