purplehat_
today at 7:37 PM
I really don't understand the argument here. That the product is locked down by design is a feature, not a limitation.
Yes, this has the side effect of making them more money and allowing a walled garden to form, but given that the vast majority of users wouldn't do anything different with their phones if a shell was present, this is in my opinion not that large of an effect.
The snide around "clicking on links is dangerous" and locking down the bootloader is unwarranted, because for most people a phone is not a toy (or at least, not just a toy) - it has their communications history, their bank information, their passwords, any many more. And it's really easy to steal people's phones on the subway. This isn't about freedom of computing, this is about the fact that an iPhone in BFU is nearly as secure as a GrapheneOS phone.
There are many problems with Apple software. It's buggy, uses proprietary formats that you can't export, and interoperable with open standards. It's bad, and is the primary reason why I won't buy another iPhone, but Macs have that same problem. On the other hand, being cryptographically locked-down is an optional feature. If you don't like it, buy a computer without that feature. It's harmful to us, to tinkerers and people who want to see how things work, but the average person does not care at all and just wants to be able to open LOVE-LETTER-FOR-YOU.TXT.vbs without having their 401k get drained.
If you make a bootloader unlock require a full wipe/rekey of the device, and make unlock status visible at boot, most of the "someone might unlock my bootloader maliciously" concerns go away.
purplehat_
today at 7:56 PM
Fair point, but that solution doesn't address the market for theft, so there's a tradeoff there.
If you put the icloud-lockout stuff early enough in the boot chain (which I believe is the case on apple silicon macs already?), that seems like a solvable problem too. I can understand why apple hasn't put the engineering effort into making something like this happen, but I don't think it's because they can't make it happen.
I still remember the era when jailbreaking Android and iPhones was gaining popularity among less technical people. It was eye opening to watch how many people I knew would search for a random web page and then unquestioningly follow instructions on the screen to install software from the first link they clicked.
All of this to get custom fonts in their messaging app or some other little feature they saw on someone’s phone.
I started getting a lot of requests for help from people who had broken key functions on their phones or even bricked them entirely.
Even today there’s a culture of downloading Android builds from long forum threads on XDA developers and other forums and hoping they’re not compromised.
If you steal someones phone on the subway its not going to be BFU.
throwaway27448
today at 7:40 PM
I understood this stance more 10 years ago, but now we have many layers of fairly well documented exploit tactics and none of them rely on the app store. However forcing users to use an app store was supposed to benefit us has clearly failed.
And, somehow, the indignity of being forced into paying apple a 30% tax for a market they wholly own never comes up alongside other paternalistic arguments....
purplehat_
today at 7:51 PM
Can you elaborate on "fairly well documented exploit tactics"? My impression is that most of these are either social engineering, for which we need to hire better designers, or complicated chains of hard-to-find primitives only accessible to state actors.
There's definitely problems but the solution isn't to make the iPhone a general purpose computer. We definitely need to defend the existence of general purpose computing at a time where regulation is likely to begin encroaching on it, but the promise of the App Store is "pay a 30% tax and any app you download here will be safe." In my mind, at least, that's the promise, and perhaps one solution to the situation would be to erect consequences to breaking that promise.
throwaway27448
today at 8:19 PM
A 30% tax and no freedom to install what you want better come with protection from state actors lmaooo. Otherwise what could be worth such a heavy-handed (and under a rational state, illegal) method?
Especially when the app store is nos filled with gambling apps and social media built to exploit children....
littlestymaar
today at 7:57 PM
> The snide around "clicking on links is dangerous" and locking down the bootloader is unwarranted, because for most people a phone is not a toy (or at least, not just a toy) - it has their communications history, their bank information, their passwords, any many more.
And so is their god damn computer!
The ONLY reason why we treat phones differently from computers has no relationship at all with what's at stake, it's purely because Apple felt they could get away with it for phone, while they estimated that people would stop buying macs right away if they did the same thing for computers. It's literally that simple.
And yet, try getting a full backup of your Google phone onto your own computer. (Without rooting/wiping the whole thing.) Heck, try getting just your text messages off (without a separate app)!
You can't. (Last time I checked.) The backup is encrypted in the cloud, and the only way to download it is to restore it to a phone.
Whereas I can just plug in my iPhone and get a full backup, complete with sqlite manifest, completely accessible. Text messages, photo library, everything.
It’s only about the right to use your device as you see fit.
It is kind of silly that people buy raspberry pis to run their NAS, while they trash ther infinitely more capable iphone every couple of years.
kube-system
today at 8:07 PM
The iPhone is designed to be a good smartphone, not a good NAS. It is silly to expect anyone to compromise the design of a mass market product to support some esoteric MacGyvering entirely unrelated to the original product.
Should we all expect Toyota to design their ECUs to be used as a NAS?