Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Such people would have no issue if they were to be provided with a 20 character secret code that allows rooting and fine grained security control. They would simply not enter it and rely on Apple's decisions for them.

This pretty much kills the whole "intended" security line, the intent is user control.



Or perhaps Apple doesn’t want to have to build and support a complicated alternate signing mechanism that virtually none of their users want? I don’t see how a company should have an obligation to offer you exactly the product you want, particularly when there are tons of viable alternatives (which I’m guessing you’re using right now to type these messages).


Oh come on. It is a similar issue with network locked terminals - networks fought tooth and nail to keep the unlock codes away from the people who finished their contracts. In the end, it costs them nothing to provide the codes, but real money to lose customers.

The "none of the users want it" is circular reasoning. If unlock was possible on a mass scale, developers would build for the unfettered iDevices and a market would emerge separate from the one Apple controls. Then users would want it, since it provides value for them - cheaper apps, legal apps that are banned in the Store etc. Of course Apple will fight to the death to prevent such a thing.


The difference was when that was common, virtually all the carriers in certain countries did it because as you said it netted them more money and for a while they mostly refused the compete on it. There are plenty of competitors selling rootable phones and laptops, there’s even ones completely without stuff like Intel’s Management Engine. These are more niche, because the desire for them is more niche, but they’re by no means extinct or on the way out. The users have the option to opt for different products with the properties you want.

There is less money overall put into these products, and correspondingly less software, but that’s not because of anti-competitive practices. It’s because the reality is less people care about this stuff. I don’t think “people are obligated to put effort into the products I want” is a particularly noble political position, since you seem to be insistent on framing it that way. The position you’re talking about in the carrier case is different, it’s “people are obligated not to conspire together to do things that none of their users want and give them no options to vote with their feet”.


In the "carrier era" you could still buy unlocked phones directly from the manufacturer. Your analogy doesn't hold.

The truth is that there is a threshold, a level of user complaints that turns a legitimate practice into an anti-competitive one. People disagree on where this threshold lies - is it at 0, is it at 1000, is it at millions? Until recently, most of Apple's shenanigans have kept the complaints under thresholds small enough to be socially acceptable, that's all. If more people complain, that threshold could be reached.


That wasn’t the case for CDMA phones in the US (and back then not every manufacturer made models for multiple bands). There was no SIM card to swap in. If you could buy unlocked phones from the manufacturer without the carrier subsidy, what was anti-competitive about it?

That’s an interesting metric for anti-competitive practice. Isn’t a large number of user complaints basically the core mechanism that drives market competition? Once you have enough users complaining about an aspect of a product (or otherwise being underserved), why would they not go to a competitor if one is allowed to exist (as they are in this situation)?


A manufacturer had to have a relationship with carriers to move enough product to make its prices affordable even off-carrier. Manufacturers who couldn’t sell through carriers were effectively made uncompetitive by the carrier cartel, that also resulted in a number of other restrictions (how one can pay for stuff etc). In this sense, as I wrote elsewhere, Apple strong-arming ATT was a big step forward; but it also took legislation on this side of the pond to force carriers to play nice with unlockings, there was no chance the market would self-correct.

Which takes me to the second point: the market alone often does not self-correct. This is why we have antitrust laws and authorities to enforce them. People lack the education to be able to reason about “voting with their wallet” in an effective way; and even when they do, they often don’t have the resources to follow through. This is why contract bundles are so popular, despite the fact that they make handset more expensive overall: people can’t do math, and when they do they still often lack the cash reserves to buy a handset in one go rather than paying small instalments for a long time. If a market fails, it’s legitimate for the law to step in; and one indication of failure is the level of discontent from consumers.


>This pretty much kills the whole "intended" security line

Only if the "20 character secret code" had the same security characteristics, which it doesn't.


It has the same security as the scenario of buying vs non buying a product for its alleged security: you either use it or you don't. If you do, you are greeted with copious warnings and voiding of warranty, so it would definitely be a conscious act.


You're completely ignoring the fact that a large part of the user base of these products explicitly buys these products because they don't have these options. Windows attempted to add UAC control to the OS so that people wouldn't install random files from websites without being notified of the changes being made and browsers tried to add systems where users had to go into the options and turn off protections in Windows Defender to be able to install. What was the end result? These websites just started offering tutorials that showed users how to turn off those protections and bypass them completely. If you give people a way to bypass security, they'll do it in order to get to what they think they want. The problem is that most people don't understand the unintended consequences of those actions. That's the entire reason why people trust Apple to make those decisions on their behalf.


Ah, the ole "idiot user" rhetoric, imprisoned for their own sake. Say I call the Apple support center, ask for the code, and they warn me in no uncertain terms that I'm voiding my warranty and would not be eligibile for continued support.

How can this prevent any mentally sane person from trusting Apple made the correct decisions and not root their device?


No, not "idiot user". No one is imprisoned. In the same way that people choose to be part of organizations and groups with rules and limits to what can be done, people choose to use devices that are slightly limited in exchange for reliability and security. I don't want Apple waste time and resources to need to support the people that call the call center to ask for this supposed code and most people using their devices don't either. If they did, wouldn't the market make that movement?


No, it wouldn't, see the terminal unlock code for contract phones discussed below. If your opinion is that the free market is all correcting and magical and that laws and regulations should never intervene in private consumer choices, I have a failed state I can introduce you to, not to mention a salmonela infested burrito.


Unlocking phones isn't in the same scope at all. Locking a phone in the first place was done because carriers were subsidizing phones so they needed to ensure they stayed on their networks. An "unlock code" for root access to a phone is a giant security flaw and a potential vector even for anyone that doesn't want the functionality or care to root their phone. The fact that the option could exist for someone to bypass security is, in and of itself, a security risk. The specific reasons I buy iPhones for family and staff is because I know they can't do those things, even if they wanted to. I want them to have smartphones so they can run specific apps or connect to our servers but I don't want even the possibility of those devices being compromised.

You call it a prison. I call it a fortress.


That's definitely a fair point! Though I think this could probably open you up to some MITM style attacks where someone intercepts a Macbook in transit and steals the root key that comes with it or something. Maybe not though, I guess it really depends on how you accomplish this.

But on the surface it does seem like that could work.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: