Or Input/Output Controller (scientific facility control layer tech)

Come here to say that too.

Now what if an “AI” system could come up with the key points to know for domain knowledge, that would make each domain that bit less intimidating.

Providing there’s a reliable publicly available store of data to extract the domain knowledge from.

Sounds so good I guess there’s several systems like that already.

But then skim the submission article and try to evaluate which audience it seems written for.

Considering they have stuff like "Located within the Sysdiagnoses in the Unified Logs section (specifically, Sysdiagnose Folder -> system_logs.logarchive -> Extra -> shutdown.log)" in the article, my guess is that they're aiming for people who at least have a basic understanding of security, not general users, as those wouldn't understand an iota of that.

One of the iVerify people (which this blog post comes from) spoke at CCC about what Apple could do to improve detection of IOCs:

https://www.youtube.com/watch?v=YG_6N0DSFRE

The relevant bits I was talking about starts at 41:15.

I agree but the blog post is completely orthogonal to that

I think a difference is that apple has the means to change the behavior of the device after the fact in ways that the person that purchased the product doesn’t.

This is unique to modern technology, and the fact that they sell you the house keeping sole ownership of the keys to certain rooms is indeed worth examining I think.

> If people really want to add their own features they are free to modify the device.

Except that they are not actually given that freedom.

The entire notion of free software is that users should be free to modify the software stacks of their devices.

Very few consumer devices are free in that sense. You can't run a custom OS on an iPhone.

> Does that mean the state actually owns it?

By registering the car and obtaining a license you are agreeing to obey the rules set out by the state in exchange for permission to use the roadways.

To steelman the argument, you could argue that by using an iDevice you are using Apple's services and agree to follow the rules set out by them. But there is no such possible way to use an iDevice without relying on Apple's services.

With a car you can have it delivered and only use it off public roads on your own property. That would be a lot less useful, but it is something people do sometimes, such as with vintage/museum cars, race cars, construction/farm/mining vehicles, etc.

It's always your vehicle. The issue is the roads not the vehicle. But with an iDevice, even if it's legally "your phone", it's been designed to be impossible to do whatever you want with it within the bounds of the law, which weakens the traditional notion of what it means to "own" something (ie "right of disposal").

Again to steelman it, the retort is "Apple has the right to manufacture devices in alignment with protecting their business model, if you don't like it then buy other devices". Which is fine normally, except that the only other major similar device manufacturer is starting to do similar kinds of things and our society increasingly depends on the assumption everyone has a phone.

So what's increasingly becoming the scenario is that you have a choice: either allow your rights over your own property be infringed, or allow your ability to participate in society be infringed.

> I “own” a car, but am not allowed to drive it in some situations (if I’m drunk, on the wrong side of the freeway, …). Does that mean the state actually owns it?

No, it means that the state owns the freeway.

Yes, that is exactly the problem. No need to read more into it.

Yeah, that's always how bribery works.

From Wikipedia: "Bribery is the corrupt solicitation, payment, or acceptance of a private favor (a bribe) in exchange for official action."

> the gold thing seemed like a good, cheap way to get on Trump's good side

Which, whilst morally repugnant, does make business sense - if Apple got hit by tariffs or other penalties, you can be sure the Carl Icahn style leeches would be popping out of the woodwork complaining that Tim Cook was ruining Apple / the share price / etc. and trying to orchestrate shareholder and/or board revolts.

(And Good Lord, imagine the threads on here if Apple's value dropped just because Tim Cook didn't give a hideous piece of tat to Trump.)

Bribery can be done in a myriad of ways but the gift itself is not the valuable thing, it is the display of fealty.

I’d like to clarify with a couple of questions.

- Are you saying that you believe apple is picking someone who is a real wizz with css, but because of the country’s laws they had to serve with the IDF?

- Are you saying the formality of having to be a former of your previous employer, as part of taking on new employment is to be unexpected in any way?

The phrase "someone inside Apple" doesn't really connote top leadership. To me at least it resonates more with "insider threat". If they meant it was corporate policy, they would have just said "Apple". And as you said it's rather implausible to start, so I don't know why that would be your first interpretation. :)

Yeah, loldrivers are a thing because any signed driver can load, vuln drivers with ELAM .. I don't know of any, I believe they're quite rare.

You have a good point with attack surface, but apple has a pretty robust system already for ensuring boot and lock security that doesn't rely on EL0/El1 security. I'm sure you know more than me about higher EL's like EL3 and secure world code that can take care of all that. I'm pretty sure they don't have to issue new signing keys either, matter of fact, why let even 3rd parties do this, apple themselves could expose a memory and file system dumping api without involving third parties. That way, they could sanitize away anything they consider sensitive as well. They can also require that the commands be issued over a physical/authorized usb connection.

Point is, there are very legitimate are critical cases where memory and file system forensics could be critical. From what little chatter I've heard, forensic software today is resorting to exploitation of the devices and those exploits tend to be abused for other reasons too.

Do you know of any reports where macos system extensions being abused this way? I've heard about windows drivers, but my impression was apple is doing this well enough to be a non-issue mostly?

Crowdstrike has system extensions on macos.

Apple's response to XCodeGhost was to draft a breach notification to everyone impacted and then not send it as it would impact their brand.

I'm sure that's true, but your personal experience as [presumably] rank-and-file wouldn't have given you visibility into C-suite machinations. The ruling in the App Store case this year documented that Cook personally overruled Schiller's compliance recommendations, made the decision to violate the judge's court order on fees, and then tried to hide those meetings from the court - resulting in contempt findings and a criminal referral. Those are top-down decisions, on the record, with executives lying about it, which wouldn't have been known outside the inner sanctum but for this case. Not at all consistent with "trust", in a matter that directly harms consumers.

Regarding the basis of Apple's market cap, I would suggest that profitability ranks a bit higher than privacy. Apple's potential tariff burden was $44 billion annually, reduced to $7 billion after Cook plied the mad king with flattery, gold and cash. Apple had lost $300 billion in market value before Trump exempted smartphones, then immediately regained its $3 trillion market cap.

Privacy is nice brand positioning, but the truth behind it was always that Apple wasn't beholden to "surveillance capitalism" like the other tech behemoths as hardware was their primary profit center. This allowed them to take the high ground on this one, while coincidentally kneecapping Meta and others with App Tracking Transparency - which cost Meta an estimated $10 billion in 2022 alone and hit Google as well. But ATT only blocks third-party tracking across apps and websites - it doesn't apply to Apple's own growing advertising business, which uses first-party data from the App Store, Apple News, etc. Apple claims they don't "track users across apps and websites owned by other companies" - but they absolutely track within their own walled garden for their expanding ad business.

And the iOS 26 removal of Pegasus/Predator detection artifacts right as ICE activates Paragon spyware contracts? Maybe a coincidental bug, maybe what happens when keeping Trump happy is worth tens of billions.

The idea that a corporation, a private entity, can flex so much influence over our government is a direct threat to the entire model of government that has lead to America's greatest successes.

There is a triangular structure, where government, corporations, and labor all keep each other in check. The balance between these three represents the golden age of America in many metrics, although attributing that age to JUST this balance is silly.

Happiness, income inequality, trust in institutions, etc. all of it follows this trend. Even life expectancy is dropping! Literacy rates are declining!

Why? A huge part is that this balance is completely shattered. Labor has almost no influence, with corporations consuming 80% of it. Now we are rubbing up against a true fueudal Corporatocracy and the tip of the spear is not shy about that (https://rationalwiki.org/wiki/Peter_Thiel)

>"It’s just how business is done"

I will not just roll over and accept this. It's worse than it ever has been, and the last time it got bad we had a severe economic collapse that led to starvation in the streets. How will it go next time, with the core problem being 100x larger and globally networked? Maybe we should address the problem before catastrophe?

That makes it that much easier to stop supporting them, in my eyes. Tim has the option to draw the line in the sand, but he's reliant on protectionist US control more than ever now.

This isn't 'business as usual' on multiple levels.

First, I never claimed Cook "supports" Trump - as I said, I suspect he personally loathes him. The point is that corporations are making unprecedented concessions to avoid Trump's wrath.

Second, companies push back on government constantly when it serves their interests. Apple previously fought the FBI over privacy, but more typically companies push back or evade the law for financial benefit, not principles. When penalties are low enough they accept them as the cost of doing business, e.g. Meta's consistent, willful FTC consent decree violations.

Third, openly bribing a sitting president with a 24-karat gold gift is not normal corporate behavior. The Trump administration has used state power to control private enterprise in a completely unprecedented way: tariff threats as extortion, DOJ investigations targeting companies over DEI programs, prosecution of high-profile figures who resist - mostly political enemies so far but Zuckerberg faced threats of "life in prison" before he showed sufficient fealty.

I'm waiting for the whataboutism replies here, and executive overreach was a thing in the past, but Trump has fundamentally changed the character of the US system of government. The enabling environment is unprecedented: a Congress with zero interest in oversight and a Supreme Court granting immunity for official acts. When you combine unlimited executive power with no checks, corporate capitulation isn't "just business" - it's rational fear of an authoritarian using every lever of government to punish dissent.

MIE eliminates a whole class of bugs (memory corruption) and has demonstrated that it stops full chains but also renders them unusable if parts get swapped out.

See: https://security.apple.com/blog/memory-integrity-enforcement...

And some interesting excerpts:

Both approaches revealed the same conclusion: Memory Integrity Enforcement vastly reduces the exploitation strategies available to attackers. Though memory corruption bugs are usually interchangeable, MIE cut off so many exploit steps at a fundamental level that it was not possible to restore the chains by swapping in new bugs. Even with substantial effort, we could not rebuild any of these chains to work around MIE. The few memory corruption effects that remained are unreliable and don’t give attackers sufficient momentum to successfully exploit these bugs.

Notably, attackers confront Memory Integrity Enforcement early in the exploitation process. Although some issues are able to survive MIE — for example, intra-allocation buffer overflows — such issues are extremely rare, and even fewer will lend themselves to a full end-to-end exploit. Inevitably, attackers must face MIE at a stage where their capabilities are still very limited, leaving few viable avenues for exploitation. This leads to fragile chains where breaking just one step is often enough to invalidate the entire exploit strategy. When that happens, most of the chain’s components can’t be reused, and the attackers have to restart exploit development with entirely new bugs.

MIE is preventing an entire exploit category permanently. Blastdoor is just being more careful in a specific area of the code. It's also not just a case of is it possible to exploit or not, but how much does it cost to develop an exploit, and how long do they last for.

If it costs you millions of dollars for an exploit that gets patched a week after it's deployed, you can't use that for mass surveillance. If it costs you hundreds of millions, you can hardly use it for targeted attacks either. The cost of exploiting phones is constantly going up. It used to be within the ability of a single hobbyist developing a jailbreak. Now it's only in reach of the most well funded hacking groups for highly targeted attacks.

PRISM was also disclosed through a whistleblower, not a FOIA request. I commend your naivete if you seriously think Apple was included in the old wiretaps but exempted from the new ones.

Swift is a ridiculously far cry from a memory safe language.

I’m not sure of the whole dynamic of the stolen phone black market, but if iPhones are still stolen, it seems iCloud lock does not sufficiently deter the practice.

Why is iCloud lock such a casual, non-concerning topic? It just shows you don't own your over priced iCrap because iClown can remotely brick it at any point

To be able to lock a phone without having access to the iCloud account. If I have devices on my account that was provided to someone to use with their own iCloud account but they refuse to turn them over to me, there is no way I can shut that account down. I can report the IMEI as stolen, but they are free to continue using it as a wifi only device. If they attempt to move the device to a new provider, they are supposed to say no since the IMEI is reported stolen. Not sure how well the lower tier providers pay attention to that though.

TL;DR if the device is stolen from you by a stranger, this is possible. If the device is stolen from you by someone you permitted to use the device, this is not possible