Apple cuts off Beeper Mini's access • Hacker News Board

Re: Apple cuts off Beeper Mini's access

#651

Post by jiggawatts » Sat, Dec 09, 2023, 5:12 AM UTC

Shawnj2 wrote: post #594

jiggawatts wrote: post #463

Earlier quoted context omitted.

[flagged]

In fairness the dev is a 16 year old. It’s still bad practice but this is a minor mistake all things considered compared to most programming projects by people of that age

Perfectly understandable, at that age I only had the vaguest notion of how cryptography works.

Unfortunately, nobody else seems to either, which is why my comment is getting downvoted.

"Why is this a problem?" say people when the publishing of a private key is inherently the wrong thing to do, and will always lead to a bad consequence.

It doesn't matter who's key it is, how it was generated, how it was obtained, etc...

The purpose of private keys is to be kept secret. A published private key by definition is worthless. That will have a consequence. Either it'll be make-believe fairytale security, or someone else getting into your product, or what happened here: the third party who's keys were stolen changed the locks.

Meanwhile I'm at -4 and clocking down because people struggle to understand how keys and locks work, never mind cryptography.

Re: Apple cuts off Beeper Mini's access

#652

Post by ungamedplayer » Sat, Dec 09, 2023, 5:14 AM UTC

leidenfrost wrote: post #561

paulmd wrote: post #437

Earlier quoted context omitted.

It’s also at severe risk of ruining the fun for numerous other hacker-spirit communities like hackintosh or opencore. Apple can come down on this in ways that potentially make it much more difficult for hackintosh to operate, or for people to update their legitimate apple systems after the end of official support. Which was pointed out in those threads too. See also geohot taking some other PS3 exploits that were alr…

> it still puts the hackintosh and opencore communities in the middle as collateral damage. Hackintosh is already on a death march. Sooner or later Apple will remove support for all x86 OSX versions. Its life can be extended a bit by hackers who try to backport the software from ARM to x86. But you can't sustain the entire Apple ecosystem by volunteer work alone. Why spend resources trying to kill it when we all know…

I feel that contributing to these closed source extension hostile software never ends up benefiting anyone long term.

I know people gotta make a buck though. Sucks.

Re: Apple cuts off Beeper Mini's access

#653

Post by _rs » Sat, Dec 09, 2023, 5:15 AM UTC

jeroenhd wrote: post #271

tiltowait wrote: post #220

Earlier quoted context omitted.

I heard/saw quite a few people saying Apple either couldn't or wouldn't cut them off—and that even if they did, it would take a while. They were ridiculous takes, yes, but apparently made in earnest.

While it would ruin the experience in practice (not being able to receive any notifications), I don't see why someone couldn't perfectly reverse engineer the protocol. Beeper made several design decisions that made the app super easy to use (i.e. using a single certificate that wasn't supplied by a user's phone), but if you extract the necessary source material from an old jailbroken iDevice, you could create an iMes…

Any source/articles about the AIM RCE and it being left open? Would love to read about that

Re: Apple cuts off Beeper Mini's access

#654

Post by jocaal » Sat, Dec 09, 2023, 5:15 AM UTC

simondotau wrote: post #638

belltaco wrote: post #390

Earlier quoted context omitted.

It was the same when Apple banned Fortnite for daring to accept payments outside of their walled garden and the forced 30% cut. People falling over themselves to hate on Epic and defend Apple's forced cut and the total removal of developer freedom. If it was Microsoft the entire tone would be completely different.

Does Epic Games give developers "total freedom" with Unreal Engine or will they insist upon their royalty when applicable? You can read their FAQ and there's literally a section titled "Why does Epic think it’s fair to ask for a percentage of a developer’s product revenue?" What's good for the goose, etc.

5% Royalty past $1m for using the most high tech game engine in the world is a totally reasonable price. Just like 3% for using payment services is totally reasonable. But 30% for using a distribution service is just absurd. The only reason the app stores can charge that much is because of their iron grip on the platforms.

Re: Apple cuts off Beeper Mini's access

#655

Post by Bud » Sat, Dec 09, 2023, 5:16 AM UTC

russelg wrote: post #336

Where is the hacker spirit here? The number of Apple apologists that have crawled out to say "see? I told you so!!" is saddening. It is a bit dicey when you're charging for it, but since Mini was entirely client-side it would be feasible for a free version to exist. Apple claims iMessage is E2EE, do we have proof they aren't siphoning the messages from the client once it's been decrypted? The level of trust we have t…

[dead]

Re: Apple cuts off Beeper Mini's access

#656

Post by poundtown » Sat, Dec 09, 2023, 5:16 AM UTC

shocker.. be serious youre never going to out wit apple. esp if u have the nerve to charge for it.

Re: Apple cuts off Beeper Mini's access

#657

Post by jiggawatts » Sat, Dec 09, 2023, 5:16 AM UTC

wyldfire wrote: post #519

jiggawatts wrote: post #463

Earlier quoted context omitted.

[flagged]

> how publishing a private key makes the slightest bit of sense. From what I gather, the private key was private until it was leaked to / stolen by the team who published it for this use case. I don't have enough context to say, because I have to admit that once published, the keypair corresponding to the private key is likely to be revoked/discarded.

> the keypair corresponding to the private key is likely to be revoked/discarded.

That's precisely it! Publishing a private key -- anyone's -- invalidates the security of the private-public key pair, making it worthless as security.

There's going to be some consequence to this, such as the third party "changing the locks" and locking out you, or your users.

Similarly, it might allow hackers to intercept the comms, break into your code, or whatever.

The essential, fundamental point I'm trying to get across here is that it never ever makes sense to publish a private key, and then rely on it for any purpose.

Re: Apple cuts off Beeper Mini's access

#658

Post by lolinder » Sat, Dec 09, 2023, 5:28 AM UTC

dcow wrote: post #624

runnerup wrote: post #371

Earlier quoted context omitted.

I remember another post that was very well-received where an individual hacker wrote his own homebrew iMessage client for his own personal purposes. HN really liked that! I think HN exists at an intersection of individual hackerism and business. If a project is clearly by-hackers-for-hackers it gets a lot more leeway for unsustainable concepts / implementations. But this is building a business on adversarial interope…

> on adversarial interoperability In what world is interoperability adversarial? What the actual?

It's adversarial because one party explicitly does not want to interoperate and can be expected to try to break interop.

OP didn't coin the term, it looks like it comes from Cory Doctorow [0].

[0] https://www.eff.org/deeplinks/2019/10/adversarial-interopera...

Re: Apple cuts off Beeper Mini's access

#659

Post by noirbot » Sat, Dec 09, 2023, 5:32 AM UTC

dcow wrote: post #624

runnerup wrote: post #371

Earlier quoted context omitted.

I remember another post that was very well-received where an individual hacker wrote his own homebrew iMessage client for his own personal purposes. HN really liked that! I think HN exists at an intersection of individual hackerism and business. If a project is clearly by-hackers-for-hackers it gets a lot more leeway for unsustainable concepts / implementations. But this is building a business on adversarial interope…

> on adversarial interoperability In what world is interoperability adversarial? What the actual?

Are you trying to ignore the state of what's going on? Beeper's business model was as interoperable with Apple as my neighbors cracking my wifi password to use for their household. The interoperability wasn't intended.

Forcing someone to interoperate with you doesn't immediately make it all collaborative any more than a stranger walking up to me at lunch and declaring they're my friend now makes me want to invite them home after.

Re: Apple cuts off Beeper Mini's access

#660

Post by admax88qqq » Sat, Dec 09, 2023, 5:34 AM UTC

jiggawatts wrote: post #651

Shawnj2 wrote: post #594

Earlier quoted context omitted.

In fairness the dev is a 16 year old. It’s still bad practice but this is a minor mistake all things considered compared to most programming projects by people of that age

Perfectly understandable, at that age I only had the vaguest notion of how cryptography works. Unfortunately, nobody else seems to either, which is why my comment is getting downvoted. "Why is this a problem?" say people when the publishing of a private key is inherently the wrong thing to do, and will always lead to a bad consequence. It doesn't matter who's key it is, how it was generated, how it was obtained, etc.…

Your understanding in of cryptography appears to be "private means private"

> A published private key by definition is worthless.

If I publish the AACS _private_ key, is it now worthless?