Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear Jailbreak Community

evasi0n.com

Post reply on HN
Print view View original

11–20 of 72 posts

Re: Dear Jailbreak Community

#11

Post by schneidmaster »

elboru wrote: post #9
schneidmaster wrote: post #5

This is interesting. The jailbreak community is a weird place on the edge of free software- normally, "just open source it" is an easy answer to security concerns, but there are understandable reasons not to open-source exploits. However, the whole competition thing between evad3rs and saurik seems kind of strange. Honestly, I wish Apple would just get with the times and allow an appropriate degree of freedom on thei…

> but there are understandable reasons not to open-source exploits Legit question, What reasons could there be?

Yeah, what voltagex said. Same reason you shouldn't open-source a zero day exploit on any website without responsibly disclosing it to the company and giving them a reasonable amount of time to patch it.

Re: Dear Jailbreak Community

#12

Post by nwh »

rolleiflex wrote: post #6

Malware should be easy enough to detect by MiTMing the device, assuming the baseband is unmodified and cellular is shut down. (edit: no, it doesn't-- shouldn't post before I'm awake) I have just updated my phone and I have no traces of the chinese app store mentioned here, for what it's worth.

No, you can not detect malware working like that.

How do you know the data will be sent when you are looking, how do you know what the encoding will be? Maybe it exports your AppleID password by using the unused bit ("evil bit") in IPv4 packets, maybe it encodes your keychain into every screenshot you take, maybe it's using high frequency audio (haha) to send out copies of your photos when you're not looking.

Treating the iPhone like a black box it would be impossible to deny the existence of malware, you can only confirm it's existence. Given that the evad3rs didn't even know what the binary they included with their exploits contained, we can assume that there's possibly a backdoor or two in there as well.

Re: Dear Jailbreak Community

#13

Post by chengyinliu »

duiker101 wrote: post #7
chengyinliu wrote: post #4

I do not believe that helping a Chinese company that is related to Qihoo360, which has a very bad ethical record will in anyway benefit the Chinese users. I also don't see how is this benefiting the jailbreak community, except for the compensation they took in.

One thing I don't understand... why do you think it is wrong for them to make money out of their work? I am not saying that what they did was good for the community but what if the alternative was not getting anything? They are still offering it for free...

I don't think I said that it is wrong for them to take the money. It is more about who to take it from and what are they asked to do. They claimed including TaiG is good for the Chinese user and a positive thing for the jailbreak community. I personally don't think that's the case.

Re: Dear Jailbreak Community

#14

Post by nwh »

schneidmaster wrote: post #11
elboru wrote: post #9

Earlier quoted context omitted.

> but there are understandable reasons not to open-source exploits Legit question, What reasons could there be?

Yeah, what voltagex said. Same reason you shouldn't open-source a zero day exploit on any website without responsibly disclosing it to the company and giving them a reasonable amount of time to patch it.

They've basically made it open to the world, Apple has worked out closed sourced jailbreaks before with no help. Jailbreaks like Star (jailbreak.me) were just a PDF binary with absolutely no clue as to the contents or method of exploitation.

Re: Dear Jailbreak Community

#15

Post by RRRA »

I'm still baffled as to why someone would want to buy a locked up device and be forced to use frequent / complicated measures to be somewhat freed... I understand if you didn't get a choice at first, but I people realizing they are really stuck in a jail anyway, without any jailbreaks, might do more good than having them. (Though I encourage breaking things! ;)

Re: Dear Jailbreak Community

#16

Post by rolleiflex »

nwh wrote: post #12
rolleiflex wrote: post #6

Malware should be easy enough to detect by MiTMing the device, assuming the baseband is unmodified and cellular is shut down. (edit: no, it doesn't-- shouldn't post before I'm awake) I have just updated my phone and I have no traces of the chinese app store mentioned here, for what it's worth.

No, you can not detect malware working like that. How do you know the data will be sent when you are looking, how do you know what the encoding will be? Maybe it exports your AppleID password by using the unused bit ("evil bit") in IPv4 packets, maybe it encodes your keychain into every screenshot you take, maybe it's using high frequency audio (haha) to send out copies of your photos when you're not looking. Treatin…

Fair point, I didn't think it through very much. Jailbreak is inherently risky and the risk increases as the effort required to achieve becomes unsustainable without financial help.

Re: Dear Jailbreak Community

#17

Post by saurik »

(This is what I said on Twitter in response.)

So, yes: someone approached me with a potential jailbreak; the goal being to get a non-piracy-laden jailbreak out; this does not seem bad...

...in particular, I do not see how it is "backstabbing" @evad3rs (as some claim): it was unlikely to work, and was mostly just "having fun".

Also, I am not part of @evad3rs: they made that very clear to me. They never told me anything about their exploit. Should I not help others?

I guess now the argument is that if people come to me with a potential jailbreak, in order to not "backstab", I am not allowed to help them?

Regardless, I gave the iOS 7 Substrate build to evad3rs on September 30th, and all I needed to test was a new copy of redsn0w (not evasi0n).

I guess I don't understand "we really wanted TaiG's deal, so when we heard a rumor of an open jailbreak we were rushed: shame on saurik". :/

Re: Dear Jailbreak Community

#18

Post by minimalist »

It doesn't seem like there has any response this:

From @Hackl0us: "Taig also uploads users' private data to iphonespirit.com(belongs to Qihoo360 company). @iH8sn0w @pod2g @MuscleNerd @winocm"[0]

Other sources: [1][2]

[0]: https://twitter.com/Hackl0us/status/414835565524422656

[1]: https://twitter.com/JonathanSeals/status/414835993015894020

[2]: http://bbs.weiphone.com/read-htm-tid-7417919.html

Re: Dear Jailbreak Community

#19

Post by ChuckMcM »

I am not sure how to interpret this statement:

"Yes, we have benefitted financially from our work, just as many others in the jailbreak community have, including tweak developers, repo owners, etc. Any jailbreak from us will always be free to the users but we believe we have a right to be compensated in an ethical way, just as any other developer. "

In my world view people do work in exchange for money, there are two sets of people, people who make money through legal means, and people who make money through illegal means. On the border of those two realms are people who walk back and forth over the line between legal and illegal. If you're 'productizing' a jailbreak (nominally legal in some countries, illegal in others) the people you're going to get money from are the folks on the illegal side of the line.

Given that world view you want to be compensated in an 'ethical way' by people who threw ethics out the window? That is what I have trouble with.

Re: Dear Jailbreak Community

#20

Post by Goopplesoft »

saurik wrote: post #17

(This is what I said on Twitter in response.) So, yes: someone approached me with a potential jailbreak; the goal being to get a non-piracy-laden jailbreak out; this does not seem bad... ...in particular, I do not see how it is "backstabbing" @evad3rs (as some claim): it was unlikely to work, and was mostly just "having fun". Also, I am not part of @evad3rs: they made that very clear to me. They never told me anythin…

Did they change the text? What I'm seeing is:

> SaurikIT had been in talks with Chinese companies regarding potential partnerships, made a counteroffer. We believe they share our views on how a relationship with companies in China currently utilizing jailbreaking might benefit everyone in the community. Unfortunately, the negotiations did not work out. A few days later, we received information that SaurikIT was working with another group to release a jailbreak ahead of us. We decided to release, knowing that Cydia, MobileSubstrate, and jailbreak tweaks would be updated after a few days, just as it always has in the course of jailbreaking.

Which seems honest and clear enough (financial incentives and potential loss of the contract motivated the release) without the whole "shame on saurik" thing.

Post reply on HN