Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple confirms iOS kernel code left unencrypted intentionally

techcrunch.com

Post reply on HN
Print view View original

71–80 of 157 posts

Re: Apple confirms iOS kernel code left unencrypted intentionally

#71

Post by robbiep »

matt4077 wrote: post #65
andyjdavis wrote: post #55

Earlier quoted context omitted.

>A PR person would bristle at the idea of denying to unlock the phone of a terrorist Not if they were any good at their job. Very publicly standing up against what many would see as heavy handed government and being seen to defend the rights of the little guy (who happen to be their customers and potential customers) got them an enormous amount of very positive press not just in the US but in many countries. It would…

It's not easy to decide either way. I recently advised a women's rights organization in a similar matter: they were poised to publish a scathing (and somewhat stupid) indictment of islam with regards to women's rights. It's obviously a minefield, with popular opinion divided almost equally. You have to judge the intensity of emotions it will cause in people, the propensity of people to act on those emotions and the b…

> 'with popular opinion divided almost equally.'

that's interesting. This is a factual statement, or is it opinion?

Re: Apple confirms iOS kernel code left unencrypted intentionally

#72

Post by piyush_soni »

IBM wrote: post #67
piyush_soni wrote: post #61

Earlier quoted context omitted.

I supported Apple's stand against the FBI, but believing it's purely altruistic would be simplistic and optimistic thinking at best. When safety and security are your perceived selling point, it's the best PR you can have. I'm not entirely sure about the validity of this nytimes article [1], but if we believe it, Tim Cook had asked FBI to submit their request 'in private' - but FBI did it openly, so Tim Cook 'had to'…

It's perfectly compatible to comply with the law and still be known for security and privacy and there's no reason Tim Cook "had to" oppose law enforcement. The only people who don't believe this is the HN crowd. This is a fraction of the people who believe Apple was in the wrong for opposing the FBI.

Yes, it's "perfectly compatible", but that also means it's "perfectly normal". And normal is no good when it comes to advertising - that's no PR. How about a company which can fight even with the government for your privacy? Now that will make the users drool.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#73

Post by malka »

Kristine1975 wrote: post #46
headShrinker wrote: post #26

A move like this fits with a more general ideology Apple has been advocating for the last three years. Privacy, security, and ultruism. Tim Cook has put is mark on the company. One of the first things he did was apologize, (for maps) something unheard of in Apple's culture. I haven't drank the cool-aid and Apple has a lot of issues. I do see they however are making attempts at differentiating from the general corpora…

>altruism Then why does Apple avoid paying taxes? Let's not kid ourselves: Apple is a company, and companies are only "altruistic" if they expect that it will help their bottom line.

Apple does not do anything. Apple is not a person. Person do things. In this case, Tim Cook deciding "hey let's start paying a lot more taxes" will probably not be received very well by the shareholders.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#74

Post by Dylan16807 »

evgen wrote: post #70
crypty wrote: post #68

Earlier quoted context omitted.

> encrypting a running kernel in RAM How is that supposed to work? Ok, the CPU can fetch an encrypted instruction, decrypt it and execute it, but when it needs to jump, how is it supposed to know where to jump? Also encrypting each instruction separately and independently would be trivial to reverse. Is there any system that really runs encrypted code from RAM? Any papers describing such a system?

A company that Facebook acquired a couple of years ago (PrivateCore) realized that the L1 cache had grown large enough that you could run a hypervisor out of it. You use a TPM secure boot chain to ensure you are booting the code you need into the hardware you expect, load up the hypervisor and its keys, and then this hypervisor is used to encrypt _everything_. Now you have encrypted RAM, so physical possession of a r…

L1 had grown large enough? What do you mean? L1 was 32KB in the Pentium II days, and for the last ten years of Intel chips it's been an unchanging 64KB. Why would it have to fit into L1 specifically, rather than L2/L3? (If you do use L2/L3, that's also been big enough to spare the space for a hypervisor since the Pentium II, which had 512KB.)

Re: Apple confirms iOS kernel code left unencrypted intentionally

#75

Post by ff10 »

hackuser wrote: post #33
headShrinker wrote: post #26

A move like this fits with a more general ideology Apple has been advocating for the last three years. Privacy, security, and ultruism. Tim Cook has put is mark on the company. One of the first things he did was apologize, (for maps) something unheard of in Apple's culture. I haven't drank the cool-aid and Apple has a lot of issues. I do see they however are making attempts at differentiating from the general corpora…

I don't know enough about their new ethical approach to say whether it's PR, whether it's just a few well-publicized decisions, or whether it's broad-based and substantial. I'm not saying either way; I just don't know. But it could make me a loyal customer much more than cool design and fashionable cache ever would.

Does it really matter if it is PR or not? It doesn't change the result, regardless if it is a good result for you personally or anyone else. I understand that people are looking for reasons to like or dislike a brand because, I believe, most of us see a brand choice as a reflection of (a part) of our personalities – that includes company politics. But in the end we have to assume that Apple does what's best for Apple and that includes advocating for civil rights _as in_ defending one of their main selling points. However, Apple is not your buddy, it might pretend to be here and there, but after all corporations are not people.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#76

Post by adrianN »

Kristine1975 wrote: post #46
headShrinker wrote: post #26

A move like this fits with a more general ideology Apple has been advocating for the last three years. Privacy, security, and ultruism. Tim Cook has put is mark on the company. One of the first things he did was apologize, (for maps) something unheard of in Apple's culture. I haven't drank the cool-aid and Apple has a lot of issues. I do see they however are making attempts at differentiating from the general corpora…

>altruism Then why does Apple avoid paying taxes? Let's not kid ourselves: Apple is a company, and companies are only "altruistic" if they expect that it will help their bottom line.

Billings Learned Hand once said:

> Any one may so arrange his affairs that his taxes shall be as low as possible; he is not bound to choose that pattern which will best pay the Treasury; there is not even a patriotic duty to increase one's taxes.

If we want companies to pay more taxes (which I think we do want) we should change the laws. You can't blame anybody for only paying the legally required amount of taxes.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#77

Post by crypty »

evgen wrote: post #70
crypty wrote: post #68

Earlier quoted context omitted.

> encrypting a running kernel in RAM How is that supposed to work? Ok, the CPU can fetch an encrypted instruction, decrypt it and execute it, but when it needs to jump, how is it supposed to know where to jump? Also encrypting each instruction separately and independently would be trivial to reverse. Is there any system that really runs encrypted code from RAM? Any papers describing such a system?

A company that Facebook acquired a couple of years ago (PrivateCore) realized that the L1 cache had grown large enough that you could run a hypervisor out of it. You use a TPM secure boot chain to ensure you are booting the code you need into the hardware you expect, load up the hypervisor and its keys, and then this hypervisor is used to encrypt _everything_. Now you have encrypted RAM, so physical possession of a r…

What does it do with the encrypted RAM? The only possibility I see is to take an sufficiently large block, decrypt it into the cache an run it there. But then again if you need to jump out of the block how does the CPU know which block to decrypt next?

Re: Apple confirms iOS kernel code left unencrypted intentionally

#78

Post by crypty »

evgen wrote: post #70
crypty wrote: post #68

Earlier quoted context omitted.

> encrypting a running kernel in RAM How is that supposed to work? Ok, the CPU can fetch an encrypted instruction, decrypt it and execute it, but when it needs to jump, how is it supposed to know where to jump? Also encrypting each instruction separately and independently would be trivial to reverse. Is there any system that really runs encrypted code from RAM? Any papers describing such a system?

A company that Facebook acquired a couple of years ago (PrivateCore) realized that the L1 cache had grown large enough that you could run a hypervisor out of it. You use a TPM secure boot chain to ensure you are booting the code you need into the hardware you expect, load up the hypervisor and its keys, and then this hypervisor is used to encrypt _everything_. Now you have encrypted RAM, so physical possession of a r…

What does it do with the encrypted RAM? The only possibility I see is to take an sufficiently large block, decrypt it into the cache an run it there. But then again if you need to jump out of the block how does the CPU know which block to decrypt next?

Re: Apple confirms iOS kernel code left unencrypted intentionally

#79

Post by skc »

headShrinker wrote: post #26

A move like this fits with a more general ideology Apple has been advocating for the last three years. Privacy, security, and ultruism. Tim Cook has put is mark on the company. One of the first things he did was apologize, (for maps) something unheard of in Apple's culture. I haven't drank the cool-aid and Apple has a lot of issues. I do see they however are making attempts at differentiating from the general corpora…

"Privacy, security, and altruism"

Hmm, the cynic in me thinks that they will play up those aspects of their offerings that make hurt their competitors. They sell hardware after all. Google sells "people".

Re: Apple confirms iOS kernel code left unencrypted intentionally

#80

Post by spiderfarmer »

gionn wrote: post #54

“The kernel cache doesn’t contain any user info, and by unencrypting it we’re able to optimize the operating system’s performance without compromising security,” This is probably the only true part of the article, it means that they disabled a kernel feature of cache encryption to speed-up performances. It has nothing to do with source code nor binaries of the kernel.

Does the same count for the watchOS kernel? I mean, the performance enhancements they claim to have realized have to come from somewhere.
Post reply on HN