Apple loses copyright battle against security startup Corellium | Hacker News Reader

Apple loses copyright battle against security startup Corellium

washingtonpost.com

288 pointscomex58 comments

Here is the actual ruling:

https://www.courtlistener.com/docket/16064642/784/apple-inc-...

The judge found that Corellium's use of iOS is fair use, in large part because Corellium's emulator satisfies the "transformative" test and is not a market substitute for normal uses of iOS. Interestingly, he explicitly mentioned Oracle v. Google, where Google's use of Java APIs was considered non-transformative, but distinguished this case from that one.

Note that, like most cases involving novel legal issues, this is all but certain to be appealed by the losing party.

Also, the judge only granted summary judgement on Apple's copyright infringement claim, not their DMCA anticircumvention claim, which he held involved a "genuine dispute of material facts" and thus would have to go to jury trial.

Everyone should also know that Apple tried to buy the company first, but when talks failed, sued them. Typically bullying tactics of corporates.

A surprise, to be sure, but a welcome one. Still have to read the ruling, but it's nice that this seems to have gone well for Corellium–it's such a useful product that it would be undeniably worse for the world if it was forced to shut down.

This is huge. But it's not over yet.

Hope Corellium is ready for Round 2.

What is this supposed to mean? If Apple even tries touching them again, the courts will probably toss out their hearing for fear of double jeopardy. Apple will do the same thing it's always done, which is wince and smile for the camera. Apple might hate emulation of iOS, but they hate controversy even more.

This is just a district court ruling. The case is almost certain to be appealed. (Also, the DMCA claims aren't settled yet.)

Double jeopardy applies to criminal prosecution by the state, not civil matters between non-state entities.

Civil court has a similar thing regarding double jeopardy. It's just not called double jeopardy and doesn't apply to the state. Multiple people CAN sue you. A single person cannot continually attempt to sue you for the same thing every time they lose.

> they hate controversy even more.

Did you come from the Berenstein Bears universe? Apple does unpopular things constantly. The iPhone 12 doesn't come with a charger, and you think they're terrified of controversy?

Apple's MO is to double down on controversy.

I don’t think its to double down on controversy but to not be afraid to make product changes they believe in despite the predictable ensuing controversy.

Right. Apple commits to a direction and rarely changes course, which could be perceived as doubling down on controversy if you happen to think their motives are ill.

I’ve long felt Apple is a Rorschach test. How you feel about the company and its products often says more about your priorities than the company itself.

Honestly, this can often (but not always) be true regarding social or political views, as well. Something about the ego projecting onto the external world.

Could you give an example of an ill motive?

Extracting profit under the guise of environmental activism, which actually ends up causing the opposite effect? I mean, the charger fiasco just happened...

Likewise there are many examples of how Apple works against the public interest.

When Apple stopped supplying chargers, they also dropped the prices on chargers.

That's the kind of thing I mean: soundbite analysis of Apple's policies makes it very easy to cast them as the big baddies.

Also Huawei and Samsung are now doing the same thing with no models -- no chargers.

As with most "controversial" things Apple does, like removing the headphone jack, the other companies then follow suit.

Because Apple is a prime example of a money grab. Once other companies see the profit motive, they too decide to join the bandwagon. It's not like they saw some environmental positive and decided to act.

Do you think other companies suddenly see a profit motive because Apple does something? I think it's an insult to other vendors if you think they can't come up with an idea like "don't include a charger". Obviously everyone has the idea.

You need to understand Apple's position in the market vs. everyone else to know why Apple goes first. Apple's retention is off the charts. If you are Xiaomi, you can't give your user any reason to buy an iPhone or you've lost them forever. It would be suicide for other vendors to take these kinds of ticky tack steps first.

So if the prices dropped, that's supposed to be a good thing for the environment? Tell me exactly how?

> The iPhone 12 doesn't come with a charger

Both Huawei and Samsung are also not shipping chargers in new models (both of which made fun of Apple for not doing so at first).

> If Apple even tries touching them again, the courts will probably toss out their hearing for fear of double jeopardy

Res judicata, actually, as this is civil not criminal.

The article mentions that "Apple initially attempted to acquire Corellium in 2018". Any idea why the deal fell apart?

Either not enough money offered or the authors knew Apple was just buying their company to shut it down.

On the surface, this is an easy case for Apple. Their argument is simple: iOS is not a licensed product like Windows. You can’t run it - virtualized or not - without Apple’s permission. I do think Apple will win the follow up appeal.

For even a billion dollar company (let alone a 2 trillion dollar company), their legal team has had some surprisingly bad failings.

I recall another “cupcake” case they lost a few years ago because they walked into the courtroom without sufficient evidence (despite it being clear the other party was a copyright-infringing troll) and lost the ruling. Once a legal team starts taking things for granted, it’s time to find a new one.

But what about fair use? That's the argument Corellium used.

> iOS is not a licensed product like Windows

Do developers not need to pay $100 a year to write code for it? (for software that will run longer than a couple weeks on a device). To run IOS no, it develop for it, yes?

That’s an interesting way to ask that question. GP claimed that iOS is not a licensed product while your question is about developing for iOS.

While the answer to your question is:

> Membership includes access to beta OS releases, advanced app capabilities, and tools needed to develop, test, and distribute apps and Safari Extensions. You must be 18 years or older to join.

essentially: yes. You need to pay to develop, the core thing is: is does not give an iOS “license”.

These are orthogonal.

yeah its interesting, and that is why I asked it that way to see if people smarter than myself could argue it (either side of the discussion). I find it weird that if I were to buy and apple device, and I wanted to write my own program to use only for myself on it I would have to pay an annual fee to Apple to get permission to run it. I think it does sort of boil down to a semantics argument about what is a license for a device you own or not own? Or if you want to want to sell and distribute something you need to pay an annual fee plus 30% of every sale (or 15% if you do their multi-year subscription magic, Or are large enough like Netflix).

Apple is very hostile towards their customers and developers/business partners.

Imagine if software developers were held to this standard. Time to find another team of developers.

Imagine if consumers held the billion/trillion dollar companies to this standard. Time to find another OS.

Apple's outside counsel do not take anything for granted. Post a link to the "cupcake" case and let's have a look.

iOS is a licensed product. The license only allows iOS to be run on a single "Apple-branded" computer. Here is an earlier version:

https://www.apple.com/legal/sla/docs/ios6.pdf

The license is interesting because all not the bits that make up iOS are written by Apple nor exclusively licensed to Apple; iOS is not 100% proprietary. What rights does Apple actually have that it can license. Some parts of iOS come from BSD projects, some come from other open source third party projects, some parts come from Apple, the later some of which have been open-sourced. The mere fact of a license does not mean Apple will successfully be able to enforce all its terms. Avoiding legal challenges to them is one way to keep licensees guessing as to their enforceability. Wanna bet whether this case settles before trial.

https://opensource.apple.com

> Imagine if software developers were held to this standard. Time to find another team of developers.

> Imagine if consumers held the billion/trillion dollar companies to this standard. Time to find another OS.

What is there to imagine? If you are not satisfied with the relationship, you quit. Why would you torture yourself and not do that?

Absence of choice. Necessity.

Unfortunately I don’t recall the name of the patent troll. Is there a place I can search these cases up?

IIRC, Apple’s evidence amounted to repeatedly shouting “they’re obviously a patent troll” (which they were)

And it seems, that Christopher Wade, the cofounder of Corellium received a full pardon by Pres. Trump last week for cybercrime charges.

https://www.whitehouse.gov/briefings-statements/statement-pr...

What crimes did he commit before? I couldn't find anything on it

> his sentence is under seal, as are the offences under which he is convicted.

It's rather scary that such a thing is possible.

It's common after convictions that judges can seal or expunge charges. It's with the permission of the convicted. The point of a public trial is to protect the defendant, not just so the public is aware generally.

No, public awareness is an explicit goal of the system, and one of the factors that must be considered in a motion to seal legal filings.

I believe the interests of the public are best served with transparency of our justice system. Unless public knowledge would truly pose more harm to the convicted than the sentence itself and stigma that any conceited criminal bears, then it should be public. If sealed under the "additional harm" principal, the public should be provided with at least the broad strokes of that potential harm so that public scrutiny of our justice system is possible. The more such scrutiny is lacking, the more room for abuse.

Is it related to the case against his virtualization solution for iOS?

That's an interesting ruling, but seems overly broad to allow an entirely unlicensed copy simply because there are (apparently extensive) debugging tools incorporated into the emulation. Then again, this sort of debugging it already possible on less locked-down OS's with valid paths to licensing them. I like the end result, but not the means by which this ruling gets there: I'd rather something like compulsory licensing under reasonable terms for certain purposes like this, something along the lines of the system used for compulsory licensing in music.

The whole point of this is that it should be debuggable without any permission from the copyright holder.

I agree, which is why I would rather a legal framework of compulsory licensing. This seems an overly broad interpretation of fair use.

Can’t legislate from the bench. But there already is a subtext here. If one could license iOS for this, what they are doing here probably wouldn’t fall under fair use. Instead it could fall under the terms of Apple’s own license agreement. I’m personally kind of sick of Apple’s shit in the virtualization/emulation/kernel/cloud/hackintosh/thumb-on-developers area though, and I fully realize my bias to applaud this decision regardless of whether or not it is fair or right to Apple or whether Cornelium deserved to win. Seems there is a lot of smoke billowing out of this thing...

Yes, I'd rather see legislation to resolve this issue as well.

A small victory for the little guy.

Isn't the issues that Corellium allows you to side step the passcode brute force lockout? aka...... https://www.aclu.org/news/privacy-technology/the-fbi-is-secr...

Not really, by my understanding. Corellium is effectively providing a hosted virtual machine, presumably running on their own custom hypervisor, with their own management stack to give a convenient user experience.

You "spin up" VM-based instances of emulated devices (i.e. booting an emulator from a filesystem image), and can then research vulnerabilities and explore, and downgrade/upgrade iOS versions rapidly, like you can with VMs. Real devices are fused to prevent downgrades.

Side-stepping brute force lockouts on passcode would be irrelevant, since that's enforced on physical devices via the Secure Enclave - even if you dumped the flash from a real device, you'd not be any further forward as you would need the enclave's contents to derive the correct keys to do anything.

> Real devices are fused to prevent downgrades.

Not quite, to install a version of iOS it must be signed by Apple, and Apple stops signing old versions soon after releasing a new one. Further you need to put the phone in recovery mode to install a lower version because the UI simply won't do it.

You may be thinking of game consoles, which use fuses to prevent downgrades.

Thanks, I was thinking of the server-side AP Token system (i.e. the signed per-device authentication tags that confirm the firmware is up to date and able to be installed), but then ended up describing the Nintendo Switch fuse system.

Indeed, in the past I believe people have used SHSH blobs to successfully downgrade, and also if Apple misconfigured their signing server to approve older versions, people have successfully downgraded during the window created due to the misconfiguration.

Apple's devices have fuses, too, but they ensure that you boot something signed by them.

Actually, it can be used to prevent that from happening in the future through facilitating security research that is not restricted to Apple-approved parties.

It is much more likely that this is based on the secure enclave vulnerability that was found earlier this year and affects devices with a A7 through A11 chip.

I initially thought as such too, but on a previous discussion about this exact issue on hacker news I was linked to this https://securephones.io/main.pdf. Which pretty much says that a lot of your data is just stored unencrypted entirely on the phone, so the FBI is probably just dumping the info without even needing a exploit.

By “little guy”, you mean convicted criminal and recently pardoned friend of President Trump?

https://www.whitehouse.gov/briefings-statements/statement-pr...

I haven't read the ruling, but I'm surprised. Surely iOS is only licensed to run on Apple hardware, and any other usage would involve making an unlicensed copy?

Since the ruling turned on fair use, that the use is unlicensed is a given but also not dispositive, since fair use is an exception to the copyright holders exclusive rights.

The law is not a programming language, no matter what herds of software engineers may like to believe. Every license is subordinate to legislation, statute, rights and obligations, tests of reasonableness and the public interest, jurisprudence etc.

The delusion that one can magically conjure otherwise with a few words and a tickbox, leads straight down the path that Apple followed.

Reply on news.ycombinator.com