Hacker News Reader

Comment by bitwize | Hacker News Reader

Again, read this Mastodon thread by Hector Martin, who forgot more than most right-to-repair advocates know about how Apple devices work internally, about this issue:

https://social.treehouse.systems/@marcan/110803356645502548

Unlike every other laptop vendor, Apple actually gives a shit about the security of their systems, and does much, much more to harden a MacBook against firmware-level exploits than anyone else in the industry. That includes moving the controller, firmware, and configuration/calibration data on-die to the M2 and having signed, verified firmware.

Apple is simply built different as a company, and their concern for security and integrity of your personal data is simply UNMATCHED in the industry.

View on HN

Apple is well aware that the average user does not need that level of hardening, while also being aware that it gives them easy cover for unethical practices when it comes to repairing their hardware.

It's the "think of the children" equivalent for making things repairable.

I know right? they should do what other manufacturers do: sell insecure hardware to consumers, and charge 10x extra for bolted-on-later security for people who "need it".

After all, there's never been articles about exploiting consumer devices through firmware and driver flaws, right? Nor have there ever been attacks caused by plugging in peripherals.

You can either have secure hardware, or tamperable hardware, you can't have both.

Security, for the average person, is not all or nothing, unless you're suggesting that every Apple user also automatically gains perfect password management practices and all software running on it becomes unexploitable.

It's funny how Apple must not be criticized for its unethical practices, its hardware is secure while other devices are insecure, all over highly targeted exploit vectors that do not apply to the vast majority of Apple users, while all the low-hanging, wide impact exploits remain just as open. Just another part of Apple's 'reality distortion field' - lock down the hardware, thwart repair efforts, tell people it's for their own good and you get people acting like Apple devices are secure from the threats which matter most.

i'd argue that everyone's device should be secure against nation-state-level actors, so that those who actually need it won't stand out from the crowd at all

What is the basis of your claim that users don't need secure devices?

My claim isn't that users don't need secure devices, but rather that there's always a balance between security and other factors (such as repairability), such that locking all parts of a device to it does not make sense for the average user. Hacking someone by replacing a part of their computer/phone with one modified to be malicious is a very target-specific attack.

In comparison, on so-called 'secure' Apple devices, all the usual holes are still open for traditional approaches like vulnerable software, poor password practices etc. These are the approaches that have the widest impact and are the most meaningful to deal with when it comes to security for a broad audience.

As such, it's ridiculous to be suggesting that the security Apple devices add by being unrepairable is reasonable.

In my opinion, it's kind of like how we could force everyone in the world to have a yubikey or other similar separate device for 2FA, with no backups and no recovery methods to eliminate any risk of someone unauthorized gaining access to any data. But that would be way overkill for most people and would make computers much less valuable to them due to all the added hassle. I see Apple's locking down of all parts of the device to prevent repairs the same way.

so google provides a calibration software for the pixel fingerprint sensor, I've read of no security vulnerabilities with the sensor though and yet apple is not able to provide a screen calibration software because.... security

someone is trying to use 1 excuse for mulitple wrongdoings and sorry but it doesn't work

Agreed with Hector, there’s so many bad-faith or misinformed opinions around this.

They should probably be obligated to provide calibration tools. However, the risk of providing those freely is that it increases the street value for stolen devices. The fact that a stolen iPhone can’t be erased and sold is a feature many people care about. Conveniently it also helps Apple’s bottom line. Someone needs to come up with a system to allow sustainable reuse without encouraging theft.

Reply on news.ycombinator.com