Hacker News Reader

Comment by aresant | Hacker News Reader

"At this stage, Apple’s actions to block Beeper Mini look increasingly hard for them to defend."

That is 100% accurate from the technical perspective.

As an iPhone mobile / windows desktop user I would love an interoperable protocol so I could respond to texts from my desktop

But from the business side Apple's decision is totally defensible and clear

The blue bubbles are a luxury item / luxury signal that let's apple differentiate their products

I assume an internal assessment of that "brand" value from blue bubbles is in the many billions of dollars

View on HN

Not really? iMessage isn't a peer-to-peer network. It's dependent on Apple's massive global messaging service. Beeper Mini simply doesn't work without co-opting Apple's servers. Unless you start from the premise that it's okay for one business to siphon off resources from another one without authorization or compensation, then Beeper Mini's solution is technically infeasible.

As far as “siphoning off resources” is concerned, it’s not that different from sending emails to an iCloud Mail address, which also makes use of Apple’s servers. Beeper’s purpose is not for Android users to communicate among themselves, but to communicate with Apple users. It’s only natural that this would involve Apple’s servers, as it does with email.

This is not to say that this entitles anyone to do so without Apple’s consent, but the argument about resource usage is a straw man here, IMO. This is not about who pays for the servers. Even if Beeper would offer Apple an appropriate portion of their revenue (edit: and they actually do in TFA), Apple would not agree. For Apple, this is about keeping the garden wall up.

> As far as “siphoning off resources” is concerned, it’s not that different from sending emails to an iCloud Mail address, which also makes use of Apple’s servers.

Which is the intent of running those email servers. These are the “public-use” servers. The iMessage servers are private.

That’s not how email works. Your email provider maintains servers to send and receive messages on your behalf, and your email client checks in with your provider for messages. iMessage not like email.

Sending an email will connect to Apple’s SMTP server and make use of Apple’s resources that way. (I happen to run my own mail server that does exactly that.) Yes, receiving iMessage messages presumably works differently from receiving email, in that it’s probably pull rather than push, but that doesn’t change the basic argument.

It’s not just that: for email providers, they’re responsible for storing messages that their customer has received. Your server you pay to maintain holds your messages.

On iMessage, all messages are stored on Apple’s servers (at least in-transit), even those that would be destined between two Android users communicating via iMessage.

At least with email it’s a bit easier to filter out spam, but iMessage is also E2E encrypted so automatic spam detection is much harder.

The fundamental difference is that iCloud email is based on a 41 year old plain-text open protocol which was designed to be federated and lacks any real security or E2EE built-in.

It seems that you agree that resource usage isn’t the issue. Which was the point of the analogy.

Agree, but it is a closed service. Hacking for shit-n-giggles is fine. Doing it for security research and bug bounties is also fine. Offering another service (and planning to charge, no less!) that uses that closed service without concent isn't, irresepective of motive or ethics. Ethically, whether you advocate FOSS or not, it is wrong. I'm no Stallman fan, but I admire his ethics here; if it's closed, he won't entertain using a service.

But why do you run your own mail server if you can just use Apple's?

Same reason I don't use Gmail: I don't want all of my emails on a big tech company's servers. I pay for Fastmail.

It’s completely different. Email is a decentralized network. iMessage is centralized. Email servers, like Mastodon, Usenet (RIP), etc. implicitly agree to federate (usually!) with other servers. All iMessage traffic sent or received has to go through an Apple owned iMessage server and propagate through the iMessage network, so every additional iMessage client has a direct cost to Apple that Apple didn't agree to.

The resources are negligible and not worth mentioning. Chat, encrypted or not, is not an expensive service for Apple to run.

There are much better business arguments to make here then "oh no! The 3 trillion dollar company might have slightly more overhead managing text messaging!"

iMessage supports attachments up to 100Mb and groups of 32 participants. It’s certainly more resource intensive than 140 byte SMS.

Sure, but let's not fool ourselves. It isn't exactly a cost center for Apple to run the service nor would it be to scale up usage to include Android users. The cost would be a rounding error to Apple.

From a business perspective, I'm much more sympathetic to arguments that iMessage is a perk Apple wants to keep as incentive for more users to switch to Apple's ecosystem and, likely more important, lack of cross-platform interoperability raises the cost for existing Apple users to transition to Android.

Another way to look at it is that there would always be a fixed cost to operating any global messaging network that would probably be at least a million dollars a year. Piggybacking on Apple's already-built network and focusing only on marginal cost sidesteps the reality that standing up a service that big from scratch is very expensive. Even if iMessage were a decentralized network like email that allows federation, Beeper Mini would be on the hook for a much bigger bill.

.....?

Are you claiming Apple would have to pay fixed costs a second time because new users were added to the already existing service?

And are you claiming that 1 million dollars is a lot of money to Apple, a company worth over three million million dollars?

The unauthorized access is the problem, not the amount of resources used. If you hack into a system and use it "just a little" you've still committed a crime.

Okay? Not sure why you're bringing up a what-if that didn't happen. Beeper Mini didn't hack into Apple's servers.

I was responding to someone who said the extra overhead for running a chat service that has more people use it would be notable for Apple. A business argument - not a legal one.

This hacking is more DMCA than CFAA

This is the one and only argument needed. Everything else can be met with some degree of philosophical discussion and back-and-forth. The bottom line is that Apple didn’t invite them to use their (Apple’s) resources.

The article literally responds to this...they said if Apple wants reasonable (key word, reasonable) compensation for the resources used, they're more than willing to pay that.

Apple could simply sell iMessage. They don't because iMessage is not a product, it's a stealth marketing tool and a wildly successful one.

So no 3rd party client software unless the company running the service gives explicit permission?

No 3rd party batteries in devices or 3rd party ink cartridges either

It generally doesn't cost e.g. the printer manufacturer anything when you use a 3rd party cartidge. This is separate from the value/loss described above. I still think once you reach a certain size there need to be some interop requirements though but I can also see why many would say these points are unrelated to iMessage.

> So no 3rd party client software unless the company running the service gives explicit permission?

That's about the strength of it. Unless the protocol is open, paid or otherwise. iMessage is closed and undocumented.

Beeper says in the article that they'd be willing to pay Apple for use of their resources.

If I broke into your house and started sleeping on your couch, would you be OK with it as long as I promised to pay you rent?

If my house was the size of twelve Tesla Gigafactorys stacked on top of each other, every other door was locked, I could track your movements throughout the house, you had your own private door and couch to sleep on, and I was worth 3 trillion dollars, sure.

Apple is running a hotel, not a house

Even if we accept the terrible metaphor it would be a hotel solely for Apple users

Beeper says that, but they probably don't have the amount of money that Apple thinks is worth using their services.

I'm willing to buy all of your property for $1, but that doesn't give me the right to come use it all, just because in theory there is a price I would pay to have it all.

what do you mean co-opting? Unless you're referring to beeper mini to beeper mini communications, sure, but the majority of the comms are going to Apple users.

On a messaging network, work must be done to both send and to receive messages. For Beeper Mini to iPhone communication, cost is added to the network, but only one of the devices has paid for the privilege of using it. At best you could argue that Beeper Mini only steals half of the resources needed to communicate with iPhone users.

The ability to differentiate blue and green bubbles isn't inextricably tied to keeping iMessage closed. Apple could allow iMessage to interoperate and still only allow apple users to have blue bubbles. But they choose not to. Requiring an iPhone for a blue bubble is reasonable. Forcing everyone to use insecure chat just because one of them isn't an Apple customer isn't.

Blue vs green bubble isn't about iPhone vs Android - It's about iMessagevs not-iMessage. If Apple did have an Android client with feature parity, I would strongly imagine that would show up as blue bubbles.

> But from the business side Apple's decision is totally defensible and clear

Sure, many atrocious acts are fantastic business decisions. Slavery? Great for business. Massive ROI. Incredibly evil.

> As an iPhone mobile / windows desktop user I would love an interoperable protocol so I could respond to texts from my desktop

You have MANY of them. SMS/MMS and Matrix spring to mind immediately. Mastodon qualifies. You can use RCS today if your carrier has an app like Verizon's Message+. If you want to go all retro, IRC.

That's ignoring the productized implementations all over the place - Signal, WhatsApp, Telegram, Messenger, Slack, Discord, and so on. MSN and ICQ are still running.

100% accurate elsewhere.

Who is auditing Beeper's code for security issues? How big is their security team and their response SLA? How are they encrypting messages at rest? How much money are they prepared to spend on attorneys to defend these stances against various governments? What can their servers see, what do those servers retain? etc etc

Apple makes commitments about encryption and security, shown in-app via message colors, that Beeper has no right to subvert.

> Apple makes commitments about encryption and security

Those commitments are only as strong as the recipient's control of their Apple ID credentials. It should be up to them whether they want to entrust a third-party (whether Beeper, or someone with an actual Apple device) with their messages.

Nonsense. They're making that decision, without consent or notification, for everyone else in that conversation.

But they don't need Beeper to make that decision. They can just as well leak screenshots of the conversation, backup their phone to iCloud (which breaks E2E unless Advanced Data Protection is enabled) or a compromised computer, or just leak their Apple ID credentials which would allow any attacker to take over their iMessage account (using a real device) and download their backups, or run an outdated iOS version with known vulnerabilities or jailbreak and install a malicious tweak.

I don't see how Beeper makes that any worse - I've listed a myriad of ways a user can choose to compromise the security of any iMessages sent to them. These ways have been known for decades and Apple hasn't done anything (they could lock-out outdated and jailbreakable iOS versions).

Those are exceptions. Being able to take a screenshot simply isn't in any way comparable to silently transiting every single message through a service, with unknown management and unaudited security, with < 50 employees, and that doesn't even appear to employ a single security engineer per my skim of their linkedin page.

Being careless with your Apple ID credentials, having malware on your outdated iOS device or the computer you sync your iPhone to (note: they can sync wirelessly and in the background now, so it doesn't have to be an explicit action) can result in the same outcome - your messages silently going to an attacker.

Either way, it should be up to the user to decide what they want to do with their messages and how much security they attach to them. After all, even in case of a fully bulletproof solution that would even prevent screenshots, the user is still free to read their messages out loud in a public place or in reach of a recording device.

Also, again, Beeper Mini (different from Beeper Cloud, which is not E2E compatible) operates entirely on-device - no message data transits through Beeper's infrastructure. There's an optional cloud component to enable real-time push notifications but even in that case I believe their server merely relays data and doesn't have the decryption keys.

> Either way, it should be up to the user to decide what they want to do with their messages and how much security they attach to them.

So you agree, it's wildly unethical to use Beeper because it doesn't give all the users in the convo the right to choose the security of their messages.

It's only as unethical as someone not running the latest iOS version, not having a strong passcode on their device and a strong Apple ID password and observing proper security practices on their main computer to ensure it isn't compromised either.

Whether you consider that unethical is up to you. Most people don't know or care and everything works out anyway.

> The blue bubbles are a luxury item / luxury signal that let's apple differentiate their products

It's also an abuse of their market position to discriminate against the competition, and they have done so very successfully.

There are far more subtle, less othering ways to indicate a participant in a conversation isn't capable of the same functionality as others.

It’s not an abuse any more than Google doing the same damn thing with Google messenger! Your phone number is registered there too by the way.

Google is pushing RCS only because they are completely incapable of making their own protocol and lord you know they have tried (gchat, hangouts, allo, and now messenger)

And by the way, RCS is entirely carrier dependent. It’s awful. I wish my friends could also use iMessage but Apple is well within their rights to stop people from using their network against their terms of service.

It's more abuse because of a) the market position and b) the extent of the othering.

> so I could respond to texts from my desktop

You can. I've been using Beeper Cloud for a year on a Windows desktop. It's fantastic. I also use WhatsApp in that same application.

Before that I had all sorts of workarounds that mostly worked. Like having a Mac VM running in the background with an AirMessage server and then using their web client to access messaging from Windows. Beeper Cloud removed all this nonsense from my life.

Reply on news.ycombinator.com