Hacker News Reader

Comment by saurik | Hacker News Reader

iMessage runs on desktop Macs and can be easily automated there... in fact, how to do it is so trivial and so commonly known that I just asked ChatGPT how to do it and it told me without balking: it is just a handful of lines of AppleScript, as Apple doesn't even try to make it difficult (and arguably has gone out of their way to support it). I am thereby not sure what mechanism you are contemplating that ties the generation of spam to rooted and/or jailbroken devices?

View on HN

Easily automated does not mean Apple’s servers won’t detect spamming patterns and block that device. If the software is not tied to that device- make up a new identity and keep going. But if it’s tied down with SafetyNet or Apple’s DeviceCheck… that gets expensive. Is it worth buying a Mac Mini if it’s easy to automate but will be blocked in hours?

And what does Apple's servers detecting spamming patterns have to do with rooted/jailbroken devices? iMessage fundamentally is used every day by people who can have as much root as they want on their desktop Mac, and so whatever mechanisms we are talking about that differentiate iMessage from whatever other services can't be cited as an argument to take away freedom to modify your software.

I am not certain, but at a minimum, I suspect that Apple knows a non-rooted device will be incapable of lying about, say, its serial number; whereas a rooted device might make one up and try repeatedly until it finds one that works. The ability to lie about such identifiers makes a device ban impossible to enforce.

And how does that explain Apple not having an issue with you using iMessage on a desktop Mac? Again: we know the anti-spam mechanisms Apple might have in place do not rely on people being unable to root their devices as iMessage runs on desktop Macs (as well as on jailbroken iOS devices, btw, without any need for subterfuge).

Apple simply does not have this restriction that Google is imposing on RCS. Apple's anti-spam comes from a combination of server-side analysis, having a centralized way to enforce bans, and tying accounts to phone numbers, none of which seem to involve banning jailbroken devices as, again: Apple doesn't.

(FWIW, I don't know off the top of my head how Apple ties your iMesaage account to your phone number. I vaguely remember that it involves functionality implemented by the carrier, not just trusting the client, and as RCS definitely has to be supported by the carrier there is no issue deploying such here. Regardless, not only would trusting the client be ridiculously stupid in case it ever got hacked, we can continue to lean into the analysis that Apple does not nor have they ever banned jailbroken iPhones from using iMessage, and so we don't even have to dig deeply: we know their security model doesn't rely on something they don't do.)

Think it sends a confirmation SMS?

Apple has often asserted that software obtained outside their walled garden will do things behind your back on the phone, like using your phone to send spam or collecting your data. I do not agree with this assertion as it implies anyone not playing in their garden is a criminal, but I'd assume these types of behaviors will use that as an excuse.

Apple can't put the genie back in the bottle with macOS, they've been trying though. True root requires a special boot sequence otherwise you really only get pseudo-root. They introduced the AppStore to macOS and it was a huge flop because of how restrictive they made it. Microsoft also tried the same with Windows S on ARM devices and eventually were forced to allow disabling S mode.

Again, I think there is this impression that I agree with any or all of their behaviors. I don't, I'm only reasoning about why and how in some cases it might be one part of a deterrent. Nothing stops me from jumping over a fence, so why put it up to begin with?

We know it isn't part of the deterrent as Apple simply doesn't do this: Apple does not now nor have they ever restricted the use of iMessage on either desktop Macs -- whether their SIP is enabled or not -- nor on jailbroken iPhones. It is thereby nonsensical to look at Google implementing such a restriction and then say it makes sense because Apple manages to keep spam off their platform somehow... we know that is unrelated to how Apple pulls that off as Apple literally doesn't do this thing.

Doing it server side seems like proof that it doesn't matter whether the user's device is rooted.

Allow me to introduce you to the world of the hackentosh...

I can bypass HDCP trivially, but it's still there. I'm not arguing its effectiveness, but maybe it's a just one of many defense in-depth solutions they intend to implement. I'm guessing if they block jailbroken devices that it may include emulated devices as well.

p.s. had to do a double take when I saw your name, been a while since I've done anything jailbreak related with iOS but I really appreciated all the work you did when I did. <3

Reply on news.ycombinator.com