Apple Security Research Device Program

https://developer.apple.com/programs/security-research-device/

by dewey • 6 years ago

330 186 6 years ago

developer.apple.com

Looks fairly cool, but I'll bet it isn't that popular with security boffins. I would be cautious about something that might not actually reflect a current "in the wild" device.

For example, if the OS isn't quite at the same level as the release OS, it could be an issue.

That said, this is not my field, and I am not qualified to offer much more than the vague speculation, above.

saagarjha47• 6 years ago

I would expect it to be exactly the same except that you can debug it, basically. iPhones have a special fuse in them that prevents that from being done on production hardware, and these will presumably have that "unblown". If you want to test on production hardware you always can, this just lets you do research (a metaphor might be that this is "a debug build with symbols, normal iPhones are a "release build".)

natvert• 6 years ago

This is huge. Not as a security device, but if this were the normal permission model on all iPhones (e.g. owners of devices get root on the devices they own... like a normal general purpose computing device) I could ditch my android and my mac and use an iPhone for everything.

I'm not saying this will ever happen, but in my mind this paints a bright picture of what the iPhone could be.

It's also a bit sobering as I'm quite concerned Apple is actually pushing the other direction in their shift from Intel to ARM.

yalogin• 6 years ago

I dont get the allure of this. As someone working in security, the phone is an extremely leaky thing and very bad for privacy to begin with. On top of that you want to remove all restrictions and make it a security nightmare too? I get that you want to install what you like. Sure, but I don't think the convenience is worth the security trade off.

Honestly the mac or desktop is where I enjoy the openness and do stuff I want to do. I would want to leave the phone untouched and as secure as possible.

I would like to hear your and others' take on it though.

saagarjha47• 6 years ago

As someone working in security, the phone is an extremely leaky thing and very bad for privacy to begin with. On top of that you want to remove all restrictions and make it a security nightmare too?

One major issue is that Apple's security model is "we don't trust you". And by that I mean everything works from their root of trust; not yours. This isn't the usual "I think Apple is backdooring my iPhone, FWIW", what I'm really saying is that I want the ability to elevate some of my software to the same permissions that Apple gives theirs. There is no reason that I should not be able to vet my own code and add it to the "trust cache". So this isn't just "every app should run without a sandbox", but it should be "I think GDB that I personally should be able to attach to other apps, but nothing else".

legulere• 6 years ago

As someone working in security, the phone is an extremely leaky thing and very bad for privacy to begin with.

Compared with a computer where every program can steal all your data?

dfischer• 6 years ago

How is android any better? Anecdotally I’ve seen more compromised android devices than iPhones. It appears to me Apple has defaults, at least now, that protect the privacy of the user. Additionally the ecosystem is less littered with apps that can take over the whole OS. My mother’s phone is always getting compromised by malware or apps that inject ads.

userbinator• 6 years ago

I'd rather live with the risk and enjoy the freedom than give in to the authoritarian corporations whose main goal is to achieve complete control over their users, and advertise it under the guise of security.

Personally, I find it a bit sad and disturbing that people will so willingly and eagerly help --- even for free --- these companies put tighter nooses around themselves and others' necks.

(I'm not "Stallmanist", in that I'm not necessarily advocating open-source; but I am a strong proponent of being able to control what one's computing devices runs, regardless of source availability or even legality. In that sense, what Apple does with its walled gardens is really a strong DRM.)

saagarjha47• 6 years ago

I see it as the opposite: these iPhones are rented to you, and are clearly not what they want to "sell" to people. It's certainly a huge surprise that this exists at all, and I would certainly like more moves in the direction that you mentioned, but I am not sure that this is it.

Wowfunhappy9• 6 years ago

Nitpick—I wouldn't say it's a huge surprise, since they said last year they planned to do this.

I was actually wondering what was taking so long.

jacobkania• 6 years ago

Curious what you mean by “pushing the other direction.” I would say the opposite — it seems like everything running on ARM is exactly what it would take for your phone to run desktop programs.

I think there are other downsides to switching off of x86, but I think it strengthens the case for having one small portable computer to do everything. The question is if that device will allow real work like macOS, or if it’ll be stuck as a fancy consumer-only device..

cookiengineer• 6 years ago

like a normal general purpose computing device

Maybe just go for a PinePhone instead? [1] I mean, Linux GUIs aren't fully mobile and touchscreen friendly yet, but it's getting there real quick. I mean, they started in November 2019.

In my opinion the PinePhone is the most promising device, as all upstream projects use it as an official developer device and upstream linux has integrated support.

[1] https://wiki.pine64.org/index.php/PinePhone_Software_Release...

dcow• 6 years ago

Don't get your hopes up. This is not what you think it is, sadly.

ebg132• 6 years ago

This involves an interesting set of assumptions about the plausibility of deep-cover hacking operations.

If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple

But let's say you pass their review, get a device, find a vulnerability, and don't report it. Then what? You're breaching the contract, but they have no way to know that, so there's no consequence?

saagarjha47• 6 years ago

I would expect that if you put up jailbreakmeios14.com and they find you have one of these devices, they will remove you from the program.

ebg132• 6 years ago

Yes, but most exploits are deployed in secret by malicious groups trying to hack your shit and steal your money/identity/whatever, not publicized on consumer-facing websites with your name attached.

saagarjha47• 6 years ago

I want to apply (not that I am sure that Apple would consider me a security researcher) but am unsure to what extend they're going to go with

If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party.

I mean, if I find a bug I might report it, but I know people who work on jailbreaks and stuff–if they tell me something will I have to promptly report it? What if I find something on a non-SRD device? If I ever hypothetically "write a jailbreak", will Apple come after me even if I say I didn't use that device for it? I can get 90% of the benefit from using a device with a bootroom exploit, with none of the restrictions here…

jentist_retol2• 6 years ago

if they tell me something will I have to promptly report it

according to the terms no, unless you use the SRD to verify the information or vulnerability

If I ever hypothetically "write a jailbreak", will Apple come after me even if I say I didn't use that device for it

I imagine that if you sold a jailbreak for $$$$ that Apple would probably take a close look at the telemetry the device is sending. If you're confident in your ability to terminate all telemetry, and keep good opsec, and defend yourself in court, then maybe that avenue would be feasible. It certainly wouldn't be ethical.

saagarjha47• 6 years ago

You're taking this question the wrong way: my scenario isn't "I want to trick Apple", it's "will Apple believe me even if I am being honest" and "even if Apple thinks I am being honest will they hold it over my head anyways as a way to control what I disclose".

phnofive2• 6 years ago

I’m not a lawyer nor your lawyer, but I read that to mean any vulnerability you discover as a result of your research using the SRD, not any vulnerability you otherwise discover or of which you have knowledge.

saagarjha47• 6 years ago

Right, but is Apple going to believe me when I say that I didn't? They could just revoke my access anyways. (I'm being honest here, this isn't a question of "can I trick Apple into thinking I didn't do this on the SRD".)

saurik9• 6 years ago

Anyone who wants to should be able to buy such a device, as it isn't like any of the machine code you are getting elevated access to is even secret (you can download, from Apple, unencrypted copies of the entire operating system). (You can try to make an argument that this is about keeping you from getting access to third-party encrypted assets to prevent some aspect of piracy in the App Store, but this doesn't accomplish that either as you need only have a single supported jailbroken device for that to be easy, and the world already has millions of those and you can't really prevent them as the act of fixing bugs discloses the bug for the older firmware.)

The real problem here is that Apple is so ridiculously controlling with respect to who is allowed to develop software (in Apple's perfect world, all software development would require an Apple license and all software would require Apple review)--in a legal area that isn't really conducive to that (see Sega v. Accolade, which was important enough to later ensure permanent exemptions on reverse engineering and even jailbreaking for software interoperability purposes in the original DMCA anti-tampering laws)--that they are even working right now on suing Corellium, a company which makes an iPhone emulator (which again, has strong legal precedent), in order to prevent anyone but a handful of highly controlled people from being able to debug their platform.

Apple just has such a history of being anti-security researcher--banning people like Charlie Miller from the App Store for showing faults in their review process, pulling the vulnerability detection app from Stefan Esser, slandering Google Project Zero, denying the iPhone 11 location tracking until proven wrong, requiring people in their bug bounty program to be willing to irresponsibly hold bugs indefinitely so Apple can fix things only at their leisure, and using the DMCA to try to squelch research via takedowns--that this ends up feeling like yet another flat gesture: they should have done much more than this device at least a decade ago. I'd say Apple is in store for a pretty big fall if anyone ever manages to get a bankroll large enough to actually fight them in court for any protracted length of time :/.

saagarjha47• 6 years ago

Not only a flat gesture, I think this by this they are actively gunning for companies like Corellium and will have a huge amount of control over security researchers who join the program. Disclose your bugs to us on our terms or have your access yanked? Pretty yikes. (And this is completely ignoring the rest of your comment, because it's pretty clear that they don't want consumers with debuggable iPhones.)

tptacek10• 6 years ago

We don't have to speculate about this; Apple is actively gunning for Corellium. Your best tip-off to that was them suing Corellium.

markstos• 6 years ago

Consider Android is open source and people have been able to get root access on devices since the beginning.

Still, it seems for overall security to have this program exist then not have a program at all.

saurik9• 6 years ago

To be fair (as a problem we have is that there is a small oligopoly of players and they all mostly suck), the original Android G1 was a locked down device: to get root on it required you to buy the Android ADP1 (which cost a lot more and had serious limitations with respect to apps from the Market); we only got root on it due to a bug (so the same as with iOS... it was just a dumber bug ;P). But yeah: Android wouldn't be usefully open source to anyone if you couldn't at least build your own device to test and run it on, and they clearly support that and they even provide emulators (and, thankfully, more recent, first-party Google devices are nice and open: Google learned their lesson there pretty quickly).

oneplane2• 6 years ago

The 'android' that you get from your phone vendor definitely isn't open source. The AOSP project is and the distro from your vendor will have parts of it that can be traced back to the source.

But the android ecosystem as a whole is not 'open source' and not 'open' like people like you tell about. Almost all access is due to hacks and bugs, not because the boot loader and the OS came with the option for user access on the inside.

grishka• 6 years ago

And the method by which you get root, which involves unlocking the bootloader and using a custom recovery to flash the su binary and an app to manage it, is in itself enough of a deterrent that only people who know exactly what they're doing do it. It's impossible to root accidentally, you have to install adb/fastboot on your computer and follow instructions. And then every time it boots there'll be a warning that the system has been modified.

Google though... I really hate their stance with SafetyNet. It's as if they're trying to say "your device can either be fully useful or fully under your control, but not both".

I still don't get why iPhones absolutely can't have unlockable bootloaders.

Despegar5• 6 years ago

that they are even working right now on suing Corellium, a company which makes an iPhone emulator (which again, has strong legal precedent), in order to prevent anyone but a handful of highly controlled people from being able to debug their platform.

Anyone can debug their platform, as they have been. You just need to be approved for this specific program.

Apple's case against Corellium is about intellectual property, and it's frankly going to be a slam dunk in court. There's already established precedent with Apple v. Psystar with an almost identical set of facts.

saagarjha47• 6 years ago

Anyone can debug their platform, as they have been.

Apple would not like “anyone” debugging their platform. The fact that people have jumped through hoops to do so is considered a bug and something that they actively try to prevent.

Wowfunhappy9• 6 years ago

You just need to be approved for this specific program.

Since not just anyone can be approved, I don't think I"d consider that "anyone".

I mean, I guess technically "anyone" can learn to become a security researcher and spend years building up a "proven track record of success in finding security issues on Apple platforms, or other modern operating systems and platforms", but that's not generally how I think of the term "anyone". ;)

ladberg4• 6 years ago

If anyone could buy this device, then tons of scammers would buy them, install malware, and sell them to people as normal phones. They could then control banking apps and whatever else they wanted.

except• 6 years ago

I doubt they would cost the same as regular iPhones.

derefr• 6 years ago

Most such devices (e.g. "development kit" devices for game consoles) look very different than the release product. Usually in such a way that it'd be impractical to use them casually for your personal needs.

In other cases, e.g. Android/Chromebooks, there's a common, immutable early chain-of-trust that stays the same between production and development devices (or in this case, between rooted and unrooted devices); which pops up a message during boot warning that a device is currently a development/rooted device, and therefore should not be trusted for production use-cases. It could just-as-well also say "DO NOT BUY THIS PHONE ON THE SECONDARY MARKET; IT HAS BEEN TAMPERED WITH, AND CANNOT BE TRUSTED WITHOUT FACTORY RE-VERIFICATION" — and then users told repeatedly in the company's messaging to look for messages at boot before buying.

devwastaken• 6 years ago

If only open source software licenses could have predicted the level of vertical integration control their software would be used in. Apple continually violates the good will of developers and puts forth their own bad will. I'm tempted to make up an 'MIT minus non-free platforms' agreement. If the OS can't be completely emulated and freeley installed without restriction, then you can't use the library.

I'd like to see Apple survive having to recreate half their software from scratch.

saagarjha47• 6 years ago

Sounds like you might want GPL?

exikyut• 6 years ago

They made APFS in (probably?) less than ten years :(

The license structure you suggest sounds kind of interesting.

rimliu2• 6 years ago

Go ahead. See how nobody uses your library.

rkagerer• 6 years ago

The move is in line with their reputation. Handing out a bunch of research devices which come with a catch is a great way to exert more control and influence over vulnerability reporting, and skew the bargaining power when it comes to disclosure. I expect the motivation is largely genuine to encourage security research that bolsters their platform, but also stems in part from an increasing fear of PR ramifications outside their control.

"I'm handing out a bunch of water bottles; sign up here. The contents remain my property so when you're done please urinate back into them and return to me on demand."

saagarjha47• 6 years ago

Honestly had to think about whether your offer was a good deal.

jimbob45• 6 years ago

In fairness, no one is really developing for the .NET ecosystem without VS licenses either. I’m sure it’s theoretically possible but MS de facto runs the same scam.

guidovranken2• 6 years ago

If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party. If you didn’t use the SRD for any aspect of your work with a vulnerability, Apple strongly encourages (and rewards, through the Apple Security Bounty) that you report the vulnerability, but you are not required to do so.

So vulnerabilities found through this program are not eligible for any reward. Then what would be the incentive to enroll (and accepting liabilities like losing the device, Apple suspecting you of breach of contract etc)? Just bragging rights?

saagarjha47• 6 years ago

I think that is supposed to be read as "you must report any vulnerabilities, which will be treated as any vulnerability you chose to voluntarily submit".

guidovranken2• 6 years ago

You are correct because they have now added a bullet point:

Vulnerabilities found with an SRD are automatically considered for reward through the Apple Security Bounty.

jedieaston3• 6 years ago

I wonder how much people are able to publish about the device. I'd expect not much, but it'd be nice to be able to compare a iPhone that was completely unlocked (at least, to whatever that means for Apple) with whatever security they put on the ARM Macs which are supposed to be "open for hobbyists". I'd expect that the ARM Macs have much of the same security stack (by default) that iOS devices have given what they said in the WWDC talks, but maybe that's not the case.

Also, if you found an exploit on a research iPhone because you made use of entitlements that were Apple-only, I wonder if that'd be worth anything bounty wise. Nobody can/should be able to write an that'll get through App Store checks if they asked for PLZ_NO_SANDBOX_ILL_BE_GOOD or something (at least, that's what I thought before the whole Snapchat system call thing happened). But hypothetically the App Store review process is vulnerable to a bad actor inside Apple pushing an update to a big app that included malware, so I'd think that private entitlements shouldn't be available at all to binaries that didn't ship with the device/in a system update (unless some kind of hobbyist flag was flipped by the consumer). So I'd say that would be worth something, even if smaller than a more interesting exploit.

saagarjha47• 6 years ago

We’ll see how the shipping ARM Macs are “fused” when they come out, but my guess is that they will be more locked down than these devices: their OS will be more permissive but you will not have meaningful kernel debugging.

Nobody can/should be able to write an that'll get through App Store checks if they asked for PLZ_NO_SANDBOX_ILL_BE_GOOD or something (at least, that's what I thought before the whole Snapchat system call thing happened).

Snapchat (on iOS at least) is still subject to the app sandbox, no app has on iOS has been granted an exception there to my knowledge. On macOS there are apps that are “grandfathered in” to not require the sandbox on the App Store, but new apps are supposed to have it. Due to the way the dynamic linker works, until recently it was possible to upload an app that could bypass the sandbox, but Apple has said they have fixed this. Some apps do have an exception to this as well, as the broad way they fixed one of the issues broke legitimate functionality in library loading. You can find those hardcoded in AMFI.kext, theoretically they could turn off the sandbox for themselves if they wanted.

mrpippy• 6 years ago

you will not have meaningful kernel debugging

Given that kext development is still supported (although highly discouraged), won’t they have to support the same level of kernel debugging as usual?

On macOS there are apps that are “grandfathered in” to not require the sandbox on the App Store

Can you name any of these apps? Apple’s own apps don’t have to be sandboxed (like Xcode or macOS installers), but I don’t know of anything else that gets an exception. Some apps like Office get special “holes” out of the sandbox (in the form of additional SBPL), but fundamentally they’re still sandboxed.

GekkePrutser5• 6 years ago

We’ll see how the shipping ARM Macs are “fused” when they come out, but my guess is that they will be more locked down than these devices: their OS will be more permissive but you will not have meaningful kernel debugging.

My big worry is them dropping terminal access altogether like on iOS. That would really make the platform useless to me.

However I don't think they would do this at this point. There's many user groups (like cloud developers) specifically favouring Mac because of the strong terminal access.

xenadu02• 6 years ago

The KDK has instructions for loading your own kernel extensions on Apple Silicon. This includes making a new writable root snapshot, modifying it, then blessing it for boot. It also includes kernel debugging.

Booting custom kernels is not supported at the moment but as has been noted "the Mac remains the Mac" and booting a custom kernel is allowed on the Mac.

And of course you can disable SIP.

Developer and hobbyist scenarios are an explicitly supported workflow on the Mac. Default security policies need to be the right thing for the vast majority of users but that doesn't mean anyone wants to take away your ability to do all kinds of interesting things to the system.

bluesign• 6 years ago

But hypothetically the App Store review process is vulnerable to a bad actor inside Apple pushing an update to a big app that included malware.

I don’t think this is technically possible.

keyme• 6 years ago

From experience, I'll suggest all serious security researchers to never, ever, sign any agreement with the company whose products they are researching.

This particular case is also outrageous for other reasons:

1) They are only doing this now because Corellium has been selling virtually the same thing for a while already.

2) They are doing this to try and hurt Corellium financially, while they're already suing them in parallel.

3) Agreeing to their terms here, effectively makes you a glorified Apple QA engineer. Only you don't get a salary, but rather, a bounty for whenever you find a bug. For most people that would be way, way less money than just being employed wherever.

ballenf• 6 years ago

Kind of humorous to imagine a researcher suing apple under the anti-gig California law. Would be a factual question of whether the researcher has sufficient control over their work under the agreement.

Apple would almost certainly win the suit, but I think there's reasonable odds the suit would survive an early motion to dismiss before factual discovery.

ghshephard• 6 years ago

I read the terms of the SRD [1] to suggest if you get one, and use it, you aren't eligible for bounties on any bugs you find while using it. So, you are an entirely unpaid Apple QA engineer. Knowledge is its own reward I guess.

[1] "If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party. If you didn’t use the SRD for any aspect of your work with a vulnerability, Apple strongly encourages (and rewards, through the Apple Security Bounty) that you report the vulnerability, but you are not required to do so."

xondono5• 6 years ago

It doesn’t suggest that you aren’t eligible for bounties, but rather that you are not allowed to not disclose a vulnerability.

vngzs• 6 years ago

The (and rewards) bit isn't saying that SRD users are ineligible for rewards! Rather, it's trying to encourage non-SRD users to report vulnerabilities they find. If Apple explicitly stated that SRD users are ineligible for bounties, I'd be pretty confident Apple has lost their minds, as the SRD devices would be completely worthless to vulnerability researchers - only serving to contractually restrict them, and offering no practical benefit.

To show that "you aren't eligible for bounties on any bugs you find while using it" is false, let's break Apple's quote into two separate statements, and only consider things that are explicitly stated in them.

First:

If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party.

If you use SRD in the process of discovering a vulnerability, you have to disclose it to the software authors. Got it.

Second:

If you didn’t use the SRD for any aspect of your work with a vulnerability, Apple strongly encourages (and rewards, through the Apple Security Bounty) that you report the vulnerability, but you are not required to do so."

If you don't use SRD, Apple strongly encourages you to report the vulnerability. But they have no way to force it.

I understand how a casual interpretation of those quotes could be seen to imply that SRD excludes you from bounties, but that's not what Apple is saying.

avianlyric• 6 years ago

Read a little further, the last bullet says

Vulnerabilities found with an SRD are automatically considered for reward through the Apple Security Bounty.

I would say that pretty explicit about being eligible for bounties.

tptacek10• 6 years ago

To whatever extent these devices are distributed, my guess is that they land predominantly in the hands of consultancies and security product firms, where the bulk of bread-and-butter security research is done. Those firms will all have their legal vet the actual contract (which this page is not).

And, of course, that's the case with Corellium as well; it's not like Hopper or Binja, a tool that random people just buy to kick the tires on. The front page of Corellium's site is a "contact sales" mailto; the term of art we use for that pricing plan is "if you have to ask...".

donarb2• 6 years ago

They are only doing this now because ...

Apple announced these devices last year at Black Hat.

saagarjha47• 6 years ago

Right before they promptly sued Corellium.

shantara2• 6 years ago

If you report a vulnerability affecting Apple products, Apple will provide you with a publication date... Until the publication date, you cannot discuss the vulnerability with others.

In addition to the mandatory bug reporting, Apple reserve a right to dictate the researchers a mandatory publication date. No more 90/180 days responsible disclosure deadline policy. I highly doubt any serious researcher would agree to work with such conditions.

saagarjha47• 6 years ago

Would be interesting to see if Google Project Zero joins the program, given their inflexibility in disclosure.

shantara2• 6 years ago

That's what I've been thinking about as well. I'm leaning towards "no", but let's wait and see.

bobviolier• 6 years ago

Looks like they won't https://twitter.com/benhawkes/status/1286021329246801921?s=1...

hendersoon2• 6 years ago

I agree this is theater; no serious whitehat researcher would sign a deal forcing them to accept dates from the manufacturer. It won't be useful for its intended purpose.

On the bright side, it will be very useful for jailbreak research and in a way, those bugs _do_ get disclosed to Apple for them to subsequently fix. Not necessarily the way Apple wants, but it does shine daylight on their code.

These guys keep working exploits close to their hearts and don't release them specifically so they can get a look at new hardware. That will no longer be necessary. You find an exploit, you can release it right away.

And on the gripping hand, it will also be used by malicious criminals and state actors to develop zero days for various evil purposes.

saagarjha47• 6 years ago

On the bright side, it will be very useful for jailbreak research and in a way, those bugs _do_ get disclosed to Apple for them to subsequently fix.

It’s useless for jailbreak research because Apple will force you to shut up about it at least until they patch it, so now you can’t jailbreak.

GekkePrutser5• 6 years ago

That is if people obey the NDA of course. I'm sure not everyone will do so.

However finding a bug, reporting it and then 'suddenly' a jailbreak appearing that would use it, would be highly suspicious indeed. So they'd probably have to give up the chance of getting the bug bounty.

PS: I'm certainly not signing that NDA myself :)

dpifke• 6 years ago

Has anyone here ever been paid a bounty for a vulnerability reported to Apple?

GekkePrutser5• 6 years ago

Yes it does happen: https://gizmodo.com/apple-pays-developer-100-000-for-finding...

saagarjha47• 6 years ago

Any for kernel bugs?

mattmar96• 6 years ago

Enjoyed this

thamer• 6 years ago

I don't know if the author is on HN (also not sure what difference this makes) but a payout of $100k made the news recently for https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a...

A few days later another researcher reported earning $75k for webcam access vulnerabilities: https://www.ryanpickren.com/webcam-hacking

These payments are not uncommon.

gowld• 6 years ago

Why do experts make absurd comments like "“Everybody thinks basically that the method you learn in school is the best one" ?

saagarjha47• 6 years ago

Wrong thread?

brutopia• 6 years ago

As a long time iOS user this single aspect has made me look over the fence to the android side the whole time. Not having full access to my own devices is insane. The poor security on android side has kept me away, but they’ve just recently been catching up enough that the scales are almost tilted.

rimliu2• 6 years ago

    > The poor security on android side

You almost got it… almost.

Apple Security Research Device Program

Related Stories