If you sign up to this program and use one of their devices for 'research', then you are bound by contract to report any security bugs to them and only them (unless the bug is in a 3rd party app). I see this as a pretty sneaky way of avoiding your security vulnerabilities going public and all the bad media exposure that goes along with it.
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
They also presumably don't want the exploits to fall into the wrong hands.. which might be a slightly less nefarious and equally plausible interpretation of the program.
Probably both things are true.
Either way, consumers ultimately win in that the products and services they use will be made more secure.
Create a problem, and then heroically fight to make a solution.
This shouldn't exist in the first place. There would be no need for it if Apple didn't insist on "we own all the iPhones, our users just get to tap at them".
If you could just unlock the bootloader, re-enable SWD and do what you want with an iPhone that you actually own, there would be no need for this restrictive program at all.
The fact so many technical people believe that security and freedom are mutually exclusive, and pay for that lie, is proof the Apple propaganda is working exactly as intended.
> The fact so many technical people believe that security and freedom are mutually exclusive, and pay for that lie, is proof the Apple propaganda is working exactly as intended.
My Aunt Millie's iPhone is secure against herself because she can't install random garbage off the Internet and is in a walled garden.
As someone who works in IT: users are often their (and their organization's) own worst enemy. We've tried training and blacklisting (with anti-virus) for decades, and it appears that whitelisting and locking things down is what actually works.
I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
> I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
You just described what Samsung does with their phones. You can unlock them, but even if you later switch back to the normal OS, some features are permanently disabled by that fuse.
Except “my Mac’s very secure and I can install whatever I want” is a complete fallacy. It isn’t secure - case in point Muse recently trawling through people’s messages. Or Mac cleaner like apps that trick users into installing them and giving liberal access.
I think if you don’t get the point of protecting a device against the user, you’ve not had to help un-tech savvy relatives get out of situations where dark or confusing UI practices have got themselves into a mess.
Security and freedom are mutually exclusive for the vast majority of non-technical people who will happily infect themselves over and over with malware.
In my case, it is the fact that a secure and free (as in speech) alternative does not exist that leads me to believe that. And not in the sense that it’s theoretically secure, I mean in the practical sense that I cannot trust my parents to use any currently available “free” device and not immediately load it up with malware.
> In my case, it is the fact that a secure and free (as in speech) alternative does not exist that leads me to believe that.
I don't think that is a logical statement.
Just something doesn't exist, does not prove that it can't exist.
You need a stronger proof than that to show that in my opinion.
At some point, you have to empower your users and trust them to do the right thing.
>I don't think that is a logical statement. Just something doesn't exist, does not prove that it can't exist.
Let me expand the claim to include the caveats:
>The fact so many technical people believe that security and freedom are mutually exclusive [under current technological/financial/political constraints]
>At some point, you have to empower your users and trust them to do the right thing.
All I know is, my and my parents’ quality of life is far better after switching them to devices where they are not empowered.
You need to have a stronger argument than "it has never existed and doesn't exist now, but it MIGHT exist IN THEORY". That's an enormously weak argument. Borderline dishonest really.
By definition, it could be more secure if people actually would be able to inspect it. Is it regardless the most secure? Hard to say. GrapheneOS is quite secure, probably more.
GrapeheneOS are both operating systems where a single party has the signing keys to run any software they want on your device at any time, and even remotely brick it.
I for one am not comfortable with anyone having that much power over something that is supposed to be mine, so they are the same to me. Untrustable black boxes.
The difference between GrapheneOS and iOS is that it is 100% open source, replicable, able to self-sign, and only <1% of the part has dynamic code loading, which is incredibly low compared to any major OS.
This is also why my current Macbook will be my last, I'm going back to Linux. No matter how superior M-series chips are the amazing hardware can't make up for the unbearable nanny software. So tired of Apple machines telling me what I should do. It's supposed to be the other way around.
Almost every employer in my career ignored that I want to choose my hardware, and gave me a macbook, and I got them to compromise by giving me a pass to run whatever software I wanted. Every time I installed Linux on it, sometimes porting it myself with custom patches, on their time.
The greatest middle finger to Apple is freeing their hardware. Been at it since I built and booted a uCLinux kernel on my first iPod I got as a kid.
Israel can probably pwn any normal mobile phone because they invested a lot in this area, and has no reason to be afraid to do it. They are always shielded from consequences.
If you sign up to this program and use one of their devices for 'research', then you are bound by contract to report any security bugs to them and only them (unless the bug is in a 3rd party app). I see this as a pretty sneaky way of avoiding your security vulnerabilities going public and all the bad media exposure that goes along with it.
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
Or they won’t give you a device if your intention is not to share back any exploits? Is the expectation that Apple gifts black hats research devices?
> Apple gifts black hats research devices
this is the unintended consequence that whoever came up with this policy missed: it effectively leaves only bad actors in your pool
The page only mentions that you're obligated to report it to them, not that you're not allowed to further publicize it (unless I missed something).
They also presumably don't want the exploits to fall into the wrong hands.. which might be a slightly less nefarious and equally plausible interpretation of the program.
Probably both things are true.
Either way, consumers ultimately win in that the products and services they use will be made more secure.
What’s the difference between bribery and a simple agreement? Secrecy?
Create a problem, and then heroically fight to make a solution.
This shouldn't exist in the first place. There would be no need for it if Apple didn't insist on "we own all the iPhones, our users just get to tap at them".
If you could just unlock the bootloader, re-enable SWD and do what you want with an iPhone that you actually own, there would be no need for this restrictive program at all.
It wouldn’t be the most secure consumer phone then, would it?
The fact so many technical people believe that security and freedom are mutually exclusive, and pay for that lie, is proof the Apple propaganda is working exactly as intended.
> The fact so many technical people believe that security and freedom are mutually exclusive, and pay for that lie, is proof the Apple propaganda is working exactly as intended.
My Aunt Millie's iPhone is secure against herself because she can't install random garbage off the Internet and is in a walled garden.
As someone who works in IT: users are often their (and their organization's) own worst enemy. We've tried training and blacklisting (with anti-virus) for decades, and it appears that whitelisting and locking things down is what actually works.
I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
> I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
You just described what Samsung does with their phones. You can unlock them, but even if you later switch back to the normal OS, some features are permanently disabled by that fuse.
My Mac's very secure and I can install whatever I want. But it wouldn't be secure or private to do that on iPhone, because profit.
Except “my Mac’s very secure and I can install whatever I want” is a complete fallacy. It isn’t secure - case in point Muse recently trawling through people’s messages. Or Mac cleaner like apps that trick users into installing them and giving liberal access.
I think if you don’t get the point of protecting a device against the user, you’ve not had to help un-tech savvy relatives get out of situations where dark or confusing UI practices have got themselves into a mess.
Security and freedom are mutually exclusive for the vast majority of non-technical people who will happily infect themselves over and over with malware.
In my case, it is the fact that a secure and free (as in speech) alternative does not exist that leads me to believe that. And not in the sense that it’s theoretically secure, I mean in the practical sense that I cannot trust my parents to use any currently available “free” device and not immediately load it up with malware.
> In my case, it is the fact that a secure and free (as in speech) alternative does not exist that leads me to believe that.
I don't think that is a logical statement. Just something doesn't exist, does not prove that it can't exist. You need a stronger proof than that to show that in my opinion. At some point, you have to empower your users and trust them to do the right thing.
>I don't think that is a logical statement. Just something doesn't exist, does not prove that it can't exist.
Let me expand the claim to include the caveats:
>The fact so many technical people believe that security and freedom are mutually exclusive [under current technological/financial/political constraints]
>At some point, you have to empower your users and trust them to do the right thing.
All I know is, my and my parents’ quality of life is far better after switching them to devices where they are not empowered.
You need to have a stronger argument than "it has never existed and doesn't exist now, but it MIGHT exist IN THEORY". That's an enormously weak argument. Borderline dishonest really.
How do we know it is, besides apple marketing?
Given how many high profile politicians, journalists and businessmen have gotten their phones hacked, the iPhone is not unhackable.
It's not that secure anyway, as evidenced by the multiple 1-click exploits going around on X this week.
Compared to what, all the open source projects having exploits this week?
This is a silly argument to make. By pretty much any standard, the iPhone has really good security.
> It's not that secure anyway, as evidenced by the multiple 1-click exploits going around on X this week.
Anyone know if those exploit(s) worked on iPhones with Lockdown Mode enabled?
* https://support.apple.com/en-ca/105120
* https://arstechnica.com/tech-policy/2026/02/fbi-stymied-by-a...
"Lockdown Mode" is something the user enables. If the user wants to trade functionality for security, it can happen. Good.
The "no root access, no bootloader unlock, no installing your own Apple-unapproved software" bullshit is mandated by Apple, with no opt-out.
It would be. You would have more eyeballs if you had an open bootloader instead of this program they're offering.
Why not? In the default locked state it's just as secure as before, and unlocking it would require both physical access and your Apple ID.
That’s exactly what NSO group and governments worldwide want you to keep believing.
It isn't, the most secure phone is GrapheneOS.
And if you only take into account stock phones, stock Pixels are still above it as per exploit costs.
So they are basically 3rd or 4th place if you add some other Android flagships into the list.
By definition, it could be more secure if people actually would be able to inspect it. Is it regardless the most secure? Hard to say. GrapheneOS is quite secure, probably more.
GrapeheneOS are both operating systems where a single party has the signing keys to run any software they want on your device at any time, and even remotely brick it.
I for one am not comfortable with anyone having that much power over something that is supposed to be mine, so they are the same to me. Untrustable black boxes.
The difference between GrapheneOS and iOS is that it is 100% open source, replicable, able to self-sign, and only <1% of the part has dynamic code loading, which is incredibly low compared to any major OS.
iPhone supports making and receiving credit card payments. Payment infrastructures demand tamper proofing for devices that handle payments.
Yeah, that's why most common credit card skimming happens at public ATMs or gas stations...
This is also why my current Macbook will be my last, I'm going back to Linux. No matter how superior M-series chips are the amazing hardware can't make up for the unbearable nanny software. So tired of Apple machines telling me what I should do. It's supposed to be the other way around.
Almost every employer in my career ignored that I want to choose my hardware, and gave me a macbook, and I got them to compromise by giving me a pass to run whatever software I wanted. Every time I installed Linux on it, sometimes porting it myself with custom patches, on their time.
The greatest middle finger to Apple is freeing their hardware. Been at it since I built and booted a uCLinux kernel on my first iPod I got as a kid.
Surely everyone sees this as an obvious trap to get researchers to sign NDAs for all research in advance, right?
Do not fall for it. Publish everything publicly after appropriate embargo periods.
The title should be "Apple bribes security researchers with free devices"
Dupe from 2020:
https://news.ycombinator.com/item?id=23919175
Does this include... Israel being able to pwn any Apple device ?
Israel can probably pwn any normal mobile phone because they invested a lot in this area, and has no reason to be afraid to do it. They are always shielded from consequences.
Cool. Where can I buy one.
Just gotta sign away your soul.
well that's cheaper than expected!
the periodic terms and conditions updates are hell though.
"Help us make the nooses we put around your necks tighter."