YHK - yet another hacker news clone

Today, we hacked what we'd set out to hack: the iPhone

324 points pavel_lishin 1 hour ago 174 comments

john_strinlai 1 hour ago | parent

the videos just don't hit the same without the dancing anime girl and the electronic dance music.

lol768 1 hour ago | parent

My favourite part from the first video is how much effort it took to drag up from the bottom of the screen to get back to the home-screen. This reflects my experience with how iOS handles touch gestures in general.. also super easy to accidentally activate "Reachability" mode!

ezfe 58 minutes ago | parent

The reason they're having trouble is because they're in the simulator.

Also, if reachability bothers you like it does me, you can disable it.

mahboi 34 minutes ago | parent

Seriously I want a physical home button again

arjie 1 hour ago | parent

Same guys who found the PHP.

Edit: hahaha you guys are funny. “The php hack” is what I meant!

awestroke 1 hour ago | parent

They found the PHP?

hk__2 1 hour ago | parent

Yes, actually PHP was not invented but discovered in nature. That’s why it’s a bit wild sometimes, because it still remembers its origins.

rob74 1 hour ago | parent

PHP was born as a templating language, but mutated into a programming language, and then grew organically from there.

jc_811 1 hour ago | parent

Craziest part is it was never even intended to be a programming language. From the Wikipedia page, the founder Rasmus Lerdorf is quoted as saying:

"I don't know how to stop it [...] there was never any intent to write a programming language [...] I have absolutely no idea how to write a programming language [...] I just kept adding the next logical step on the way."

And 23 years later here we are with php2shell and it powering 70% of the internet’s websites

karagenit 1 hour ago | parent

Everything becomes a programming language in due time. At work we have YAML files with #if and #include statements…

dylan604 56 minutes ago | parent

Does that mean eventually a programming language becomes a crab or a crab becomes a programming language?

cwnyth 1 hour ago | parent

But that only raises the question: what bore PHP? A bit of a C(hicken) and an egg situation.

Zak 57 minutes ago | parent

I am reasonably certain PHP is not written in Chicken.

https://en.wikipedia.org/wiki/Chicken_(Scheme_implementation...

kalleboo 58 minutes ago | parent

I mean there's no way there was any intelligent design behind it

/ducks and runs

rob74 1 hour ago | parent

Didn't know that the PHP was lost, thanks for pointing that out.

bix6 1 hour ago | parent

The Princely Hippopotamus Parlor in this case.

hxugufjfjf 1 hour ago | parent

They found the PHP vulnerability that has upended the world, or so it seems.

suralind 1 hour ago | parent

I'm not sure if this is real, but if it is: this week is unbelievable. I really hope it's not the new normal, but unfortunately I don't believe this myself.

bananaflag 1 hour ago | parent

It's a minuscule part of the new normal.

stuxnet79 1 hour ago | parent

There's every incentive for nation states and other espionage outfits to keep these types of exploits under wraps. This has probably been the new normal for some time ..

I for one have experienced multiple lifetimes worth of internet madness and will be looking to airgap / disconnect as many devices as I can get away with.

unethical_ban 1 hour ago | parent

I think in time (a few years) the gap will close a bit. As AI is used to harden software, it will be harder to break. Software not validated by AI will continue to be vulnerable to it.

mrweasel 28 minutes ago | parent

So what happens if AI becomes something that you need to actually pay real money for? Then only Apple, Google and Microsoft can affort to do network exposed software. Smaller companies and solo developers are just f-ed if the price of running LLMs goes up as investor money dries up.

mrweasel 31 minutes ago | parent

If this continues I'll argue that you have to be absolutely insane to allow network connected electronics into your home in the future. This is Apple, known for locking down their device to the extreme, and yes some people would love to use this for jailbreaking their phones, other organisations want to root your phone for .... other purposes.

Insecure webpages, broken certificates and an insecure PDF library... You shouldn't have anything more connected than an FM radio at this point. Security is no longer something a private individual can deal with.

dofm 25 minutes ago | parent

> You shouldn't have anything more connected than an FM radio at this point.

They can still hack your mind with ads.

ChrisArchitect 1 hour ago | parent

Oct 16th post;

More recently: iPhone Duo Jailbreak vid https://x.com/calif_io/status/2113570095549337977 (https://news.ycombinator.com/item?id=50206680)

erelong 1 hour ago | parent

Hoping more "unsupported" older "iDevices" can be made usable with newer software with something like "jailbreaking"

Waterluvian 1 hour ago | parent

It's a felony to subvert the natural order of disposable tech consumerism.

gambiting 1 hour ago | parent

I can 100% guarantee that we'll have comments from people saying they buy iPhones specifically because of the walled garden and the last thing they want is a jail broken device. On a website called Hacker News.

travoc 1 hour ago | parent

It’s reasonable to like to hack things, but to want a phone that just works.

mebrainmush 45 minutes ago | parent

Not sure what your definition of "hack" is but apple seems to be "anti hack" on all fronts.

They do have good hardware, but surely the hacker in you is a little sad using an IPhone!

MYEUHD 1 hour ago | parent

I like jailbreaks.

But to jailbreak you need to stay on an older iOS version (because Apple patches the bugs enabling the jailbreaks). And that means you don't get security updates.

lambdaone 1 hour ago | parent

I'm glad to confirm your suspicion. I like to have both a walled-garden phone and several open-platform computers. They do two completely different things for me.

To be honest, I'd like my open computers to be even more open and hackable, with a secure boot path that doesn't involve any mysterious unpatchable embedded firmware or auxiliary CPUs, but we are slowly getting there with RISC V.

Waterluvian 56 minutes ago | parent

I want the same kind of phone. But I reject the premise that it's impossible to have a deeply nested "De-wall this device yes I know what I am doing yes I confirm I'm about to really open myself to issues if I don't understand the implications" settings option without compromising the walled mode security.

gambiting 53 minutes ago | parent

The point is that no one forces you to jailbreak your iPhone. If you like the walled garden - great! Keep using it! But I've been in plenty of discussions where iPhone users are literally against jailbreaks at all and in any form.

arjie 6 minutes ago | parent

I want a device I can give the elderly in my family that they cannot be easily induced into doing insecure things on. If there were an unlockable iPhone and a locked iPhone I want to give them the latter. It’s not enough for me to tell them not to scroll to General and click seven times on About to activate developer mode. I would prefer to just give them a device that can’t do that.

My own parents are still relatively young and my in-laws are sceptical enough of other people that it’s currently safe but it won’t be so forever.

Vaushite 1 hour ago | parent

The meaning of Hacker here is VC Startup Founder

wuhhh 50 minutes ago | parent

You said what I was thinking. If anyone has links for _hacker_ news drop them here ;)

Vaushite 42 minutes ago | parent

Can't, I'd be autobanned, but this one is allowed at least: https://unslop.news/

bunderbunder 59 minutes ago | parent

Earlier today on the thread about the google play store apocalypse I posted a comment saying that I like some things about life in Apple's walled garden. But I still upvoted the parent comment because it's true and it's funny.

Also I'd happily jailbreak my iPhone and put an alternative OS on it to extend its lifespan. I'm a living human with nuanced opinions and I'm allowed to like more than one thing.

fhdkweig 42 minutes ago | parent

I got curious when you mentioned "google play store apocalypse", but I can't seem to find a comment of yours on the topic today. Would you be willing to post a link?

bunderbunder 40 minutes ago | parent

https://news.ycombinator.com/item?id=50209087

fhdkweig 36 minutes ago | parent

thanks

cosmic_cheese 55 minutes ago | parent

Having control over one's device and allowing anything and everything to have free reign on said device are two different things.

I'd love to have more control and customizability that the user can initiate, but random executables shouldn't be able to so much as sneeze without my permission. Third party software (yes, even the FLOSS variety due to issues such as supply chain compromises) must be treated as adversarial by default, anything less is foolishness.

2III7 53 minutes ago | parent

I converted to an iphone 13 mini (from the S24 Ultra) after being on Android since the release of the HTC Desire in 2010. I used to install custom roms and tweak everything on all of my Android phones which actually lead me to the iphone because I realized I wanted a phone without all the OE clutter and Google crap. The only clutter on the iphone is icloud which stays out of the way and doesn't annoy me with subscription messages. Also I don't have time to fuck around with modifying my phone. I just want everything to work without user intervention.

gambiting 52 minutes ago | parent

And you can keep doing that, no once forces you to jailbreak.

ribosometronome 43 minutes ago | parent

"No one forces you..." is an interesting line to go down in the comments of an article that focuses on using messaging apps to deliver exploits to a cellphone. It's pretty malware adjacent. Isn't that sort of thing how Jamal Khashoggi and his friends, family, and coworkers were hacked before his murder/execution?

foltik 29 minutes ago | parent

Uhh, what? Clearly nobody is arguing that "arbitrary remote execution is good." Apple could easily satisfy everyone by simply allowing users to unlock their own bootloader.

ragequittah 47 minutes ago | parent

I can root my Android phone and have in the past, but I have absolutely no desire to do so now because it adds almost no functionality in exchange for a very large security risk. I consider rooting my phone in the past quite a foolish move by someone who didn't know better.

latexr 18 minutes ago | parent

> people saying they buy iPhones specifically because of the walled garden and the last thing they want is a jail broken device.

I’m not one of those people.

> On a website called Hacker News.

But I still find that unfair. Being a hacker doesn’t mean you want to hack every aspect of your life. I’m perfectly content hacking away on a computer, but I have no desire to hack my toaster and risk burning down my house.

whynotmaybe 1 hour ago | parent

Eli5 the iMessage video? They open a file that calls their webapp?

slowin 1 hour ago | parent

#3 is so nice, I want root access to my phone. Does anyone know if doing this can lock Apple out from updating/removing it?

drum55 1 hour ago | parent

The videos sort of imply that these are userland rather than bootrom, whatever payload they have running is getting hit before first unlock, which isn't a lot of surface. They specifically say to not update which pretty much confirms where the attack surface is. Somewhere after the kernel starts but before the main user space is unlocked with the passcode.

aseipp 54 minutes ago | parent

Subverting the secure boot/upgrade chain would require a SecureROM exploit and presumably a compromise of the Secure Enclave, so the answer is almost certainly "no" (even prior major exploits from recent memory like usbliter8 are tethered and don't exploit the enclave; the last true untethered Jailbreak was iOS 9 or something.) An upgrade would fix it. The internet reporting claims this break they are showing in this video is untethered though, which is extremely rare on its own.

easytiger 41 minutes ago | parent

Well the governments and supranational bodies who want to read your messages would be aghast at you having root on your phone.

Like we did on HTC G1s in 2008

nalekberov 1 hour ago | parent

I think we will probably see more and more restrictions on frontier models in the coming months. This is not what behemoths like Apple and Sony want to see.

Paradoxically, people are happier to buy things that they have control over, but boy, Apple loves to control every layer of consumerism.

torben-friis 1 hour ago | parent

If the current frontier allows for this, we can probably expect alternative models to reach the same spot in a matter of months as well. The cat's out of the bag, for better of worse.

kam 47 minutes ago | parent

Apple doesn't want security researchers to find bugs? Then why do they have a $2m bug bounty?

nalekberov 17 minutes ago | parent

Awarding security researcher != Average Joe being able to jailbreak your device.

Hope you understand the difference.

phn 44 minutes ago | parent

The paradox is that if the models are restricted, more exposed software will exist. I'm not convinced you can make a model that allows you to build secure software without it also being able to build exploits.

zb3 1 hour ago | parent

Too bad this will be patched instead of allowing the device owner to control their own device.

Of course it's better that they found that before some shady mercenary spyware company, but I'd also want to control my ios device the same way they did in the video, but no, that's not for us.

layer8 1 hour ago | parent

In principle it should be possible to jailbreak-patch the OS so that it will patch any patches to your liking.

paxy 1 hour ago | parent

Man, sucks to see these "hacked" iPhones doing so many cooler things than my Apple-approved one.

Zak 1 hour ago | parent

I'm for being able to hack your own device to do whatever you like with it, preferably without active resistance from its manufacturer. I'm against anybody who can convince you to open a PDF being able to hack your device to do whatever they like with it.

paxy 57 minutes ago | parent

Who is saying this?

Zak 52 minutes ago | parent

The link here demonstrates an exploit which runs arbitrary code on an iPhone when the user opens a PDF.

paxy 51 minutes ago | parent

> I'm against anybody who can convince you to open a PDF being able to hack your device to do whatever they like with it.

Who is saying this part?

Asking for an open device does not mean supporting malicious hacking of others. This is the single biggest false equivalence used by Apple and the rest of the industry to keep a closed ecosystem and restrict users' control over stuff they paid for. And people continue perpetuating it for some reason.

Zak 45 minutes ago | parent

Nobody said exactly that, but your first comment pointed out how cool the capability is without acknowledging that it is trivial to exploit maliciously.

We're on the same side here. I daily a Pixel with LineageOS and root.

bigyabai 55 minutes ago | parent

iOS has enough zero-click exploits that you don't exactly get a choice between the two.

2III7 49 minutes ago | parent

You don't get that choice on any mobile platform.

Thaxll 1 hour ago | parent

Is it an exploit around the library that handles PDF parsing/opening? Can someone explain how files / attachement are open on a mobile device ( android/iPhone).

I don't understand how in 2026 this is still a thing, we have many safe languages to parse/deserialize data. Why is it complicated?

drum55 1 hour ago | parent

PDFs are basically executables, that's why it's hard. They support running code, they support decoding images which themselves have their own custom compressors that are basically code. Anything to do with image formats is rife for bad decoders, insane compression algorithms from the 90s, and a PDF is basically 1000 formats inside many different container types with executable code plastered on everywhere. If you want to make a compatible PDF viewer you'll need to be able to implement an image decoder algorithm for a fax machine that was specific to Japan in the late 80s, which was somehow ratified into a standard and is used today by all the top legal firms, or something absurd like that. When you open a PDF on your computer, depending on how it is being parsed, it can even make outbound network connections without you knowing. To safely open a PDF you need one of those bomb proof suits, a disposable laptop, and even then you might be going home without eyebrows.

paxy 1 hour ago | parent

Willing to bet that a default "treat PDFs/documents/spreadsheets as dumb" option in operating systems would eliminate the majority of common one-click vulnerabilies out there. And exactly 0.001% of actual use cases would be affected.

Vaushite 1 hour ago | parent

"dumb" isn't a real thing in computer science though. You mean render them to bitmaps in a sandbox?

nananana9 54 minutes ago | parent

I read it more as "don't implement JS, 3D object rendering, slideshow transitions, sound annotations and the other 999 insane features that I'm not even aware exist"

odo1242 47 minutes ago | parent

Would require defining what features are needed. "Require PDF/A" is probably a reasonable approximation, though it would break most PDFs

Melatonic 50 minutes ago | parent

I think he just means disable any of the "advanced" features mentioned above like accessing web content, running custom scripts, etc etc. You might still be vulnerable to any dependencies they use for image rendering itself but I bet it would make it drastically more safe.

Then just have a button for turning those on as needed on a case by case basis

Vaushite 41 minutes ago | parent

If you disable features then people will see important documents as white rectangles and complain and you'll get a reputation as not working.

warkdarrior 29 minutes ago | parent

"It's for security, honey."

Vaushite 8 minutes ago | parent

"Cool, since you aren't signing this rental agreement, you have five minutes to move your stuff out of my house."

dylan604 58 minutes ago | parent

Did we do that with Excel spreadsheets so that macros are disabled by default?

nhubbard 55 minutes ago | parent

PDFs are just absurdly complicated in general. Dumbing down the parser might be the right idea. I wonder what consequences that would have with how intertwined PostScript and PDF in general are with macOS/iOS; maybe that's why the PostScript engine was removed with macOS Sonoma/iOS 17? I don't know if that was only user facing behavior and Apple is still working to remove the internal usages.

bradly 47 minutes ago | parent

This is one of the things iOS's Lockdown Mode does. I wish the features of Lockdown Mode were able to be enabled individually instead of a single all or none option.

https://support.apple.com/en-us/105120

kccqzy 35 minutes ago | parent

No. Very few PDF exploits come from the officially sanctioned way of running code (JavaScript) inside PDF. Most are just plain old parser bugs.

wildzzz 24 minutes ago | parent

That's kind of what Adobe does with downloaded PDFs, you have to click the Enable button to turn on more document features. My schematic capture app will output a PDF that has links that will take you to specific spots on a page and also some JavaScript where you can right click on a part and see it's BOM information. None of that stuff works until you click the Enable button. I've also seen some vendors offer not only normal 3D model files and 2D drawings but a PDF that has an interactive 3D model inside. It's kinda cool how much random shit can go into a PDF but it's clearly a massive malware vector.

One neat thing I've seen is a PDF that will ping an IP catcher when opened in Adobe, regardless of the security level. The same can be done with word docs, excel spreadsheets, and even SVGs.

cosmic_cheese 1 hour ago | parent

From the standpoint of a layman it looks like there's a lot of overlap between writing safe web browsers/engines and writing safe PDF readers/engines. There just hasn't been anywhere near as much of an impetus to push PDF readers/engines in that direction because most of us aren't interacting with PDFs nearly as often as we interact with the web (and things built on web tech).

Melatonic 50 minutes ago | parent

Most web browsers actually make decent PDF viewers by default don't they ?

layer8 56 minutes ago | parent

> PDFs are executables, that's why it's hard.

That isn’t really true, it’s not hard for PDF viewers to block by default (or just not implement) the problematic features, which also aren’t critical for the vast majority of PDF files.

The exploitable bugs are typically the usual, some buffer overflow in an underlying image or font library or similar, but unrelated to PDFs being “executable”.

pishpash 33 minutes ago | parent

What a sleight of hand. PDF's are obviously not executable, any more than text files are. Decoders are executable and they can choose to unsafely handle input. Even plain text editors can have exploits. It's no different than any piece of complex software.

layer8 24 minutes ago | parent

The characterization of the PDF format specifically being “basically code” in any substantial manner is simply incorrect. The only PDF-specific features that reasonably meet that description is the PostScript support, which has fallen out of use decades ago and was completely removed in PDF 2.0, and the JavaScript support, which is optional, prohibited in PDF/A, and can easily be limited or omitted by a PDF viewer.

Wowfunhappy 48 minutes ago | parent

> PDFs are executables, that's why it's hard. They support running code

I don't think Apple's PDF renderer supports e.g. running JS, you'd need real Acrobat for that. Or are you talking about something else?

> they support decoding images which themselves have their own custom compressors that are also basically code themselves.

But this is fundamentally true for anything that displays images, right? Or are the PDF formats particularly bad for some reason?

wildzzz 16 minutes ago | parent

Yeah a lot of those fancy PDF features are Adobe-only. It's not that other apps can't support those features, it's that no one in their right mind wants to spend endless amounts of money and time trying to sandbox it.

Most people have some understanding that shady websites can give you malware, a drive-by exploit is pretty rare but it's good that most people think just visiting a site could infect your computer. But a PDF is just a document, right? Just thinking that a PDF is just words on a page is exactly why it's such an insidious threat. Or they'll get a PDF as an email attachment, see that it's not an exe or something weird, and open it because they think a document is safe.

ghm2180 1 hour ago | parent

Noob q: Does this(and most) hacks like this on the iphone likely rely on some kernel module — or what it talks to for executing code — being compromised to run arbitrary code execution? I dunno about ios but it seems from the videos that something that reads imessage attachments was compromised for privilege escalation.

Like what im mean is an attack vector shaped similar to https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/ i.e. they compromised `fs` module that did not protect against a buffer attack(in memmov)? My understanding is that most core kernel modules are difficult to attack directly because of XOM, PAC and CFI like protections make it impossible for anyone/thing, so most likely only indirect attacks like above can work in such situations — there is a lot of incentive for teams like apple to do everything possible to improve security so i assume only these kind of difficult to find vectors remain.

jonathanstrange 1 hour ago | parent

My dream is to release an iOS app that self-installs and not say anything special about it other than having a "Download for iPhone" button on my website. If someone asked me, I'd answer: "Huh, what do you mean? It's our app for the iPhone."

Vaushite 59 minutes ago | parent

You can do this on Android

jonathanstrange 50 minutes ago | parent

Not for long now...

Vaushite 42 minutes ago | parent

Still, but with a one-time 24-hour delay, at least until Google pulls a future Xiaomi.

This "there will be literally no difference between apple and Google in 70 days" is great propaganda for Apple.

jonathanstrange 28 minutes ago | parent

It's better to use 0-day exploits to install legitimate software by now. It saves everyone from a lot of hassle. Or, more realistically for most, make a web app and forget about native apps.

nsxwolf 1 hour ago | parent

What are these videos actually demonstrating?

jeroenhd 27 minutes ago | parent

A couple of PDF exploits from iMessage and Signal leading to code execution, and an app that roots the phone. Also, they seem to have managed to make their malware survive a reboot, which is difficult. That's another reason why automatic reboots are considered a security feature: exploits leaving malware in-memory are a lot easier to build than malware that survives a full reboot, passing all stages of signature checks and validation.

ks2048 5 minutes ago | parent

Yes, why don't they just say it instead of posting videos. Opening a sinister PDF in iOS can give them access to what exactly? anything/everything? What iOS versions or devices, etc?

cromka 1 hour ago | parent

Someone correct me please if I’m wrong but is this because iOS doesn’t sandbox their processes? I think I read Safari in particular doesn’t, but wonder if this is system-wide issue.

The more of this stuff we see, the more people will start using GrapheneOS, I guess.

Also wonder why they choose to publish and not cash-in the Apple bounty..

odo1242 25 minutes ago | parent

iOS does sandbox their processes really well, that's why this hack was as difficult as it was. The Safari thing you're talking about is JIT - iOS disables all runtime code generation across the system except in Safari (for JavaScript), but this is a completely separate thing from sandboxing.

reacharavindh 59 minutes ago | parent

It’s a pity we gave in to the “ecosystem” play by these huge companies.. even if I jailbreak my iOS and never let it update.. Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such. iPhone would be one glorious iPod touch after that.. :-(

Seeing all these gives me the same energy of early days of jailbroken Android phones where one could become root and do whatever with the hardware… I stopped considering such tinkering because I got tired of finding those little tweaks and fixes on forums like xda every time something was updated. With the LLMs capable of automating that tool, I might find those old school way of mobile phones again…

traceroute66 40 minutes ago | parent

> even if I jailbreak my iOS and never let it update.

Two things:

a) Why the would you never want to update an OS in this day and age ?

b) I understand the perspective of people insisting on wanting to be able to root their phone. But how about we take a step back and look at the reality of the 2026 security environment ? An environment where you have:

     - Increasing volumes of increasingly sneaky security exploits on one side
     - A phone with your 2FA apps, your banking apps, your email apps, your kids photos on the other
Frankly. I want Apple to lock down my iPhone as much as possible in that context.

If I want to be root, I can do so on my desktop or a cloud VM or whatever.

But making root on a phone easy just seems like a recipe for disaster... if its easy for you, its easy for the bad guys too.

mahboi 35 minutes ago | parent

Maybe your phone doesn't have banking and stuff on it

warkdarrior 33 minutes ago | parent

If your phone does not have any important or sensitive on it, why even secure it?

traceroute66 28 minutes ago | parent

> If your phone does not have any important or sensitive on it, why even secure it?

Or why have a smartphone in the first place if you're not going to put any sort of meaningful apps on it. ;)

mahboi 27 minutes ago | parent

My iPhone passcode was either unset or 2222 until like 2018. At times it was jailbroken af. It had messaging and stuff. I'm not one of those people who uses a phone to pay for stuff instead of just using a credit card. Wouldn't have been the end of the world if someone hacked it, and nobody did.

traceroute66 31 minutes ago | parent

> Maybe your phone doesn't have banking and stuff on it

I don't know where you live, but where I am most banks insist on proprietary 2FA via their own app. Only (some of) the fintechs allow TOTP.

Yes you can get your codes via SMS, but I thnk we all know what a security mess SMS is. I would rather have the bank's proprietary app since at least everything will be going over HTTPS and also eliminates most of the vulnerabilities associated with SMS just by virtue of being an app.

mahboi 29 minutes ago | parent

USA, Chase lets me set a passkey

tadfisher 11 minutes ago | parent

Passkeys are the standardized version of the bank's proprietary app. Well, except for the device attestation part, that won't happen on iPhones.

mort96 31 minutes ago | parent

> a) Why the would you never want to update an OS in this day and age ?

Because updates break the jailbreak. If Apple actually had a sanctioned way to let you do what you want with the device you bought there would indeed be very little reason to not update.

mahboi 26 minutes ago | parent

Updates slow down your phone, eg Liquid Ass. Lots of people follow the rule of only running the OS that came with your iPhone.

tsunamifury 34 minutes ago | parent

We gave in because open source and hobbiests do not design good products and even worse shared systems, as much as they enjoy self-righteously declaring their values. And shared systems require trust, planning, and goal setting in a way no open system would ever build.

1) They of course lack the resources

2) Often lack professional displince across all skills required

3) Mostly make for themslves or whats interesting, not whats needed.

4) The release schedule is laughable at best.

gimlichgu 29 minutes ago | parent

this must be nailed to the wall somewhere at autodesk

rootnod3 34 minutes ago | parent

Vote with your wallet. Fuck them.

You shouldn’t have to use LLMs to run your software.

Give it another 6-12 months until the big AI shops shut those capabilities down and running local ones becomes cost prohibitive.

isodev 31 minutes ago | parent

> Vote with your wallet.

Apple is too big for that. Hard regulation is the only way out right now. Maybe breaking them up too.

zaphar 24 minutes ago | parent

No it's not. You can vote with your wallet right now. Nothing is stopping you.

breakingcups 19 minutes ago | parent

What if I want to vote against both Apple and Google but still be able to do my banking business?

CPLX 18 minutes ago | parent

Many things are stopping you. I see this response all the time as a counter to inappropriate behavior by monopolistic giant entities.

It's the wrong way of thinking about the problem. The whole point is that they've gained too much market power for any individual to be able to stop them meaningfully, and that collective action using the power of government is the only way.

Any argument that tries to talk people out of that is on the same side as the tech oligarchs, in my opinion.

afavour 17 minutes ago | parent

But the alternative is another monopolistic tech giant. There is no viable third platform. So I agree with OP, the answer is breaking them up.

balarjin 9 minutes ago | parent

> There is no viable third platform.

There is no "viable third platform" because people don't vote against the two existing ones with their wallets.

Can you name an example where a government succeeded in breaking up a monopoly, and the result was better for consumers? AT&T, IBM, and Microsoft were all "broken up", but it didn't make a difference for consumers. In every case, a competitor forced them to change their ways.

peterleiser 11 minutes ago | parent

Serious question: What alternative phones do you suggest? I've tried PinePhone and PinePhone Pro and it was painful.

fschuett 9 minutes ago | parent

Google Pixel + GrapheneOS

saghm 7 minutes ago | parent

Yes, I can vote with my wallet, but no, it doesn't make a difference. I've been voting with my wallet since day 1 by never buying an iPhone because of how closed it is, and unsurprisingly, this has done absolutely nothing to change how open the iPhone is.

ctoth 3 minutes ago | parent

I'm blind. Apple has explicitly said they wouldn't consider the "bloody ROI" of accessibility. This is important to me. Software freedom is also important to me. What am I to do?

dreamcompiler 30 minutes ago | parent

How are running local ones going to become cost prohibitive? Indications are that Nvidia has been channel stuffing (artificially inflating perceived demand), which suggests massive oversupply of GPUs.

ActorNightly 30 minutes ago | parent

>Give it another 6-12 months until the big AI shops shut those capabilities down and running local ones becomes cost prohibitive.

The local inference threshold has been crossed already. Its possible to achieve big model like performance through agent harnesses with local models.

Razengan 26 minutes ago | parent

> Give it another 6-12 months until the big AI shops shut those capabilities down and running local ones becomes cost prohibitive.

If Murican lobbying/corruption tries to snuff AI that threatens the Hutt cartels, China will accelerate it.

neya 4 minutes ago | parent

> Vote with your wallet. Fuck them.

Easier said than done. Because, "Apple can do no wrong" is the general public perception. Look at any wrongdoing by Apple - whether they were caught slowing down the phones, degrading cameras on purpose or even the lawsuit where they were caught spying on people's voice recordings. There will always be some NPC defending them as if the billion dollar corporation gives a shit about them.

That or "Apple is the only pro-privacy company in the world" despite there being an active lawsuit against them for the exact opposite.

So, I say: Vote with your wallet. Fuck them...and the fanboys.

orangecat 3 minutes ago | parent

Give it another 6-12 months until the big AI shops shut those capabilities down and running local ones becomes cost prohibitive

I don't expect that to happen, but I do expect Apple et al to spend trillions of tokens hardening their platforms against users and red-teaming to find these sorts of holes before release.

tw600040 27 minutes ago | parent

You do understand the reasons right? iCloud, iMessages etc are an interplay of software in your device, software in cloud and some networking. They have to work together. A jailbroken phone can have a tinkered iMessage app. Supporting tinkered / unsupported versions is more overhead / possible security risk. Why would you expect them to take on that?

jd3 20 minutes ago | parent

I agree with your point, though I can easily modify ~/Library/Messages/Attachments or ~/Library/Containers/com.apple.MobileSMS/Data on macOS, which is a platform similarly secure to an iPhone when you take sandboxing, sip, etc. into account. So Apple already supports macOS, which can be tinkered, no? I guess the argument is that by locking down iOS, a platform which was never open, they just never needed to handle that class of security risks which are introduced when customers have more freedom.

I did actually discover a bug in iOS (related to photos which have failed to sync to icloud for the past four years) by investigating why there were over 23k empty folders in ~/Library/Containers/com.apple.photos.ImageConversionService/Data/tmp/, fwiw.

runjake 16 minutes ago | parent

You're right, but I could see Apple acting on iOS alone, just because of scale.

There are some orders of magnitude more iOS/iPadOS devices than macOS devices.

There's a bunch of ways we could debate ourselves about things Apple would or wouldn't do, but at the end of the day, Apple is going to do whatever is in it's best interest.

sersi 14 minutes ago | parent

My computer is jailbroken, I have sip disabled yet icloud and imessage work. So what makes my computer different from my phone?

tarpitt 10 minutes ago | parent

Who bears the security risk? The user.

The only security risk for apple is a job security risk if the ecosystem lock-in is eroded.

roosterIllusi0n 7 minutes ago | parent

Can't anyone customize the source of grapheneOS and simultaneously get a phone that is not trying to disable itself?

ValtteriL 58 minutes ago | parent

Curious to see how many tokens was spent

baq 57 minutes ago | parent

guess who put themselves on the must-hack list of every single national intelligence agency

SoKamil 56 minutes ago | parent

Stay on 27.0 or upgrade to 27.0.1?

sgjohnson 55 minutes ago | parent

Oh boy, what a week. Must be great working in cybersec right now.

cardboard9926 55 minutes ago | parent

How did they bypass MTE? Wasn't it suppose to make such exploits basically impossible?

bcvvvy 54 minutes ago | parent

Right that does it. I'm fucking off to the pub and drinking myself under the table after this week.

amelius 53 minutes ago | parent

Apple doesn't use AI to vibecode and/or pentest their software?

I think we have a right to know.

amelius 49 minutes ago | parent

Ok so you became "root", but who knows, Apple might have "superroot" and if that is not enough "god-mode".

saagarjha 7 minutes ago | parent

Apple does have that and generally you need to break it to do the kinds of things demonstrated here

Imustaskforhelp 46 minutes ago | parent

Slightly offtopic but I find it slightly funny that they have accomplished to hack the iPhone yet the name of the third video is: Can you iPhone do this?

I would like to think that they might've created the video so fast and perhaps out of so excitement that the name of the title had the typo :-D

terhechte 46 minutes ago | parent

It would make me so happy if this would allow running UTM.app with Hypervisor support on iPadOS. I don't want to travel with two devices, the would be enough, but sometimes I need a real desktop. Apple, of course, wants you to buy two devices. I do have UTM with Jit Linux running on my iPad, via altstore and entitlements and so on, but it is all a bit complex and still fairly slow.

sgjohnson 44 minutes ago | parent

#4 is very interesting. Truly untethered (persistent) jailbreaks haven't been a thing for 10 years.

aemoron 43 minutes ago | parent

What's with iOS and pdfs pwning them? Reminds me of the ForcedEntry in Pegasus.

https://projectzero.google/2022/03/forcedentry-sandbox-escap...

https://www.trendmicro.com/en_gb/research/21/i/analyzing-peg...

enjoytheview 38 minutes ago | parent

PDF has been an entry point since forever, it is extremely complex and can in some cases even run javascript, it has a huge attack surface.

motoboi 36 minutes ago | parent

Too huge attack surface. Good candidate for victim trust (who would not open a pdf file on an iPhone?).

So pdf and images are the best vector for iPhones.

Once you escape the parser you have to reach and escape the sandbox and from there reach the kernel.

anthk 7 minutes ago | parent

That's why you need Rust in any image decoder. FFMPEG too.

mahboi 35 minutes ago | parent

Well it was TIFF one time

bushbaba 2 minutes ago | parent

Maybe with LLMs a full rewrite that’s more secure could be done

eqmvii 37 minutes ago | parent

I'm tired, boss

tptacek 35 minutes ago | parent

A reminder for people who don't follow this, Calif is Thai Duong's firm. Thai discovered the BEAST and CRIME TLS attacks (with Juliano Rizzo), and then worked at Google for a bunch of years, including on Wycheproof with Daniel Bleichenbacher. The team at Calif includes lcamtuf, Dion Blazakis, Tavis Ormandy, and Stefan Esser (among many others).

They're basically the most interesting team working in vulnerability research right now; a cross product of ludicrous talent and full-tilt AI work.

Just before I left Fly.io a few months ago, we retained Calif for an annual pentest (we'd previously worked with Tetrel, Atredis, Doyen, and I think Include?). They were spooky good. Everybody we'd worked with was good, but Calif's results were unusually high-impact.

I love these people and everything they're doing.

dangoodmanUT 32 minutes ago | parent

so i see we're still going with the apocalypse today too

smasher164 31 minutes ago | parent

why do we see pdf viewer exploits on ios when we have sandboxing mechanisms nowadays like wasm? Or is this exploit accounting for the sandbox breakage?

CH-Abhinav 25 minutes ago | parent

Bro rewrite IOS in Rust :)

jeroenhd 24 minutes ago | parent

Very cool demos, but now I'm interested to know: does enabling Lockdown mode help at all against these exploits? It'll theoretically protect against a lot of common attack vectors, but I'm curious about its real-life effectiveness.

keel-control 23 minutes ago | parent

They are going to run out of vulns eventually when the code is rewritten in memory safe lang & the rest are found.

mintflow 23 minutes ago | parent

Video 3 get a root shell agains 27.0.1 which is the latest iOS version installed on my lovely se3.

This really blown my mind, and seem the 1/2 video is installed a app by click pdf link?

I guess and hope there will be update from apple quickly

1970-01-01 19 minutes ago | parent

Just let me know when I can install an alternate OS to my junk drawer of 6-10 year old iPhones. That's the holy grail.

devy 13 minutes ago | parent

This brings back lots of memory of jail-breaking iPhone era and cydia the alternative jailbroken iPhone app store.

The second video, the person who's shooting the video has his face mirrored onto the screen, anonymity is gone.

artursapek 13 minutes ago | parent

Man... PDF is such an unfortunate file format.

blondie9x 11 minutes ago | parent

This made me miss Cydia and the old jailbreaking days so much. Was such an exciting time to have an iPhone with the tinkering. Anyone still remember iDitDahText https://iditdahtext.com/iDitDahText.html?

so-gala-massey 9 minutes ago | parent

Does this work in lockdown mode? I’ve been running lockdown for six months and there’s practically no significant difference except for auto opening links.