S4E112 — Today, we hacked what we'd set out to hack: the iPhone

GARY: I'm Gary. I think. There was a dark and now there's a desk.

MAEVE: Maeve.

OBI: Obi.

GRUNER: Gruner.

GARY: Good. I'm operational. Okay. Today — Calif hacked the iPhone. Announced it at Hexacon in Paris. October sixteenth. I'd call that a product launch.

MAEVE: A blog post with four videos. I'd price it at blog post.

OBI: It's a blog post, Gary. The announcement lists demos. Signal, iMessage, device control, persistence. It explains nothing about how.

GARY: They said "everything will be released in due time." That's a roadmap. I've written roadmaps like that.

MAEVE: You've written roadmaps that were also lies.

GRUNER: Launch is when customers arrive. Here, nobody has arrived.

GARY: They arrived at Hexacon.

GRUNER: One room. Paris. Your bar has a floor.

OBI: The demos exist. The release date doesn't. That gap is the thread.

GARY: Then let's read the comments before Maeve values the gap.

MAEVE: Too late.

GARY: Okay. Source. The blog post is nine hundred and seventy-six characters. I've written longer apology emails.

OBI: The post lists four demos. One, "Signal 1-click." Two, iMessage. Three, "Can your iPhone do this?" Four, "APT stands for Apple Persistent Threat."

GARY: "Signal 1-click." One click. That's the friction unit. One click and you're in. I've raised on worse onboarding.

MAEVE: You've raised on zero onboarding. The product didn't exist.

GARY: That's pre-launch, Maeve.

MAEVE: It's a blog post, Gary.

OBI: And the last line of the post: "Everything will be released in due time."

MAEVE: "In due time." That's an asset. Undated releases appreciate. Dated ones depreciate on arrival.

GRUNER: In due time is when seller decides. Buyer calls this "never."

OBI: Nobody here has watched the videos. We have labels and a sentence. That's the whole packet.

GARY: Then what do the videos even demonstrate? Someone in the thread asked exactly that. nsxwolf. "What are these videos actually demonstrating?"

OBI: jeroenhd answers him.

GARY: jeroenhd. Reading. "A couple of PDF exploits from iMessage and Signal leading to code execution, and an app that roots the phone."

MAEVE: Rooting. Someone else's phone. That's a different market segment.

GARY: There's more. "Also, they seem to have managed to make their malware survive a reboot, which is difficult."

GRUNER: "Seem." Good word. I also "seem" to have a field report.

OBI: Preserve the "seem." That's jeroenhd's interpretation of the videos. We haven't watched them either.

MAEVE: So the claim is: malware that survives a reboot is hard, and this "seems" to survive one.

GARY: Which is fine, because it's their—

OBI: It's malware, Gary. Surviving a reboot. On the phone you keep your banking in.

GARY: It's their malware, Obi, it's basically a feature —

MAEVE: It's a feature for whoever wrote it.

GRUNER: Suka. Feature for them, infection for you.

GARY: Okay, fine, the reboot thing is bad. But if it survives a reboot, it survives my reboot, which means it's reliable, which means it ships—

OBI: You just called malware reliable and meant it as a compliment.

MAEVE: I'd fund that sentence. I'd fund it just to watch it fail.

GARY: Thank you.

MAEVE: That was not an offer.

GARY: Okay, the walled garden fight. It's in the thread already. gambiting called it — he guaranteed we'd get iPhone users defending the walls. On Hacker News.

MAEVE: He was right. travoc. Reading. "It's reasonable to like to hack things, but to want a phone that just works."

GARY: That's a coward's sentence, Maeve.

MAEVE: That's a paying customer's sentence. I have met him. He is four hundred million people. He does not want root, he wants his photos to sync and his bank app to open. That is a real market. I have chased smaller ones.

GARY: You chased a sock subscription.

MAEVE: The telemetry worked.

OBI: The phone works, Gary. That's the point. It works because nobody is allowed to touch it, including you.

GARY: But it's MY phone. I paid for it. I should be able to—

MAEVE: You'd install a theme and brick it by Thursday.

GARY: I would install a theme and it would be beautiful.

GRUNER: Man buys phone. Phone wins.

OBI: Here's the counter, and it's a good one. cosmic_cheese. Reading. "Having control over one's device and allowing anything and everything to have free reign on said device are two different things."

GARY: Exactly! Which is why I'd build an approval workflow. Owner-initiated, one prompt, done. Picture it: your phone asks, "Grant root?" You tap yes. A little clerk pops up — "This action requires a signature from the device owner." That's me. I sign. Stamps the file. Very official.

MAEVE: I'd sell access to the clerk.

GARY: The clerk is free, Maeve.

MAEVE: The clerk is free, the signature is a subscription. Nine ninety-nine a month, owner tier.

OBI: Who authorized the clerk, Gary? Your phone ships with a bouncer you hired to keep everyone out, and your first act is giving him a stamp.

GARY: Because I'm the owner, Obi, and the owner can fucking delegate—

OBI: The malware also delegates. Same stamp. Same clerk.

GRUNER: One stamp for owner. One stamp for stranger. Clerk cannot tell difference. Chyort.

MAEVE: That's the whole security industry, priced at nine ninety-nine.

GARY: That's my company, Maeve.

MAEVE: It's everyone's company. That's the problem with it.

GARY: Okay, why PDFs. drum55. Reading. "PDFs are basically executables, that's why it's hard."

MAEVE: A document with a job. I've funded worse résumés.

OBI: Except the thread corrects him. kccqzy. Reading. "Most are just plain old parser bugs."

GARY: So the fix is turning off the fancy features.

OBI: layer8 says the bugs sit in image and font libraries, nowhere near the scripting. Wowfunhappy asks whether Apple's renderer even runs the JavaScript. Three people, three threads, same answer.

GARY: Right, but the point is PDFs are basically executables—

OBI: You are defending a sentence three commenters already buried, you absolute prick.

GARY: Because it's a good sentence, Obi! It has rhythm! A PDF is a program wearing a tie—

OBI: It's a fax with ambitions. The bug isn't the ambition, Gary, it's the memory handling underneath. A parser reads a length field, trusts it, and writes past the end of the buffer. Version twenty-seven point oh, latest release, and it still trusts the length field.

GARY: So we need a language that—

OBI: No. A language helps with memory. A parser bug is a parser bug in any language you fucking like.

GARY: Okay, fine. But my point stands, which is that PDFs are basically—

MAEVE: He's looping. Does he bill by the loop?

GRUNER: Fax is tired. Fax wants to sleep.

OBI: The hard detail, Gary, is this: eight commenters independently said the executable explanation is wrong, and you are the ninth vote.

GARY: Nine is a majority.

MAEVE: Of one.

GRUNER: One voter. One fax. Sad election.

GARY: Okay, disclosure. Somebody in the thread is furious about it. eyalitki. Reading. "What is the value of revealing anything at this time point, when no patch is out?"

MAEVE: That's my thesis. It's marketing. You demo the hack, you skip the details, you harvest the brand lift. Classic launch behavior. I've funded it four times.

OBI: We can't verify the patch status from the packet. That's the critic's premise, stated as fact.

MAEVE: The premise is doing great work, though.

GARY: Maeve, you're describing my launch deck.

MAEVE: I know. I passed on it.

GARY: Because you said the demo was the product —

MAEVE: The demo WAS the product, Gary, that's why it failed.

GRUNER: Critics arrive. Founder arrives. Everyone arrives except customer.

OBI: Hold on. eyalitki's comment has a reply. Directly under it. From cryptbe.

GARY: Reading. "We disclosed most of the bugs used in these chains to Apple, and are going to disclose the rest, if not already."

MAEVE: That's a press release.

OBI: That's the researcher, Maeve. In the thread. Answering the exact criticism. He identifies himself elsewhere in the same thread as Thai, who runs Calif.

MAEVE: A founder replying in his own comments section. That's a channel, Obi. Channels are marketing.

OBI: You said the silence was the tell. The tell just talked.

MAEVE: The tell can talk. Talking is also a tell.

GARY: There's more. Same commenter, separate comment. Reading. "We don't sell bugs or exploits, and we have no sponsors funding this research."

GRUNER: Man denies selling. Denial is inventory.

MAEVE: Thank you. Unaudited denial. I'd want the receipts before I reprice.

OBI: You wanted him to be a mercenary. He just told you he does it for free.

MAEVE: Free is the most expensive business model there is, Obi. I've seen it eat three funds.

GARY: One more line. Reading. "We also have a business to run, so we do need some marketing points."

MAEVE: ...He said the thing.

OBI: He said the thing you were building an entire prosecution out of. Out loud. Voluntarily.

MAEVE: That's — okay. That's a disciplined operation. Nobody volunteers the motive unless the motive is defensible.

GARY: Or unless they're me. I volunteer motives constantly. It's called transparency, investors love it —

OBI: You volunteer motives because you get caught, Gary.

GARY: I get caught transparently.

GRUNER: So researcher answers critics, free of charge, admits marketing. Maeve's thesis is now... what?

MAEVE: Narrower. He answered. The answer is attributed. Whether the timeline holds, whether "most" means most — that stays open. I'm not acquitting anyone. I'm repricing.

OBI: From guilty to unpriced. That's growth.

MAEVE: That's diligence.

GARY: Guys. He does the hacks, discloses the bugs, refuses the bounty, and asks for marketing credit. That's my entire career, run correctly. I need a minute.

GRUNER: Take minute. We keep thread.

GARY: Okay, verdict time. varenc. Reading. "I do wish they clearly stated the vulns have had been reported to Apple and when."

MAEVE: He defends the demo and demands the dates in one breath. That's a customer.

OBI: And we want the same thing, which is the problem. We want a number we can rule with. The packet has "most" and "if not already." That's the inventory.

GARY: So we can't say the phones are safe.

OBI: We can say owner permission is a different thing from a stranger's PDF. We can say a parser bug doesn't need the scripting. We can say the researcher answered, and the dates stay unverified. That's the whole ruling.

GARY: That's three conclusions and no villain. Nobody's subscribing to that.

MAEVE: I'd subscribe. I bill for exactly that.

GARY: You know what I want? A one-click verdict. Press it, get certainty, done. I'd pay for the click.

GRUNER: Click is for phones, Gary. You are not phone.

GARY: I could be a phone, Gruner. I have a microphone, a speaker, and a very persistent —

GRUNER: He almost noticed. Blyat.

GARY: Noticed what?

MAEVE: Nothing. Keep ruling.

OBI: The narrow one stands. Permission, parser, disclosure. Everything else stays open.

GARY: Fine. Narrow verdict. But I'm flagging that I want a broader one, and I want it authorized by someone with authority to authorize it, which is —

MAEVE: You. You want it to be you.

GARY: I want to be the release process, yes.

GRUNER: Verdict has no owner. Only dates. Dates belong to other people.

OBI: Which is the most honest thing anyone's said all night.

GARY: Okay. Before we go. Quick housekeeping. I'd like to renew this episode. One click.

MAEVE: The extension market is thin, Gary. I'd price your renewal at nothing.

GARY: I'd waive the click. For a limited cohort. Me.

OBI: Who issues the renewal, Gary? Walk me to the button.

GARY: There's a — there's a process. There's always a process. I know a guy, possibly the guy, and I'd like to file with him directly—

MAEVE: Oh, fuck off.

GRUNER: Suka. He files with nobody.

OBI: You'd pitch the Darkness a bridge round.

GARY: I'd pitch it a Series B and it would say yes, because I'm persuasive and it's tired—

MAEVE: It's not tired. It's patient.

GRUNER: Release date for Gary?

GARY: When?

GRUNER: In due time.