5 ms·

Are you a person of high interest? I was under the impression that these sorts of breaches only happen to journalists, state officials, etc.

walterbell 7mo ago
Who knows? Does HN count as journalism :) I would happily pay Apple an annual subscription fee to run iOS N-1 with backported security fixes from iOS N, along with the ability to restore local data backups to supervised devices (which currently requires at least 2 devices, one for golden image capture and one for restore, i.e. "enterprise" use case). I accept that Apple devices will be compromised (keep valuable data elsewhere), but I want fast detection and restore for availability. GrapheneOS on Pixel and Pixel Tablet have been anomaly free, but Android tablet usability is << Apple iPad Pro. USB with custom Debian Live ISO booted into RAM is useful for generic terminal or web browsing.
- Melatonic 7mo ago
  First idea if great honestly - lots of vendors do this. I use Firefox long term stable and Chrome offers this for enterprise customers. Windows even offers multiple options of this (LTSC being the best by far). Would also make a great corporate / government product - I doubt they care about charging the average consumer for such a subscription (not enough revenue) but I can see risk averse businesses and especially government sectors being interested.
- MichaelZuo 7mo ago
  You can already do that? Apple offers that to all customers who open up an enterprise account and direct billing line.
  - walterbell 7mo ago
    You can already do that? Apple offers that to all customers who open up an enterprise account and direct billing line What's the name of the feature for Apple Enterprise customers that would allow iOS 18 to be installed on a newly provisioned device today? Downgrades are not supported by Apple Business Manager MDM and there's no reference to downgrades on the Enterprise page, https://www.apple.com/business/enterprise/ https://www.apple.com/business/enterprise/
    - MichaelZuo 7mo ago
      By definition you will have access to things Apple wont publish or support at subsidized rates below the fully loaded hourly cost of a senior engineer. Because you will be paying the full unsubsidized rate for any support needed for features not available to the mass market. Its like how IBM will gladly send a team of senior engineers to help enterprise clients resolve every last possible request. Edit: As compared to mass market features, where the economics dont work unless they’re close to 100% certain most users wont require any costly support.
      - walterbell 7mo ago
        Would the following be possible, in principle? - Signup for Apple Enterprise account with direct billing - Buy one hardware device direct via Enterprise account - Buy one MDM license for the hardware device - Sign contract for support at $500/hr, no minimum commitment - Get access to docs & tools for iOS 18 on new hardware (don't need support) Apple Enterprise Developer account requires 100 employees minimum, but Apple Enterprise does not.
      - walterbell 7mo ago
        > By definition you will have access to things Apple wont publish or support at subsidized rates below the fully loaded hourly cost of a senior engineer. If you're an Apple Enterprise customer, can you install iOS 18 on a new device today? It appears that enterprises can delay upgrade to iOS 18 post-enrollment, but cannot roll back to or provision iOS 18 on new hardware.
- throawayonthe 7mo ago
  could you please elaborate on how you determine that your devices have been breached? e.g. referring to "anomaly free" makes it sound like you might witnessing non-security related unexpected behaviour? sorry for the doubt, i'm curious
  - walterbell 7mo ago
    Explained at length below: after subjective indicator of possible breach, by monitoring, allowlisting and then deleting outbound network traffic sources (i.e. apps) on the device, then look closely at any remaining, non-allowlisted traffic, which should be zero. apps: https://news.ycombinator.com/item?id=46993016 https://news.ycombinator.com/item?id=46993016 | https://news.ycombinator.com/item?id=46997970 https://news.ycombinator.com/item?id=46997970 Apple: https://news.ycombinator.com/item?id=46994394 https://news.ycombinator.com/item?id=46994394

walterbell 7mo ago

Who knows? Does HN count as journalism :) I would happily pay Apple an annual subscription fee to run iOS N-1 with backported security fixes from iOS N, along with the ability to restore local data backups to supervised devices (which currently requires at least 2 devices, one for golden image capture and one for restore, i.e. "enterprise" use case). I accept that Apple devices will be compromised (keep valuable data elsewhere), but I want fast detection and restore for availability. GrapheneOS on Pixel and Pixel Tablet have been anomaly free, but Android tablet usability is << Apple iPad Pro. USB with custom Debian Live ISO booted into RAM is useful for generic terminal or web browsing.

Melatonic 7mo ago
First idea if great honestly - lots of vendors do this. I use Firefox long term stable and Chrome offers this for enterprise customers. Windows even offers multiple options of this (LTSC being the best by far). Would also make a great corporate / government product - I doubt they care about charging the average consumer for such a subscription (not enough revenue) but I can see risk averse businesses and especially government sectors being interested.
MichaelZuo 7mo ago
You can already do that? Apple offers that to all customers who open up an enterprise account and direct billing line.
- walterbell 7mo ago
  You can already do that? Apple offers that to all customers who open up an enterprise account and direct billing line What's the name of the feature for Apple Enterprise customers that would allow iOS 18 to be installed on a newly provisioned device today? Downgrades are not supported by Apple Business Manager MDM and there's no reference to downgrades on the Enterprise page, https://www.apple.com/business/enterprise/ https://www.apple.com/business/enterprise/
  - MichaelZuo 7mo ago
    By definition you will have access to things Apple wont publish or support at subsidized rates below the fully loaded hourly cost of a senior engineer. Because you will be paying the full unsubsidized rate for any support needed for features not available to the mass market. Its like how IBM will gladly send a team of senior engineers to help enterprise clients resolve every last possible request. Edit: As compared to mass market features, where the economics dont work unless they’re close to 100% certain most users wont require any costly support.
    - walterbell 7mo ago
      Would the following be possible, in principle? - Signup for Apple Enterprise account with direct billing - Buy one hardware device direct via Enterprise account - Buy one MDM license for the hardware device - Sign contract for support at $500/hr, no minimum commitment - Get access to docs & tools for iOS 18 on new hardware (don't need support) Apple Enterprise Developer account requires 100 employees minimum, but Apple Enterprise does not.
    - walterbell 7mo ago
      > By definition you will have access to things Apple wont publish or support at subsidized rates below the fully loaded hourly cost of a senior engineer. If you're an Apple Enterprise customer, can you install iOS 18 on a new device today? It appears that enterprises can delay upgrade to iOS 18 post-enrollment, but cannot roll back to or provision iOS 18 on new hardware.
throawayonthe 7mo ago
could you please elaborate on how you determine that your devices have been breached? e.g. referring to "anomaly free" makes it sound like you might witnessing non-security related unexpected behaviour? sorry for the doubt, i'm curious
- walterbell 7mo ago
  Explained at length below: after subjective indicator of possible breach, by monitoring, allowlisting and then deleting outbound network traffic sources (i.e. apps) on the device, then look closely at any remaining, non-allowlisted traffic, which should be zero. apps: https://news.ycombinator.com/item?id=46993016 https://news.ycombinator.com/item?id=46993016 | https://news.ycombinator.com/item?id=46997970 https://news.ycombinator.com/item?id=46997970 Apple: https://news.ycombinator.com/item?id=46994394 https://news.ycombinator.com/item?id=46994394