Hacker News new | past | comments | ask | show | jobs | submit login
The Bay Area German bar that brought down Apple’s famed iPhone security (sfgate.com)
154 points by wallflower on June 11, 2023 | hide | past | favorite | 89 comments



> “Powell kept his job in spite of the lost prototype and worked on Apple’s iOS software for another seven years before leaving the company in 2017.”

There’s actually a photo, taken as a joke, by Steve Wozniak you can find online. It shows him drinking a beer, holding an iPhone in the other hand, and he’s wearing a T-Shirt that reads: “I went drinking with Gray Powell and all I got was a lousy iPhone prototype.”

https://www.cnet.com/tech/tech-industry/woz-has-fun-with-lea...

Thankfully, it appears Steve Jobs took his wrath out at Gizmodo than Powell.


It's interesting to look back at the commentary on HN from then: https://hn.algolia.com/?dateEnd=1323561600&dateRange=custom&...


I had to read this sentence a few times before I realized it was the decision and not the child: "My wife and I even decided to have our third child on our way to a dinner at Gourmet Haus Staudt."


My first read was that it was the copulation.


Both reads could be correct. It's not uncommon for the decision to have a child to be immediately followed by an attempt at conceiving it, or for that decision to be made during the attempt.


The site guilted me into turning off my adblocker. I’m sympathetic to local media outlets.

My god. That site is comically unusable. There is just no way to read an their article in peace.

So when they, too, inevitably have to fold, let it be known, I tried.


SFGate was originally the online version of the SF Chronicle, starting in the 90's. For whatever reason, they wanted a distinct online brand. Now the online version of the Chronicle is hosted at sfchronicle.com and SFGate continues on under the same ownership (Hearst) as its own clickbaity thing. Not much in the way of original reporting.


I know SFGate as the San Fransisco newspaper website that for some reason comes up when you google for questions about repairing old homes. Seems like they're spending their entire SEO budget on lath and plaster repair guides.


Yeah I renovated my home to SFGate code


I tried turning off Adblock and wow.... I didn't even mind the ads, but the loading just never stopped. Some of the article images wouldn't load because they were trying to load so many ads.


I believe Firefox/Mozilla use sfgate as a stress test.


SFGate has been a notorious test site for Chrome web performance folk too. Here's a perf audit from 8 years ago: https://docs.google.com/document/d/1viSX0vNYPeDB9iWLaOyAg6Fa...


NLtimes.NL can serve as a European contemporary for this stress test. Absolutely unusable without an adblocker.


It was sure a good stress test for my eyes.


Oh good gravy I just tried. It’s over 50% ads.


Everyone involved should feel bad and really if this is the only way for them to figure out how to survive, they should just go out of business.


Media used to exist based off of classified ad sales, then tech companies absorbed all that cash flow. After that, most local media died.


> It’s over 50% ads.

Like 1999…


European here. I clicked the privacy pop-up and did not accept the ad and tracking cookies. No ads..


No ads (adguard..), loads instantly, also in Europe

edit: it seems that the Americans get our ads too, ah sweet schadenfreude


Europe currently, no pop ups, no ads. And no place holders. Page loads fast.


You owe them nothing and the guilt you feel is an exploitation of your courtesy.


That's because you haven't tried Mercury News.


Try the EFF's Privacy Badger. I didn't see any ads there. Just click "Continue without Disabling".


I tried too. Awful. And the biggest chumbox I've ever seen in my damn life at the bottom.


”Show Reader” in iOS does a great job of showing you the actual content without having to interact with all that garbage — I presume the “reader” functionality in most other browsers does too.


Interesting. I turned off my adblocker out of curiosity but I'm not seeing anything special. Coming from the EU though, maybe that has something to do with it.


Funnily enough, I get the GDPR pop-up, agree to nothing and the site is readable


Man if y’all think this is bad try tom’s hardware. It usually crashes chrome on iOS for me after reloading on its own


Firefox mobile's reader mode was usable


I had no problems using 1Blocker for iOS in Safari and no guilt trip or ads.


If you have an Apple News/One subscription you can read it as this link. Much more readable, and the publisher still gets ad revenue:

https://apple.news/AlNrxUYEHQPGfrBna1YfVqQ


I had to delete Apple News because Apple was forcibly inserting its own channels that I could not remove or say “Not Interested”, which you can normally do for all other channels. I recall they were BLM and COVID19; sorry that I don’t want politics shoved in my face every day. Why can’t I choose what I want to see?


Google news is the same. At some point it decided that I must follow every sniff and fart coming from a certain electric car tycoon, and there was no negotiating.


You can. First you can just use it like Reader Mode. Safari -> share menu -> open in News for any HN link you click on that has too many popups.

Or, in the News following tab, click Edit, remove all “suggested by Siri” topics, and block low-quality channels. I blocked the National Review, WSJ, USA Today, and People Magazine and my feed got a lot better.


No, you can’t remove the “Special Coverage” section, which you can’t unsee in the macOS app.

https://discussions.apple.com/thread/251600920


Click on the special coverage section -> three dot menu -> block channel.

Or better yet, just don’t use their feed.


I did that for their World Cup coverage, and it did not block the channel. There was a World Cup banner with scores and stuff for a month. At that point I noped out and haven’t touched it since.


“I’m not interested in facts I don’t agree with”


Are they actual facts though? We know now several of the “facts” were wrong, bordering on lies.

Trust is hard to gain and very easy to lose.


They were the best information they had at the time based on a new disease in the case of Covid.

Are you also as dismissive of Newton because Einstein showed he wasn’t entirely correct?

And as far as BLM, I understand that people don’t want to tell their little Timmy that officer friendly, is less friendly to minorities and have always been.


Not so. We have centuries of experience with respiratory disease, and nothing turned out substantially different in the end. I made this statement when they closed our beaches.

Also the don’t-mask/mask thing was an outright lie. Huge mistake that gave nuts a foothold.


Did as many people die from the common cold as died from Covid? Are you also claiming that medical grade mask like those used by hospitals don’t work?

And yes I’m sure “centuries ago” when they didn’t even understand germ theory they knew about viruses and how to treat diseases using DNA sequencing and mRNA


I'm claiming the opposite. Lying about that made the year a disaster.


Ahh my bad. I think we are in “violent agreement” then.


Because Apple, not you, owns your phone.


My god that is so much better.


Reader mode every time.


This is functionally no different to using an adblocker for the site.


Its better because it gets rid of crap layout


I use it in conjunction with an adblocker.

For sites that I repeatedly visit, I pay for them. Substacks and local newspapers for example.

As a one-off if I can’t adblock or reader-mode, it ain’t worth my time.


> My god. That site is comically unusable. There is just no way to read an their article in peace.

Lurk more f.....

https://archive.is/JngjW


Uh, I have ublock origin and such...

Site is clean as a whistle for me:

(zoomed all the way out so you can see the whole page:

https://i.imgur.com/I4EaG3A.png -

Edit: I appear to have “wooshed” the point… Sorry fam.


So you didn't try at all.


The only interesting part of this article to me is what happened to Powell: he continued to work at Apple on iOS for another 7 years before leaving the company.

I also like this bit:

"Apple forced its own ban from the bar on Powell — though it doesn’t sound like that ban was enforced very strictly."

I wonder what that looked like.


Back when I joined Apple, this story was told in the orientation training.

I remember some sketchy details to the story that seem to have gone unmentioned but it has been a long time and I am very unclear on the specifics so I will not mention them here. Especially since Apple really cares about these kind of things.


I know Gray personally and have been able to hear the whole story from him, which is amazing and one of my favorite stories from the bay, ever. He's a great dude.


I have spent countless hours there over the years. It was an after work place everyone could agree on. As you change jobs over the years, you still end up there, and you will almost always run into someone you know.


Used to go there all the time - had no idea it was the bar where the iPhone prototype was lost (which happened long before I moved to the Bay).


> One of the first things Volker did after navigating the throng of TV reporters was email Jobs. “I email Steve, and I said, ‘Steve, this is what happened. What do you want me to do? Can you please reach out and let me know? How do you want me to handle the situation?’” he said, noting that Jobs’ email was readily available online.

Thought it a bit odd that one of the first things the bar owner did was email Steve Jobs. Like...why?


steve jobs had a reputation for responsiveness. i missed the warranty period by a couple weeks on my c2d imac and his office got me a free logic board replacement (priced ~$800 at the time)


Redwood, California? Was this article written by ChatGPT? Did a local human editor even read this?


I see spelling mistakes all of the time in print media, and they've had spellcheck for 30+ years.


I can see how "Redwood City" could become "City of Redwood", and then just "Redwood", through multiple steps. I had never heard of it before moving to norcal.


Neil Young, who lives nearby, called it simply "Redwood" in 1972's hit Heart of Gold. (I've been to Hollywood; I've been to Redwood.)


It's been fixed now.


Do human editors catch every mistake? No.


But a news site (SFGate) that purports to be local to the area should know the name of the county seat of one of the Bay Area counties.


I feel ridiculous having to explain this, but it's possible to know the name of a place and still get it wrong when you intend to write it down, or overlook a mistake when reading it over.


> the most infamous security breach

The XcodeGhost supply chain attack by the CIA infected a hundred million devices with malware. Quixun Zhaos chaos exploit chain took full control over iPhones from a drive by on a website and was used by china as part of the ugyhur genocide. And the cyberwar mercenary group NSO keeps targeting journalists and opposition around the world with what feels like an endless supply of exploits for apple devices.

But somehow the hype for the iPhone4 starting three month earlier than planned in 2010 is called the "the most infamous". Apple PR at it's best, telling people the worst that can happen is loosing a phone at a bar.


"Infamous" has nothing to do with scale. It's entirely based on how well known something is. This incident had worldwide attention almost immediately and for weeks. Many articles were written at the time, and followup articles since (some of which are linked here). By all definitions of the word, it tracks.


Yeah, it was embarrassing overreaction by Apple. It was just another iteration of the iPhone. This used to be a thing in the auto industry, with reporters trying to get pictures of new car styling. Now nobody cares. Same for phones. Version N+1 has rounder corners. Big deal.


Not all definitions. Mine may be a bit old school, meaning publicly disgraced. Yours is more modern meaning slightly embarrassing. Both share that fame means "being spoken of"

IMHO no one wants to be infamous, under the classical definition. Infamous people have a search warrant by the federal police. Infamous people are the ones your parents tell you not to interact with.

No matter how often the "no bad PR" mantra is spoken, Steve Wozniak isn't going to wear a t-shirt referencing what i would consider their most infamous security breach. He isn't gangster enough for a teardrop tattoo.


The definitions are irrelevant to the topic at hand, which is that nobody seems to have heard of the attack.

Something can’t be infamous (or regular famous) if nobody has heard of it, and that’s the issue people have with your claim.

It might be a “publicly disgracing” attack but that alone doesn’t make it infamous. It still has to be well known, and quite simply, the iPhone case is so well known that it’s practically impossible to beat.


I’ve heard of the 2010 one, not the other you mentioned.


Xcodeghost wasn't made by the CIA. It used a technique similar to one described in leaked CIA documents, but the author was a Chinese national.


Infamous is about notoriety, not scale. It’s not about what happened, it’s about who knows.


The notion that this was a "security breach" is weird. Did it contain private keys to production apple servers?


Physical security predates computer security by millennia


The implication of a loss of a physical gadget, no matter the hype that exists around it, has low intrinsincal security severity. If the object could be otherwise used to have severe impacts, that would be another story.


Companies have security protocols for whatever they want to protect. What they consider protecting is their business. New product prototypes, or just random possible product explorations are a common example. And the protocols they use (special enclosures, training people on how to not be obvious) are figured out the same way they are in computing, In fact the core terminology we use in computer security comes from physical security.

And security protocols go back thousands of years. You can read about them in ancient literature,


So leaks about future products isn't a security threat? I think it is. That could definitely affect the stock price. Depending on the leak, it could definitely be more of an impact than a ip or data security breach. What will people do with digitizer firmware source? Other than bad pr, what affects does a data breach of customer records have on a company?


It doesn't matter. Apple had IP they didn't want to leak, and it got leaked. That alone was a security breach.


Wouldn't call that security, no.


Security doesn’t only have to imply software / online security. There’s physical security as well, which this seems to be referring to.


The design was the big secret that all their security protocols were supposed to protect.

Revealing the design was the security breach.


Their security protocols were pretty lax, if they allowed someone to take a secret prototype to a bar, and to use it in the bar.


It had "development silicon" instead of "production silicon". At the very very least that means you can use `sudo` and `su` after logging in with the well known "alpine" credentials.


@dang this is a clickbait title. "iPhone security" is entirely misleading.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: