Hacker News new | ask | show | jobs
by bri3d 4561 days ago
I don't think this really helps evad3rs build credibility.

They put a giant, user-facing blob payload into their jailbreak with no transparency about how it got there or what it is. Reading between the lines they were paid for it, but they don't even manage to come out and say that outright in this "letter."

There's always some level of faith involved in installing an early iOS jailbreak, because exploits often aren't documented or open-sourced until long after their release (for a variety of reasons - vanity, ripoffs, weaponization, etc.). But at least most of the jailbreaks released in the past have been transparent and configurable.

In the Dev Team jailbreaks, all userland packages were optional and if a user wanted, they could uncheck the "Install Cydia" box in the payload configuration, configure their own Cydia (because the source is open, imagine that!), or install a completely different set of user-land applications. Plus a variety of parties with various interests in the development community were given previous jailbreaks early, which provides at least a cursory level of auditing and sign-off. This evad3rs release offers none of these reassurances.

I certainly wouldn't call any iOS jailbreak "trustworthy" in the truest sense but this one is definitely the worst so far.

2 comments

I think one point you are making is unfair. Many (most?) previous jailbreaks not named PwnageTool or redsn0w have had a single, non-configurable payload containing Cydia and various Unix tools, with the understanding that once it's installed, the user can use Cydia to do whatever they want. In the case of my jailbreaks (years ago), I don't remember anyone ever expressing a desire for an alternate payload, presumably for that reason.

Of course there's a difference between Cydia and a closed source, less generally useful application that the jailbreakers were paid a large amount of money to include, but I wouldn't call it an issue of transparency/configurability as such.

Good point. I am unfairly using a subset of jailbreaks (PwnageTool and redsn0w) as an example of the community norm when that's really not the case.

I think the important distinction in the evad3rs release is indeed the one you make in the second paragraph of your post.

I do still think there's an issue of transparency, though: this letter carefully dances around the actual exchange of money for an unaudited blob in exchange for a lot of "we wanted to beat Saurik to a release" fluff.

Just to point out that evad3rs are basically the core group within the iPhone Dev Team. I wouldn't really trust future Dev Team jailbreaks anymore either.