Interesting that this company is able to do this without threat of being sued into a smoking crater by Apple. They'd have to use Apple's software to build their product, and to do that they'd be bound by the license agreement. Apple could forbid the research in the license.
Oracle created the DeWitt Clause that forbids researchers from publishinging benchmarks for their products, and this apparently stands up in court. I have to imagine Apple could forbid researching and building exploit tools just as easily.
"Oracle created the DeWitt Clause that forbids researchers from publishing benchmarks for their products, and this apparently stands up in court."
Was this "DeWitt Clause" ever challenged specifically in a trial? If yes, can you give us some details, e.g., date, the name of the opposing party, the venue, etc.?
If it has never been challenged specifically, and gone through litigation all the way to a trial, can we honestly say "it stands up in court"?
For example, if there was a lawsuit for breach of license agreement based on publishing results in violation of the "DeWitt Clause", the defendant might argue that clause was unenforceable.
It might be possible to require a publication delay as a condition to a license, but an outright ban on publication might not be enforceable. The only way to know for sure is a lawsuit that goes to trial. Of course, even if we never actually find out because it never actually is the basis of any litigation that goes to trial, inclusion of a "DeWitt Clause" in a license could still intimidate licensees and effectively discourage publication.
The 2002 story linked on the Wikipedia page for "DeWitt Clause" mentions a telephone call to DeWitt's employer asking for him to be terminated. However it says nothing about a lawsuit based on breach of this particular "DeWitt Clause".
I'm no lawyer but it seems to me the world is awash with contracts that include agreements by one or more parties not to disclose something or other. What's the sort of thing that would make this particular one 'not enforceable'?
There are copyright exceptions for security researchers. Apple can block access to their network services, but I doubt they can do legal action, at least not based on copyright laws. Of course in this particular instance it sucks, but in general, such exceptions are very valuable as they allow researchers to find out about vulnerabilities and warn the public without being impeded by the manufacturer.
The research is mostly in Apple's interest - someone does free work for them. If 'security and privacy' are features you are selling to consumers, 'we sue everyone who fiddles around' is much less convincing messaging than 'we try to make the most secure device we can and if it's compromised, we fix it'.
Interesting that this company is able to do this without threat of being sued into a smoking crater by Apple.
Consider whether a company such as https://www.blackbagtech.com/ (specifically products like MacQuisition) can exist without active support from Apple.
Comments
Interesting that this company is able to do this without threat of being sued into a smoking crater by Apple. They'd have to use Apple's software to build their product, and to do that they'd be bound by the license agreement. Apple could forbid the research in the license.
Oracle created the DeWitt Clause that forbids researchers from publishinging benchmarks for their products, and this apparently stands up in court. I have to imagine Apple could forbid researching and building exploit tools just as easily.
"Oracle created the DeWitt Clause that forbids researchers from publishing benchmarks for their products, and this apparently stands up in court."
Was this "DeWitt Clause" ever challenged specifically in a trial? If yes, can you give us some details, e.g., date, the name of the opposing party, the venue, etc.?
If it has never been challenged specifically, and gone through litigation all the way to a trial, can we honestly say "it stands up in court"?
What would the nature of that specific challenge be?
For example, if there was a lawsuit for breach of license agreement based on publishing results in violation of the "DeWitt Clause", the defendant might argue that clause was unenforceable.
It might be possible to require a publication delay as a condition to a license, but an outright ban on publication might not be enforceable. The only way to know for sure is a lawsuit that goes to trial. Of course, even if we never actually find out because it never actually is the basis of any litigation that goes to trial, inclusion of a "DeWitt Clause" in a license could still intimidate licensees and effectively discourage publication.
The 2002 story linked on the Wikipedia page for "DeWitt Clause" mentions a telephone call to DeWitt's employer asking for him to be terminated. However it says nothing about a lawsuit based on breach of this particular "DeWitt Clause".
I'm no lawyer but it seems to me the world is awash with contracts that include agreements by one or more parties not to disclose something or other. What's the sort of thing that would make this particular one 'not enforceable'?
There are copyright exceptions for security researchers. Apple can block access to their network services, but I doubt they can do legal action, at least not based on copyright laws. Of course in this particular instance it sucks, but in general, such exceptions are very valuable as they allow researchers to find out about vulnerabilities and warn the public without being impeded by the manufacturer.
The research is mostly in Apple's interest - someone does free work for them. If 'security and privacy' are features you are selling to consumers, 'we sue everyone who fiddles around' is much less convincing messaging than 'we try to make the most secure device we can and if it's compromised, we fix it'.
What's the turn around time on them fixing the exploit?
The Boston bomber had a years old iphone that they eventually got cellebrite to decrypt.
It comes across as LE access by stealth rather than transparently handing over data upon request.
Consider whether a company such as https://www.blackbagtech.com/ (specifically products like MacQuisition) can exist without active support from Apple.