Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Those customers are not able to use iMessage to securely communicate with Android users.

Well, they can't now as a result of blocking Beeper. But they could — using Beeper.

It's one thing to argue that you won't open the platform because it's additional work to support that. But that argument degrades when they're willing to do the work to shut out unexpected uses of the platform.

If they want to ensure safety, they should do the extra work of making it possible to interoperate with iMessage safely. But safety isn't the priority and everyone knows it.



> "But that argument degrades when they're willing to do the work to shut out unexpected uses of the platform."

Or, as many in software engineering call it, fixing potential security holes, which is well worth any businesses time.


That's how I view it as well, this is a security issue. Beeper is gaining unauthorized access to a service and Apple doesn't like it. The fact that they are not technically breaking anything is kind of like going into a business after hours because the door wasn't locked. You still aren't authorized to be there.


The better analogy is using a fake ID to get the locksmith to give you a copy of the house key.

The house is Apple’s servers The fake ID is spoofed device serials and UUIDs The copy of the house key is the authentication blob

Nobody would blink twice if a prosecutor threw the book at someone like that. Still, somehow, I’m sure many here would complain if the DOJ would prosecute Beeper for violating the CFAA by committing computer trespass or if Apple would sue them for violating the clause prohibiting reverse engineering in the OS license.


The analogy is off in a meaningful way: you're using a "fake ID" to get the locksmith to give you a copy of your own house key because the locksmith won't accept your real ID. No prosecutor is going to throw the book at someone trying to access their own house.

Apple claims I'm in control of my messages. They're on my devices. Apple refuses access to Android. Why can't I use technology to make my messages work on Android? They're my messages!

You might respond that this impacts someone else. For example, me using Beeper means that anyone messaging me is impacted. My counterpoint is that the user is always the weakest link. I can share messages sent to me with anyone I like, and that's legally fine to do. So why can't they be shared with a different software service that I trust? (People use all kinds of 3rd party email clients which could be untrustworthy, and yet we still mostly trust email.)


We’re talking about accessing Apple’s servers, how would that be your own house?


Pretty sure they're buying actual Mac minis and using those device IDs. If you have evidence to the contrary I would be very interested in seeing it.


Pretty sure you’re mixing up Beeper Cloud with Beeper Mini.

Beeper Mini is based on pypush, which they’ve bought, and is clearly using spoofed data in the data.plist[0].

I’ve searched, but I’ve found no mention of them purchasing Mac Minis en masse to support the $2/mo Beeper Mini customer’s texting habits.

Besides, it wouldn’t make sense anyway because they used to tout you didn’t need an Apple ID and instead could use your phone number, and non-iPhone IDs don’t allow for iMessage activation on phone numbers, only email addresses.

0: https://github.com/JJTech0130/pypush/blob/main/emulated/data...


Oh maybe I'm mixing up their products.

They've gone full Microsoft with the naming. Next release will be called Cloud.BEEP Core


I didn’t see anywhere that they’re buying any real hardware for this product for purpose of gaining legitimate device IDs. Source?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: