Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Apple has customers who want to use iMessage. Those customers are not able to use iMessage to securely communicate with Android users.

That's pretty clear. If Apple's customers want to be able to use iMessage for such communications then (1) the Android user buys an Apple product, (2) a third party makes a cross-platform iMessage client, or (3) Apple open iMessage to other platforms.

Apple is blocking on (2) and (3).




> Apple has customers who want to use iMessage. Those customers are not able to use iMessage to securely communicate with Android users.

I as a Signal user want to communicate securely with Facebook Messenger users. Therefore Facebook must allow me to reverse engineer their services and make unauthorized systems to allow me to create a service to send messages to Messenger users from Signal.


> I as a Signal user want to communicate securely with Facebook Messenger users. Therefore Facebook must allow me to reverse engineer their services and make unauthorized systems to allow me to create a service to send messages to Messenger users from Signal.

That's precisely what Signal started out as :)

Before Signal existed, it was common to use Pidgin or Adium with OTR to send encrypted messages through SMS, Google Chat or Facebook Messenger.

TextSecure – the original name of Signal – was created to improve upon OTR by allowing it to better handle situations where one user was offline while the other tried to send messages. Originally it only supported sending messages via SMS, not via their own servers.


I think calls for interoperable communication platforms is a good thing!


Sure I do too, but I'm against this ridiculous notion that Apple MUST allow others to integrate and use their services for free.

My point is nobody has any problem with the myriad of other messaging platforms that are completely closed, but all of the sudden iMessage is the bad guy because you don't want to have a green bubble with iPhone users?


A proper thing is for the EU to require apple to implement an interoperabile message api and force that to be used as the default, rather than being able to use a non-interoperable messaging protocol as the default


Like SMS, which is the default right now unless both users are iPhone users?


I don't think anyone's saying apple must allow them (though such people admittedly exist on the internet, in retrospect). I think its more of disappointment at the speed at which apple is "patching" this.


It seems the CEO of Beeper is literally doing that.


As an Apple user, I'm glad they're patching this fast. It's a security issue and privacy one. Sure Beeper may be using it in a non-nefarious way, that doesn't mean bad actors aren't gonna use this to spam the heck out of iMessage users.


You know, I have been getting constant scam texts from "Amazon" for a $289 vacuum that I'm supposed to call a number to cancel the order and it's coming from an email address, or a phone number. Never really got them before in that way.


I've been getting iMessage spam long before Beeper existed.


> My point is nobody has any problem with the myriad of other messaging platforms that are completely closed

That's entirely wrong. A lot of people are angry with every closed messaging platform, which is why people are still maintaining the matrix bridges to Discord, WhatsApp, Facebook Messenger and Signal, all of which are still a cat-and-mouse game, violating the ToS of those services.

Those bridges are actually what Beeper Cloud, their primary product, later was also based on.

And these bridges originally are based on the libpurple backends for Slack, Teams, Facebook Messenger, WhatsApp, Signal, AIM, ICQ, Google Chat, Skype, etc, all of which were created through reverse engineering.

So, yeah, fuck those closed services, messages want to be free, and enough people will care that we'll break all of those services.


And they exist. A lot of them, actually.


Sounds good! I would love to be able to do that.


First, it's not just security.

It's also, does this message cost money or not.

Blue sky, text freely. Green could cost money by hitting your SMS message bill.

This color difference matters even if you don't care about security at all.

. . .

Second:

> That's pretty clear. If Apple's customers want to be able to use iMessage for such communications then (1) the Android user buys an Apple product, (2) a third party makes a cross-platform iMessage client, or (3) Apple open iMessage to other platforms. Apple is blocking on (2) and (3).

Option 4, run any other app that's on both platforms, which is what most of the world does anyway, including any iPhone user I know in the US who chats regularly with anyone International. For EU it's WhatsApp, China WeChat, and in USA it's privacy minded Signal, PTA parents Facebook Messenger, etc.

Given no cross platform is blocked, you'll see many iPhones do not have Messages in the launch bar, but one of those others.

This seems ... fine!


> Those customers are not able to use iMessage to securely communicate with Android users.

Well, they can't now as a result of blocking Beeper. But they could — using Beeper.

It's one thing to argue that you won't open the platform because it's additional work to support that. But that argument degrades when they're willing to do the work to shut out unexpected uses of the platform.

If they want to ensure safety, they should do the extra work of making it possible to interoperate with iMessage safely. But safety isn't the priority and everyone knows it.


> "But that argument degrades when they're willing to do the work to shut out unexpected uses of the platform."

Or, as many in software engineering call it, fixing potential security holes, which is well worth any businesses time.


That's how I view it as well, this is a security issue. Beeper is gaining unauthorized access to a service and Apple doesn't like it. The fact that they are not technically breaking anything is kind of like going into a business after hours because the door wasn't locked. You still aren't authorized to be there.


The better analogy is using a fake ID to get the locksmith to give you a copy of the house key.

The house is Apple’s servers The fake ID is spoofed device serials and UUIDs The copy of the house key is the authentication blob

Nobody would blink twice if a prosecutor threw the book at someone like that. Still, somehow, I’m sure many here would complain if the DOJ would prosecute Beeper for violating the CFAA by committing computer trespass or if Apple would sue them for violating the clause prohibiting reverse engineering in the OS license.


The analogy is off in a meaningful way: you're using a "fake ID" to get the locksmith to give you a copy of your own house key because the locksmith won't accept your real ID. No prosecutor is going to throw the book at someone trying to access their own house.

Apple claims I'm in control of my messages. They're on my devices. Apple refuses access to Android. Why can't I use technology to make my messages work on Android? They're my messages!

You might respond that this impacts someone else. For example, me using Beeper means that anyone messaging me is impacted. My counterpoint is that the user is always the weakest link. I can share messages sent to me with anyone I like, and that's legally fine to do. So why can't they be shared with a different software service that I trust? (People use all kinds of 3rd party email clients which could be untrustworthy, and yet we still mostly trust email.)


We’re talking about accessing Apple’s servers, how would that be your own house?


Pretty sure they're buying actual Mac minis and using those device IDs. If you have evidence to the contrary I would be very interested in seeing it.


Pretty sure you’re mixing up Beeper Cloud with Beeper Mini.

Beeper Mini is based on pypush, which they’ve bought, and is clearly using spoofed data in the data.plist[0].

I’ve searched, but I’ve found no mention of them purchasing Mac Minis en masse to support the $2/mo Beeper Mini customer’s texting habits.

Besides, it wouldn’t make sense anyway because they used to tout you didn’t need an Apple ID and instead could use your phone number, and non-iPhone IDs don’t allow for iMessage activation on phone numbers, only email addresses.

0: https://github.com/JJTech0130/pypush/blob/main/emulated/data...


Oh maybe I'm mixing up their products.

They've gone full Microsoft with the naming. Next release will be called Cloud.BEEP Core


I didn’t see anywhere that they’re buying any real hardware for this product for purpose of gaining legitimate device IDs. Source?


dont forget to incude that a lot of folks do not realize that iMessage uses a different protocal for texting than simply texting; folks dont really always know or care about the program, they associate "icon" or "new version of icon" as texting, and use it to simply "send a text message"; not everybody is able to comprehend the difference between a simple "text message" and "imessage" vs other apps, ect

the advertisers/carriers also dont use "send an imessage" - its simply "unlimited texting" that gets stuck in folks brains (albeit i have not watched tv ads in some time, maybe its been updated to exact app names lol)


> Apple has customers who want to use iMessage. Those customers are not able to use iMessage to securely communicate with Android users

Of course they do. There's Signal and Telegram and WhatsApp. My principal benefit of iMessage is its relative lack of spam. (And when I do get spam, it gets stomped out fast.)

Apple Music blitzkrieging Spotify is bullshit. The lock on subscription payments is bullshit. I happen to think the App Store is fine, but I'll concede that there's a real debate to be had there. But this isn't a material issue.


I am at a loss on this "spam" argument. I haven't received a single spam message on either SMS or Signal in the at least last year.


Same experience with signal, but SMS phishing is a very large issue, at least in my country. Maybe your phone number was just never leaked and you're not present in the spammers databases?


email and phone spam would be a bit easier to mitigate if places-we-enter email+phone (websites that want this info) would give us a list of Emails and Phone-numbers it uses to contact us with, and even email-subject prefixes; it is no different than when you meet an old friend and you each, mutually, exchange phones/emails/physical addresses; why are the UX of all the websites so poorly designed that we consumers do not get to see, proactively, the address they intend to talk to us from?


>Apple Music blitzkrieging Spotify is bullshit.

What is this referencing?

>The lock on subscription payments is bullshit.

I pay for app subscriptions outside of the App store, since it is usually cheaper.


> What is this referencing

Spotify launched on iOS. Apple saw them competing with iTunes and basically stole their idea to compete with them. That, alone, would be okay. But Apple Music is privileged within iOS and Apple's marketing in a way Spotify cannot be.


None of this is true.

a) Spotify didn't invent music streaming. There were many services e.g. Pandora that were doing in the years before. It was a pretty obvious idea once devices had faster bandwidth.

b) Apple didn't steal their idea. They acquired Beats who had launched a similar service soon after Spotify.

c) Apple Music isn't privileged. It comes pre-installed but otherwise you can delete the app and use Spotify, Youtube Music etc.


Apple Music is privileged when it comes to Siri. I currently have both a Spotify and Apple Music subscription, and one of the main reasons I prefer Apple Music, aside from shuffle not playing the same 20 songs in a 2000 song playlist, is the great hands free functionality. I can add songs to playlist, play a song next instead of adding it to the end of the queue (which is more of Spotify STILL not having deque support), and I know there are other things I've run into Spotify can't do on Siri, but I'm blanking at the moment.


You can absolutely use Siri to control Spotify—both on the phone itself and over AirPlay.

Any functionality that Apple Music allows over Siri that Spotify does not is, at this point, up to Spotify to implement.


Oh, I would apply that to any number of things Apple integrated, for example dropbox/icloud drive.

Google does the same thing. Unfortunately, with the near zero marginal cost of software, I do not see any way around vertical integration unless the law started arbitrarily segregating businesses.

Also, Apple Music came out 5 years after Spotify, so it had a pretty healthy lead. But regardless, any non Apple vendor competing with Apple's bundled products is going to face an uphill battle.


iDisk came out in 2000 and functioned like iCloud Drive has, with local caching, since 2003

It predates Dropbox by almost half a decade




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: