Second, the word “China” is conspicuously absent, once again demonstrating the value the PRC gets from their leverage over the world’s most valuable public company. To be fair, Google’s post also didn’t mention China. Their employees likely leaked attribution on background. Third, the pivot to Apple’s arrogant marketing is not only tone-deaf but really rings hollow to the security community when Google did all the heavy lifting here. I’m guessing we won’t hear Tim talk about how they are going to do better on stage next week. Dear Apple employees: I have worked for companies that took too long to publicly address their responsibilities. This is not a path you want to take. Apple does some incredible security work, but this kind of legal/comms driven response can undermine that work. Demand better.
Michael Tsai raises further questions about the way Apple framed its statement: “A blog,” rather than “a blog post”? I love how Apple is subtly trying to discredit Project Zero by implying that it’s a mere blog. And let’s be sure everyone knows it’s affiliated with Google, the privacy bad guys, even though it’s a responsible, technically focused group. Apple says: “First, the sophisticated attack was narrowly focused, not a broad-based exploit of iPhones ‘en masse’ as described.”Project Zero literally referred to “a small collection of hacked websites” that received “receive thousands of visitors per week.” And it does seem like a particular subpopulation was targeted “en masse.” The sites in question were on the public Internet; it wasn’t links being sent to target particular individuals. Apple is blaming the messenger for things it didn’t even say.
Apple adds: “The attack affected fewer than a dozen websites that focus on content related to the Uighur community.”
Oh, I get it. Most people would consider “fewer than a dozen” to be “a small collection.” But in Apple-speak, there were “a small number” of corrupt App Store binaries causing crashes, and “a small number” of MacBook Pro users experiencing butterfly keyboard problems, not to be confused with the “very small number” of iPhones that unexpectedly shut down. So, yeah, I can see why Apple wants people to know that this “small collection” doesn’t mean “millions.” Although there are apparently 10 million Uigurs in China. Apple adds: “Google’s post, issued six months after iOS patches were released[…] It’s great that Project Zero reported this in a responsible way, because now we can downplay it as old news.