Talk:SHSH blob

WP:3O

I come here as a third opinion Wikipedian. I would like to point out that notability is not inherent. SHSH blob is not notable because its associated with iOS and barely deserves its own article. The only reason it does is because of the significant independent coverage it has received as a result of jailbreaking and exploits. With out, it struggles to find reliable and independent sources where it is the direct focus of the publication. I would either recommend keeping the section in full and possibly shifting the focus of the article to weight towards how its an important part of that aspect, or simply merge the information into iOS and iOS jailbreaking. At which point the remaining page (even with only the exploit information reduced) is a very likely candidate for WP:AfD -- it almost is as present a candidate for merge. Mkdw^talk 00:20, 30 December 2012 (UTC)

Thanks! I'm not entirely opposed to merging this material into iOS jailbreaking, but I'm not sure it'd fit, since this topic is associated with jailbreaking but not actually part of jailbreaking - you can cache and re-use SHSH blobs without ever exploiting the operating system on the device. Jailbreaking older iOS versions is the primary reason for fooling around with SHSH blobs, but other reasons include testing apps on older versions and reverting if you don't like the newer iOS version. I think it'd be weird to put more than a sentence or two about this topic into iOS though, since like you've noted, this protocol is a tiny part of iOS. A while ago I thought about merging this material into Hardware restrictions#Apple devices (see its talk page), but now I think it has too much detail to fit neatly into that article. Would you be up for explaining the other idea a little more - "shifting the focus of the article to weight towards how its an important part of that aspect"? Do you mean adding more material about exploiting the protocol, and revising the introduction to explain that the exploits are the notable aspect? Dreamyshade (talk) 01:34, 30 December 2012 (UTC)

I think regardless of where you decide to merge the information, at present the current article barely has enough to warrant a standalone article. All the sources are about exploits. As such, you could probably keep everything as it is, but the alternate proposal to make the article more about the technical data and less about the exploits seems not to be supported by the coverage and thus WP:BALANCE. I haven't heard from the other editor, which I would like, before going any further. Mkdw^talk 06:28, 30 December 2012 (UTC)

OK, I'll post on their talk page to invite them back. It sounds like you agree that the balance tag should remain on the article for now; any thoughts on the primary sources and NPOV tags? Dreamyshade (talk) 07:52, 30 December 2012 (UTC)

I'd also be interested in opinions on this phrasing change intended to help with neutrality - the results seem equivalent in neutrality to me but a little more confusing/unclear, but I know I'm COI, so it's hard for me to tell. And an unrelated issue I just noticed is that early articles about this topic refer to it as "ECID SHSH" instead of "SHSH blobs" (see here, here, and here), so the article should probably include both phrases. Dreamyshade (talk) 20:59, 30 December 2012 (UTC)

I agree that this technical jargon is not notable enough on its own merits to warrant a stand alone article and I think that it more or less serve as a vehicle to spread names of iPhone tampering software, their developers, and direct stake holders like Cydia which stands to gain from sell of Apps through its program. Cantaloupe2 (talk) 22:46, 30 December 2012 (UTC)

Just for reference, here's how the article looked before I revised it based on sources. The content was approximately the same as in the current version, minus some technical details that I removed since I couldn't find secondary sources to confirm them. For example, it'd be great to include details on early iBEC and iBSS caching tools from July 2009, but George Hotz's original blog post is no longer available, and the remaining sources are weak: iHackintosh tutorial, another iHackintosh tutorial, ModMyi copy of Hotz's post, iClarified tutorial, another iClarified tutorial, GDGT forum post, Dev Team blog post, etc. I believe my COI mostly applies here in influencing my thinking that this topic is interesting/significant; publishing technical and historical details about this topic doesn't really help users install Cydia, since the article doesn't include how-to information (note that actually saving and using SHSH blobs requires rather complicated and unintuitive steps, not suitable to include in an encyclopedia article). Dreamyshade (talk) 23:41, 30 December 2012 (UTC)

They're all poor quality quasi-anonymous websites, especially the ihackintosh one which is registered to an unqualified individual person. I counted CYDIA mentioned four times in the article, and repeated references in citation to SaurikIT the company you work for. I see this article as extension to Cydia to disseminate its presence into other articles. Cantaloupe2 (talk) 05:49, 31 December 2012 (UTC)

I agree on the weakness of those sources. This article had four mentions of Cydia before I started editing it, and four mentions of Cydia after I revised it; it's just part of the topic, which you can verify by reading the sources. It has three references to one post by the Cydia developer, but I think that makes sense for referencing technical information because of his expertise in this subject and Cydia's role in SHSH blob usage, and each use of that reference is accompanied by an additional reference. Dreamyshade (talk) 06:31, 31 December 2012 (UTC)

I find the presence of "Cydia" as an example as a form of masqueraded product placement. "To subvert that system using a man-in-the-middle attack, Cydia requests SHSH blobs from Apple for jailbroken devices and caches those SHSH blobs on Cydia's servers". The use of Cydia in explanation infers that use of that particular vendor of yours with COI is a requisite. Can this not be generized with the use of word like "platform" "interface" or "provider"? "Cydia" in this prose means two different things. First, it means the software, second the company. If you replace it with program and provider, then a source that is not tainted with Cydia, we'll have a neutral section. Cantaloupe2 (talk) 08:29, 31 December 2012 (UTC)

I like the idea of expanding that sentence to cover the general case as well as the common case; several of the article's sources discuss Cydia specifically, but it's not the only way to do this process. (Also note that Cydia is just the name of the software; the company is called SaurikIT.) Here's the current text:

"To subvert that system using a man-in-the-middle attack, Cydia requests SHSH blobs from Apple for jailbroken devices and caches those SHSH blobs on Cydia's servers, so that if a user changes the hosts file on a computer to redirect the SHSH blobs check to Cydia's servers instead of Apple's servers, iTunes would be tricked into checking those cached SHSH blobs and allowing the device to be restored to that version.^[1][2]"

Here's a revision:

"To subvert that system using a man-in-the-middle attack, a user can request SHSH blobs from Apple while a specific iOS version is being signed for a device, save those SHSH blobs, and then reuse them later to restore that device to that iOS version.^[2][3] On jailbroken devices, Cydia automatically requests available SHSH blobs from Apple and saves them on Cydia's servers,^[4][5] so that if a user changes the hosts file on a computer to redirect the SHSH blobs check to Cydia's servers instead of Apple's servers, iTunes would be tricked into checking those cached SHSH blobs and allowing the device to be restored to that version.^[2][6]"

Here are quotes from additional references to verify the usefulness of the expanded text:

• PCWorld 2010: "don't forget to back up your SHSH ‘blobs,’...Once you're jailbroken, it's easiest just to back them up through Cydia. Alternatively, this method, using a program called Firmware Umbrella, works whether or not you are jailbroken, and is a good idea if you haven't yet but think you might want to in the future."
• Ars Technica 2011: "Users can save their SHSH blobs using a tool such as Cydia or TinyUmbrella before upgrading to a new version of the OS so that they can eventually restore that specific device to that firmware via iTunes."
• MacWorld 2011: "For a downgrade to work, a redirect line must be added to the hosts file; the added line forces a connection to a Cydia server rather than Apple's server."

Dreamyshade (talk) 09:37, 31 December 2012 (UTC)

pulling aside prose for discussion over the coverage by brand name/COI SaurikIT "Cydia"

So, after reading the sources, it looks like Umbrella is simply a Java program for storing security hash locally and Cydia's role here is merely as a remote cloud backup. The author's site specifically mentions the lack of dependence on Cydia so you can still restore the device if Cydia capsizes. It is not deserving of by brand name mention. Does anyone else care to comment on this? My understanding from reading the sources is that devices simply need to think that it is "calling home" and the local or remote host emulate the host. Am I wrong?

As specifically stated on Umbrella's page, the utilization of CYDIA's service is not a requisite nor a critical part of this process. Cantaloupe2 (talk) 03:27, 4 January 2013 (UTC) In question:

Top Part:

For iOS 3 and 4, SHSH blobs were made of static keys (such as the device type, iOS version, and ECID), which meant that the SHSH blobs for a specific iOS version and device would be the same upon every restore. To subvert that system using a man-in-the-middle attack, Cydia requests SHSH blobs from Apple for jailbroken devices and caches those SHSH blobs on Cydia's servers, so that if a user changes the hosts file on a computer to redirect the SHSH blobs check to Cydia's servers instead of Apple's servers, iTunes would be tricked into checking those cached SHSH blobs and allowing the device to be restored to that version.^[1][2]

Bottom Part:

First released in 2009 (as TinyTSS and Umbrella),^{[3][4][dubious – discuss]} TinyUmbrella is a tool for finding out information about SHSH blobs saved on Cydia's servers, saving SHSH blobs locally,^[5]

You're right that TinyUmbrella doesn't rely on Cydia's servers, but it includes features for downloading and uploading SHSH blobs on Cydia's servers - in other words, it lets you work without Cydia's servers or with Cydia's servers, depending on your preferences and goals. The TinyUmbrella developer's FAQ has some information on this - see "are there any options or solutions to fix this problem?" and "How do I save my SHSHs on Cydia?" Dreamyshade (talk) 05:49, 4 January 2013 (UTC)

Another prospective target merge target is Cryptographic_hash_function or other articles that have something to do with digital signature keys. Mention of Cydia is unnecessary and the current state is WP:UNDUE over representation. Further research shows there are a handful of SHSH blob handling tools. iFaith, SHSH Extractor, Auto SHSH grabber and such. So from my reading, user can get Apple to sign the SHSH Blob for the device's iOS version or if Apple won't sign for it anymore, then it can be extracted from the device. I have no knowledge if there's any financial gain by SaurikIT, either through contract or indirectly for some backup program vendors from designating it as the preferred service provider, though if there is, it just thickened the degree of COI. Explicit mention of Cydia may sway users to use it in lieu of more established and reliable option such as Google Drive or other cloud backup setup. What I really don't understand is the motive behind remitting unique device ID along with the hash key to Cydia by default in some programs, as opposed to download to user's computer or have it sent as an attachment to user via email. I speculate there's some kind of financial incentive for Cydia in this transaction as I doubt they're donating the necessary bandwidth at their expense as a community service. This website which appears to be of comparable quality to some of sources within this article describes it in a very neutral manner. Dreamyshade, does CYDIA hold any financial or R&D stake in hosting this cloud service? Does Cydia touch(inspect) any of the files for development purposes?

"I simply think that I would rather have my shsh blobs on my personal machine AND on his server for safe keeping. This way if something happens to cydia, I can still restore my phone to the version I want to restore to. Plus I have the peace of mind knowing that my files are safely in my possession."2009 9 This is a very valid concern. Since Cydia is under no legal obligations to provide this service; aside from the user losing the cell phone; Cydia is also the weak link, and if for some reason the need for accessing the file increases due to some future event, there's nothing to prevent Cydia to require user to "buy" the only copy of file unique to the customer. Therefore, I present serious potential COI motive. Cantaloupe2 (talk) 07:30, 4 January 2013 (UTC)

I don't think this material would fit into cryptographic hash function - the protocol does include a hashing formula, but it's not particularly significant to the history of hashing formulas. It could probably be mentioned if that article had a list of examples of uses, but the article doesn't have that right now.

Yes, there are multiple tools that handle SHSH blobs, and I believe all the significant ones should be mentioned. Note that SHSH blobs can only be extracted from the device in limited circumstances - only on iPhone 4 and older devices, and only for the currently-installed iOS version.

SaurikIT maintains the SHSH servers because helping people preserve the ability to restore to older iOS versions means that people have more freedom to jailbreak their devices - in other words, so that even if they have to restore to fix a problem, they can restore to a jailbreakable iOS version instead of to the newest iOS version. saurik has discussed the economics of his work a few times - search for "SHSH" in this article from 2011 (which also says "Cydia's 'profits' largely go back to 'shoring up' the community...If I were somehow in this 'for the money' I would just be doing my old consulting job, which paid /much/ more, had more reasonable hours, and involved far less political negotiation") and this one from 2012. I'm not sure what you mean by touching/inspecting the files - the servers store them, and anyone can download them.

Regarding Google Drive - you need to use a specialized tool to save SHSH blobs, and you also need to use a specialized service or tool to use them; you could store them on Google Drive between saving them and using them, but you'd have to write your own saving and replaying tools or use the available ones (Cydia, Cydia's servers, redsn0w, TinyUmbrella, iFaith, iSHSHit, AutoSHSH, etc). MacHackPC seems to be a self-published blog by authors not recognized as reliable by any other sources, but that page also includes mentions of using Cydia and Cydia's servers.

Yes, a number of people use tools such as TinyUmbrella to make local backups of their SHSH blobs, which is sensible and not discouraged by anyone. I am a little puzzled by your speculation about Cydia someday charging for SHSH blob access; it sounds like it stems from being suspicious of my motives instead of being based on evidence. Dreamyshade (talk) 08:42, 4 January 2013 (UTC)

Yes MacHackPC looks SPS, but the phrasing is very neutral in the first paragraph and it was shown as an example. imore, givememind etc aren't necessarily personal homepage, but they're not quite up there as reliability published secondary source, because it often reflects the author's opinion and often time they're non-credential'd contributing editors.

I don't know why your motives, nor d I know why you have such vested interest on topics that go around SaurikIT's CYDIA. Am I not understanding it correctly that Cydia can disable access and hang users to dry at its discretion? Doesn't the accessibility get lost if Saurik IT is shattered? It's just my instinct that there's direct or long term indirect financial incentive behind this by SaurikIT to try to get users to do it this way, not necessarily, you as the editor. Cantaloupe2 (talk) 09:50, 4 January 2013 (UTC)

Perhaps you mean "such strong interest" instead of "such vested interest"? I believe I've explained that I find these topics personally interesting. I also like helping with these articles because I have an understanding of the material and some experience with technical writing for general audiences; I like contributing my expertise.

I agree that the iMore and GiveMeMind articles shouldn't be used as references; I just linked to them because they quote saurik explaining his reasons for working on Cydia and the SHSH servers - I believe they help explain that SaurikIT isn't really a traditional business trying to maximize profits. You're right that he could someday stop providing access to stored SHSH blobs; most maintainers of free services can choose to do that. If that happens, or if anything else changes related to the servers, it'll probably be covered by secondary sources, and then we can include that information in the article. Dreamyshade (talk) 01:06, 6 January 2013 (UTC)

Revision replacing "Cydia" with server/cache/third-party

I have a few concerns with this edit from yesterday ("since its been established that local storage, is an option and that the use of proprietary vendor Cydia is not a technical requirement, it has been genericized").

The previous version of the article didn't say that Cydia and Cydia's servers were required to save SHSH blobs or do SHSH blob restores, just that they are among the most notable tools for doing these things. For my effort to improve the article to make that more clear, see my comment at 09:37, 31 December 2012 (UTC) in #WP:3O, where I suggested rewriting part of the article to mention the general case before mentioning the Cydia-specific case. I don't think you responded to that suggestion though, so I don't know if you considered it insufficient in some way.

I believe that my comments in #WP:3O and #excess details in off topic area, undue weight, product placement have explained that Cydia's servers are the only notable SHSH blob servers, and that Cydia is notable as a tool for saving SHSH blobs. I can provide more lists of quotes from sources to support this if you like.

Another problem with this revision is that the sources don't support changing "Cydia" to "server" or "third party", since the sources specifically discuss Cydia and its servers. Dreamyshade (talk) 11:47, 9 January 2013 (UTC)

"Proprietary vendor" also seems like an unusual way to describe a piece of free open-source software and a free service run by a developer who has shared code and implementation advice with other developers of similar tools/services, even if it's all supported by a company. :) Dreamyshade (talk) 12:04, 9 January 2013 (UTC)

For reference, here's the TUAW chat post from September 2009 where saurik shared code for this: "Users who want to get this information from either my server or Apple's server need only make a standard Apple signature server request: if the firmware is "current" they can get it from Apple, and if not they will need to get it from me (if I have it stored, of course)...I will be offering a mechanism for users to do this more easily in the future, but for right now users who wish to do this can do so using the following Python program: http://svn.saurik.com/repos/menes/trunk/cysts/tss.py". The post has other background material that might be helpful too. Dreamyshade (talk) 03:06, 10 January 2013 (UTC)

Third opinion

Hi Dreamyshade and Cantaloupe2. Here is a third opinion for you.

1. Please note that I have no expertise in this area. I am not even an Apple user.
2. I do not think that the "Exploits and countermeasures" section is well-written to be understood by the general reader. Fixing it so that it gives clearer explanations of what different bit of software do and why people might want to do that should be given priority.
3. The current version with "server" replacing "Cydia" is no good at all. It doesn't even result in acceptable English and it is not clear what "server" is being talked about. This may involve moving content between paragraphs in the section.
4. Since Cydia is not the only application that handles SHSH blobs, and since caching them on a server does not even appear to a necessary part of the process, the content should be re-organised. Firstly, it should be explained that there are apps that will subvert the iOS process by cashing SHSH blobs. It should then be explained that there are services that will cash these to a dedicated remote server (eg Cydia). Stuff to do with bypassing iOS's auto-update fetish should also be mentioned (this is not currently mentioned, but seems to be an alternative way of handling what is currently described in paragraph 2 of the section - apols if this is my misunderstanding).
5. Once the content is made a little less wordsalady, I don't think it matters a great deal whether Cydia is mentioned or not. However, it should be made clear that it is a common application for a particular purpose, rather than a core and essential part of the jailbreaking process (recent versions of the article seem to have wrongly given this impression). Cydia does seem to be a standard enough part of the process, though, for a mention not to be UNDUE.
6. Please note that third opinions are not binding and you are free to pursue other means of dispute resolution if my comments solve nothing.

Thanks. Formerip (talk) 17:41, 2 February 2013 (UTC)

Recently tagged and removed sources

Responding to concerns in your recent edits:

• "pull disreputable site called idownloadblog" - Can you explain this a bit more? iDownloadBlog is an independent blog with hired writers, editorial oversight, and a decent reputation; I wouldn't use it as the only reference for something controversial, but as an additional source for supporting uncontroversial material, I believe it's useful.
• "we're not certain of this grad student is a reliably published expert on this subject to have exemption from WP:SPS policy" - As noted by this edit removing a "self-published" tag on a different article by saurik, "neutral description of features is OK to come from self-published sources (unless there is a reason to believe the data is falsified)".
• "WP:RS, no i think not. about author; "Sayam Aggarwal is a 18-year-old student living in India who has been an Apple fan for almost 5 years."" and "reliable? no. author bio: "a 18-year-old student living in India who has been an Apple fan for almost 5 years"" - that article is from a non-self-published blog that has a decent reputation, and it's only supporting technical details that can be confirmed in other sources. It's not the best reliable source, but I believe it's fine for supporting those claims.

• I escalated this to RS/N. Your patience is appreciated until we have sufficient community consensus. Cantaloupe2 (talk) 05:15, 10 January 2013 (UTC)

• Just to follow up on this for anyone watching, here's the archived RS/N discussion - no third opinions were volunteered, unfortunately. Dreamyshade (talk) 07:23, 22 January 2013 (UTC)

• "per my suggestion as well as 3PO input" and tagging the Stefan Esser presentation as a primary source with the note "this author should have been published in a reliable secondary source on this matter, such as a computer engineering journal" - I believe the iOS Hacker's Handbook book, mentioned above, is sufficient to show that he's an expert source. I don't know why a security researcher would publish his work in a computer engineering journal - perhaps you mean a computer science or information security journal? I don't think that's a requirement for an expert source on software topics though, just that his "work in the relevant field has previously been published by reliable third-party publications" (WP:SPS). Also, I'm puzzled by your mention of "3PO input" - I believe User:Mkdw just discussed the iH8sn0w source, not this source, unless I missed something?
• "inclusion of this by SaurikIT(Cydia)'s Dreamyshade maybe COI because this program just happens to auto-install its software, and also utilize saurikIT server" - redsn0w is a notable tool for handling SHSH blobs, and it was the first public tool that could stitch SHSH blobs in a way that bypasses the nonce requirement, so I believe including it is justified. All recently-released jailbreaking tools install Cydia by default, so I don't have any special reason to recommend redsn0w instead of a different tool. Also, as I believe I've explained, my COI is pretty indirect here.

Maybe we're getting to the point where I should start a Wikipedia:Reliable sources/Noticeboard post listing the article's disputed sources, to get more opinions? Dreamyshade (talk) 02:47, 10 January 2013 (UTC)