|
So, I'm on the train this morning and I read some news indicating that the "Apple iPhone SDK key has been leaked!". So I start thinking... the SDK itself has a key? That's interesting. SDKs are typically collections of libraries and, in the case of C-based languages, header files. If there was a key, it would be a key required to sign your application bundle to prove who wrote it.
So, let's think about this for a second. What would be the sense in there being only one key? That would mean that every application ever published for the iPhone by legitimate developers would appear to have come from the same verified location - Apple. I'm sure Apple doesn't want that and I know I don't want that. Usually what happens with closed environment development is you apply for a key from the host environment owner (in this case Apple) and, if you are deemed worthy, you are given a key or a token. This key/token is then used to uniquely identify the things that you produce.
This serves two purposes. One - it allows you to publish content onto the closed platform. Two - if code written by you does something terrible to said closed platform - everyone will immediately know that it was your code that caused the problem.
What I really find hilarious is the amount of fervor, almost to the point of frothing at the mouth, that has gone into "hacking" the iPhone. Every time Apple releases a new firmware update, folks across the globe set about hacking the new firmware so that they can run their unauthorized applications on the phone. "Hacking the SDK" is apparently someone's holy grail whereby they allow homebrew applications written by people without ADC memberships or valid relationships with Apple to publish their apps for download and installation on iPhones.
What I fail to see is an actual reason for all of this. By hacking the phone itself, you detach the phone from any support that might come with it, and you require that the phone be re-hacked every time Apple releaases an update. It's a cat-and-mouse game that has no end in sight. By hacking the SDK, the only thing anyone might manage to do is allow a means for hacked phones to download unauthorized applications.
So, someone please explain to me how either of those models actually creates a user experience compelling enough for someone to actually want to use your application? I'm not talking about the hackers, since they will obviously enjoy the "freedom" of being unchained by "the man" ... but, average users, the folks who have no intention of hacking their phones, nor do they have the skill or patience to do so - does anybody actually think those people are going to want to download unsigned/unverified applications in the first place?
Right now, the only point I see in people hacking the iPhone or the SDK is in obtaining imaginary bragging rights... bragging rights that only have merit within the community of hackers to begin with. Sure, the hacker community will respect people who "leak the SDK key" (if there were a single key, an idea I find ludicrous), but, will anyone who matters (consumers, downloaders, and purchasers of iPhone software) care?
Don't get me wrong, it takes a lot of skill to do what they're doing... But, I just wonder about what they might produce if they spent their time working on legitimate apps for the iPhone when the SDK came out instead of trying to hack it purely for the sake of claiming they were able to hack it.
So, we will all find out just how completely irrelevant that leaked key is when the SDK comes out at the end of February.
After looking at the "key", it looks surprisingly similar to a public key
token, which is the public half of a public/private key encryption. Public
key tokens are very often used to uniquely identify the owner of a signed
file. For example, if I digitally sign three different DLLs with my private
key, all three will have the same public key token, which can be used for
setting permissions policy and for verifying the authenticity of the DLL.
I'm thinking that's exactly what this key might be - could it be just
Apple's public key token for signed binaries? If so, it reiterates my
previous point about this information being completely useless. We should
also go back to our regularly scheduled programming.
some folks have too much time on their hands. a rational person just waits
for the SDK to be released in a month.