Apple Shares Private Cloud Compute Virtual Research Environment, Provides Bounties for Vulnerabilities - MacRumorsOpen MenuShow RoundupsShow Forums menuVisit ForumsOpen Sidebar
Skip to Content

Apple Shares Private Cloud Compute Virtual Research Environment, Provides Bounties for Vulnerabilities

Private Cloud Compute is a cloud intelligence system that Apple designed for private artificial intelligence processing, and it's what Apple is using to keep Apple Intelligence requests secure when they need to be processed in the cloud.

Apple Intelligence General Feature 2
Apple promised to allow security and privacy researchers to verify the end-to-end security and privacy promises that Apple made with Private Cloud Compute, and today, Apple made its Private Cloud Compute Virtual Research Environment (VRE) and other materials publicly available to all security researchers.

Apple has a Private Cloud Compute (PCC) Security Guide that details all of the components of PCC and how they work to provide privacy for cloud-based AI processing. Apple released the source code for select components of PCC that help implement its security and privacy requirements, which allows for a deeper dive into PCC.

apple private cloud compute security
The Virtual Research Environment is a set of tools that lets researchers perform their own security analysis on PCC using a Mac. The VRE can be used for inspecting PCC software releases, verifying the consistency of the transparency log, booting a release in a virtualized environment, and modifying and debugging PCC software for deeper investigation. The VRE can be accessed in the macOS 18.1 Developer Preview and can be used with a Mac that has an Apple silicon chip and 16GB+ unified memory.

Along with these tools, Apple is expanding its Apple Security Bounty to include rewards for vulnerabilities that demonstrate a compromise of the fundamental privacy and security guarantees of Private Cloud Compute. Security researchers who locate a vulnerability can earn up to $1 million.

Top Rated Comments

UpsideDownEclair Avatar
19 months ago

From a security perspective, the only way to 100% prove transparency is having an outside firm perform and publish an audit on their internal servers.

Which will never happen




Attachment Image
Score: 8 Votes (Like | Disagree)
ProbablyDylan Avatar
19 months ago

I'm talking about what Apple does with your data. There's nothing stopping them from having code we can't see that collects data from users.
Image pulled directly from Apple's documentation, and a link to where I found it ('https://security.apple.com/documentation/private-cloud-compute').

Score: 4 Votes (Like | Disagree)
ProbablyDylan Avatar
19 months ago

If you have proof that's true, let's see it. In comparison to Proton, they have had outsourced firms inspect their servers to verify they're statement of end-to-end encryption is true. Apple has done 0 outsourced audits of their servers.
Right. That's because none of this stuff is ready to go yet. Proton's products are ready to inspect. Apple's aren't. You don't check the doneness of a steak before it hits the grill do you?

You don't have to hear it from me though. You're welcome to read Apple's documentations and promises at that link I provided, but I get the feeling that you're more interested in being skeptical than in being informed.
Score: 3 Votes (Like | Disagree)
19 months ago
Broadly, most of the arguments here come down to "PCC is just marketing, you'll still have to trust Apple". Some slightly more sophisticated hot takes are along the lines of "if you don't have physical access to the hardware, you have nothing".

It's not that simple. If you haven't read up on it IN DETAIL you don't know enough to have a valid opinion.

FWIW, in the actual real world, Apple has a shot at doing something really big and really good here. Or they could totally screw it up and fail. My money is on them succeeding, but the whole point of what they're doing is you don't have to rely on my opinion, or any other single person's. If you don't know why that's true, then again, you don't know enough to have a valid opinion.

They might screw up. They way to know that though is not to carry around your skepticism and assumptions. They are giving visibility into their setup. If you want to have an opinion, you have to actually look through the window. And yes, that takes time and effort. It should.
Score: 1 Votes (Like | Disagree)
19 months ago
It's nice to see all the people with degrees in math and CS, and lots of real-world security experience, all agree that Apple's getting this wrong, that you can't build a verifiable setup, that you'll still have to trust them (and you shouldn't), etc.

Oh. Wait. You *don't* actually have advanced degrees in the relevant subjects? You haven't actually read all of Apple's PCC docs to understand what it is they're promising and what they're claiming is verifiable? You don't do security for a living (or maybe, you do, but really shouldn't)?

Sigh.

This stuff is *hard* and *complicated* and worthy of careful thought and a concerted effort to find weak spots. Handwaving it as fake or insufficient based on a lack of knowledge or understanding doesn't do you or anyone else any favors.

One of the biggest problems (probably the biggest) in security is the human side of things. How do you get people not to do stupid things? How do you arrange things so a not-stupid person with no special security expertise can make not-stupid choices? There's no perfect broadly applicable answer to that, unfortunately, but one way to do better is to not have tons of confusing and false information out there.

That means, every single one of you spouting off about this without being expert and fully up-to-date on the specifics of the PCC implementation is doing damage to every other person reading your text. Maybe think about that before posting next time.
Score: 1 Votes (Like | Disagree)
wanha Avatar
19 months ago

Uh, what are your complaints regarding https://developer.apple.com/download/ and in particular
https://developer.apple.com/documentation/macos-release-notes/macos-15_1-release-notes
?
He seems to be waiting on MacOS 18.1, not 15.1. Who's going to tell him he'll have to wait three more years?
Score: 1 Votes (Like | Disagree)
Related Apple News: Entertainment | Iphone | Local News | Travel | Reviews