BlackBerry Blog

I have been using the BlackBerry Priv since it's release. One of the best things they have going for them is how quickly they apply the android security patches once they are available. I think they have released every security patch on the day of the public disclosure since the Priv released. This blog post shows the release dates up until March atleast, and they've hit the Nexus release dates on all of them. http://blogs.blackberry.com/2016/03/beating-expectations-android-secur… EDIT: The beta branch for the Priv already applies 5th August security patch. Usually the official release is not that far (a week or so AFAIK). http://m.gsmarena.com/latest_priv_marshmallow_beta_brings_august_secur…

Source at Blackberry: http://blogs.blackberry.com/2016/07/change-is-only-natural-a-classic-m…

It's worthwhile to note that John Chen called out Apple for refusing to unlock an iPhone for the US government. (No, not the San Bernardino one, but a different one in a criminal case; I believe Apple has unlocked iPhones in other cases though.) Quote: "In fact, one of the world’s most powerful tech companies recently refused a lawful access request in an investigation of a known drug dealer because doing so would “substantially tarnish the brand” of the company. We are indeed in a dark place when companies put their reputations above the greater good." I guess it depends on your definition of "the greater good". http://blogs.blackberry.com/2015/12/the-encryption-debate-a-way-forwar…

http://blogs.blackberry.com/2015/11/managing-android-security-patching… a bit full of themselves but it seems that they will follow the security updates.

"The phone, first introduced in 2011, will be re-released as 'The Classic'." This seems to indicate that he means it's a new device, the Classic (formerly known as the Q20 [1]). Seems just like a BB10 version of the Bold. [1] http://blogs.blackberry.com/2014/02/blackberry-q20/

If you doubt that this is official, it's right there on their blog: http://blogs.blackberry.com/

http://blogs.blackberry.com/ Unlikely to remain up for long, that's why i submitted a screenshot.

For some context, read BlackBerry COO Marty Beard's blog post[1] from a few weeks ago. I don't think Chen or anyone else at BlackBerry thinks the government should compel anyone to write apps for their specific platform, in fact that's the very mindset they're criticizing. What they're getting at is that services should leverage open technologies so that nobody's platform gets shut out, which I believe is also a core value of Mozilla and Firefox OS, for example. It's not just a matter of BlackBerry vs. the world; how many apps are iOS-first or iOS-exclusive, despite the market domination of Android? I think Chen and Beard are advocating for the tearing down of the "walled garden" world of mobile platforms. I use a BlackBerry Passport as my daily driver, and although I have both native apps and sideloaded Android apps via Amazon App Store and Snap, a lot of my most regularly used items are mobile websites. Many companies have excellent mobile sites, you can save them as bookmarks to your homescreen, they pull in the favicon and look just like apps. You don't have to install updates for them or worry that they'll stop supporting your OS version or particular hardware, and a lot of times they're a better experience than the corresponding native (or sideloaded) apps. [1] http://blogs.blackberry.com/2015/01/surprising-winner-of-html5-apps-wa…

It says "mixed-criticality" "Mixed-criticality essentially means one chip is running two pieces of software that require disparate safety levels. An example would be a single chip that controls both radio volume and electric steering controls. A failure of audio controls is annoying — while a failure of steering controls is dangerous, possibly even life-threatening."[0] It says they're working on ISO 26262 Automotive Safety Integrity Level B (ASIL-B) which from[0] says - "medium-risk" for failures e.g. headlights or rear-camera. [0] https://blogs.blackberry.com/en/2022/09/why-mixed-criticality-is-the-f…

Yes but the host he's using is Apple Silicon, I think what he's talking about is QEMU using Apple's Hypervisor Framework, which is what vmware Parallels, etc also use nowadays. Booting an apple silicon version of MacOS on non-Apple hardware probably isn't going to possible for a while as it would require emulation. In 2021 Blackberry, surprisingly, wrote this article about getting emulating the XNU kernel and getting it running on non-apple hardware, but its just a terminal: https://blogs.blackberry.com/en/2021/05/strong-arming-with-macos-adven… Someone would have to write something that can emulate/abstract the apple iGPU to get anywhere near a usable GUI - I'm no expert but I don't think this is going to happen anytime soon, so when Intel releases of MacOS stop happening apple hardware might be the only way to virtualize MacOS for a while

They’ve been around for a while and identified by several governments. “NOBELIUM is an advanced persistent threat group also known as APT29, which is publicly attributed to the Russian government and specifically to the Foreign Intelligence Service of the Russian Federation (SVR)” https://blogs.blackberry.com/en/2023/03/nobelium-targets-eu-government…

JFYI, Apple CarPlay never have been an OS. People often get confused between the foundation SW that OEM provides and consumer overlay that companies like Apple, Google provide. Both are not the same. One cannot replace another. You can refer to this blog about more popular misconceptions among consumers. https://blogs.blackberry.com/en/2022/10/the-top-9-misconceptions-about… Disclaimer: Worked for a Teir1 SW provider in past.

> I've been a mobile OS developer for a decade now. Basically nobody uses Rust in the real world of firmware/kernel engineering. You know it’s kinda funny, I read this comment and then tabbed over to twitter and then read this: https://blogs.blackberry.com/en/2023/02/this-is-the-kind-of-rust-the-a… Anyway you’re not wrong that Rust is still a tiny portion of this kind of thing, but it is growing, and quickly. Only time will tell. (I work at a company writing firmware (and virtually everything else) in Rust, but as a startup I don’t expect that to carry as much weight as big established companies, of course.)

I fooled around with this for a weekend, learnt a lot about qemu and friends. So there is this: https://blogs.blackberry.com/en/2021/05/strong-arming-with-macos-adven… And there is also work around getting iOS to boot, which could pave the way for future work. https://github.com/sickcodes/Docker-eyeOS

Can you run it with a working framebuffer and peripherals? Probably not. You'd have to ask Corellium for their secret sauce Apple SoC virtualization. Can you run it in some capacity? Yes. See https://blogs.blackberry.com/en/2021/05/strong-arming-with-macos-adven… and https://news.ycombinator.com/item?id=25064593 With additional work, it should be "possible" to do this on an ARM device and use KVM to get virtualized performance, with unsupported instructions/features trapping back to the hypervisor and being emulated in software. All that said, it will probably be a long time (if ever) that you will be able to boot a virtualized ARM MacOS up to a graphical desktop.

Blackberry gave the RCMP a global decryption key[0], then defended the practice[1]. Given the chance, they probably would have sold out their users as well. [0] https://news.vice.com/article/exclusive-canada-police-obtained-blackbe… [1] http://blogs.blackberry.com/2016/04/lawful-access-corporate-citizenshi…

Blackberry's CEO has already indicated that the company is willing and able to defeat device encryption for law enforcement: "At BlackBerry, we understand, arguably more than any other large tech company, the importance of our privacy commitment to product success and brand value: privacy and security form the crux of everything we do. However, our privacy commitment does not extend to criminals," http://blogs.blackberry.com/2015/12/the-encryption-debate-a-way-forwar… In the same blog he says the company doesn't put backdoors in, but how do they plan in defeating Android's hardware encryption if there isn't one?

Unless he disagrees with the decisions of his own company, he is being extremely hypocritical. Blog post (from another person representing Blackberry) a few days ago: http://blogs.blackberry.com/2015/11/why-blackberry-is-exiting-pakistan… "After November 30, BlackBerry will no longer operate in Pakistan. While we regret leaving this important market and our valued customers there, remaining in Pakistan would have meant forfeiting our commitment to protect our users’ privacy. That is a compromise we are not willing to make."

Well, his actual letter doesn't mention the phrase "API," so reading such a request into it seems like a stretch: http://blogs.blackberry.com/2015/01/blackberry-net-neutrality/

Software/Services. Besides, they're not going to dump the phones. The reporters misquoted Chen: http://blogs.blackberry.com/2014/04/not-leaving-handsets/

I found some notes from when I was looking into the Priv at the end of last year. They lack detail, but maybe are a good starting point for someone. * Root of trust: unique crypto keys at the hardware level: Somehow implemented in way that guarantees Blackberry through supply chain, they claim. Maybe Blackerry supplies own chipset, w/ key included? * Verified Boot and Secure Bootchain: Verifies integrity of all layers, from hardware to software. Uses hashes, crypto signatures * hardened Linux kernel with numerous patches and configuration changes to improve security * FIPS 140-2 compliant full disk encryption for data and applications * Monthly updates through the Google Play store (only?) * DTEK: "a single dashboard to monitor and control application access to your microphone, camera, location and personal information." * Can customize each app's privacy settings, like in Android 6 Also of potential interest, from a competitor: * http://www.tomshardware.com/news/copperhead-nexus-more-secure-priv,305… ---- Sources: * http://blogs.blackberry.com/2015/10/priv-is-for-private-how-blackberry… * http://www.zdnet.com/article/the-many-ways-blackberry-beefs-up-android…

> Which is no software company has ever done this Yeah, I'm just not buying this whole we're the only one to have ever used the common "<letter> is for <thing we provide>" -- for one more letters, including sometimes with the implication that the company being promoted provides a whole alphabet of solutions either by explicit claim using the term "alphabet" or by providing or implying coverage of the full alphabet of letters -- promotional gimmick in and around the software industry. https://twitter.com/mscloud/status/619883853587591168 http://www.wittyparrot.com/sales-blog/s-is-for-storytelling http://www.ornavi.com/2015/05/31/the-a-z-of-ornavi-2/ http://blogs.blackberry.com/2015/07/the-a-to-z-of-qnx-in-cars/ http://nchsoftware.blogspot.com/2012/01/is-for-audio.html http://www.computeruniverse.co.za/ABC.html > Would it surprise you to learn that we too are in "advertising" business. No, because I already knew that. Which makes it even sillier -- two companies that (whether more fairly viewed as technology companies or not) are in the advertising/marketing business both use different variations (not more similar to each other than each is to many other common instances of the technique) on a technique common in advertising and marketing. This is not surprising. That one of them would accuse the other of stealing the idea, based on the idea that, despite the fact that the technique is common, the two companies are "software" companies and supposedly no other software…