First of all, thanks for taking the time to write this detailed comment. I really do appreciate it.

Second, let's try to achieve clarity on what it is we're actually disagreeing about here, because I'm not sure we even agree about that.

> no mass-market computing platform has been safer than the flagship hardware/software platforms from Apple and Google

I actually agree with that (though I wonder if leaving Microsoft off this list is actually justified, but that is neither here nor there). What I don't agree with is the implication that Apple and Google flagships are plenty good enough, and that buying phones from Apple or Google is the right answer to all our security concerns.

An analogy: before Fukushima it could be said of boiling water reactors that "no reactor design has been safer". Indeed, even after Fukushima the safety record of BWRs compares very favorably overall (in terms of casualty rates) with almost all other forms of energy. That doesn't mean that we can't do substantially better, or that we shouldn't try. But humans have always had trouble with low-probability high-impact events.

> 1. We're talking about SS7 security.

Well, sort of. The original topic was SS7 security (or the lack thereof). This is a somewhat unfortunate distraction because it led down a rabbit hole: yes, SS7 is insecure. But that doesn't matter much because most sensitive data that is transmitted by a cell phone nowadays is locally encrypted. But it matters some because most != all.

> 2. Whether or not SS7 is secure, if your phone is compromised and hostile, it's game-over. So it's hard to see how this debate is even relevant.

Well, SS7 is a data point. It is an existence proof that modern cell phone contain security flaws because they are the product of a long design process that has a lot of legacy from a time when security was less of a concern. If one such flaw exists, others might as well.

> 3. You introduced the argument that Apple and Google phones were untrustworthy because nobody outside Apple (or Google) can audit them. You now say that's an overstatement.

Yes, I chose my words poorly. A apologize for that.

> 4. When informed that there's in fact a whole cottage industry of people outside Apple who do audit iOS from binaries --- you express incredulity.

No, that's not fair. I am well aware that this industry exists. But I am skeptical that the existence of this industry is sufficient reason to accept the proposition that anyone who owns an Apple or Google flagship need not be further concerned about security, and I think my skepticism can be justified. Even if I'm wrong, I think my position is defensible. And I may well be wrong. That would actually be a good outcome.

> 5. You denominate your incredulity in a "bytes per second" rate of reverse engineering based on compiled image sizes.

I have a lot of reasons to justify my skepticism. I could write a paper (and maybe I should). But HN comments do not lend themselves well to long-form communications so I advanced what I thought would be a compact argument: a quick back-of-the-envelope calculation of the amount of effort required to audit iOS (which is just one component of an iPhone) would reveal that to be infeasible. Now, that calculation may have been way off. That entire argument may have been wrong. But I can always fall back on the fact that to prove that there are no security holes in iOS you would have to solve the halting problem (specifically, you would have to solve the lambda-equivalence problem, which reduces to the halting problem). So I'm pretty sure I'm on solid ground with at least some level of skepticism about the effectiveness of reverse engineering.

> 6... 7... 8...

Yes, because the position that I'm arguing for is that there are a lot of potential problems that the reverse-engineering industry is not well equipped to address no matter how effective its tools are. And furthermore, even if I'm wrong about that, that is still not enough to justify the conclusion that owners of Apple and Google flagships need not be further concerned, because it is not just the abilities of the reverse-engineering industry that matters, but also their motives. And I see a lot of grounds for skepticism about that.

> it still doesn't make sense to try to protect phone calls by securing the SS7 network.

Yes, we agree about this too.

> radare

I was not aware of radare, so thanks for that pointer. It does appear to be a very impressive and comprehensive collection of tools. But one thing that it doesn't have (AFAICT) is advanced AI that automates the process of extracting algorithms and intent from object code. So at the end of the day, you still have humans searching for needles in a 1.6GB haystack.