May 29, 2017

Apple Altered DTrace Tool, Says Leventhal

The debugging tool DTrace has been ported to Apple’s architecture, but it has been changed to prevent it from being used against iTunes.

Apple Altered DTrace Tool, Says Leventhal
Apple Altered DTrace Tool, Says Leventhal

Sun’s Adam Leventhal has drawn attention to some Apple-engineered shenanigans that have broken the DTrace dynamic tracing tool. When porting it to OS X, Apple made some changes that go against the spirit of the DTrace project.

Leventhal noticed some missing probes while running DTrace on an Apple machine. After delving deeper into DTrace’s operations, he found it ignoring a prominent application:

While there’s nothing suspicious about the output in itself, it was strange because I was listening to music at the time. With iTunes. Where was iTunes?

I let it run for a while, made iTunes do some work, and the result when I stopped the script? Nothing….Which started me thinking… did they? Surely not. They wouldn’t disable DTrace for certain applications.

But that’s exactly what Apple’s done with their DTrace implementation.

Boing Boing blogger Cory Doctorow believes Apple did this to keep people from trying to “break iTunes DRM.”

“To paraphrase Warren Buffet, DRM is the gate to hell: once you enter, you can’t leave,” said Doctorow.

The discussion on Boing Boing turned to Apple’s plans to provide movie rentals via iTunes. One commenter wondered if Apple had to break DTrace to keep their studio partners happy.

Doctorow answered by suggesting “if Apple starts down the DRM path and then has to take a series of ever-worsening step to “protect itself,” that we should note this, and stop using their products until they improve.”

We’ll ask this question in response: Cory, if Apple does what you suggest they might, will you have the Mac tattoo removed?

About David Utter 902 Articles
David Utter is a business and technology writer for SecurityProNews and WebProNews.