Silence in the code speaks louder than the hype.
On a Tuesday morning in late spring, a single sentence crossed my feed: iOS now runs on Android. By Thursday it had been repeated on three financial wires, two newsletters, and roughly nine hundred posts from accounts that have never once opened a decompiler. The sentence mutated as it traveled. "Runs" became "ported." "Ported" became "freed." By the weekend, someone with a blue checkmark was explaining to forty thousand people that Apple's moat had cracked.
I went looking for the data. Not the retweets โ the data.
Here is what I found across the seven days that followed: zero attestation anomalies, zero activation-server irregularities, zero measurable movement in any of the eleven device-trust metrics I track for consumer hardware. Nothing. A rock dropped into a pond, and the pond did not notice.
That absence is the story. And buried inside the original six-sentence item โ the one almost nobody read, only quoted โ were two words that the entire timeline stepped over to reach the headline: barely works.
Chaos is just data waiting for a lens. Let me put one on.
Context: what a bring-up actually is
The source item is six sentences long. No named researcher, no methodology, no iOS version number, no reproduction steps, no video. It states that a group booted iOS on a Xiaomi handset and a Nothing handset, that the result "barely works," and that functionality is "very limited." Everything else โ the framing, the extrapolation, the moat commentary โ was added downstream by people who were not in the room.
Set that against the record. In 2020, Corellium's Project Sandcastle booted iOS 13, built from iPhone 7 firmware, onto a Pixel 3, and later onto a Raspberry Pi 4. That was six years ago and it was documented. If the current effort is iOS 16 or 17, then what happened this week is a version advance, not a first. In technology journalism the word "first" almost always means "first one I noticed."
I have a specific allergy to this pattern, and it is not new. In 2017 I spent six weeks inside the vesting schedules of three Ethereum ICOs at the peak of the mania, mapping the cliff structures line by line, and what I found was that the contracts compiled perfectly and distributed unfairly. Compiling is not the same as distributing. In 2020 I wrote a Python script that polled liquidity depth across fifty Compound and Uniswap pools every ninety seconds for three months, and the thing that nearly broke my model was not the exploit I expected โ it was that the pool which looked deepest on the dashboard was the thinnest at 3 a.m. The headline number lied every single time.
So when I read "iOS runs on Android," my first question is not whether it is impressive. It is: what exactly did you measure?
Because there is a very specific engineering artifact underneath that sentence, and it has a name. It is called a kernel bring-up. You take an open-source kernel โ Darwin and XNU are open, under the Apple Public Source License โ and you coax it into booting on foreign silicon. That is a milestone. It is also roughly step one of a journey that has three gates ahead of it: the driver stack, the activation service, and performance tuning. The distance from gate one to gate three is measured in years, and for reasons I will get to, it is probably infinite.
Here is the part the timeline never understood: "barely works" is not a bug report. It is the finding.
Core: three locks, one wall
The first lock is silicon. Apple's stack is iBoot, the Secure Enclave Processor with per-device keys fused at manufacture, an in-house GPU, an ISP, a PMIC, a touch controller, and the device tree that binds all of them together. None of that is publicly documented. A port must therefore stub out the closed kernel extensions โ meaning the kernel has to be convinced it is talking to hardware that is not there. The kernel will boot. The peripherals will not answer. In practice, the honest reading of "barely works" is: it reaches a prompt, and touch, baseband, GPU acceleration, camera, and power management are somewhere between degraded and absent. The article never says which. That omission is not incidental; it means the author did not have the information either.
The second lock is firmware, and this is where the arithmetic gets uncomfortable. iBoot enforces a signature chain. To get past it, you need either a signing bypass or a bootrom exploit. The famous one is checkm8, which covers A5 through A11. iOS 16's minimum supported device is the iPhone 8 โ which is A11. The firmware donor device sits precisely inside the blast radius of an unpatchable hardware defect.
If that is the vector โ and I want to be careful here, because the source never names it โ then this is not software unbinding. It is the exploitation of a silicon flaw that Apple cannot fix in the field, only in new parts. We trace the ghost in the machine's memory, and what we find is a hole drilled in 2017 that nobody can fill.
The third lock is the one nobody wrote about, and it is the real wall. The service layer. Even if you own the kernel, you do not own the activation server. APTicket. Apple ID device proof. DeviceCheck. The device must prove to Apple that it is a device, and Apple decides whether to agree. Boot an unsigned stack and you get a handset that cannot reach the App Store, cannot sign into iCloud, cannot receive an iMessage. You have built a very expensive calculator with a beautiful boot log.
This is the insight I want to leave with you, and it generalizes far beyond Cupertino: the lock was never in the hardware. The lock is in the attestation. Hardware is the visible wall. Attestation is the wall behind the wall, and it is the one that does not care how good your reverse engineering is.
Now the mirror, because our industry runs on exactly the same architecture and mostly pretends otherwise. Hardware wallets โ the supposed trustless endpoint of every self-custody narrative โ depend on a secure element that ships with vendor-fused keys and a closed firmware blob. Across the wallet SDKs and signing stacks I reviewed in the first half of this year, twenty-nine of forty-one required a call to a vendor-hosted attestation endpoint before the device would sign. Twenty-nine. Twelve of those described themselves in their own documentation as "fully non-custodial." The keys were on the device. The permission was on a server. That is not a scandal โ it is an architecture โ but it is an architecture most of the people celebrating this week's headline have never drawn on a whiteboard.
The same holds for sybil resistance. Every proof-of-personhood and unique-human design I have audited in the last two years bottoms out in a device attestation primitive: Play Integrity, DeviceCheck, a passkey bound to a trusted execution environment. Unlock the bootloader and the attestation chain breaks, and the unique human becomes a unique emulator. The iOS-on-Android experiment is, functionally, a demonstration of how to break proof-of-personhood at the root. Nobody in that thread mentioned it. They were busy applauding openness.
Surface metrics lie. I learned that expensively in 2021, when I spent two weeks clustering the ownership history of a hundred Bored Ape wallets and found that fifteen percent of the "unique" holders resolved to a single entity running a wallet cluster. The chart said decentralization. The graph said one hand. "iOS runs on Android" is the same species of metric: true at the level of the sentence, meaningless at the level of the system.
And then there is the licensing layer, which the article skips entirely. XNU is open under APSL. The kexts, the user-space frameworks, and the binary blobs are not. Apple's software license restricts the OS to Apple-branded hardware, so flashing it elsewhere is a plain contract breach. The DMCA ยง1201 jailbreak exemption, renewed in 2021, covers interoperability for phones and wearables โ it does not cover porting an operating system onto unauthorized hardware. The legal position is not "Apple's software is free." It is "the open part is open, the closed part is exposed, and the project sits in a high-risk zone in the United States."
Which brings us to economics, and to the reason any of this matters to someone holding a portfolio in a bear market. Apple's revenue mix has been migrating from hardware to services for a decade. The moat is not the phone. The moat is the identity. Apple ID is the billing relationship, the entitlement ledger, the thing that turns a device into a customer. A ported device cannot enter that ledger, which means its commercial value is exactly zero โ to Apple, to the researchers, and to anyone who might try to productize it. The ledger remembers what the market forgets.
I have watched this pattern in DeFi for six years. Liquidity mining APY is the project subsidizing its own TVL number; cut the incentive and the deposits leave inside a week. Here the subsidy is narrative and the deposits are attention. Cut the headline, and underneath there is nothing but a boot log.
Contrarian: the risk is rhetorical, not technical
Now let me argue against my own instincts, because the instinct is to file this under noise and move on. The engineering is genuinely impressive. The coverage is wrong. The commercial impact is nil. Case closed.
That reading misses the actual exposure, and the actual exposure is not technical. It is rhetorical.
In March 2024, the EU's Digital Markets Act obligations on sideloading and alternative marketplaces took effect. In the same month, the US Department of Justice filed its antitrust suit against Apple, with the walled garden as a central allegation. Both proceedings need a very specific kind of evidence: proof that closure is a commercial choice rather than a technical necessity. A headline reading "iOS runs on Android" is precisely that evidence, in the form regulators and litigants prefer โ a sentence, not a specification.
The trap is that the sentence is backwards. "Barely works" is not evidence that the wall is artificial. It is the strongest available evidence that the wall is real. Someone spent years of engineering effort to reach a boot prompt, and the reward was a device that cannot place a phone call. That is what a genuine technical barrier looks like when you hit it at speed.
Correlation is not causation, and a demo is not a port. The distance between "the kernel booted" and "the product shipped" is the same distance between "the contract deployed" and "the protocol survived." I have spent a large part of my career watching people confuse the first with the second. In 2022 I documented an algorithmic stablecoin's reserve volatility widening for three straight weeks while the timeline insisted the peg was structural. The peg was structural. That was the problem.
So the real risk is second-order: a narrative weapon gets loaded by people who never read the six sentences underneath. And the second-order risk for us is worse. The crypto industry's loudest openness advocates are, architecturally, running on attestation servers they do not control. If a regulator ever applies to our claims the same scrutiny we are joyfully applying to Apple's, "runs on Android" will have a very uncomfortable sibling.
Takeaway: what I am watching next
What I am watching next week is not the retweet count. It is whether an independent third party reproduces the boot with a video, a build log, and a named exploit vector. If none of those appear, the story is a screenshot, and screenshots decay.
The second thing I am watching is quieter and more useful. Any protocol whose security model leans on device attestation โ proof-of-personhood, airdrop sybil filters, passkey-gated wallets โ should be repricing the assumption that attestation is a constant. It is not a constant. It is a vendor, a server, and a fused key, and all three can be turned off or broken.
Finding the signal where others see only noise usually means asking who holds the switch. In a bear market, the only question worth asking about any system you hold is the one this week's story answered by accident: where is the trust root, and who can revoke it?
The wall did not move. Somebody measured it at enormous expense, and the measurement was reported as a door.