Is it really the case that the burden of proof is on someone who thinks that a system might be vulnerable?  Should we believe by default in the security of new cryptosystems because they haven't been cracked yet?<p>I am neither asserting nor implying that there is malware anywhere in the iPhone ecosystem at any point.  I meant merely that<p>1. the reviewers wouldn't, and couldn't be expected to, catch it, unless it were very clumsy (do you check the sources of all the software you run?  Even if you do, do you think that the reviewer does?  Now consider how many more apps a reviewer must vet daily than you run);<p>and<p>2.  that there are much cleverer things to do with malware than loudly announce your presence, such as quietly funnelling out interesting personal data, so that it is very dangerous to confuse a lack of reports of malware with a lack of malware.<p>To the last point it may rightly be objected that arguing something on the basis of “If it were there you wouldn't see it, and you don't see it, so it's there” is indulging in a particularly base sort of logical fallacy (identification of a statement with its converse).  I emphasise again that I am in no way claiming that there <i>is</i> malware; merely that the belief that there isn't, can't be, and won't be as long as we stick with the closed model seems to represent an indulgence in a peculiar sort of optimism.