5 ms·

Ah, that makes a lot of sense. I thought they were distributing the source for you to compile yourself.

by arm 11y ago

autoreleasepool 11y ago
> I thought they were distributing the source for you to compile yourself. This is what they should have done. Instead, they chose to distribute a binary of their proprietary (patent pending [0]), closed source [1] product. Not only am I not surprised that Apple shut them down the very next day, but I'm also having trouble feeling any sympathy for their cause. [0] https://justgetflux.com/ https://justgetflux.com/ - bottom of page [1] https://justgetflux.com/news/pages/eula/ https://justgetflux.com/news/pages/eula/
- walterbell 11y ago
  Developers distributed binaries before app stores. They could publish a hash for their binary, on an HTTPS web page.
  - alextgordon 11y ago
    True, but I can understand Apple's position. Commercial software is unlikely to be a trojan. You have much higher value as a paying customer than as a victim. Open source software is similarly unlikely to be a trojan, especially if compiled from source. Closed-source freeware is the perfect attack vector. Opaque and widely disseminated. Who knows what's going on inside? Freeware is responsible for a gigantic amount of malware.
    - walterbell 11y ago
      If the source of the freeware is authenticated by HTTPS, users can make their own informed decisions, e.g. to enter a risk pool with millions of other users whose health has been improved, courtesy of a known developer with no track record of shipping malware. There are no zero-risk activities, only risk signals. Some people choose to trust a corporation with lawyers and endless pages of EULA, some people choose to trust one authenticated developer with a proven track record of service to the community. At the moment, we are still free to make our own informed choices.
      - alextgordon 11y ago
        I am talking about closed-source freeware only. f.lux is closed source. Nobody can verify whether it does what it says. Apple clearly does not want to set a precedent. Open source is fine. If f.lux published the source code, then we could compile it ourselves, and Apple would be happy (they recently made the iOS Dev Program free of charge to allow sideloading in this manner.)
        walterbell 11y ago
        Millions of people have used f.lux on other platforms. Hundreds of hours of real-world testing per user, multiplied by millions of users, leads to expectations about the behavior of f.lux on iOS. This is also known as reputation, credibility and brand recognition. For those who need what f.lux offers, this empirical data means more than Apple's walled garden theories and non-liablity EULAs.
    - mikeash 11y ago
      There is a gigantic amount of closed-source freeware available on the App Store. Literally hundreds of thousands of apps. Roughly zero of which have had any security scrutiny. Apple's review process only checks user-visible behavior. (Edit: and a quick check for private API use, which is not user-visible, but nor is it relevant to security.) If iOS's app sandbox is inadequate, then those are all threats too, but Apple doesn't seem to mind them. If the sandbox is adequate, then apps like f.lux are safe even if intended to be malicious. Apple's position is only really understandable if they don't understand their own technology. Which considering who is probably making these decisions could very well be true.
- hackuser 11y ago
  > This is what they should have done. Instead, they chose to distribute a binary of their proprietary (with patent claim [0]), closed source product. Apple does the same with their own products.
  - dijit 11y ago
    "the same" what? sending binaries you have to sign yourself.. I doubt that somewhat, they'll be signed by Apple. For FOSS they use: http://www.opensource.apple.com http://www.opensource.apple.com
    - cortesoft 11y ago
      Well, they would sign the binaries themselves if that worked... but you need to sign it yourself to get an iOS device to let you install it.
  - callumlocke 11y ago
    How is that relevant?
- monochromatic 11y ago
  > patent claim Not seeing anything about patents at that link.
  - r00fus 11y ago
    Wikipedia says [1]: "License: Proprietary, with free download. (with patent claim)" [1] https://en.wikipedia.org/wiki/F.lux https://en.wikipedia.org/wiki/F.lux
    - monochromatic 11y ago
      O...k? The linked page doesn't mention patents, Wikipedia doesn't identify what patent, and Wikipedia isn't exactly authoritative anyway. And also, what in the world does "Proprietary, with free download. (with patent claim)" mean??
      - r00fus 11y ago
        Proprietary means not open-standard/open-source. I remember this coming up on tech news sites a few years ago when I discovered f.lux... this article also makes mention of the patent-pending nature of the software: http://readwrite.com/2013/09/23/flux-a-hack-for-your-devices-and-your-sleep-schedule http://readwrite.com/2013/09/23/flux-a-hack-for-your-devices...
  - glass- 11y ago
    Go to justgetflux.com and CTRL+F for the word "patent".
guelo 11y ago
That makes zero sense. Millions of people have installed f.lux binaries on more sane platforms without problems.

Ah, that makes a lot of sense. I thought they were distributing the source for you to compile yourself.

by arm 11y ago

Ah, that makes a lot of sense. I thought they were distributing the source for you to compile yourself.

> I thought they were distributing the source for you to compile yourself. This is what they should have done. Instead, they chose to distribute a binary of their proprietary (patent pending [0]), closed source [1] product. Not only am I not surprised that Apple shut them down the very next day, but I'm also having trouble feeling any sympathy for their cause. [0] https://justgetflux.com/ https://justgetflux.com/ - bottom of page [1] https://justgetflux.com/news/pages/eula/ https://justgetflux.com/news/pages/eula/

walterbell 11y ago
Developers distributed binaries before app stores. They could publish a hash for their binary, on an HTTPS web page.
- alextgordon 11y ago
  True, but I can understand Apple's position. Commercial software is unlikely to be a trojan. You have much higher value as a paying customer than as a victim. Open source software is similarly unlikely to be a trojan, especially if compiled from source. Closed-source freeware is the perfect attack vector. Opaque and widely disseminated. Who knows what's going on inside? Freeware is responsible for a gigantic amount of malware.
  - walterbell 11y ago
    If the source of the freeware is authenticated by HTTPS, users can make their own informed decisions, e.g. to enter a risk pool with millions of other users whose health has been improved, courtesy of a known developer with no track record of shipping malware. There are no zero-risk activities, only risk signals. Some people choose to trust a corporation with lawyers and endless pages of EULA, some people choose to trust one authenticated developer with a proven track record of service to the community. At the moment, we are still free to make our own informed choices.
    - alextgordon 11y ago
      I am talking about closed-source freeware only. f.lux is closed source. Nobody can verify whether it does what it says. Apple clearly does not want to set a precedent. Open source is fine. If f.lux published the source code, then we could compile it ourselves, and Apple would be happy (they recently made the iOS Dev Program free of charge to allow sideloading in this manner.)
      - walterbell 11y ago
        Millions of people have used f.lux on other platforms. Hundreds of hours of real-world testing per user, multiplied by millions of users, leads to expectations about the behavior of f.lux on iOS. This is also known as reputation, credibility and brand recognition. For those who need what f.lux offers, this empirical data means more than Apple's walled garden theories and non-liablity EULAs.
  - mikeash 11y ago
    There is a gigantic amount of closed-source freeware available on the App Store. Literally hundreds of thousands of apps. Roughly zero of which have had any security scrutiny. Apple's review process only checks user-visible behavior. (Edit: and a quick check for private API use, which is not user-visible, but nor is it relevant to security.) If iOS's app sandbox is inadequate, then those are all threats too, but Apple doesn't seem to mind them. If the sandbox is adequate, then apps like f.lux are safe even if intended to be malicious. Apple's position is only really understandable if they don't understand their own technology. Which considering who is probably making these decisions could very well be true.
hackuser 11y ago
> This is what they should have done. Instead, they chose to distribute a binary of their proprietary (with patent claim [0]), closed source product. Apple does the same with their own products.
- dijit 11y ago
  "the same" what? sending binaries you have to sign yourself.. I doubt that somewhat, they'll be signed by Apple. For FOSS they use: http://www.opensource.apple.com http://www.opensource.apple.com
  - cortesoft 11y ago
    Well, they would sign the binaries themselves if that worked... but you need to sign it yourself to get an iOS device to let you install it.
- callumlocke 11y ago
  How is that relevant?
monochromatic 11y ago
> patent claim Not seeing anything about patents at that link.
- r00fus 11y ago
  Wikipedia says [1]: "License: Proprietary, with free download. (with patent claim)" [1] https://en.wikipedia.org/wiki/F.lux https://en.wikipedia.org/wiki/F.lux
  - monochromatic 11y ago
    O...k? The linked page doesn't mention patents, Wikipedia doesn't identify what patent, and Wikipedia isn't exactly authoritative anyway. And also, what in the world does "Proprietary, with free download. (with patent claim)" mean??
    - r00fus 11y ago
      Proprietary means not open-standard/open-source. I remember this coming up on tech news sites a few years ago when I discovered f.lux... this article also makes mention of the patent-pending nature of the software: http://readwrite.com/2013/09/23/flux-a-hack-for-your-devices-and-your-sleep-schedule http://readwrite.com/2013/09/23/flux-a-hack-for-your-devices...
- glass- 11y ago
  Go to justgetflux.com and CTRL+F for the word "patent".

guelo 11y ago

That makes zero sense. Millions of people have installed f.lux binaries on more sane platforms without problems.