8 ms·

App Store vetting varies wildly and tends to trend towards more close introspection on smaller apps. Well known apps such as Facebook Messenger and Snapchat for

App Store vetting varies wildly and tends to trend towards more close introspection on smaller apps. Well known apps such as Facebook Messenger and Snapchat for example can get an update reviewed and pushed out faster than a standalone developer.

pooper 10y ago
I think Apple should require app vendors to just submit source code and build instructions and have Apple just build it. It'd be harder to pull off on Google Play Store but I think Apple could make this happen if they wanted to.
- codazoda 10y ago
  As a developer, I'd rather they build it and sign it for me. The key signing stuff always seems difficult.
  - anc84 10y ago
    As a user, I'd rather you build your code and sign it for me. Enabling a third-party to alter your programs taking away the trust I would have in you.
    - tekromancr 10y ago
      But you are already trusting Apple to manufacture your device and the operating system the app runs on top of.
      - nitrogen 10y ago
        Hypothetically, signing power could be useful if an organization wanted to attribute malicious code to somebody else.
  - dan1234 10y ago
    I would hate that. How could ever be sure Apple (or anyone else) hasn’t added/modified my code without consent? I wouldn’t ever stake my reputation on signed code which hasn’t been signed by myself!
    - hueving 10y ago
      Yeah, it's not like Apple is in charge of the entire operating system running the app and verifying said signatures. Having them sign your app is definitely what gives them too much power.
    - algesten 10y ago
      Apple owns the hardware, OS and distribution, they can do whatever they want. Your signature is neither here nor there. The only thing it can do do is show Apple you compiled the code. There's no way you as the dev or the end user can verify the installed software really originated from you.
- cronjobber 10y ago
  There are many things Apple or Google could do to encourage the development of new mobile ecosystems outside the duopoly.
- LoneWolf 10y ago
  For me requiring that would be the same as kicking me off the platform.
  - pavel_lishin 10y ago
    How so?
    - LoneWolf 10y ago
      Because it is MY source code, I don't want to send it anywhere. (Yes I do use GitHub/Bitbucket, only for public code)
      - kuschku 10y ago
        Eh, is it? If users buy the app, why shouldn't they also get the source with it? Ethically, and morally, requiring the source to be available might be good.
    - netsharc 10y ago
      For him, and imagine how Microsoft or Google would feel if they have to submit their source code to Apple...
      - pooper 10y ago
        Well, it is only client-side code though. Yes, it'd require some discipline to have proper separation so there is no leakage but I imagine it can be done. to be clear, this is the reaction I anticipated when I wrote the gp. I don't think this is a cut and dried topic. I was merely expressing one side of the argument. I don't think Apple compiling and signing binaries changes much when it comes to the average user and their security and trust model. It is my impression that Apple could easily intercept any keyboard input if they wanted to and frankly I wouldn't put it beyond the people at some other companies like Facebook or LinkedIn but I don't think we have found any good reason to lose faith in Apple's (or Google's) ability and will to do the right thing. Of course, ideally the idea of Trust No One is great but at some point you have to trust someone because who can read all the lines of all the code in the world? I don't think Apple needs access to the source code to do things it needs to do. I was just saying that they have enough clout that the platform iOS has a solid foundation and can weather the storm that would inevitably rise from such a divisive decision.

pooper 10y ago

I think Apple should require app vendors to just submit source code and build instructions and have Apple just build it. It'd be harder to pull off on Google Play Store but I think Apple could make this happen if they wanted to.

codazoda 10y ago
As a developer, I'd rather they build it and sign it for me. The key signing stuff always seems difficult.
- anc84 10y ago
  As a user, I'd rather you build your code and sign it for me. Enabling a third-party to alter your programs taking away the trust I would have in you.
  - tekromancr 10y ago
    But you are already trusting Apple to manufacture your device and the operating system the app runs on top of.
    - nitrogen 10y ago
      Hypothetically, signing power could be useful if an organization wanted to attribute malicious code to somebody else.
- dan1234 10y ago
  I would hate that. How could ever be sure Apple (or anyone else) hasn’t added/modified my code without consent? I wouldn’t ever stake my reputation on signed code which hasn’t been signed by myself!
  - hueving 10y ago
    Yeah, it's not like Apple is in charge of the entire operating system running the app and verifying said signatures. Having them sign your app is definitely what gives them too much power.
  - algesten 10y ago
    Apple owns the hardware, OS and distribution, they can do whatever they want. Your signature is neither here nor there. The only thing it can do do is show Apple you compiled the code. There's no way you as the dev or the end user can verify the installed software really originated from you.
cronjobber 10y ago
There are many things Apple or Google could do to encourage the development of new mobile ecosystems outside the duopoly.
LoneWolf 10y ago
For me requiring that would be the same as kicking me off the platform.
- pavel_lishin 10y ago
  How so?
  - LoneWolf 10y ago
    Because it is MY source code, I don't want to send it anywhere. (Yes I do use GitHub/Bitbucket, only for public code)
    - kuschku 10y ago
      Eh, is it? If users buy the app, why shouldn't they also get the source with it? Ethically, and morally, requiring the source to be available might be good.
  - netsharc 10y ago
    For him, and imagine how Microsoft or Google would feel if they have to submit their source code to Apple...
    - pooper 10y ago
      Well, it is only client-side code though. Yes, it'd require some discipline to have proper separation so there is no leakage but I imagine it can be done. to be clear, this is the reaction I anticipated when I wrote the gp. I don't think this is a cut and dried topic. I was merely expressing one side of the argument. I don't think Apple compiling and signing binaries changes much when it comes to the average user and their security and trust model. It is my impression that Apple could easily intercept any keyboard input if they wanted to and frankly I wouldn't put it beyond the people at some other companies like Facebook or LinkedIn but I don't think we have found any good reason to lose faith in Apple's (or Google's) ability and will to do the right thing. Of course, ideally the idea of Trust No One is great but at some point you have to trust someone because who can read all the lines of all the code in the world? I don't think Apple needs access to the source code to do things it needs to do. I was just saying that they have enough clout that the platform iOS has a solid foundation and can weather the storm that would inevitably rise from such a divisive decision.