3 ms·

On Android you can Sideload VPN apps, iOS on the otherhand banned them in China. Apple mounted the most successful attack on General Computing with it's walled

On Android you can Sideload VPN apps, iOS on the otherhand banned them in China. Apple mounted the most successful attack on General Computing with it's walled garden. The whole Apple is good for privacy is marketing.

3825 9y ago
Sorry for the silly question. I don't own a mac or an iPhone anymore. My understanding is you can sideload apps on your own iPhone from your own mac running xcode. Are there limitations to what kind of apps you can side load using xcode?
- ikawe 9y ago
  Nothing installed that way can receive push notifications, though not all apps need or use then.
  - nnutter 9y ago
    I'm not certain but I think push notifications can also be used "invisibly" to trigger data sync so this could mean limited functionality beyond just receiving "pop-ups".
  - mhovan 9y ago
    Not strictly true. I regularly test push notifications on sideloaded builds at client sites. Getting provisioning profiles and certificates setup correctly (especially on all extensions) is a bit cumbersome. To get those certificates may require an Apple enterprise developer account. And the builds signed this way are not debuggable.
  - dpkonofa 9y ago
    That's not true. You can receive push notifications on side loaded apps.
- ReverseCold 9y ago
  You can (used to be able to?) also sideload without a Mac, that's how some pirate app stores work without jailbreak.
blfr 9y ago
You don't need to sideload VPN apps on Android. They're right in the store, and there's an API for them to run without root, from what I understand. Here's OpenVPN. https://play.google.com/store/apps/details?id=net.openvpn.openvpn&hl=en https://play.google.com/store/apps/details?id=net.openvpn.op... There's also Tor with Orbot and Orfox. https://play.google.com/store/apps/details?id=org.torproject.android&hl=en https://play.google.com/store/apps/details?id=org.torproject... https://play.google.com/store/apps/details?id=info.guardianproject.orfox&hl=en https://play.google.com/store/apps/details?id=info.guardianp... But only explicitly configured apps will use this proxy. Proxying all traffic does require a rooted phone. In general, Android gives you more options but iOS seems to offer a more privacy-minded configuration OOTB.
- userbinator 9y ago
  The parent is talking about the lesser-known (for obvious reasons) VPNs, not the well-known ones which are pretty much useless in China for "jumping over the wall".
  - blfr 9y ago
    Do Chinese authorities block OpenVPN based on traffic characteristics? Because you can use this app to connect to any OpenVPN server you choose, including your own. Same with Tor. You can use an unlisted bridge to get on the network.
    - userbinator 9y ago
      They do deep packet inspection. This item, especially the top comment, is well worth reading: https://news.ycombinator.com/item?id=10101469 https://news.ycombinator.com/item?id=10101469
disconnected 9y ago
Android and its community are sorta schizophrenic towards security. On one hand, users are told that they should never ever, ever install applications from untrusted sources. They should always use the play store because applications are scanned for vulnerabilities and whatnot. On the other hand, we have people telling us that one of the great advantages of Android is that you can sideload apps - bypassing the store security model completely. On one hand, a VPN needs root access for transparent proxying (or at least TOR does). Changing the hosts file needs root access. Changing gps.conf requires root. Lots of useful operations need root access, so if you are concerned about privacy and security, or just want more control, you probably want root. On the other hand, root is stupidly hard to obtain, and users are strongly discouraged from doing it anyway because it opens all sorts of attack vectors. Unless the manufacturer provides a legitimate method to do it, the operation of obtaining root itself, like on iOS, often relies on an unpatched local privilege escalation vulnerability. Note that any application can exploit this, not just the rooting app. I don't support Apple's walled garden approach, but we can't argue that they have a much clearer picture with regards to security, and the results speak for themselves. Malware in the Apple devices is rare, whereas in Android it is rapidly becoming routine. Unfortunately, you sacrifice flexibility for enhanced security.
- jswizzy 9y ago
  Yep as someone who is in a cybersecurity job, it's almost trivial to hack Android.
  - ReverseCold 9y ago
    Most Android devices at least, unless you have the latest Nex... Pixel or Samsung phone.
    - blfr 9y ago
      Considering this is HN, you're probably fine with any device as long as you run a patched OS on it. Which is fairly easy with LineageOS. And they support a lot of devices. I dug out an old Moto G (1st generation, falcon) last week and it runs Lineage 14 (based on Android 7/Nougat) smoothly.

3825 9y ago

Sorry for the silly question. I don't own a mac or an iPhone anymore. My understanding is you can sideload apps on your own iPhone from your own mac running xcode. Are there limitations to what kind of apps you can side load using xcode?

ikawe 9y ago
Nothing installed that way can receive push notifications, though not all apps need or use then.
- nnutter 9y ago
  I'm not certain but I think push notifications can also be used "invisibly" to trigger data sync so this could mean limited functionality beyond just receiving "pop-ups".
- mhovan 9y ago
  Not strictly true. I regularly test push notifications on sideloaded builds at client sites. Getting provisioning profiles and certificates setup correctly (especially on all extensions) is a bit cumbersome. To get those certificates may require an Apple enterprise developer account. And the builds signed this way are not debuggable.
- dpkonofa 9y ago
  That's not true. You can receive push notifications on side loaded apps.
ReverseCold 9y ago
You can (used to be able to?) also sideload without a Mac, that's how some pirate app stores work without jailbreak.

blfr 9y ago

You don't need to sideload VPN apps on Android. They're right in the store, and there's an API for them to run without root, from what I understand. Here's OpenVPN. https://play.google.com/store/apps/details?id=net.openvpn.openvpn&hl=en https://play.google.com/store/apps/details?id=net.openvpn.op... There's also Tor with Orbot and Orfox. https://play.google.com/store/apps/details?id=org.torproject.android&hl=en https://play.google.com/store/apps/details?id=org.torproject... https://play.google.com/store/apps/details?id=info.guardianproject.orfox&hl=en https://play.google.com/store/apps/details?id=info.guardianp... But only explicitly configured apps will use this proxy. Proxying all traffic does require a rooted phone. In general, Android gives you more options but iOS seems to offer a more privacy-minded configuration OOTB.

userbinator 9y ago
The parent is talking about the lesser-known (for obvious reasons) VPNs, not the well-known ones which are pretty much useless in China for "jumping over the wall".
- blfr 9y ago
  Do Chinese authorities block OpenVPN based on traffic characteristics? Because you can use this app to connect to any OpenVPN server you choose, including your own. Same with Tor. You can use an unlisted bridge to get on the network.
  - userbinator 9y ago
    They do deep packet inspection. This item, especially the top comment, is well worth reading: https://news.ycombinator.com/item?id=10101469 https://news.ycombinator.com/item?id=10101469

disconnected 9y ago

Android and its community are sorta schizophrenic towards security. On one hand, users are told that they should never ever, ever install applications from untrusted sources. They should always use the play store because applications are scanned for vulnerabilities and whatnot. On the other hand, we have people telling us that one of the great advantages of Android is that you can sideload apps - bypassing the store security model completely. On one hand, a VPN needs root access for transparent proxying (or at least TOR does). Changing the hosts file needs root access. Changing gps.conf requires root. Lots of useful operations need root access, so if you are concerned about privacy and security, or just want more control, you probably want root. On the other hand, root is stupidly hard to obtain, and users are strongly discouraged from doing it anyway because it opens all sorts of attack vectors. Unless the manufacturer provides a legitimate method to do it, the operation of obtaining root itself, like on iOS, often relies on an unpatched local privilege escalation vulnerability. Note that any application can exploit this, not just the rooting app. I don't support Apple's walled garden approach, but we can't argue that they have a much clearer picture with regards to security, and the results speak for themselves. Malware in the Apple devices is rare, whereas in Android it is rapidly becoming routine. Unfortunately, you sacrifice flexibility for enhanced security.

jswizzy 9y ago
Yep as someone who is in a cybersecurity job, it's almost trivial to hack Android.
- ReverseCold 9y ago
  Most Android devices at least, unless you have the latest Nex... Pixel or Samsung phone.
  - blfr 9y ago
    Considering this is HN, you're probably fine with any device as long as you run a patched OS on it. Which is fairly easy with LineageOS. And they support a lot of devices. I dug out an old Moto G (1st generation, falcon) last week and it runs Lineage 14 (based on Android 7/Nougat) smoothly.