4 ms·

When people bitch about “walled gardens” I like to remind them just why people build walls. This... is why. Sure, a world without walls and locks would be ideal

When people bitch about “walled gardens” I like to remind them just why people build walls. This... is why. Sure, a world without walls and locks would be ideal, but only if it’s also a world without thieves, saboteurs, and jerks.

PeachPlum 9y ago
"Good fences make good neighbors."
hawski 9y ago
Google Play is a walled garden. Maybe a wall is a little lower then some, but still. Is F-Droid a walled garden?
- Spivak 9y ago
  Yeah, its walls are higher than most. What's the point?
lactinfo 9y ago
Err, isn’t the google play store exactly the type of walled garden people bitch about? It has walls and locks all over the place. To what are you referring?
draw_down 9y ago
Um.... it didn’t seem to do much good here. Not sure what your point is.
- eric-hu 9y ago
  I think his point is that Apple's app store is commonly criticized for being a walked garden. While the Android app store may be as well, some complaints seem specific to the Apple side. For instance, releasing a new or updated app requires manual review from someone at Apple. I've only seen complaints about an app release taking an arbitrary amount of time with the Apple app store. There's a list of guidelines your app must conform to, and Apple is generally more aggressive about catching violations before app release compared to Google. There are consequences to this, like Safari-WebKit being the only permitted browser engine on iOS. Any other browser must wrap this engine. The grandparent post is likely pointing out the dissatisfaction that devs express regarding the Apple app store review process. It seems like it comes down to an engineering trade-off. At some point you have to choose between developer experience and end user security.
ryanmarsh 9y ago
Scams in the Google Play store are an old problem. It genuinely perplexes me that Google hasn't solved this problem. Surely they realize this drives people away from the platform. My parents don't follow @swiftonsecurity but they do read the news and they don't want their retirement accounts pilfered. Thus they overreact to any negative security news in the mainstream news. So they own iPhones. The volume of bad news about Android security outweighs iOS.
- Sylos 9y ago
  Google has an obsession with automating everything and employing at best no humans at all. Same thing with Chrome extensions. Mozilla has solved this same problem in near perfection by just having a few actual human beings look over the code of newly submitted or updated extensions. Google has magnitudes more money than Mozilla, so they could easily afford to just copy that, too.
rectang 9y ago
While physical analogies have their limitations, a meatspace store where any supplier could drop their product without vetting would not be a safe place to shop. There has to be some sort of curation. Algorithms and automation can help with the curation, but there has to be something.
spiorf 9y ago
The irony is strong here. You need walled gardena because walled gardena protect people from dangerous software. Posted as a comment in a news about dangerous software found in a walled garden.
- ufmace 9y ago
  The argument would be that this suggests that Google's garden should have higher and better-guarded walls to prevent such things, while many seem to argue that our gardens' walls are too high. Apple gets criticized for having slower and more arbitrary manual reviews of all app updates, but they don't seem to get malicious apps like this in their app store nearly as much.
  - ycmbntrthrwaway 9y ago
    They also don't have decent free mail clients with OpenPGP support.
- wpietri 9y ago
  Not really. This is only news because it's surprising and uncommon. In contrast, consider the fake Microsoft tech support scams. Those are so common that Microsoft gets 10,000 complaints/month [1], so nobody would think to mention a single example here. [1] https://blogs.microsoft.com/on-the-issues/2017/05/18/fight-tech-support-scams/ https://blogs.microsoft.com/on-the-issues/2017/05/18/fight-t...
  - djrogers 9y ago
    It’s not uncommon at all, and it’s been documented here and other places many many times. The difference between this and your poor analogy is that here Google could actually prevent this if they chose to.
- nl 9y ago
  It's hardly a walled garden. More like a picket fence.
the8472 9y ago
If you prefer being unfree in the name of security, that is your prerogative. But please don't drag the rest of us with you into your golden cage. I prefer solutions that offer both, freedom and security. Such as proper application isolation, user review systems (a tough nut, yes) and generally having better reputation/quality signals than just a company name.
ycmbntrthrwaway 9y ago
They build walls and fences because of economic inequality. I have been in places with huge 3m walls and in places with no fences around the house and owner name plates over the doors. In former places there are jobless people asking for job in the streets, lets call them thieves. Walled gardens just keep small developers out of the marketplace by rising the bar. Now you need to pay money or have a name, so WhatsApp, Viber and similar shit can retain monopolies and keep their users despite being filled with ads and offer less security than competitors. Jabber clients and independent media never get a "verified" badge. If you want to download "genuine" WhatsApp, go to their website, check their TLS certificate (you can never be sure, they don't even bother to get a EV cert, even for WhatsApp web; https://app.wire.com/ https://app.wire.com/ has an EV, for example) and follow the link to Google Play. Software repos are not here to do the job of CAs.
- redstripe 9y ago
  And of course you go to their website by googling them. Maybe clicking one of the 5 adword links at the top of the page that look like search results. Works out nicely for someone.
  - ycmbntrthrwaway 9y ago
    That is what TLS EV certs are for. WhatsApp does not have EV, it is their problem. Just fucking read the whole message.

PeachPlum 9y ago

"Good fences make good neighbors."

hawski 9y ago

Google Play is a walled garden. Maybe a wall is a little lower then some, but still. Is F-Droid a walled garden?

Spivak 9y ago
Yeah, its walls are higher than most. What's the point?

lactinfo 9y ago

Err, isn’t the google play store exactly the type of walled garden people bitch about? It has walls and locks all over the place. To what are you referring?

draw_down 9y ago

Um.... it didn’t seem to do much good here. Not sure what your point is.

eric-hu 9y ago
I think his point is that Apple's app store is commonly criticized for being a walked garden. While the Android app store may be as well, some complaints seem specific to the Apple side. For instance, releasing a new or updated app requires manual review from someone at Apple. I've only seen complaints about an app release taking an arbitrary amount of time with the Apple app store. There's a list of guidelines your app must conform to, and Apple is generally more aggressive about catching violations before app release compared to Google. There are consequences to this, like Safari-WebKit being the only permitted browser engine on iOS. Any other browser must wrap this engine. The grandparent post is likely pointing out the dissatisfaction that devs express regarding the Apple app store review process. It seems like it comes down to an engineering trade-off. At some point you have to choose between developer experience and end user security.

ryanmarsh 9y ago

Scams in the Google Play store are an old problem. It genuinely perplexes me that Google hasn't solved this problem. Surely they realize this drives people away from the platform. My parents don't follow @swiftonsecurity but they do read the news and they don't want their retirement accounts pilfered. Thus they overreact to any negative security news in the mainstream news. So they own iPhones. The volume of bad news about Android security outweighs iOS.

Sylos 9y ago
Google has an obsession with automating everything and employing at best no humans at all. Same thing with Chrome extensions. Mozilla has solved this same problem in near perfection by just having a few actual human beings look over the code of newly submitted or updated extensions. Google has magnitudes more money than Mozilla, so they could easily afford to just copy that, too.

rectang 9y ago

While physical analogies have their limitations, a meatspace store where any supplier could drop their product without vetting would not be a safe place to shop. There has to be some sort of curation. Algorithms and automation can help with the curation, but there has to be something.

spiorf 9y ago

The irony is strong here. You need walled gardena because walled gardena protect people from dangerous software. Posted as a comment in a news about dangerous software found in a walled garden.

ufmace 9y ago
The argument would be that this suggests that Google's garden should have higher and better-guarded walls to prevent such things, while many seem to argue that our gardens' walls are too high. Apple gets criticized for having slower and more arbitrary manual reviews of all app updates, but they don't seem to get malicious apps like this in their app store nearly as much.
- ycmbntrthrwaway 9y ago
  They also don't have decent free mail clients with OpenPGP support.
wpietri 9y ago
Not really. This is only news because it's surprising and uncommon. In contrast, consider the fake Microsoft tech support scams. Those are so common that Microsoft gets 10,000 complaints/month [1], so nobody would think to mention a single example here. [1] https://blogs.microsoft.com/on-the-issues/2017/05/18/fight-tech-support-scams/ https://blogs.microsoft.com/on-the-issues/2017/05/18/fight-t...
- djrogers 9y ago
  It’s not uncommon at all, and it’s been documented here and other places many many times. The difference between this and your poor analogy is that here Google could actually prevent this if they chose to.
nl 9y ago
It's hardly a walled garden. More like a picket fence.

the8472 9y ago

If you prefer being unfree in the name of security, that is your prerogative. But please don't drag the rest of us with you into your golden cage. I prefer solutions that offer both, freedom and security. Such as proper application isolation, user review systems (a tough nut, yes) and generally having better reputation/quality signals than just a company name.

ycmbntrthrwaway 9y ago

They build walls and fences because of economic inequality. I have been in places with huge 3m walls and in places with no fences around the house and owner name plates over the doors. In former places there are jobless people asking for job in the streets, lets call them thieves. Walled gardens just keep small developers out of the marketplace by rising the bar. Now you need to pay money or have a name, so WhatsApp, Viber and similar shit can retain monopolies and keep their users despite being filled with ads and offer less security than competitors. Jabber clients and independent media never get a "verified" badge. If you want to download "genuine" WhatsApp, go to their website, check their TLS certificate (you can never be sure, they don't even bother to get a EV cert, even for WhatsApp web; https://app.wire.com/ https://app.wire.com/ has an EV, for example) and follow the link to Google Play. Software repos are not here to do the job of CAs.

redstripe 9y ago
And of course you go to their website by googling them. Maybe clicking one of the 5 adword links at the top of the page that look like search results. Works out nicely for someone.
- ycmbntrthrwaway 9y ago
  That is what TLS EV certs are for. WhatsApp does not have EV, it is their problem. Just fucking read the whole message.