17 ms·

Apple restores Google’s internal iOS apps after certificate misuse punishment

237 points by sidcool 8y ago

booleandilemma 8y ago
That was fast.
shinymark 8y ago
Anyone know how the revocation and subsequent reversal works at a nuts and bolts level? I’m curious.
- saagarjha 8y ago
  Revocation is simple: Apple simply blacklists the certificate, and iOS devices will refuse to run the app. I'm not sure how reversal works, but it's likely that either Google was granted a new certificate to sign their apps with or Apple somehow has a way of "unblacklisting" certificates.
  - vortico 8y ago
    Do iPhone users lack the ability to have control over their device by adding their own certificates?
    - saagarjha 8y ago
      That's the whole point of enterprise certificates. However, everything must still be rooted at Apple's WWDR authority, including these certificates.
    - code_duck 8y ago
      Presumably if the ability was present, Google or anyone could easily get around this.
    - geofft 8y ago
      Unjailbroken iOS users, yes - certificates are signed by Apple. That said it's pretty easy to get a developer certificate for yourself. You just have to a) own a Mac and b) agree to not use it externally (which is what both Facebook and Google failed to do), but nothing prevents there being e.g. a community of people running open-source apps that don't abide by the App Store restrictions, all compiling them on their own machines.
      - saagarjha 8y ago
        > agree to not use it externally (which is what both Facebook and Google failed to do) It's important to note that the certificates that Facebook and Google had revoked were not developer certificates, they were enterprise certificates, which are have significantly fewer restrictions when distributing outside of the App Store and hence have more rules attached to their use.
      - eric-hu 8y ago
        > but nothing prevents there being e.g. a community of people running open-source apps that don't abide by the App Store restrictions, all compiling them on their own machines. My memory could be wrong on this, but I thought this is exactly what the Flux app did and Apple sent them a cease and desist for keeping the self compile and self sign instructions online. In a sense, you're still right as long as the community stays small enough that it doesn't get the attention of Apple.
        saagarjha 8y ago
        f.lux is not open source, and Apple told it to stop because it tried to distribute itself as an opaque binary rather than something that users could compile themselves.
        eric-hu 8y ago
        I don't think this is accurate. The original announcement HN thread includes discussion of the source, which is linked and still online on GitHub: https://news.ycombinator.com/item?id=10550427 https://news.ycombinator.com/item?id=10550427
    - izacus 8y ago
      > Do iPhone users lack the ability to have control over their device by adding their own certificates? That is correct, you cannot run software that wasn't explicitly allowed by Apple on your phone.
  - jordache 8y ago
    what if device is not connected to internet or that you have the apple certificate check IPs blocked in your corporate proxy?
    - saagarjha 8y ago
      As of iOS 8.1, enterprise-signed apps will refuse to launch if the device has not recently checked in with Apple to grab the latest revocation list.
      - shinymark 8y ago
        Got it, that was the main missing link that I was looking for. Devices are frequently phoning home to get an updated certificate revocation list.
      - jordache 8y ago
        how easy is it ti mock this list? Say you map that apple endpoint within your local network to mocked revocation list? I assume it's probably hashed?
        saagarjha 8y ago
        It’s probably signed by Apple or something like that.
kyrra 8y ago
It should be noted that (I don't believe) Google nor Apple aknowledged why the certificate stopped working. And shortly after it did stop working both Google and Apple said they were working to get it fixed.
- DannyBee 8y ago
  Right, this is probably techcrunch saving face because they really have no idea what they are talking about, so have to make it seem like whatever happened was in line with what they reported.
  - saagarjha 8y ago
    Sorry, but why do you think this? The Facebook app was very clearly Onavo rebranded and signed with an enterprise certificate; I have a copy of the file if you'd like to check it yourself.
    - DannyBee 8y ago
      We're talking about the google one,not the facebook one. The google one - there is no sourced evidence that apple banned them. Apple has no reason to include friendly PR and did in the google case. So did Google. These were coordinated messages clearly. In the facebook case that did not happen That suggests the are not the same. I posited a working theory above.
      - saagarjha 8y ago
        Facebook and Google engineers have weighed in on Hacker News confirming that their internal apps stopped working. Again, why do you think TechCrunch doesn't know what they're talking about here?
        DannyBee 8y ago
        Again, i don't disagree both certs were revoked, and it's been actually confirmed that apple banned facebook . That doesn't mean apple intentionally banned Google. This has neither been confirmed (and is completely and totally unsourced), nor would it make any sense for them to ban google and then issue friendly press about it. So I'm suggesting the different reactions from apple and coordinated messaging differences imply there is something different about this case.
united893 8y ago
Is Apple now also going to ban Square, Sonos, Amazon, DoorDash, Instacart, Postmates, Uber, DBS Bank, Handy, Vseen, Shiphero etc for also misusing their certificates? If you're going to rule with an iron fist on your walled garden, then you better do it fairly. If they don't then they stand to be ridiculed and lose face. [0] Square https://squareup.com/help/us/en/article/5492-customer-display https://squareup.com/help/us/en/article/5492-customer-displa... [1] Amazon https://www.azflexinfo.com/how-to-download-and-install-the-amazon-flex-app-on-your-phone https://www.azflexinfo.com/how-to-download-and-install-the-a... [1.5] Casino 2020 https://www.igt.com/promotions/casino2020 https://www.igt.com/promotions/casino2020 [2] Doordash https://dasherhelp.doordash.com/download-app/ https://dasherhelp.doordash.com/download-app/ [3] Sonos https://twitter.com/archer_mcgee/status/1091176871734108161 https://twitter.com/archer_mcgee/status/1091176871734108161 [4] Instacart https://shoppers.instacart.com/apps https://shoppers.instacart.com/apps [5] Postmates https://fleet-help.postmates.com/hc/en-us/articles/225239347-Download-the-Postmates-Fleet-app-for-iOS https://fleet-help.postmates.com/hc/en-us/articles/225239347... [6] Uber https://help.uber.com/partners/article/updating-the-driver-app-?nodeId=3b6e7a5f-41b1-4da5-b14a-6305f66dbdaf https://help.uber.com/partners/article/updating-the-driver-a... [8] DBS https://www.dbs.com.sg/ibanking/mbanking/demo/index.html?pid=sg-dbs-lp-btnappstore-mbanking-app-download-page https://www.dbs.com.sg/ibanking/mbanking/demo/index.html?pid... [9] Handy https://prohelp.handy.com/hc/en-us/articles/217292127-Download-Handy-Pro-for-iOS https://prohelp.handy.com/hc/en-us/articles/217292127-Downlo... [10] https://viseven.com/ar-app https://viseven.com/ar-app [11] ShipHero https://help.shiphero.com/article/246-trusting-ios-apps-on-device https://help.shiphero.com/article/246-trusting-ios-apps-on-d... Worth noting the relationship between these services and the "paid contractors" that use the app is expressly not Employer-Employee. Facebook and Google paid third party personnel, so is Instacart and Uber.
- dman 8y ago
  Any idea how companies like Nielsen get their stats?
  - nevalainen 8y ago
    You get a black tracking box installed at your house. TV-tracking is done by sound signatures and web-tracking is done with a router which has custom firmware installed.
DennisAleynikov 8y ago
So does this mean Facebook is going to get their restored? Or is this some kind of slap on the wrist for google but also not really. Very confusing messaging from Apple here.
- ocdtrekkie 8y ago
  Facebook's was restored a few hours ago. Apple likely wanted to have a nice long chat with some people at each company about their behavior. This was probably meant as a warning not to step out of line again.
  - DannyBee 8y ago
    Or one was an accident and the other wasn't?
    - gok 8y ago
      Whose accident?
    - DannyBee 8y ago
      Here, let me posit a theory that fits all facts: Apple banned Facebook. They said nothing in PR about it. Apple did not in fact ban Google. Instead, one of (Apple, Google) fucked up removing the screenwise app and accidentally revoked the cert. Techcrunch being techcrunch, they assumed Apple banned Google and published that with literally no supporting evidence. If that was true, why would anyone publish friendly press so quickly? and at literally the same time? All data instead suggests if Apple banned Google, both would shut up about it. Instead, here, both Apple and Google release press statements stating they are working to fix the issue as soon as possible in a coordinated manner. Unfortunately, techcrunch/et al can't walk back their statements without looking like idiots, so they go with "Apple banned google and then google must have apologized or something" as their narrative, even though that narrative makes literally no sense given the difference in reactions from Apple.
  - mrmondo 8y ago
    Indeed, Apple is known (internally) for sitting down with privacy offenders and having serious conversations where they explain not just the rules they broke but why those rules are in place and that one of Apples business models comes from the value that they place on data and information privacy above all else is both a product and a right that people should have.
homogenaity 8y ago
So, random people, non-employees, not QA testing, not bound by real business relationships, get a copy of some enterprise FAANG apps... And that certainly is insteresting, and significant, but what circumstances does this confer to those who get the app? And are normal, ordinary commoners disadvantaged by this and missing out, or are the enterprise randos getting a hyperinvasive, buggy, flakey, nightly, crash prone, hazardous, insecure, warranty voiding piles of garbage? I guess we can’t know, without seeing what the enterprise distributions look like, and the point is that there are consumers getting special treatment, when that’s not the way the game is supposed to be played, violating franchise rules...
coder543 8y ago
I hope all of the publicity this gets will somehow bring more attention to how much control Apple exerts over the iOS app ecosystem, and maybe bring change there. I think developers should be able to distribute their apps outside of the App Store if they want, just like on macOS and Android, but Apple is allowed to have this much control because the iPhone doesn't represent the majority of the market, so they aren't as subject to monopoly/antitrust stuff. I can still hope that Apple will open up their mobile platform further, one day.
- marricks 8y ago
  They seem to be the only body capable (and willing) to enforce privacy measures, so god I hope your wrong.
  - flukus 8y ago
    My linux machines don't have a lot of privacy problems and don't have the overbearing corporate control. Walled gardens are great, but so are gates.
    - quantummkv 8y ago
      The typical Linux gardens have caretakers with backgrounds in navy seals and are fully capable of protecting their gardens without gates. The average iOS and Android users don't even know they are in a garden, much less know how to protect it.
      - flukus 8y ago
        You're looking at the current state and not the model itself. > The average iOS and Android users don't even know they are in a garden, much less know how to protect it. If you took those same users and put them on the linux equivalent (ignoring other practicalities) the same will be true, any software they want will be coming from the ubuntu software center or something equivalent and they wouldn't have to protect themselves. Yet they'd still have the freedom to get software from other sources if they wished. Corporate users could build their own repository and have software installed from there without involving anyone else. Windows didn't have such a malware problem because they gave users the freedom, it was because downloading installers from websites was the default way to install software. Without this history windows could be (I don't know how trusted the windows store should be) in the same position as linux today, with users trained to install what they want from the store but still able to go around it. The apple desktop is in basically the same situation as windows. Android isn't a walled garden, you can install apps from elsewhere. Unfortunately the play store isn't a trustworthy source of software like apple store or a linux repository, all sorts of crap ends up there. Google even generates a per device Id to help software track you.
cenal 8y ago
Devils advocate here but who would still use an iPhone if Google and Facebook pulled their apps? It’s all sunshine and rainbows if this ends here but if it escalated it would be worse for Apple than they think.
- saagarjha 8y ago
  I probably would, but only because I have managed to keep my reliance on Google's services to things that follow open protocols, don't use Facebook, and have far too many eggs in the "Apple" basket.
- tw04 8y ago
  I would, in a heartbeat. Facebook was uninstalled the moment the last round of spying was announced on android. I love maps and google music/youtube, but I could live without them, neither are deal breakers.
- burlesona 8y ago
  I would, because I don’t use Facebook at all and don’t care about Google’s native apps.
- PascLeRasc 8y ago
  Some of us already use our phones as if that's the case.
- sidcool 8y ago
  I know very few people would, and I would be one of them. It would be a huge respite.
- beezischillin 8y ago
  Well, other than YouTube, I don't use any Google apps so I would barely even notice. I don't use any Facebook apps.
- isatty2 8y ago
  Only thing that'd really affect me is google maps but I can make do with apple maps or using the web ui
mishurov 8y ago
Very good. Intelligent tech people don't use those inferior consumerist fashion accessories anyway.
calimac 8y ago
Google and facebook are the scum of corporate society
debt 8y ago
The irony is that Apple and Google and most larger tech companies require every single one of their own employees to install these certs on their phone.
georgewfraser 8y ago
Why do these bigcos use native apps for internal tools? I would think a progressive web app would be easier to maintain for multiple platforms and a good-enough user experience for an internal tool.
- TACIXAT 8y ago
  PWAs aren't fully supported across devices yet. For example, push notifications don't work in iOS Safari.
  - beezischillin 8y ago
    They could just use SMS notifications instead of push notifications. Both Google and Facebook have the infrastructure for that.
    - DeonPenny 8y ago
      But you also would have many more native devs on hand who specialize on that device
      - oblio 8y ago
        This argument is hilarious :) I'm pretty sure both Google and Facebook have way more webdevs available ;)
        DeonPenny 8y ago
        But not many web devs that specialize in that device or mobile devices in general. As someone who does both usually the native dev have a much better advantage if given 2 native devs vs 2 web devs. But thats just my experience.
- mrmondo 8y ago
  Give me a real app over a web app any day, the performance, the power and flexibility of native integration and if nothing else - JavaScript is a mess.
ctime 8y ago
Big fan of Apple products and privacy in general, but this was a really dumb move and to what end? This effort has done some serious damage to the relationships of the companies and caused needless divide. Google and Facebook should have been given a reasonable amount of time to remove the software and/or been denied renewal of their signing certs.
gigatexal 8y ago
Is Facebook still revoked?
- atdt 8y ago
  No; https://www.theverge.com/2019/1/31/18206020/apple-facebook-internal-ios-apps-restores-enterprise-certificate https://www.theverge.com/2019/1/31/18206020/apple-facebook-i...
kanishkdudeja 8y ago
Just a ploy to distract away from the FaceTime bug. What was the point of revoking the certificate if they've restored it the next day?
- saagarjha 8y ago
  It's not clear whether the Google was given a new certificate, or if their old one was reactivated, but either way it stopped both of them from abusing their enterprise certificates.
sascha_sl 8y ago
Apple would never restore services to any individual or small business like this. Neither would Google. This is bullshit and Google should've been forced to deal with their mistake.
- sschueller 8y ago
  Yes, this is why we need to stop supporting companies that run such centralised walled gardens. This includes google, facebook, youtube, instagram, whatsapp etc.
  - ajvs 8y ago
    Could have just said Google and Facebook since they're run by those two companies.
    - sschueller 8y ago
      Sadly true and most on HN probably know that but even more disturbing is not everyone knows.
  - ajross 8y ago
    And Apple, right? The whole point here is Apple's ability to selectively decide whose software runs in the garden.
- goldenchrome 8y ago
  You want to stop people at Google from being able to internally distribute iOS apps permanently? Apple and Google are far too reliant on each other for Apple to follow through with such a large punishment. Businesses skew towards "rational", not "fair".
bsaul 8y ago
There really is a blind spot in the app distribution mechanisms. There is no way to distribute your app only to a selected amount of "customer / partners". Either you put it on the app store, and everybody can download it, or you use an enterprise certificate but you're now at the mercy of apple having a different definition of what you're allowed to do with it and what constitutes a "member of the company".
- Infinitesimus 8y ago
  OT: I'm not familiar with the app store details (I develop on Android) but if an Enterprise Cert is the only way, that's embarrassingly poor and I hope they improve it soon for the sake of other devs. It's trivially easy to have a closed Beta/Alpha channel on the Play Store and updates are handled like with any other app update. On Topic: it was only a matter of time until Apple restored the cert but I am still glad they revoked it as a very clear and loud warning. This might all just be grand posturing but it's good to see the big shots get a very public warning
  - bashy 8y ago
    Apple too have TestFlight for that https://developer.apple.com/testflight/ https://developer.apple.com/testflight/
- ForHackernews 8y ago
  This is what everyone who sings the praises of locked-down platforms is advocating for. Either you control your own hardware and you can run whatever you want, or you don't and you can't. Those are the choices.
- Reason077 8y ago
  There is TestFlight: https://developer.apple.com/testflight/ https://developer.apple.com/testflight/ (With the caveat that builds expire after 90 days)
  - bsaul 8y ago
    TestFlight doesn't work for b2b. You can't sell or give a private customer a software solution then ask them to register for a test to get the iOS software.
thucydidesofusa 8y ago
disclosure - I have a significant interest in Apple. Apple should shake down Google and Facebook, it'd be a good thing if the tech companies made their competition personal.
Tsubasachan 8y ago
Why aren't they using Android phones? You have full control over what apps your device runs.
- remus 8y ago
  Presumably some of their 85000 employees prefer to use iphones.
chooseaname 8y ago
I said on one of the other posts about this that I wouldn't be surprised if Apple gave Google a heads up to let them know they have to be consistent. Especially given that Google basically apologized. Now I'm more convinced.
GeekyBear 8y ago
Apple hands companies who sign up for an enterprise signing certificate the equivalent of a "get out of walled garden free" card, on the condition that you not use it to distribute software to people outside your company. This is made VERY clear when you sign up and Google, at least, made it clear that using it to distribute software to the public violated the agreement they had entered into. >A Google spokesperson told The Verge, “The Screenwise Meter iOS app should not have operated under Apple’s developer enterprise program — this was a mistake, and we apologize. https://www.theverge.com/2019/1/30/18204064/apple-google-monitoring-phone-usage-screenwise-meter https://www.theverge.com/2019/1/30/18204064/apple-google-mon...

237 points by sidcool 8y ago

booleandilemma 8y ago

That was fast.

shinymark 8y ago

Anyone know how the revocation and subsequent reversal works at a nuts and bolts level? I’m curious.

saagarjha 8y ago
Revocation is simple: Apple simply blacklists the certificate, and iOS devices will refuse to run the app. I'm not sure how reversal works, but it's likely that either Google was granted a new certificate to sign their apps with or Apple somehow has a way of "unblacklisting" certificates.
- vortico 8y ago
  Do iPhone users lack the ability to have control over their device by adding their own certificates?
  - saagarjha 8y ago
    That's the whole point of enterprise certificates. However, everything must still be rooted at Apple's WWDR authority, including these certificates.
  - code_duck 8y ago
    Presumably if the ability was present, Google or anyone could easily get around this.
  - geofft 8y ago
    Unjailbroken iOS users, yes - certificates are signed by Apple. That said it's pretty easy to get a developer certificate for yourself. You just have to a) own a Mac and b) agree to not use it externally (which is what both Facebook and Google failed to do), but nothing prevents there being e.g. a community of people running open-source apps that don't abide by the App Store restrictions, all compiling them on their own machines.
    - saagarjha 8y ago
      > agree to not use it externally (which is what both Facebook and Google failed to do) It's important to note that the certificates that Facebook and Google had revoked were not developer certificates, they were enterprise certificates, which are have significantly fewer restrictions when distributing outside of the App Store and hence have more rules attached to their use.
    - eric-hu 8y ago
      > but nothing prevents there being e.g. a community of people running open-source apps that don't abide by the App Store restrictions, all compiling them on their own machines. My memory could be wrong on this, but I thought this is exactly what the Flux app did and Apple sent them a cease and desist for keeping the self compile and self sign instructions online. In a sense, you're still right as long as the community stays small enough that it doesn't get the attention of Apple.
      - saagarjha 8y ago
        f.lux is not open source, and Apple told it to stop because it tried to distribute itself as an opaque binary rather than something that users could compile themselves.
        eric-hu 8y ago
        I don't think this is accurate. The original announcement HN thread includes discussion of the source, which is linked and still online on GitHub: https://news.ycombinator.com/item?id=10550427 https://news.ycombinator.com/item?id=10550427
  - izacus 8y ago
    > Do iPhone users lack the ability to have control over their device by adding their own certificates? That is correct, you cannot run software that wasn't explicitly allowed by Apple on your phone.
- jordache 8y ago
  what if device is not connected to internet or that you have the apple certificate check IPs blocked in your corporate proxy?
  - saagarjha 8y ago
    As of iOS 8.1, enterprise-signed apps will refuse to launch if the device has not recently checked in with Apple to grab the latest revocation list.
    - shinymark 8y ago
      Got it, that was the main missing link that I was looking for. Devices are frequently phoning home to get an updated certificate revocation list.
    - jordache 8y ago
      how easy is it ti mock this list? Say you map that apple endpoint within your local network to mocked revocation list? I assume it's probably hashed?
      - saagarjha 8y ago
        It’s probably signed by Apple or something like that.

kyrra 8y ago

It should be noted that (I don't believe) Google nor Apple aknowledged why the certificate stopped working. And shortly after it did stop working both Google and Apple said they were working to get it fixed.

DannyBee 8y ago
Right, this is probably techcrunch saving face because they really have no idea what they are talking about, so have to make it seem like whatever happened was in line with what they reported.
- saagarjha 8y ago
  Sorry, but why do you think this? The Facebook app was very clearly Onavo rebranded and signed with an enterprise certificate; I have a copy of the file if you'd like to check it yourself.
  - DannyBee 8y ago
    We're talking about the google one,not the facebook one. The google one - there is no sourced evidence that apple banned them. Apple has no reason to include friendly PR and did in the google case. So did Google. These were coordinated messages clearly. In the facebook case that did not happen That suggests the are not the same. I posited a working theory above.
    - saagarjha 8y ago
      Facebook and Google engineers have weighed in on Hacker News confirming that their internal apps stopped working. Again, why do you think TechCrunch doesn't know what they're talking about here?
      - DannyBee 8y ago
        Again, i don't disagree both certs were revoked, and it's been actually confirmed that apple banned facebook . That doesn't mean apple intentionally banned Google. This has neither been confirmed (and is completely and totally unsourced), nor would it make any sense for them to ban google and then issue friendly press about it. So I'm suggesting the different reactions from apple and coordinated messaging differences imply there is something different about this case.

united893 8y ago

Is Apple now also going to ban Square, Sonos, Amazon, DoorDash, Instacart, Postmates, Uber, DBS Bank, Handy, Vseen, Shiphero etc for also misusing their certificates? If you're going to rule with an iron fist on your walled garden, then you better do it fairly. If they don't then they stand to be ridiculed and lose face. [0] Square https://squareup.com/help/us/en/article/5492-customer-display https://squareup.com/help/us/en/article/5492-customer-displa... [1] Amazon https://www.azflexinfo.com/how-to-download-and-install-the-amazon-flex-app-on-your-phone https://www.azflexinfo.com/how-to-download-and-install-the-a... [1.5] Casino 2020 https://www.igt.com/promotions/casino2020 https://www.igt.com/promotions/casino2020 [2] Doordash https://dasherhelp.doordash.com/download-app/ https://dasherhelp.doordash.com/download-app/ [3] Sonos https://twitter.com/archer_mcgee/status/1091176871734108161 https://twitter.com/archer_mcgee/status/1091176871734108161 [4] Instacart https://shoppers.instacart.com/apps https://shoppers.instacart.com/apps [5] Postmates https://fleet-help.postmates.com/hc/en-us/articles/225239347-Download-the-Postmates-Fleet-app-for-iOS https://fleet-help.postmates.com/hc/en-us/articles/225239347... [6] Uber https://help.uber.com/partners/article/updating-the-driver-app-?nodeId=3b6e7a5f-41b1-4da5-b14a-6305f66dbdaf https://help.uber.com/partners/article/updating-the-driver-a... [8] DBS https://www.dbs.com.sg/ibanking/mbanking/demo/index.html?pid=sg-dbs-lp-btnappstore-mbanking-app-download-page https://www.dbs.com.sg/ibanking/mbanking/demo/index.html?pid... [9] Handy https://prohelp.handy.com/hc/en-us/articles/217292127-Download-Handy-Pro-for-iOS https://prohelp.handy.com/hc/en-us/articles/217292127-Downlo... [10] https://viseven.com/ar-app https://viseven.com/ar-app [11] ShipHero https://help.shiphero.com/article/246-trusting-ios-apps-on-device https://help.shiphero.com/article/246-trusting-ios-apps-on-d... Worth noting the relationship between these services and the "paid contractors" that use the app is expressly not Employer-Employee. Facebook and Google paid third party personnel, so is Instacart and Uber.

dman 8y ago
Any idea how companies like Nielsen get their stats?
- nevalainen 8y ago
  You get a black tracking box installed at your house. TV-tracking is done by sound signatures and web-tracking is done with a router which has custom firmware installed.

DennisAleynikov 8y ago

So does this mean Facebook is going to get their restored? Or is this some kind of slap on the wrist for google but also not really. Very confusing messaging from Apple here.

ocdtrekkie 8y ago
Facebook's was restored a few hours ago. Apple likely wanted to have a nice long chat with some people at each company about their behavior. This was probably meant as a warning not to step out of line again.
- DannyBee 8y ago
  Or one was an accident and the other wasn't?
  - gok 8y ago
    Whose accident?
  - DannyBee 8y ago
    Here, let me posit a theory that fits all facts: Apple banned Facebook. They said nothing in PR about it. Apple did not in fact ban Google. Instead, one of (Apple, Google) fucked up removing the screenwise app and accidentally revoked the cert. Techcrunch being techcrunch, they assumed Apple banned Google and published that with literally no supporting evidence. If that was true, why would anyone publish friendly press so quickly? and at literally the same time? All data instead suggests if Apple banned Google, both would shut up about it. Instead, here, both Apple and Google release press statements stating they are working to fix the issue as soon as possible in a coordinated manner. Unfortunately, techcrunch/et al can't walk back their statements without looking like idiots, so they go with "Apple banned google and then google must have apologized or something" as their narrative, even though that narrative makes literally no sense given the difference in reactions from Apple.
- mrmondo 8y ago
  Indeed, Apple is known (internally) for sitting down with privacy offenders and having serious conversations where they explain not just the rules they broke but why those rules are in place and that one of Apples business models comes from the value that they place on data and information privacy above all else is both a product and a right that people should have.

homogenaity 8y ago

So, random people, non-employees, not QA testing, not bound by real business relationships, get a copy of some enterprise FAANG apps... And that certainly is insteresting, and significant, but what circumstances does this confer to those who get the app? And are normal, ordinary commoners disadvantaged by this and missing out, or are the enterprise randos getting a hyperinvasive, buggy, flakey, nightly, crash prone, hazardous, insecure, warranty voiding piles of garbage? I guess we can’t know, without seeing what the enterprise distributions look like, and the point is that there are consumers getting special treatment, when that’s not the way the game is supposed to be played, violating franchise rules...

coder543 8y ago

I hope all of the publicity this gets will somehow bring more attention to how much control Apple exerts over the iOS app ecosystem, and maybe bring change there. I think developers should be able to distribute their apps outside of the App Store if they want, just like on macOS and Android, but Apple is allowed to have this much control because the iPhone doesn't represent the majority of the market, so they aren't as subject to monopoly/antitrust stuff. I can still hope that Apple will open up their mobile platform further, one day.

marricks 8y ago
They seem to be the only body capable (and willing) to enforce privacy measures, so god I hope your wrong.
- flukus 8y ago
  My linux machines don't have a lot of privacy problems and don't have the overbearing corporate control. Walled gardens are great, but so are gates.
  - quantummkv 8y ago
    The typical Linux gardens have caretakers with backgrounds in navy seals and are fully capable of protecting their gardens without gates. The average iOS and Android users don't even know they are in a garden, much less know how to protect it.
    - flukus 8y ago
      You're looking at the current state and not the model itself. > The average iOS and Android users don't even know they are in a garden, much less know how to protect it. If you took those same users and put them on the linux equivalent (ignoring other practicalities) the same will be true, any software they want will be coming from the ubuntu software center or something equivalent and they wouldn't have to protect themselves. Yet they'd still have the freedom to get software from other sources if they wished. Corporate users could build their own repository and have software installed from there without involving anyone else. Windows didn't have such a malware problem because they gave users the freedom, it was because downloading installers from websites was the default way to install software. Without this history windows could be (I don't know how trusted the windows store should be) in the same position as linux today, with users trained to install what they want from the store but still able to go around it. The apple desktop is in basically the same situation as windows. Android isn't a walled garden, you can install apps from elsewhere. Unfortunately the play store isn't a trustworthy source of software like apple store or a linux repository, all sorts of crap ends up there. Google even generates a per device Id to help software track you.

cenal 8y ago

Devils advocate here but who would still use an iPhone if Google and Facebook pulled their apps? It’s all sunshine and rainbows if this ends here but if it escalated it would be worse for Apple than they think.

saagarjha 8y ago
I probably would, but only because I have managed to keep my reliance on Google's services to things that follow open protocols, don't use Facebook, and have far too many eggs in the "Apple" basket.
tw04 8y ago
I would, in a heartbeat. Facebook was uninstalled the moment the last round of spying was announced on android. I love maps and google music/youtube, but I could live without them, neither are deal breakers.
burlesona 8y ago
I would, because I don’t use Facebook at all and don’t care about Google’s native apps.
PascLeRasc 8y ago
Some of us already use our phones as if that's the case.
sidcool 8y ago
I know very few people would, and I would be one of them. It would be a huge respite.
beezischillin 8y ago
Well, other than YouTube, I don't use any Google apps so I would barely even notice. I don't use any Facebook apps.
isatty2 8y ago
Only thing that'd really affect me is google maps but I can make do with apple maps or using the web ui

mishurov 8y ago

Very good. Intelligent tech people don't use those inferior consumerist fashion accessories anyway.

calimac 8y ago

Google and facebook are the scum of corporate society

debt 8y ago

The irony is that Apple and Google and most larger tech companies require every single one of their own employees to install these certs on their phone.

georgewfraser 8y ago

Why do these bigcos use native apps for internal tools? I would think a progressive web app would be easier to maintain for multiple platforms and a good-enough user experience for an internal tool.

TACIXAT 8y ago
PWAs aren't fully supported across devices yet. For example, push notifications don't work in iOS Safari.
- beezischillin 8y ago
  They could just use SMS notifications instead of push notifications. Both Google and Facebook have the infrastructure for that.
  - DeonPenny 8y ago
    But you also would have many more native devs on hand who specialize on that device
    - oblio 8y ago
      This argument is hilarious :) I'm pretty sure both Google and Facebook have way more webdevs available ;)
      - DeonPenny 8y ago
        But not many web devs that specialize in that device or mobile devices in general. As someone who does both usually the native dev have a much better advantage if given 2 native devs vs 2 web devs. But thats just my experience.
mrmondo 8y ago
Give me a real app over a web app any day, the performance, the power and flexibility of native integration and if nothing else - JavaScript is a mess.

ctime 8y ago

Big fan of Apple products and privacy in general, but this was a really dumb move and to what end? This effort has done some serious damage to the relationships of the companies and caused needless divide. Google and Facebook should have been given a reasonable amount of time to remove the software and/or been denied renewal of their signing certs.

gigatexal 8y ago

Is Facebook still revoked?

atdt 8y ago
No; https://www.theverge.com/2019/1/31/18206020/apple-facebook-internal-ios-apps-restores-enterprise-certificate https://www.theverge.com/2019/1/31/18206020/apple-facebook-i...

kanishkdudeja 8y ago

Just a ploy to distract away from the FaceTime bug. What was the point of revoking the certificate if they've restored it the next day?

saagarjha 8y ago
It's not clear whether the Google was given a new certificate, or if their old one was reactivated, but either way it stopped both of them from abusing their enterprise certificates.

sascha_sl 8y ago

Apple would never restore services to any individual or small business like this. Neither would Google. This is bullshit and Google should've been forced to deal with their mistake.

sschueller 8y ago
Yes, this is why we need to stop supporting companies that run such centralised walled gardens. This includes google, facebook, youtube, instagram, whatsapp etc.
- ajvs 8y ago
  Could have just said Google and Facebook since they're run by those two companies.
  - sschueller 8y ago
    Sadly true and most on HN probably know that but even more disturbing is not everyone knows.
- ajross 8y ago
  And Apple, right? The whole point here is Apple's ability to selectively decide whose software runs in the garden.
goldenchrome 8y ago
You want to stop people at Google from being able to internally distribute iOS apps permanently? Apple and Google are far too reliant on each other for Apple to follow through with such a large punishment. Businesses skew towards "rational", not "fair".

bsaul 8y ago

There really is a blind spot in the app distribution mechanisms. There is no way to distribute your app only to a selected amount of "customer / partners". Either you put it on the app store, and everybody can download it, or you use an enterprise certificate but you're now at the mercy of apple having a different definition of what you're allowed to do with it and what constitutes a "member of the company".

Infinitesimus 8y ago
OT: I'm not familiar with the app store details (I develop on Android) but if an Enterprise Cert is the only way, that's embarrassingly poor and I hope they improve it soon for the sake of other devs. It's trivially easy to have a closed Beta/Alpha channel on the Play Store and updates are handled like with any other app update. On Topic: it was only a matter of time until Apple restored the cert but I am still glad they revoked it as a very clear and loud warning. This might all just be grand posturing but it's good to see the big shots get a very public warning
- bashy 8y ago
  Apple too have TestFlight for that https://developer.apple.com/testflight/ https://developer.apple.com/testflight/
ForHackernews 8y ago
This is what everyone who sings the praises of locked-down platforms is advocating for. Either you control your own hardware and you can run whatever you want, or you don't and you can't. Those are the choices.
Reason077 8y ago
There is TestFlight: https://developer.apple.com/testflight/ https://developer.apple.com/testflight/ (With the caveat that builds expire after 90 days)
- bsaul 8y ago
  TestFlight doesn't work for b2b. You can't sell or give a private customer a software solution then ask them to register for a test to get the iOS software.

thucydidesofusa 8y ago

disclosure - I have a significant interest in Apple. Apple should shake down Google and Facebook, it'd be a good thing if the tech companies made their competition personal.

Tsubasachan 8y ago

Why aren't they using Android phones? You have full control over what apps your device runs.

remus 8y ago
Presumably some of their 85000 employees prefer to use iphones.

chooseaname 8y ago

I said on one of the other posts about this that I wouldn't be surprised if Apple gave Google a heads up to let them know they have to be consistent. Especially given that Google basically apologized. Now I'm more convinced.

GeekyBear 8y ago

Apple hands companies who sign up for an enterprise signing certificate the equivalent of a "get out of walled garden free" card, on the condition that you not use it to distribute software to people outside your company. This is made VERY clear when you sign up and Google, at least, made it clear that using it to distribute software to the public violated the agreement they had entered into. >A Google spokesperson told The Verge, “The Screenwise Meter iOS app should not have operated under Apple’s developer enterprise program — this was a mistake, and we apologize. https://www.theverge.com/2019/1/30/18204064/apple-google-monitoring-phone-usage-screenwise-meter https://www.theverge.com/2019/1/30/18204064/apple-google-mon...