5 ms·

Is Apple now also going to ban Square, Sonos, Amazon, DoorDash, Instacart, Postmates, Uber, DBS Bank, Handy, Vseen, Shiphero etc for also misusing their certi

Is Apple now also going to ban Square, Sonos, Amazon, DoorDash, Instacart, Postmates, Uber, DBS Bank, Handy, Vseen, Shiphero etc for also misusing their certificates? If you're going to rule with an iron fist on your walled garden, then you better do it fairly. If they don't then they stand to be ridiculed and lose face. [0] Square https://squareup.com/help/us/en/article/5492-customer-display https://squareup.com/help/us/en/article/5492-customer-displa... [1] Amazon https://www.azflexinfo.com/how-to-download-and-install-the-amazon-flex-app-on-your-phone https://www.azflexinfo.com/how-to-download-and-install-the-a... [1.5] Casino 2020 https://www.igt.com/promotions/casino2020 https://www.igt.com/promotions/casino2020 [2] Doordash https://dasherhelp.doordash.com/download-app/ https://dasherhelp.doordash.com/download-app/ [3] Sonos https://twitter.com/archer_mcgee/status/1091176871734108161 https://twitter.com/archer_mcgee/status/1091176871734108161 [4] Instacart https://shoppers.instacart.com/apps https://shoppers.instacart.com/apps [5] Postmates https://fleet-help.postmates.com/hc/en-us/articles/225239347-Download-the-Postmates-Fleet-app-for-iOS https://fleet-help.postmates.com/hc/en-us/articles/225239347... [6] Uber https://help.uber.com/partners/article/updating-the-driver-app-?nodeId=3b6e7a5f-41b1-4da5-b14a-6305f66dbdaf https://help.uber.com/partners/article/updating-the-driver-a... [8] DBS https://www.dbs.com.sg/ibanking/mbanking/demo/index.html?pid=sg-dbs-lp-btnappstore-mbanking-app-download-page https://www.dbs.com.sg/ibanking/mbanking/demo/index.html?pid... [9] Handy https://prohelp.handy.com/hc/en-us/articles/217292127-Download-Handy-Pro-for-iOS https://prohelp.handy.com/hc/en-us/articles/217292127-Downlo... [10] https://viseven.com/ar-app https://viseven.com/ar-app [11] ShipHero https://help.shiphero.com/article/246-trusting-ios-apps-on-device https://help.shiphero.com/article/246-trusting-ios-apps-on-d... Worth noting the relationship between these services and the "paid contractors" that use the app is expressly not Employer-Employee. Facebook and Google paid third party personnel, so is Instacart and Uber.

dman 8y ago
Any idea how companies like Nielsen get their stats?
- nevalainen 8y ago
  You get a black tracking box installed at your house. TV-tracking is done by sound signatures and web-tracking is done with a router which has custom firmware installed.
- Uehreka 8y ago
  Last I checked it was way more low tech than you’d expect for a company people put a lot of stock in. Basically, they put scanners on some people’s TV’s (with their permission, which is good but introduces a lot of selection bias) and try to correlate what gets watched with the ages of the people in the house (while not knowing whos watching what and hoping the TV doesn’t just get left on for hours with no one watching).
  - Jach 8y ago
    They give you a remote with toggle buttons labeled with people's names so you can tell it who is watching or if multiple people are watching. They also have software for media pcs but you can hook up an intermediary box if you want. They also pay you per hooked up tv, and have stats on whether a tv is a bedroom / kitchen / family room tv.
- tzs 8y ago
  I once participated in data gathering for Arbitron, which gathers radio stats. It was very simple. For some period of time (I think it was a week...this was a long time ago so details are fuzzy) I was supposed to write down the time and identity of every radio station I heard (or maybe every station I heard for more than a few minutes?). At the end of the survey period, I mailed that to them. I forget how much they paid, but I think it was on the order of a few dollars. This would have been quite a while ago--probably at least 20 years ago. They still do that kind of survey, I believe, a few times a year in each of several hundred metropolitan areas. In 2007, they added another data gathering method that they use in a smaller number of major markets where participants wear a small device that can pick up subaudible identification messages embedded in radio broadcasts to tell what radio stations are being played in an area. These devices record that information and periodically send the data back to the company. In 2012 they were bought by Neilsen and are now called Neilsen Audio, but the data gathering is still as described above.
- makomk 8y ago
  At least at one point, Nielsen were getting their stats by paying people to install their iOS monitoring app using an enterprise developer certificate: http://www.arbitron.com/research/installhelp/install_ios9_en.pdf http://www.arbitron.com/research/installhelp/install_ios9_en... Including minors as young as 13 with parental consent: http://www.arbitron.com/research/faq/iBoard_faq_en.pdf http://www.arbitron.com/research/faq/iBoard_faq_en.pdf
DennisAleynikov 8y ago
Google's App did similar ban evasion technique as what Facebook Research put out so its weird that Facebook is still revoked (edit: apparently not they got unbanned) and Google and Amazon are still free to play. TOS has to be enforced less randomly, as that erodes trust. I do respect Apple's play here on privacy, but they are quite literally trying to police sideloaded apps and that's a hard thing to really do, which is why these apps went on undetected for a long time raising no flags until the recent media spotlight.
- deleted 8y ago
  [deleted]
saagarjha 8y ago
I think those apps have a much better chance of falling under "internal apps for employees", but they are somewhat close to the line.
NightMKoder 8y ago
Apple’s App Store policies have not been known for being fair to all participants. That’s for public apps. I’m not sure why they would change that stance - much less for enterprise apps - now. So long as the abuse is not egregious (see FB & G) they probably don’t care.
zapzupnz 8y ago
Unless Apple found it sufficient to make an example of Facebook and Google. The statement would be pretty clear: if you think we won't do it to you because you're a big company and a valued partner, just look at the size of the company who tried it on and think again.
- malshe 8y ago
  I am surprised that you are being downvoted. What you wrote makes a lot of sense.
- mikestew 8y ago
  Sibling comments says your comment was downvoted? I imagine you’re spot on. I caught my credit union doing this (to deploy a beta version to this customers), and I emailed them asking about their mental health given that Apple takes a dim view on such practices. And that’s just the one I’ve caught. So I could see Apple using this circumstance to fire a warning shot across multiple bows.
greglindahl 8y ago
I looked at the first two, they both appear to be aimed at people making deliveries for Amazon and Door Dash. It doesn't sound like the apps do anything unrelated to delivery work, much less analyze all web traffic from the mobile device 24/7. If the only point you're making is about employees vs. contractors, the 24/7 interception of non-work internet traffic seems to be far more important than employment classification.
diebeforei485 8y ago
Uber, DoorDash, and all the others actually issue 1099's to their drivers. I'd be surprised if users of the research apps were issued tax forms that show a similar relationship.
- united893 8y ago
  What's the line however? It's a bit blurry. If Google and Facebook starts paying their panelists using a 1099 that would be fine?
  - saagarjha 8y ago
    My interpretation is that this should be fine; just as I'm pretty sure it's OK to design MDM software for your employees that all but spies on them.
  - diebeforei485 8y ago
    The enterprise agreement itself does not require any showing of an employee-employer relationship as defined by the local jurisdiction. But if you read the rest of the agreement, you will find more requirements about who these apps may be distributed to, and they make this case pretty much a slam dunk in Apple's favor. For example, Facebook cannot possibly agree that they would be liable for what users of these research apps do, nor can they claim the ability to retrieve these devices if the relationship ends. So, no - simply issuing a tax form won't solve this for Facebook.
    - united893 8y ago
      That's fair, but Doordash, Square and Instacart don't have that ability either. They're distributing their apps via the same sideloading mechanism.
      - diebeforei485 8y ago
        At least the way I'm reading Apple's terms, those cases fall more cleanly into the Employee category (which includes 1099 contractors, as defined in the terms).
zethraeus 8y ago
They're not employees but 1099 workers sure sound like they're part of your 'Enterprise'. They could even be 'in house'. Lots of 1099s actually work in the same building as employees. What makes you think they wouldn't be covered?
- united893 8y ago
  Sure, fair point. But Facebook paid as well. If Facebook starts paying them via 1099, would that be fair?
  - zethraeus 8y ago
    Assuming Apple doesn't explicitly ban analytics collection (and how would that play with fancy mdm solutions?), it sure sounds like it should!
  - kccqzy 8y ago
    Generally if someone earned less than $600 as an independent contractor, the payer does not have to send the contractor a 1099-MISC. Given that Facebook pays $20 per month, it's well below the limit for issuing 1099s.
  - wheelerwj 8y ago
    everyone in the US who is not employed directly (where the employer pays income tax for you) are by default 10-99s if they are paid more than $600 per year... how the people are paid has nothing to do with why Apple took the action they did.
cameldrv 8y ago
Apple has historically looked the other way at a lot of uses of enterprise certs outside the fuzzy definition of who exactly is in the enterprise. The difference with the Apple and Google cases is that they were using the enterprise cert to distribute apps that were specifically banned from the app store, and they were distributing it to people that clearly did not have any kind of close relationship with the company. In many of your examples, the apps are for gig workers that are arguably part of the "enterprise.", even if they're not technically employees. I think Facebook tried to argue that because they were paying people $20 a month to keep the app on their phone that they were their contractors, but that is a very thin argument.
- mrep 8y ago
  Come on, let's be real, the difference is that the media blasted Facebook and Google about privacy issues and Apple capitalized on that to play to their privacy marketing play.
  - deleted 8y ago
    [deleted]
  - matthewmacleod 8y ago
    Why this, instead of the much simpler explanation above?
    - Buge 8y ago
      "Negative media attention about a thing, better ban it" seems like a fairly simple explanation to me.
  - hjanssen 8y ago
    Which i guess is _fine_ if the result from that is an increase in privacy for the end user. I get your point - there is something to be said about handling every "breach" of their rules differently. But in the case of Google and Facebook there is a clear distinction between evil and not evil if you factor in your list above, which we all can agree on.
joselreyes 8y ago
Apple hasn’t claimed it is banning Facebook or Google from their enterprise program. They are simply revoking the certificate that was spread to consumers. Those certificates can be re-generated.

dman 8y ago

Any idea how companies like Nielsen get their stats?

nevalainen 8y ago
You get a black tracking box installed at your house. TV-tracking is done by sound signatures and web-tracking is done with a router which has custom firmware installed.
Uehreka 8y ago
Last I checked it was way more low tech than you’d expect for a company people put a lot of stock in. Basically, they put scanners on some people’s TV’s (with their permission, which is good but introduces a lot of selection bias) and try to correlate what gets watched with the ages of the people in the house (while not knowing whos watching what and hoping the TV doesn’t just get left on for hours with no one watching).
- Jach 8y ago
  They give you a remote with toggle buttons labeled with people's names so you can tell it who is watching or if multiple people are watching. They also have software for media pcs but you can hook up an intermediary box if you want. They also pay you per hooked up tv, and have stats on whether a tv is a bedroom / kitchen / family room tv.
tzs 8y ago
I once participated in data gathering for Arbitron, which gathers radio stats. It was very simple. For some period of time (I think it was a week...this was a long time ago so details are fuzzy) I was supposed to write down the time and identity of every radio station I heard (or maybe every station I heard for more than a few minutes?). At the end of the survey period, I mailed that to them. I forget how much they paid, but I think it was on the order of a few dollars. This would have been quite a while ago--probably at least 20 years ago. They still do that kind of survey, I believe, a few times a year in each of several hundred metropolitan areas. In 2007, they added another data gathering method that they use in a smaller number of major markets where participants wear a small device that can pick up subaudible identification messages embedded in radio broadcasts to tell what radio stations are being played in an area. These devices record that information and periodically send the data back to the company. In 2012 they were bought by Neilsen and are now called Neilsen Audio, but the data gathering is still as described above.
makomk 8y ago
At least at one point, Nielsen were getting their stats by paying people to install their iOS monitoring app using an enterprise developer certificate: http://www.arbitron.com/research/installhelp/install_ios9_en.pdf http://www.arbitron.com/research/installhelp/install_ios9_en... Including minors as young as 13 with parental consent: http://www.arbitron.com/research/faq/iBoard_faq_en.pdf http://www.arbitron.com/research/faq/iBoard_faq_en.pdf

DennisAleynikov 8y ago

Google's App did similar ban evasion technique as what Facebook Research put out so its weird that Facebook is still revoked (edit: apparently not they got unbanned) and Google and Amazon are still free to play. TOS has to be enforced less randomly, as that erodes trust. I do respect Apple's play here on privacy, but they are quite literally trying to police sideloaded apps and that's a hard thing to really do, which is why these apps went on undetected for a long time raising no flags until the recent media spotlight.

deleted 8y ago
[deleted]

saagarjha 8y ago

I think those apps have a much better chance of falling under "internal apps for employees", but they are somewhat close to the line.

NightMKoder 8y ago

Apple’s App Store policies have not been known for being fair to all participants. That’s for public apps. I’m not sure why they would change that stance - much less for enterprise apps - now. So long as the abuse is not egregious (see FB & G) they probably don’t care.

zapzupnz 8y ago

Unless Apple found it sufficient to make an example of Facebook and Google. The statement would be pretty clear: if you think we won't do it to you because you're a big company and a valued partner, just look at the size of the company who tried it on and think again.

malshe 8y ago
I am surprised that you are being downvoted. What you wrote makes a lot of sense.
mikestew 8y ago
Sibling comments says your comment was downvoted? I imagine you’re spot on. I caught my credit union doing this (to deploy a beta version to this customers), and I emailed them asking about their mental health given that Apple takes a dim view on such practices. And that’s just the one I’ve caught. So I could see Apple using this circumstance to fire a warning shot across multiple bows.

greglindahl 8y ago

I looked at the first two, they both appear to be aimed at people making deliveries for Amazon and Door Dash. It doesn't sound like the apps do anything unrelated to delivery work, much less analyze all web traffic from the mobile device 24/7. If the only point you're making is about employees vs. contractors, the 24/7 interception of non-work internet traffic seems to be far more important than employment classification.

diebeforei485 8y ago

Uber, DoorDash, and all the others actually issue 1099's to their drivers. I'd be surprised if users of the research apps were issued tax forms that show a similar relationship.

united893 8y ago
What's the line however? It's a bit blurry. If Google and Facebook starts paying their panelists using a 1099 that would be fine?
- saagarjha 8y ago
  My interpretation is that this should be fine; just as I'm pretty sure it's OK to design MDM software for your employees that all but spies on them.
- diebeforei485 8y ago
  The enterprise agreement itself does not require any showing of an employee-employer relationship as defined by the local jurisdiction. But if you read the rest of the agreement, you will find more requirements about who these apps may be distributed to, and they make this case pretty much a slam dunk in Apple's favor. For example, Facebook cannot possibly agree that they would be liable for what users of these research apps do, nor can they claim the ability to retrieve these devices if the relationship ends. So, no - simply issuing a tax form won't solve this for Facebook.
  - united893 8y ago
    That's fair, but Doordash, Square and Instacart don't have that ability either. They're distributing their apps via the same sideloading mechanism.
    - diebeforei485 8y ago
      At least the way I'm reading Apple's terms, those cases fall more cleanly into the Employee category (which includes 1099 contractors, as defined in the terms).

zethraeus 8y ago

They're not employees but 1099 workers sure sound like they're part of your 'Enterprise'. They could even be 'in house'. Lots of 1099s actually work in the same building as employees. What makes you think they wouldn't be covered?

united893 8y ago
Sure, fair point. But Facebook paid as well. If Facebook starts paying them via 1099, would that be fair?
- zethraeus 8y ago
  Assuming Apple doesn't explicitly ban analytics collection (and how would that play with fancy mdm solutions?), it sure sounds like it should!
- kccqzy 8y ago
  Generally if someone earned less than $600 as an independent contractor, the payer does not have to send the contractor a 1099-MISC. Given that Facebook pays $20 per month, it's well below the limit for issuing 1099s.
- wheelerwj 8y ago
  everyone in the US who is not employed directly (where the employer pays income tax for you) are by default 10-99s if they are paid more than $600 per year... how the people are paid has nothing to do with why Apple took the action they did.

cameldrv 8y ago

Apple has historically looked the other way at a lot of uses of enterprise certs outside the fuzzy definition of who exactly is in the enterprise. The difference with the Apple and Google cases is that they were using the enterprise cert to distribute apps that were specifically banned from the app store, and they were distributing it to people that clearly did not have any kind of close relationship with the company. In many of your examples, the apps are for gig workers that are arguably part of the "enterprise.", even if they're not technically employees. I think Facebook tried to argue that because they were paying people $20 a month to keep the app on their phone that they were their contractors, but that is a very thin argument.

mrep 8y ago
Come on, let's be real, the difference is that the media blasted Facebook and Google about privacy issues and Apple capitalized on that to play to their privacy marketing play.
- deleted 8y ago
  [deleted]
- matthewmacleod 8y ago
  Why this, instead of the much simpler explanation above?
  - Buge 8y ago
    "Negative media attention about a thing, better ban it" seems like a fairly simple explanation to me.
- hjanssen 8y ago
  Which i guess is _fine_ if the result from that is an increase in privacy for the end user. I get your point - there is something to be said about handling every "breach" of their rules differently. But in the case of Google and Facebook there is a clear distinction between evil and not evil if you factor in your list above, which we all can agree on.

joselreyes 8y ago

Apple hasn’t claimed it is banning Facebook or Google from their enterprise program. They are simply revoking the certificate that was spread to consumers. Those certificates can be re-generated.