3 ms·

The solution is what has been suggested earlier: allow users to choose their own 'store', don't lock them to a single vendor. This is already possible with Andr

The solution is what has been suggested earlier: allow users to choose their own 'store', don't lock them to a single vendor. This is already possible with Android where F-Droid is a good example of a 'store' where the chance of being exposed to these shenanigans is close to zero. Currently iOS users lack this option so for them the only way out is to change platform.

thekyle 8y ago
Another nice thing about F-Droid is that it uses Linux style "repositories" meaning that individuals/companies can setup repos for apps without needing to build their own custom app store. There are also multiple independent implementations of the F-droid client: https://gitlab.com/gdroid/gdroidclient/ https://gitlab.com/gdroid/gdroidclient/ https://github.com/SkyzohKey/M-Droid https://github.com/SkyzohKey/M-Droid
- tty2300 8y ago
  I am told thses software repos are super useful for the 3rd world because phone stores can run a local app repo and people can download apps without using their very limited internet data. Fdroid also allows local app transfers to people near you.
acdha 8y ago
That doesn’t seem like much of an improvement: if it became popular, you’d see the same social attacks switch from getting people to install apps to enabling a new store. F-Droid is safer because it’s much smaller and mostly free software: that’s good for people who don’t want anything else but it seems unlikely to satisfy mainstream demand or survive a motivated attack.
- Yetanfou 8y ago
  Linux survived these attacks. Debian survived them. Ubuntu did. More or less all Linux distributions have been attacked but survived, many of them thrive. Yes, this is free software. Being less susceptible to these problems has been one of the stated advantages of using such for a long time. Alternative 'stores' carrying 'pirated' non-free software do not have this advantage and can easily turn into dark places so the solution does not lie there. Will people choose a 'boring' free software 'store' over a 'cool pirate store' (Arrrrr!)? Some will, some won't. Those who will will end up being mostly silent as the thing just works. Those who won't will be susceptible to the whims of those who put up those 'stores' and are likely to come home with a bit more than they asked for. Some 'stores' will get a good reputation along the lines of that of F-Droid, some will get the reputation of being the place to go to get the latest craze but also the latest infection. Users will start making conscious decisions based on those reputations, just like they already do elsewhere. Will opening up closed platforms like iOS for third-party software repositories get rid of these problems? No, it won't, it will even raise the average level of problematic software on that platform. The difference between closed systems and more open ones is not that the closed ones are inferior, it is that they limit the user's choice to get something which is better as well as worse than what the walled garden offers. In this context better can mean software which does not come with tracking, analytics, profiling and other such privacy-invading nonsense. I can get the source code and build it myself, I can host my own repository, only time limits where I can go. This is not true for the Google Play Store or the Apple Appstore, nor is it true for the Amazon equivalent or any of those Chinese alternatives. That is why I chose to use something like F-Droid. By the way, there is nothing keeping e.g. Facebook or Twitter from releasing a free software version of their apps. Their value - and most of their profiling proficiency - lies in their platforms, not in the apps used to access them. They might lose any additional venues for leaching the user of data but they would gain some believability when they state that they're not up to no good. Of course there are plenty of alternative apps for these services so they don't really need to but they could if they wanted to.
  - acdha 8y ago
    > Linux survived these attacks. Debian survived them. Ubuntu did. More or less all Linux distributions have been attacked but survived, many of them thrive. Really? Is there a huge market of mainstream consumer Linux software which I've missed in the past 3 decades of using it? The answer is, of course, no. Linux distributions have mostly been used by developers and other IT people and there's never been the equivalent of the mainstream mobile app ecosystem used by people who are asked to make critical security decisions which they don't know how to answer. If there was an equivalent, there would be the same sleazy sites pushing free porn, games, taking successful apps and repackaging them, etc. that we see in the mobile/Windows desktop world, and normal people would routinely be socially-engineered to get access to free stuff, just as Linux users have for years been fooled into running binaries or installing packages. This isn't more widespread because there's not much money in it but if that were to change it would immediately require the same kind of hardening which every other consumer OS has had to make.
    - Yetanfou 8y ago
      Well, there is Android, that uses Linux and is as mainstream consumer as it gets. Do mind that I specifically said 'Linux survived' as in 'the Linux kernel project', followed by a number of Linux distributions. Also, where are those Linux users [who] have for years been fooled into running binaries or installing packages? The majority of Linux users get their software from repositories maintained by whichever distribution they use. This fact is one of the reasons why Linux users are far less likely to install 'random' software. It is that aspect of Linux distributions which 'stores' like F-Droid bring to Android. Last, what kind of 'hardening' do you deem every other consumer OS has had to make which Linux distributions have yet to accomplish? I'd go so far as saying that the likes of Windows and MacOS are playing catch-up here in finally getting around to implementing a sane repository infrastructure from which users can install and update software instead of having them hunting around the web for some SETUP.EXE to download and click on - which then proceeds to install not only the requested program but also a host of toolbars and 'shopping assistants'. That both Apple as well as Microsoft took one step further in making these software repositories single-source to the detriment of their user's freedom of choice is what started this discussion in the first place.
bduerst 8y ago
You still have fragmentation though, which creates surfaces for security and privacy issues that the 'wild west' of the 2000s had. OS providers could enforce standards for these 'stores' as a fix, but then they'll be accused of unfairly regulating competition. Part of one of the antitrust suits against Google was that it required Play Services to be preinstalled by manufacturers on Android phones before the Play Store could be preinstalled - but the latter needs the former to work.
api 8y ago
Anything that became popular would be targeted just the same. The solution is more secure OSes, not distribution filtering. I should be able to put a gelatinous abomination from hell on my phone and be okay. Mobile OS sandboxing is better than older PC OSes but it's still not perfect.
- pferde 8y ago
  The problem is that nobody except end users wants more secure OS. And end users do not matter.
mattkevan 8y ago
> This is already possible with Android where F-Droid is a good example of a 'store' where the chance of being exposed to these shenanigans is close to zero. There are many other stores where the chance of being exposed to these shenanigans is close to 1. Think of the article recently about super-shady app stores for iOS that misused enterprise certificates to sideload apps [0]. If alternate app stores were to be allowed on iOS, all that would happen is a great proliferation of these scumware stores, full of knockoffs, fakes and outright malware. It's going to be almost impossible for a lot of people to distinguish between legit good quality, legit crap quality and non-legit harmful app stores, resulting in waves of malware and privacy theft that will make the old Windows XP days look like a panacea. While it has its problems, the curated nature of iOS' App Store is a distinct positive for users. [0] https://www.theverge.com/2019/2/20/18232583/apple-ios-developer-enterprise-program-store-mobile-apps https://www.theverge.com/2019/2/20/18232583/apple-ios-develo...
- Yetanfou 8y ago
  I don't think people using Android are different from those using iOS and recognise that that most popular alternative 'store' for Android does not seem to fall victim to these problems. This is very much related to the fact that F-Droid only hosts free software but the same thing could be done for iOS if Apple lifted its heavy control over the platform and its users. I see no reason why a similar free software store for iOS would turn into a scumware-infested hell hole.

thekyle 8y ago

Another nice thing about F-Droid is that it uses Linux style "repositories" meaning that individuals/companies can setup repos for apps without needing to build their own custom app store. There are also multiple independent implementations of the F-droid client: https://gitlab.com/gdroid/gdroidclient/ https://gitlab.com/gdroid/gdroidclient/ https://github.com/SkyzohKey/M-Droid https://github.com/SkyzohKey/M-Droid

tty2300 8y ago
I am told thses software repos are super useful for the 3rd world because phone stores can run a local app repo and people can download apps without using their very limited internet data. Fdroid also allows local app transfers to people near you.

acdha 8y ago

That doesn’t seem like much of an improvement: if it became popular, you’d see the same social attacks switch from getting people to install apps to enabling a new store. F-Droid is safer because it’s much smaller and mostly free software: that’s good for people who don’t want anything else but it seems unlikely to satisfy mainstream demand or survive a motivated attack.

Yetanfou 8y ago
Linux survived these attacks. Debian survived them. Ubuntu did. More or less all Linux distributions have been attacked but survived, many of them thrive. Yes, this is free software. Being less susceptible to these problems has been one of the stated advantages of using such for a long time. Alternative 'stores' carrying 'pirated' non-free software do not have this advantage and can easily turn into dark places so the solution does not lie there. Will people choose a 'boring' free software 'store' over a 'cool pirate store' (Arrrrr!)? Some will, some won't. Those who will will end up being mostly silent as the thing just works. Those who won't will be susceptible to the whims of those who put up those 'stores' and are likely to come home with a bit more than they asked for. Some 'stores' will get a good reputation along the lines of that of F-Droid, some will get the reputation of being the place to go to get the latest craze but also the latest infection. Users will start making conscious decisions based on those reputations, just like they already do elsewhere. Will opening up closed platforms like iOS for third-party software repositories get rid of these problems? No, it won't, it will even raise the average level of problematic software on that platform. The difference between closed systems and more open ones is not that the closed ones are inferior, it is that they limit the user's choice to get something which is better as well as worse than what the walled garden offers. In this context better can mean software which does not come with tracking, analytics, profiling and other such privacy-invading nonsense. I can get the source code and build it myself, I can host my own repository, only time limits where I can go. This is not true for the Google Play Store or the Apple Appstore, nor is it true for the Amazon equivalent or any of those Chinese alternatives. That is why I chose to use something like F-Droid. By the way, there is nothing keeping e.g. Facebook or Twitter from releasing a free software version of their apps. Their value - and most of their profiling proficiency - lies in their platforms, not in the apps used to access them. They might lose any additional venues for leaching the user of data but they would gain some believability when they state that they're not up to no good. Of course there are plenty of alternative apps for these services so they don't really need to but they could if they wanted to.
- acdha 8y ago
  > Linux survived these attacks. Debian survived them. Ubuntu did. More or less all Linux distributions have been attacked but survived, many of them thrive. Really? Is there a huge market of mainstream consumer Linux software which I've missed in the past 3 decades of using it? The answer is, of course, no. Linux distributions have mostly been used by developers and other IT people and there's never been the equivalent of the mainstream mobile app ecosystem used by people who are asked to make critical security decisions which they don't know how to answer. If there was an equivalent, there would be the same sleazy sites pushing free porn, games, taking successful apps and repackaging them, etc. that we see in the mobile/Windows desktop world, and normal people would routinely be socially-engineered to get access to free stuff, just as Linux users have for years been fooled into running binaries or installing packages. This isn't more widespread because there's not much money in it but if that were to change it would immediately require the same kind of hardening which every other consumer OS has had to make.
  - Yetanfou 8y ago
    Well, there is Android, that uses Linux and is as mainstream consumer as it gets. Do mind that I specifically said 'Linux survived' as in 'the Linux kernel project', followed by a number of Linux distributions. Also, where are those Linux users [who] have for years been fooled into running binaries or installing packages? The majority of Linux users get their software from repositories maintained by whichever distribution they use. This fact is one of the reasons why Linux users are far less likely to install 'random' software. It is that aspect of Linux distributions which 'stores' like F-Droid bring to Android. Last, what kind of 'hardening' do you deem every other consumer OS has had to make which Linux distributions have yet to accomplish? I'd go so far as saying that the likes of Windows and MacOS are playing catch-up here in finally getting around to implementing a sane repository infrastructure from which users can install and update software instead of having them hunting around the web for some SETUP.EXE to download and click on - which then proceeds to install not only the requested program but also a host of toolbars and 'shopping assistants'. That both Apple as well as Microsoft took one step further in making these software repositories single-source to the detriment of their user's freedom of choice is what started this discussion in the first place.

bduerst 8y ago

You still have fragmentation though, which creates surfaces for security and privacy issues that the 'wild west' of the 2000s had. OS providers could enforce standards for these 'stores' as a fix, but then they'll be accused of unfairly regulating competition. Part of one of the antitrust suits against Google was that it required Play Services to be preinstalled by manufacturers on Android phones before the Play Store could be preinstalled - but the latter needs the former to work.

api 8y ago

Anything that became popular would be targeted just the same. The solution is more secure OSes, not distribution filtering. I should be able to put a gelatinous abomination from hell on my phone and be okay. Mobile OS sandboxing is better than older PC OSes but it's still not perfect.

pferde 8y ago
The problem is that nobody except end users wants more secure OS. And end users do not matter.

mattkevan 8y ago

> This is already possible with Android where F-Droid is a good example of a 'store' where the chance of being exposed to these shenanigans is close to zero. There are many other stores where the chance of being exposed to these shenanigans is close to 1. Think of the article recently about super-shady app stores for iOS that misused enterprise certificates to sideload apps [0]. If alternate app stores were to be allowed on iOS, all that would happen is a great proliferation of these scumware stores, full of knockoffs, fakes and outright malware. It's going to be almost impossible for a lot of people to distinguish between legit good quality, legit crap quality and non-legit harmful app stores, resulting in waves of malware and privacy theft that will make the old Windows XP days look like a panacea. While it has its problems, the curated nature of iOS' App Store is a distinct positive for users. [0] https://www.theverge.com/2019/2/20/18232583/apple-ios-developer-enterprise-program-store-mobile-apps https://www.theverge.com/2019/2/20/18232583/apple-ios-develo...

Yetanfou 8y ago
I don't think people using Android are different from those using iOS and recognise that that most popular alternative 'store' for Android does not seem to fall victim to these problems. This is very much related to the fact that F-Droid only hosts free software but the same thing could be done for iOS if Apple lifted its heavy control over the platform and its users. I see no reason why a similar free software store for iOS would turn into a scumware-infested hell hole.