5 ms·

This is a good piece in the sense that it will get Apple to do something I've wanted for a long time, which is to ban all the third party frameworks that develo

This is a good piece in the sense that it will get Apple to do something I've wanted for a long time, which is to ban all the third party frameworks that developers are shipping in their apps. They should either provide their own first party frameworks or select a handful of vetted partners that are allowed to provide those services to developers.

la_barba 7y ago
A couple of points. How realistic is that though? How would they even know where the code came from in a compiled binary? Also, a platform vendor controlling what code I can or can't use sounds like a totalitarian regime to me. IMHO a better idea would be to create privacy jails for apps and then users can decide if they want to stick certain apps inside jails where they don't get access to your IP, GPS data, accelerometer, camera, contacts, etc. Jails would be better than the annoying popups for permissions as they currently do it.
- Despegar 7y ago
  >IMHO a better idea would be to create privacy jails for apps and then users can decide if they want to stick certain apps inside jails where they don't get access to your IP, GPS data, accelerometer, camera, contacts, etc. Jails would be better than the annoying popups for permissions as they currently do it. Nah that's a Do-Not-Track-esque cop out to preserve the ad and analytics industries. It's also extremely un-Apple. "Totalitarian" doesn't mean anything in this context because we're talking about computers and not governments. Privacy should be by default and not shift the burden to users or cost them in terms of user experience. Apple has the power to do that.
  - la_barba 7y ago
    Well, totalitarian in this context means shackling developers with micro-management of basic functions of software development. Apple has a large enough megaphone that I don't feel the need to care about whats best for them. They can do that themselves just fine. I'm only interested in it as a developer and as a user. As a developer I don't want an OS vendor telling me what code I write or which library I use. As a user, I want to be able to run an app inside a privacy jail that completely blocks access to my IP or GPS data - if I want to. >Privacy should be by default and not shift the burden to users or cost them in terms of user experience. Apple has the power to do that. You can have every single app run in a privacy jail by-default. Let the user opt-out on a per-app basis if they choose to. Apple could also simply just run a ad-blocker or a tracking scripts blocker as a system level feature. I admit that these kinds of measures are very 'controlling' if not totalitarian of their users. Should Microsoft allow users to install Chrome if the browser acts basically like a giant keylogger? Should we let users make the choice? Or let a benevolent dictator dictate what apps a user should be protected from. Reasonable people can come out of both sides of the privacy debate.
    - Despegar 7y ago
      >Well, totalitarian in this context means shackling developers with micro-management of basic functions of software development. This might be an interesting philosophical/religious debate about computers to some, but it's also one we had in 2008 when the App Store launched. It's clear after 11 years that Apple was right and the rest of the world simply does not share that religion. Conversely they sure do like the practical benefits from Apple's micromanagement. >You can have every single app run in a privacy jail by-default. Let the user opt-out on a per-app basis if they choose to. Apple could also simply just run a ad-blocker or a tracking scripts blocker as a system level feature. Apps already run in a sandbox and are private by default. The user has to give consent before an app gets location or contacts data. An ad blocker for apps is silly because it's an unnecessary hack when they control the App Store policies. The difference with giving permission to an app you downloaded is that you have a first party relationship with that app. You don't have a first party relationship with any of the SDKs that developers package into their app. They disclose it in their privacy policies that no one reads, but that's certainly not informed consent.
      - la_barba 7y ago
        Well, all I can say is thanks for explaining your position, but I don't agree with your points.
- panpanna 7y ago
  Not sure about iOS but on Android these types of countermeasures have been available for a few years. See for example Orlis, ART, xprivacy, libradar and AdDroid for some pointers. (TBH, this should not be needed in the first place if Google did their job)
  - la_barba 7y ago
    Yeah iOS doesn't allow those kinds of apps. That's one thing I'm jealous of from Android.
    - panpanna 7y ago
      Well, Android has both the most and the least secure phones out there :)
chillacy 7y ago
People are perfectly capable of writing their own first party analytics framework. Or at least the part that uploads the data.
deminature 7y ago
Banning third party tracking frameworks means banning Fabric, Facebook, Twitter and other major SDKs. I'm skeptical Apple would take such a drastic step. Taking on the responsibility of providing these functions through a first party API is also a massive undertaking, which I'm not sure Apple would agree to.
- munk-a 7y ago
  It would be absolutely beautiful if they did - they could even just cut some CDN network a check every month to host common assets in a privacy aware manner or do it themselves. It really wouldn't cost all that much. Web 4.0 integrated everywhere always-web is not at all consumer friendly - advertisers need to be downgraded to something that's suffered or rejected instead of supported.
munk-a 7y ago
I really doubt it will cause any sort of action, third party advertising is so deeply ingrained into iOS that there's some wonderfully terrible built in support - I remember helping to hook up an advertising ID share with a third party a bit ago in my employment history.
threeseed 7y ago
This makes no sense whatsoever. If you ban third parties framework then all that is going to happen is that those third party companies will just give you an API and standard schema and ask you to post the data to them. The value is in the dashboards not in the SDK. And then what you want Apple to block all HTTP POST requests too ?
untog 7y ago
I'm sorry, what? Ban all frameworks? That's absurd. How would they even know? You could just copy and paste the source code from a third-party framework into your own codebase.
- tinus_hn 7y ago
  It wasn’t enforceable but frameworks used to be banned on iOS. Note by the way that most third party frameworks of course don’t give you the source code.
beenBoutIT 7y ago
If Apple had a better app portfolio they could just get rid of third party apps entirely and have people use progressive web apps in place of app store apps. Right now most apps have websites that provide almost the exact same experience as the native app without as many privileges. Uber is a great example https://m.uber.com/looking https://m.uber.com/looking

la_barba 7y ago

A couple of points. How realistic is that though? How would they even know where the code came from in a compiled binary? Also, a platform vendor controlling what code I can or can't use sounds like a totalitarian regime to me. IMHO a better idea would be to create privacy jails for apps and then users can decide if they want to stick certain apps inside jails where they don't get access to your IP, GPS data, accelerometer, camera, contacts, etc. Jails would be better than the annoying popups for permissions as they currently do it.

Despegar 7y ago
>IMHO a better idea would be to create privacy jails for apps and then users can decide if they want to stick certain apps inside jails where they don't get access to your IP, GPS data, accelerometer, camera, contacts, etc. Jails would be better than the annoying popups for permissions as they currently do it. Nah that's a Do-Not-Track-esque cop out to preserve the ad and analytics industries. It's also extremely un-Apple. "Totalitarian" doesn't mean anything in this context because we're talking about computers and not governments. Privacy should be by default and not shift the burden to users or cost them in terms of user experience. Apple has the power to do that.
- la_barba 7y ago
  Well, totalitarian in this context means shackling developers with micro-management of basic functions of software development. Apple has a large enough megaphone that I don't feel the need to care about whats best for them. They can do that themselves just fine. I'm only interested in it as a developer and as a user. As a developer I don't want an OS vendor telling me what code I write or which library I use. As a user, I want to be able to run an app inside a privacy jail that completely blocks access to my IP or GPS data - if I want to. >Privacy should be by default and not shift the burden to users or cost them in terms of user experience. Apple has the power to do that. You can have every single app run in a privacy jail by-default. Let the user opt-out on a per-app basis if they choose to. Apple could also simply just run a ad-blocker or a tracking scripts blocker as a system level feature. I admit that these kinds of measures are very 'controlling' if not totalitarian of their users. Should Microsoft allow users to install Chrome if the browser acts basically like a giant keylogger? Should we let users make the choice? Or let a benevolent dictator dictate what apps a user should be protected from. Reasonable people can come out of both sides of the privacy debate.
  - Despegar 7y ago
    >Well, totalitarian in this context means shackling developers with micro-management of basic functions of software development. This might be an interesting philosophical/religious debate about computers to some, but it's also one we had in 2008 when the App Store launched. It's clear after 11 years that Apple was right and the rest of the world simply does not share that religion. Conversely they sure do like the practical benefits from Apple's micromanagement. >You can have every single app run in a privacy jail by-default. Let the user opt-out on a per-app basis if they choose to. Apple could also simply just run a ad-blocker or a tracking scripts blocker as a system level feature. Apps already run in a sandbox and are private by default. The user has to give consent before an app gets location or contacts data. An ad blocker for apps is silly because it's an unnecessary hack when they control the App Store policies. The difference with giving permission to an app you downloaded is that you have a first party relationship with that app. You don't have a first party relationship with any of the SDKs that developers package into their app. They disclose it in their privacy policies that no one reads, but that's certainly not informed consent.
    - la_barba 7y ago
      Well, all I can say is thanks for explaining your position, but I don't agree with your points.
panpanna 7y ago
Not sure about iOS but on Android these types of countermeasures have been available for a few years. See for example Orlis, ART, xprivacy, libradar and AdDroid for some pointers. (TBH, this should not be needed in the first place if Google did their job)
- la_barba 7y ago
  Yeah iOS doesn't allow those kinds of apps. That's one thing I'm jealous of from Android.
  - panpanna 7y ago
    Well, Android has both the most and the least secure phones out there :)

chillacy 7y ago

People are perfectly capable of writing their own first party analytics framework. Or at least the part that uploads the data.

deminature 7y ago

Banning third party tracking frameworks means banning Fabric, Facebook, Twitter and other major SDKs. I'm skeptical Apple would take such a drastic step. Taking on the responsibility of providing these functions through a first party API is also a massive undertaking, which I'm not sure Apple would agree to.

munk-a 7y ago
It would be absolutely beautiful if they did - they could even just cut some CDN network a check every month to host common assets in a privacy aware manner or do it themselves. It really wouldn't cost all that much. Web 4.0 integrated everywhere always-web is not at all consumer friendly - advertisers need to be downgraded to something that's suffered or rejected instead of supported.

munk-a 7y ago

I really doubt it will cause any sort of action, third party advertising is so deeply ingrained into iOS that there's some wonderfully terrible built in support - I remember helping to hook up an advertising ID share with a third party a bit ago in my employment history.

threeseed 7y ago

This makes no sense whatsoever. If you ban third parties framework then all that is going to happen is that those third party companies will just give you an API and standard schema and ask you to post the data to them. The value is in the dashboards not in the SDK. And then what you want Apple to block all HTTP POST requests too ?

untog 7y ago

I'm sorry, what? Ban all frameworks? That's absurd. How would they even know? You could just copy and paste the source code from a third-party framework into your own codebase.

tinus_hn 7y ago
It wasn’t enforceable but frameworks used to be banned on iOS. Note by the way that most third party frameworks of course don’t give you the source code.

beenBoutIT 7y ago

If Apple had a better app portfolio they could just get rid of third party apps entirely and have people use progressive web apps in place of app store apps. Right now most apps have websites that provide almost the exact same experience as the native app without as many privileges. Uber is a great example https://m.uber.com/looking https://m.uber.com/looking