5 ms·

It’s not an issue with $15k or if apple can pay or not. I think it’s the issue of Apple vs. Open in general. Apple’s echo system is closed to the world.

by slics 7y ago

reaperducer 7y ago
I think it’s the issue of Apple vs. Open in general. Apple’s echo system is closed to the world. I think that for people outside of HN, that's OK. Not everyone trusts the open source community, or open source organizations. If something goes wrong with something important, it's normal for people to want something or someone to blame. If that something is Apple, that's useful. If it's some rando on the internet contributing code to a code repository, it's significantly less useful to the ordinary person. For the average person, entrusting Apple with their logins is a better option than using password1234 or some other coping mechanism. People know Apple. Nobody knows OpenID. It's the same reason people used to trust Microsoft (and many still do!) with their personal information. Microsoft is a known quantity. It's like having a neighbor watch your pets while you're on vacation, or signing up with some random service on the internet to watch your pets. Those random services get bonded and insured for the peace of mind of the user. There is no such level of assurance from OpenID other than it uses the word "open" in its name, and as a culture we value the word "open" more than "closed."
- andyroid 7y ago
  But this is not an issue of Apple vs. OpenID Connect, but one between Apple’s flawed implementation of the OpenID Connect standard vs. the actual OpenID Connect standard. If they would have just gone with some proprietary implementation I very much doubt the OIDC people would have bothered. That happens pretty much daily after all.
- damnyou 7y ago
  One of the big cultural problems in society today, and (antitrust) law in particular, is the focus on consumer welfare above all else. The consumer is not the only thing that matters
  - hidden_anomaly 7y ago
    Can you expand on this idea? This is the first time I’ve heard anyone saying that consumer-first is wrong.
    - damnyou 7y ago
      Lina Khan is one of the leading proponents of the idea: https://www.nytimes.com/2018/09/07/technology/monopoly-antitrust-lina-khan-amazon.html https://www.nytimes.com/2018/09/07/technology/monopoly-antit... The consumer uber alles idea is actually pretty new in the history of antitrust law.
- jeremyjh 7y ago
  Apple - like every commercial vendor - is responsible for their products and services whether or not they use open source software and open protocols to implement them. Every service on the internet relies on open standards, it doesn't change their liability.
- AshamedCaptain 7y ago
  OpenID is not an open source community nor organization.
jandrewrogers 7y ago
Knowing nothing about Apple's specific case, I have been involved in the decision at major companies to deviate from common standards, which is not done lightly, on many occasions and worked with standards organizations to smooth over the fallout. In my experience, when a company the size of Apple deviates from a standard, there are pragmatic and arguably justifiable reasons behind the scenes. The typical driver is that the standard is a poor fit for purpose because it was originally designed by companies operating under a more limited set of constraints and use cases. In some of the cases I've been involved in, the deviations required to make it fit for purpose would immediately save millions of dollars per year versus following the strict letter of the standard, so the value of deviating was not academic. The reason you keep any deviation close to the standard instead of designing a new one is to minimize the interoperability gap in practice. If you are able to articulate why the standard is not fit for purpose to the standards organizations, they may use it as a driver for a new standard. However, this frequently runs into strong political resistance from the existing member base because they rarely benefit from the increased scope -- all downside, no upside. Nonetheless, the standards organizations are invested in maintaining relevance. As a practical matter, unless you go into these discussions with the standards orgs with an existing implementation of an alternative that threatens their existing standard, they are very reluctant to move. I'm not saying any of this applies to Apple's case but the above happens a lot in my experience. It would be nice if it was easy to work with the standards organizations if you need to make a standard work for other use cases but in practice it is an extremely difficult and political uphill battle.

It’s not an issue with $15k or if apple can pay or not. I think it’s the issue of Apple vs. Open in general. Apple’s echo system is closed to the world.

by slics 7y ago

It’s not an issue with $15k or if apple can pay or not. I think it’s the issue of Apple vs. Open in general. Apple’s echo system is closed to the world.

reaperducer 7y ago

I think it’s the issue of Apple vs. Open in general. Apple’s echo system is closed to the world. I think that for people outside of HN, that's OK. Not everyone trusts the open source community, or open source organizations. If something goes wrong with something important, it's normal for people to want something or someone to blame. If that something is Apple, that's useful. If it's some rando on the internet contributing code to a code repository, it's significantly less useful to the ordinary person. For the average person, entrusting Apple with their logins is a better option than using password1234 or some other coping mechanism. People know Apple. Nobody knows OpenID. It's the same reason people used to trust Microsoft (and many still do!) with their personal information. Microsoft is a known quantity. It's like having a neighbor watch your pets while you're on vacation, or signing up with some random service on the internet to watch your pets. Those random services get bonded and insured for the peace of mind of the user. There is no such level of assurance from OpenID other than it uses the word "open" in its name, and as a culture we value the word "open" more than "closed."

andyroid 7y ago
But this is not an issue of Apple vs. OpenID Connect, but one between Apple’s flawed implementation of the OpenID Connect standard vs. the actual OpenID Connect standard. If they would have just gone with some proprietary implementation I very much doubt the OIDC people would have bothered. That happens pretty much daily after all.
damnyou 7y ago
One of the big cultural problems in society today, and (antitrust) law in particular, is the focus on consumer welfare above all else. The consumer is not the only thing that matters
- hidden_anomaly 7y ago
  Can you expand on this idea? This is the first time I’ve heard anyone saying that consumer-first is wrong.
  - damnyou 7y ago
    Lina Khan is one of the leading proponents of the idea: https://www.nytimes.com/2018/09/07/technology/monopoly-antitrust-lina-khan-amazon.html https://www.nytimes.com/2018/09/07/technology/monopoly-antit... The consumer uber alles idea is actually pretty new in the history of antitrust law.
jeremyjh 7y ago
Apple - like every commercial vendor - is responsible for their products and services whether or not they use open source software and open protocols to implement them. Every service on the internet relies on open standards, it doesn't change their liability.
AshamedCaptain 7y ago
OpenID is not an open source community nor organization.

jandrewrogers 7y ago

Knowing nothing about Apple's specific case, I have been involved in the decision at major companies to deviate from common standards, which is not done lightly, on many occasions and worked with standards organizations to smooth over the fallout. In my experience, when a company the size of Apple deviates from a standard, there are pragmatic and arguably justifiable reasons behind the scenes. The typical driver is that the standard is a poor fit for purpose because it was originally designed by companies operating under a more limited set of constraints and use cases. In some of the cases I've been involved in, the deviations required to make it fit for purpose would immediately save millions of dollars per year versus following the strict letter of the standard, so the value of deviating was not academic. The reason you keep any deviation close to the standard instead of designing a new one is to minimize the interoperability gap in practice. If you are able to articulate why the standard is not fit for purpose to the standards organizations, they may use it as a driver for a new standard. However, this frequently runs into strong political resistance from the existing member base because they rarely benefit from the increased scope -- all downside, no upside. Nonetheless, the standards organizations are invested in maintaining relevance. As a practical matter, unless you go into these discussions with the standards orgs with an existing implementation of an alternative that threatens their existing standard, they are very reluctant to move. I'm not saying any of this applies to Apple's case but the above happens a lot in my experience. It would be nice if it was easy to work with the standards organizations if you need to make a standard work for other use cases but in practice it is an extremely difficult and political uphill battle.