8 ms·

Sadly, this is what a walled garden results in. Please don't be surprised, shocked or even remotely discontent because by signing the ToS you have waived away a

Sadly, this is what a walled garden results in. Please don't be surprised, shocked or even remotely discontent because by signing the ToS you have waived away any and all of your rights regarding the use and publishing of software in this walled garden. The only reason an issue like this will get "fixed" is when this (post/tweet) goes viral and the PR department will work extra hard to correct this.

raxxorrax 6y ago
Don't know why you are downvoted since you are completely correct. It is unfair to the developer but we wouldn't even have this discussion if people rejected app stores. I like that more developers just reject software certification processes. There is zero benefit aside from lock in.
- coldcode 6y ago
  Other than open season on the users with malware out the wazoo. But who cares about security. Do you buy healthcare from the back of a pickup truck?
  - davidg109 6y ago
    App stores leave a lot to be desired when it comes to security. In fact it can give users a false sense of security. https://www.cbc.ca/amp/1.5351280 https://www.cbc.ca/amp/1.5351280
    - zepto 6y ago
      Sure but Apple is clearly continuing to move in the direction of more security. The argument that they could be better therefore they are worth nothing, is a clear fallacy.
      - raxxorrax 6y ago
        Then the same is true for letting people just install apps without vendor lock in.
        zepto 6y ago
        No. That doesn’t follow. I’m claiming that the App Store solution as it stands is better for most users than just freely installing apps from the web. It’s not at all clear that the safety of just installing software without vendor lock in is getting better for most users. In fact it seems to be getting worse.
  - GekkePrutser 6y ago
    Fdroid is hardly full of malware. There's a big range between locked down like Apple and "click here to install bonzibuddy" like Windows. It doesn't have to be black or white.
  - lern_too_spel 6y ago
    Yet somehow more iOS users have been hit with malware (see Xcodeghost) than Google and Amazon Android users combined, despite there being far more of the latter and despite the latter being able to install whatever they want on their devices.
    - saagarjha 6y ago
      I don’t see any evidence for that?
      - lern_too_spel 6y ago
        I gave it to you. Xcodeghost infected hundreds of millions of users.
  - the_af 6y ago
    I don't think it follows that malware is the only possible alternative to walled gardens. You could still have trust mechanisms while downloading from sites where the author, not the walled garden, has the control.
    - zepto 6y ago
      A lot of authors want to do things that violate the user’s trust, but are hard to detect. Wouldn’t it be better to have the user have the control? The walled garden does have problems, but I generally don’t see anyone adding any value to our understanding of how to replace it with something better.
      - the_af 6y ago
        > Wouldn’t it be better to have the user have the control? It would, but the user has no control of the walled garden either. It's a situation where both the user and the author have little to no control, as well as poor feedback. I'm not sure walled gardens, with their arbitrary rules, and opaque audit and review processes (which include not knowing how detailed their reviews are), are really a trusty safeguard against malicious authors. Whether you believe walled gardens protect you from malware depends on your definition of "malware". It's not true that without the App Store there's a world of dangers out there. Author reputation goes a long way.
        zepto 6y ago
        If you don’t believe that there are dangers out there for general users installing software from the internet, I don’t know what to tell you. History certainly proves otherwise, as do the number of attempts at putting malware into app stores. I’d go as far as to say that you are certainly wrong about this and you can trivially verify this by even the most cursory examination of software threat models. Author reputation goes almost nowhere these days. It’s quite obvious why. There are a huge number of authors producing software. It’s impossible for more than a few authors to develop a reputation, and even those that do face impersonation. As to you not being sure how much protection ‘walled gardens’ give. They aren’t perfect, but they clearly work, and you can trivially verify that. If you think the author or the user can solve these problems without an intermediary, it bears some explanation as to how exactly this could work. Can you explain?
- elliekelly 6y ago
  As a developer it’s a pain but as a user it’s definitely useful for security purposes. It’s hardly “zero benefit”.
  - raxxorrax 6y ago
    Advantages and disadvantages. It is a bit like a kindergarten for software. At some point you might want to break out of there. There are severe disadvantages though: https://medium.com/vchaincodenotary/developers-unite-against-the-expensive-and-cumbersome-code-signing-certificates-d54342016a64 https://medium.com/vchaincodenotary/developers-unite-against... Additionally, the most predatory kind of app milks your wallet and these come in signed and unsigned forms. Also, quite a few companies with long time certs have leaked them pretty quickly. Primarily, it is a lock in mechanism with questionable security benefits. Predatory apps can be signed which would have been classified as malware 15 years ago.
    - elliekelly 6y ago
      Most apps in 2020 are malware by early-2000s standards.
      - AlexandrB 6y ago
        Exactly right. Yet they are fully signed and sold in (supposedly) secure app stores. When people talk about a feature providing security, it's important to ask "security from who?"
        elliekelly 6y ago
        I don’t know that I’d call the app store “secure” but it’s definitely more secure to download and run an app from the app store than to download and run an app from elsewhere on the internet. Better the (fully signed) devil you know.
- matwood 6y ago
  Someone said there are security benefits to the user. Obviously nothing is 100%, but there is a benefit. There’s also discovery benefits to both sides and trust benefits. I am find apps more easily on app stores, and am much more quick to buy an app through the store then some random website. Maybe those benefits don’t outweigh the downsides, but to say there is no user or developer benefit is objectively false in both cases IMO.
  - raxxorrax 6y ago
    Right, there might be some superficial advantages but I would question them as well. Sure, I don't expect an Apple or Google app to act as a trojan, but I surely expect any bad behavior under the sun, especially concerning data exfiltration.
- zepto 6y ago
  The downvotes are because we actually don’t known the full story. And of course there are benefits beyond lock-in. Do you know about the attestation service Apple has introduced? How would you build such a thing on your own?
  - pearjuice 6y ago
    Regardless of the full story, fact is that Apple (and many other owners of walled gardens) can revoke your access to it at a moment's notice without any explanation whatsoever. The reason for them doing this might be there but they owe you no explanation whatsoever. Some public outrage will put them in a position to make a statement or reconsider their decision. But you have no right to it.
    - zepto 6y ago
      All absolutely correct. Outrage based on the facts is definitely something Apple should face. However outrage based on lies is simply another evil. People who are engaging in it are not doing any kind of public service - they are just adding more harm.
- ben509 6y ago
  The app store concept is fine, we need a separation of concerns. These are all things I'd rather pay someone else to do: 1. A standard format and tools for code signing. 1b. Actively validating or rejecting code on the end user machine. 2. Purchasing and delivery of software. 3. Trust of code blobs. They just don't need to be all handled by your OS vendor.
DethNinja 6y ago
Another option would be changing the legislation. I wouldn’t hold my breath in the case of USA but rest of the world should certainly limit the monopoly of walled gardens as it limits the competition.
- bzb3 6y ago
  Apple is not a monopoly. Additionally this is a Mac app and you can sideload apps on Macs
  - AnthonyMouse 6y ago
    They pretty clearly have a monopoly on iOS app stores. Now we can skip the part where somebody says that you can't have a monopoly on your own product and then I point out that monopolies always look like that because their product is the only one in the market, and the reason that android app stores and iOS app stores are different markets is that you can't install Android apps on iOS devices or vice versa.
    - bzb3 6y ago
      Surely by moving the goalposts you can make everything look like a monopoly. In the end both mobile platforms have practically the same popular apps.
      - AnthonyMouse 6y ago
        > Surely by moving the goalposts you can make everything look like a monopoly. Walmart doesn't have a monopoly on SAE 5w30 motor oil. You can't make it look like a monopoly when it isn't one, because when it isn't you can identify competitors who sell substitute products to the same customers. > In the end both mobile platforms have practically the same popular apps. The market they have a monopoly on is iOS app stores, not individual apps. It's very straight forward. For Google Play to be in the same market you would have to be able to use it to install apps on your Apple iPhone. Since you can't, it isn't, and since there is only one app store that can, it's a monopoly. Notice that it has nothing to do with the fact that Apple also makes the phones, outside of control over the phone being used to enforce the app store monopoly by locking out competitors. If Amazon for some reason had the only app store for Apple iOS devices, they would be the one with a monopoly in that market.
veidr 6y ago
WTF. I dare any one of you who downvoted this to explain why in public.
- rimliu 6y ago
  Because it is a lot of hand-waving bullshit. This "walled garden" talk gets tiring fast. And, uh oh, big surprise, you have to actually behave according to ToS you signed. How can it be, hmmm? Nobody forces you to sign anything. Go have your own platform and distribution chanells. Oh, you want to be where the money is? Well, than. Maaaaybe there is some correlation between being the walled garden and the place there the money is?
  - veidr 6y ago
    That doesn't invalidate the point, it reinforces it: when you sign up for an Apple-style "walled garden" you cede all control of whether or not your app ships — and, assuming you do ship, whether or not your users can keep using your app. You being tired of it doesn't change anything. ¯\_(ツ)_/¯
    - rimliu 6y ago
      Ah, the illusion of control…
    - zepto 6y ago
      All stores have the power to choose what products they ship. As a developer I want a store where someone is investing in the safety and security of the ecosystem. If I want Apple to be able to be able to remove malware from the store, I obviously have to accept that if I make malware, then they may remove it. The arguments about what they are somehow holding back are completely without merit. It’s not expensive to buy an Android phone. Android phone allow both sideloaded apps and alternate stores. Where are the amazing Android apps that are only possible through side-loading?
- diego_moita 6y ago
  HN is an Apple fan club. Most people here are from Silicon Valley and Apple is the biggest employer over there. Try to badmouth Samsung in a Korean sub and you get the same treatment.

raxxorrax 6y ago

Don't know why you are downvoted since you are completely correct. It is unfair to the developer but we wouldn't even have this discussion if people rejected app stores. I like that more developers just reject software certification processes. There is zero benefit aside from lock in.

coldcode 6y ago
Other than open season on the users with malware out the wazoo. But who cares about security. Do you buy healthcare from the back of a pickup truck?
- davidg109 6y ago
  App stores leave a lot to be desired when it comes to security. In fact it can give users a false sense of security. https://www.cbc.ca/amp/1.5351280 https://www.cbc.ca/amp/1.5351280
  - zepto 6y ago
    Sure but Apple is clearly continuing to move in the direction of more security. The argument that they could be better therefore they are worth nothing, is a clear fallacy.
    - raxxorrax 6y ago
      Then the same is true for letting people just install apps without vendor lock in.
      - zepto 6y ago
        No. That doesn’t follow. I’m claiming that the App Store solution as it stands is better for most users than just freely installing apps from the web. It’s not at all clear that the safety of just installing software without vendor lock in is getting better for most users. In fact it seems to be getting worse.
- GekkePrutser 6y ago
  Fdroid is hardly full of malware. There's a big range between locked down like Apple and "click here to install bonzibuddy" like Windows. It doesn't have to be black or white.
- lern_too_spel 6y ago
  Yet somehow more iOS users have been hit with malware (see Xcodeghost) than Google and Amazon Android users combined, despite there being far more of the latter and despite the latter being able to install whatever they want on their devices.
  - saagarjha 6y ago
    I don’t see any evidence for that?
    - lern_too_spel 6y ago
      I gave it to you. Xcodeghost infected hundreds of millions of users.
- the_af 6y ago
  I don't think it follows that malware is the only possible alternative to walled gardens. You could still have trust mechanisms while downloading from sites where the author, not the walled garden, has the control.
  - zepto 6y ago
    A lot of authors want to do things that violate the user’s trust, but are hard to detect. Wouldn’t it be better to have the user have the control? The walled garden does have problems, but I generally don’t see anyone adding any value to our understanding of how to replace it with something better.
    - the_af 6y ago
      > Wouldn’t it be better to have the user have the control? It would, but the user has no control of the walled garden either. It's a situation where both the user and the author have little to no control, as well as poor feedback. I'm not sure walled gardens, with their arbitrary rules, and opaque audit and review processes (which include not knowing how detailed their reviews are), are really a trusty safeguard against malicious authors. Whether you believe walled gardens protect you from malware depends on your definition of "malware". It's not true that without the App Store there's a world of dangers out there. Author reputation goes a long way.
      - zepto 6y ago
        If you don’t believe that there are dangers out there for general users installing software from the internet, I don’t know what to tell you. History certainly proves otherwise, as do the number of attempts at putting malware into app stores. I’d go as far as to say that you are certainly wrong about this and you can trivially verify this by even the most cursory examination of software threat models. Author reputation goes almost nowhere these days. It’s quite obvious why. There are a huge number of authors producing software. It’s impossible for more than a few authors to develop a reputation, and even those that do face impersonation. As to you not being sure how much protection ‘walled gardens’ give. They aren’t perfect, but they clearly work, and you can trivially verify that. If you think the author or the user can solve these problems without an intermediary, it bears some explanation as to how exactly this could work. Can you explain?
elliekelly 6y ago
As a developer it’s a pain but as a user it’s definitely useful for security purposes. It’s hardly “zero benefit”.
- raxxorrax 6y ago
  Advantages and disadvantages. It is a bit like a kindergarten for software. At some point you might want to break out of there. There are severe disadvantages though: https://medium.com/vchaincodenotary/developers-unite-against-the-expensive-and-cumbersome-code-signing-certificates-d54342016a64 https://medium.com/vchaincodenotary/developers-unite-against... Additionally, the most predatory kind of app milks your wallet and these come in signed and unsigned forms. Also, quite a few companies with long time certs have leaked them pretty quickly. Primarily, it is a lock in mechanism with questionable security benefits. Predatory apps can be signed which would have been classified as malware 15 years ago.
  - elliekelly 6y ago
    Most apps in 2020 are malware by early-2000s standards.
    - AlexandrB 6y ago
      Exactly right. Yet they are fully signed and sold in (supposedly) secure app stores. When people talk about a feature providing security, it's important to ask "security from who?"
      - elliekelly 6y ago
        I don’t know that I’d call the app store “secure” but it’s definitely more secure to download and run an app from the app store than to download and run an app from elsewhere on the internet. Better the (fully signed) devil you know.
matwood 6y ago
Someone said there are security benefits to the user. Obviously nothing is 100%, but there is a benefit. There’s also discovery benefits to both sides and trust benefits. I am find apps more easily on app stores, and am much more quick to buy an app through the store then some random website. Maybe those benefits don’t outweigh the downsides, but to say there is no user or developer benefit is objectively false in both cases IMO.
- raxxorrax 6y ago
  Right, there might be some superficial advantages but I would question them as well. Sure, I don't expect an Apple or Google app to act as a trojan, but I surely expect any bad behavior under the sun, especially concerning data exfiltration.
zepto 6y ago
The downvotes are because we actually don’t known the full story. And of course there are benefits beyond lock-in. Do you know about the attestation service Apple has introduced? How would you build such a thing on your own?
- pearjuice 6y ago
  Regardless of the full story, fact is that Apple (and many other owners of walled gardens) can revoke your access to it at a moment's notice without any explanation whatsoever. The reason for them doing this might be there but they owe you no explanation whatsoever. Some public outrage will put them in a position to make a statement or reconsider their decision. But you have no right to it.
  - zepto 6y ago
    All absolutely correct. Outrage based on the facts is definitely something Apple should face. However outrage based on lies is simply another evil. People who are engaging in it are not doing any kind of public service - they are just adding more harm.
ben509 6y ago
The app store concept is fine, we need a separation of concerns. These are all things I'd rather pay someone else to do: 1. A standard format and tools for code signing. 1b. Actively validating or rejecting code on the end user machine. 2. Purchasing and delivery of software. 3. Trust of code blobs. They just don't need to be all handled by your OS vendor.

DethNinja 6y ago

Another option would be changing the legislation. I wouldn’t hold my breath in the case of USA but rest of the world should certainly limit the monopoly of walled gardens as it limits the competition.

bzb3 6y ago
Apple is not a monopoly. Additionally this is a Mac app and you can sideload apps on Macs
- AnthonyMouse 6y ago
  They pretty clearly have a monopoly on iOS app stores. Now we can skip the part where somebody says that you can't have a monopoly on your own product and then I point out that monopolies always look like that because their product is the only one in the market, and the reason that android app stores and iOS app stores are different markets is that you can't install Android apps on iOS devices or vice versa.
  - bzb3 6y ago
    Surely by moving the goalposts you can make everything look like a monopoly. In the end both mobile platforms have practically the same popular apps.
    - AnthonyMouse 6y ago
      > Surely by moving the goalposts you can make everything look like a monopoly. Walmart doesn't have a monopoly on SAE 5w30 motor oil. You can't make it look like a monopoly when it isn't one, because when it isn't you can identify competitors who sell substitute products to the same customers. > In the end both mobile platforms have practically the same popular apps. The market they have a monopoly on is iOS app stores, not individual apps. It's very straight forward. For Google Play to be in the same market you would have to be able to use it to install apps on your Apple iPhone. Since you can't, it isn't, and since there is only one app store that can, it's a monopoly. Notice that it has nothing to do with the fact that Apple also makes the phones, outside of control over the phone being used to enforce the app store monopoly by locking out competitors. If Amazon for some reason had the only app store for Apple iOS devices, they would be the one with a monopoly in that market.

veidr 6y ago

WTF. I dare any one of you who downvoted this to explain why in public.

rimliu 6y ago
Because it is a lot of hand-waving bullshit. This "walled garden" talk gets tiring fast. And, uh oh, big surprise, you have to actually behave according to ToS you signed. How can it be, hmmm? Nobody forces you to sign anything. Go have your own platform and distribution chanells. Oh, you want to be where the money is? Well, than. Maaaaybe there is some correlation between being the walled garden and the place there the money is?
- veidr 6y ago
  That doesn't invalidate the point, it reinforces it: when you sign up for an Apple-style "walled garden" you cede all control of whether or not your app ships — and, assuming you do ship, whether or not your users can keep using your app. You being tired of it doesn't change anything. ¯\_(ツ)_/¯
  - rimliu 6y ago
    Ah, the illusion of control…
  - zepto 6y ago
    All stores have the power to choose what products they ship. As a developer I want a store where someone is investing in the safety and security of the ecosystem. If I want Apple to be able to be able to remove malware from the store, I obviously have to accept that if I make malware, then they may remove it. The arguments about what they are somehow holding back are completely without merit. It’s not expensive to buy an Android phone. Android phone allow both sideloaded apps and alternate stores. Where are the amazing Android apps that are only possible through side-loading?
diego_moita 6y ago
HN is an Apple fan club. Most people here are from Silicon Valley and Apple is the biggest employer over there. Try to badmouth Samsung in a Korean sub and you get the same treatment.