6 ms·

Epic expressly snuck code through the door to activate a user-visible feature in direct prohibition to App Store rules. Apple could have revoked their developer

Epic expressly snuck code through the door to activate a user-visible feature in direct prohibition to App Store rules. Apple could have revoked their developer certificate in response, which would have essentially killed all installations of Fortnite iOS/Mac worldwide within 24 hours. That they are merely revoking their ability to sign new code and giving them 2 weeks to perform an orderly shutdown is far less draconian than they're capable of being here. Notarization is about protecting users who are not capable of making an informed decision about code safety from developers who refuse to comply with Apple's terms of service. Epic willfully violated their terms with Apple to make a point, and Apple is responding in the same way that they did to Facebook: taking away their access to the users, because they cannot be trusted to comply with the restrictions placed on their behavior. Most (if not all) of the restrictions on the App Store exist to protect users from app developers who prioritize their own greed over the rights of privacy and safety that Apple promises the users of the App Store. Developers are the threat model, and there's nothing inherently wrong with Apple's response to Epic declaring themselves a rulebreaker — and, thus, a threat. (If Epic was not trying so hard to be able to sue for damages, they might have been able to negotiate, same as Facebook did. But they wanted to be a martyr for the cause, so here we are.) Consider this thought experiment: At your employer, an IT employee goes rogue and installs malicious code on your computer to read your email. How would you feel if IT leadership said "they promised not to do it again" and allowed them to continue unsupervised work on your computer while you're away? Most people would feel awful, because you can't trust the IT employee's word — they literally just broke their agreement not to snoop! — and because your leadership clearly doesn't care about your privacy. Should Apple "fire" Epic, now that Epic's word can no longer be trusted? This answer should, in theory, match the answer above. I bet for most software developers, it does not. I encourage thinking through that dissonance rather than rejecting the thought experiment.

_qulr 6y ago
> Notarization is about protecting users who are not capable of making an informed decision about code safety from developers who refuse to comply with Apple's terms of service. No, notarization is about preventing malware. That's all. This has been promised to us by Apple many many times. Malware prevention only. Fortnite is not malware.
- floatingatoll 6y ago
  I'm sorry, it sounds like we're saying the same thing. Notarization is not a stick-less carrot. Anyone can sign up and agree to the rules and pay the fee begin notarizing apps. If you break the rules you agree to when you sign up, you lose access to notarization. It seems like we disagree about this basic understanding, so I'll take a couple guesses at it. Are you, perhaps, arguing that Apple should not be allowed to terminate developer access to notarization under any circumstance — regardless of their behavior? Or are you arguing that Epic's behavior is "acceptable" rule breaking, but other kinds of behavior are "unacceptable" rule breaking? I'm happy to consider that I could be wrong here, but I'll need a few more sentences from you to do so.
  - damnyou 6y ago
    Yes, Apple should very obviously not have a completely unchecked right to disable arbitrary software from running on millions of computers for whatever reason they want. This is so obviously an abuse of power that I can't believe I have to spell it out so clearly. At the very least such decisions should be subject to appeal to an independent board, and failing that the legal system.
    - floatingatoll 6y ago
      The only time in the past decade that I can think of where they used that power to remove anything other than malware on any platform, was to remove the Zoom daemon that Zoom was using to bypass Installer.app permission checks, which made sense to Apple — and to HN, at the time — because it was considered malicious/exploitable. Should they have not exercised that right, and left us all at risk — even though the daemon itself wasn't malware, nor had it been abused for such purposes by anyone?
      - damnyou 6y ago
        The decisions should be transparent and subject to review and appeal by an independent board. Zoom should be free to appeal Apple's decision to the board, yes. Checks and balances are not a new concept.
shiburizu 6y ago
This isn't being fought over a data breach or privacy concerns and that's why Epic is smart to fight at this angle. Apple says "you can't do this", but Epic does the thing and says "I should be allowed to do this. As you can all see, this is what happens when I try to put my foot down on it and here's this target audience of people who are benefited by the thing I'm trying to do". This works for them because they are advocating for a freedom of software choice and to rebel against the massive profit line that has made Apple the target of Spotify's legal hate as well. The rules they broke prevent Epic from doing a thing that consumers would prefer (lower prices) and has been argued against by other parties (30% cut). It doesn't really matter that they broke the rule if the court of public and legal opinion is that the rule was not good to begin with.
- jachee 6y ago
  Redirecting user payment info is totally a data/privacy breach.
  - tfigment 6y ago
    They gave 2 options the original through apple and then via tem. How is paying them different from when i pay uber or lyft through an app? Apple doesnt get 30% in that case.
  - romanoderoma 6y ago
    Why? Forcing me to give them to Apple is, if I prefer to give them to Epic and hide them from Apple Guess which one is the only Apple approved option
zucker42 6y ago
> revoked their developer certificate in response, which would have essentially killed all installations of Fortnite iOS/Mac worldwide within 24 hours Yeah isn't that what people see as a problem? > Notarization is about protecting users who are not capable of making an informed decision about code safety from developers who refuse to comply with Apple's terms of service. My family owns a Mac on which we have played Fortnite in the past. We have no desire to be "protected" from Epic Games. I thought to point of notarization was to prevent malware, not to punish companies which Apple doesn't like.
untog 6y ago
> Notarization is about protecting users who are not capable of making an informed decision about code safety from developers who refuse to comply with Apple's terms of service. Epic willfully violated their terms with Apple to make a point, and Apple is responding in the same way that they did to Facebook: taking away their access to the users, because they cannot be trusted to comply with the restrictions placed on their behavior. You're conflating two things here: code safety, and what Epic did. At no point did Epic do anything unsafe, nor did they put their users in any danger. They simple violated a business rule Apple enforces.
- floatingatoll 6y ago
  If Epic chooses not to follow the rules, then Apple chooses not to trust them to deliver executable code to users. You are arguing that Apple is incorrect to assert that rulebreakers should not have privileges to deploy code to end-user devices worldwide, when the rule is not one that protects users. Apple's counter-argument would presumably be that this business rule exists specifically to protect users from being harmed by developers, given the prevalence of "free trial" subscription scams over the past X decades of Internet marketing (and before that, TV commercials). So, I don't buy the argument that Epic did nothing unsafe. It takes seconds to construct multiple scenarios where users have been abused by third-party payment systems, such that Apple would consider them "malicious behaviors that impact the user". ps. There's a technicality branch here on "malware" != "malicious behaviors", but, like, malicious payment processing is implemented using software, "malware" is "malicious software", so "malware" still applies to the scenario I constructed above — and that flexibility demonstrates why "malware" is a terrible abbreviation for whatever everyone individually thinks it means.
  - dlubarov 6y ago
    You can make the case that using other payment systems sub-optimal from a security perspective, but malware? Would you also consider Uber, Lyft, and Amazon malware since they accept other payment systems?
  - neop1x 6y ago
    The problem is the Apple, who owns the whole platform is deciding here on behalf of users. Taking 30% is like paying taxes to IRS. At the same time look at Apple's marketcap and tax evading practices in Ireland. Why is there still government and police if Apple can protect users themselves and dictate what users can and cannot do on their devices?
a2tech 6y ago
Agreed. This is a calm and well reasoned post. Epic knew what they were doing, knew what they were risking, and did it anyone. Now there's nothing to do but wait for the courts to figure it out while Epic cries crocodile tears over their perceived grievances with Apple (and Google lets not forget).
kelnos 6y ago
> Epic expressly snuck code through the door to activate a user-visible feature in direct prohibition to App Store rules. I don't think "snuck" is accurate. They did intentionally do it, but it was likely pretty obvious to the app reviewer. This was necessary, because you can't sue a company because they'll harm you for something you'd like to do, but haven't done yet. You have to do the thing, get harmed, and then sue. > Apple could have revoked their developer certificate in response, which would have essentially killed all installations of Fortnite iOS/Mac worldwide within 24 hours. That they are merely revoking their ability to sign new code and giving them 2 weeks to perform an orderly shutdown is far less draconian than they're capable of being here. Don't pretend they're doing this to be nice to Epic; they know that if they cut off all existing Fortnite users, they'd get a huge amount of customer complaints and bad press. At least here they can appear like they're being reasonable and only hurting the company that violated their policies.
- floatingatoll 6y ago
  In two weeks, when the developer access goes away, so will all in-app purchase. I'm not sure whether Restore Purchases will work or not at that point. I don't think they're trying to avoid complaints, or they wouldn't have taken this step at all.
  - gpm 6y ago
    > so will all in-app purchase. Well, presumably only in-app purchases made with apples payment system.
rubber_duck 6y ago
> Most (if not all) of the restrictions on the App Store exist to protect users from app developers who prioritize their own greed over the rights of privacy and safety that Apple promises the users of the App Store. If Apple was about user protection then one would expect there to be a way for users to opt out of their safety sandbox if it didn't fit users needs. Their OS and store restrictions are about monetising the ecosystem as much as anything else, calling developers who try to circumvent the apple tax greedy while pretending Apple is doing this purely for user experience is some cognitive dissonance.
ibeckermayer 6y ago
Rather than building a platform that empowers developers to build the apps that best serve the varied needs and preferences of individuals, Apple have constructed a corporate walled garden in which they impose a drab lowest-common-denominator conformity on all developers and users. It takes a real sucker to fall for the “its for your own safety” propaganda while they arbitrarily tax you 30% on the fields you tilled like some medieval feudal lord.
fxtentacle 6y ago
Nah, the relevant part of the lawsuit is that Apple is revoking not only the Fortnite developer account (which could be considered fair) but that they threaten to revoke the developer accounts of everyone working on the Unreal Engine, too. I used to do consulting work as part of which I submitted Mac compatibility patches into the Unreal Engine source code repository. As is, it is not clear to me if I'll be hit by the Apple ban-hammer, too, or if they will limit it to "only" the 4000+ people directly employed by Epic.
systemBuilder 6y ago
Who was harmed by Epic change? Only the monopolist! I can see Apple getting cut down yo size by a 1982 AT&T-style antitrust consent decree within 6 months! Goodbye walled Golden.
vffhfhf 6y ago
Are Apple fanboys this dumb? This is why I want Epic to lose. This type of people need protection.
romanoderoma 6y ago
> Epic expressly snuck code through the door to activate a user-visible feature in direct prohibition to App Store rules That's not even the case here. Epic built an app using webviews and the web part of the view is loaded from a remote server controlled by Epic. Which is the most common way to build multiplatform apps nowadays. Epic simply updated the web part on the remote server. Which also proves Apple can't even provide the basic safety they are promoting to push notarization. Unless they ban webviews completely, we will never know how many apps are already doing it exploiting the less tech savy users, but still bringing profit to Apple.

_qulr 6y ago

> Notarization is about protecting users who are not capable of making an informed decision about code safety from developers who refuse to comply with Apple's terms of service. No, notarization is about preventing malware. That's all. This has been promised to us by Apple many many times. Malware prevention only. Fortnite is not malware.

floatingatoll 6y ago
I'm sorry, it sounds like we're saying the same thing. Notarization is not a stick-less carrot. Anyone can sign up and agree to the rules and pay the fee begin notarizing apps. If you break the rules you agree to when you sign up, you lose access to notarization. It seems like we disagree about this basic understanding, so I'll take a couple guesses at it. Are you, perhaps, arguing that Apple should not be allowed to terminate developer access to notarization under any circumstance — regardless of their behavior? Or are you arguing that Epic's behavior is "acceptable" rule breaking, but other kinds of behavior are "unacceptable" rule breaking? I'm happy to consider that I could be wrong here, but I'll need a few more sentences from you to do so.
- damnyou 6y ago
  Yes, Apple should very obviously not have a completely unchecked right to disable arbitrary software from running on millions of computers for whatever reason they want. This is so obviously an abuse of power that I can't believe I have to spell it out so clearly. At the very least such decisions should be subject to appeal to an independent board, and failing that the legal system.
  - floatingatoll 6y ago
    The only time in the past decade that I can think of where they used that power to remove anything other than malware on any platform, was to remove the Zoom daemon that Zoom was using to bypass Installer.app permission checks, which made sense to Apple — and to HN, at the time — because it was considered malicious/exploitable. Should they have not exercised that right, and left us all at risk — even though the daemon itself wasn't malware, nor had it been abused for such purposes by anyone?
    - damnyou 6y ago
      The decisions should be transparent and subject to review and appeal by an independent board. Zoom should be free to appeal Apple's decision to the board, yes. Checks and balances are not a new concept.

shiburizu 6y ago

This isn't being fought over a data breach or privacy concerns and that's why Epic is smart to fight at this angle. Apple says "you can't do this", but Epic does the thing and says "I should be allowed to do this. As you can all see, this is what happens when I try to put my foot down on it and here's this target audience of people who are benefited by the thing I'm trying to do". This works for them because they are advocating for a freedom of software choice and to rebel against the massive profit line that has made Apple the target of Spotify's legal hate as well. The rules they broke prevent Epic from doing a thing that consumers would prefer (lower prices) and has been argued against by other parties (30% cut). It doesn't really matter that they broke the rule if the court of public and legal opinion is that the rule was not good to begin with.

jachee 6y ago
Redirecting user payment info is totally a data/privacy breach.
- tfigment 6y ago
  They gave 2 options the original through apple and then via tem. How is paying them different from when i pay uber or lyft through an app? Apple doesnt get 30% in that case.
- romanoderoma 6y ago
  Why? Forcing me to give them to Apple is, if I prefer to give them to Epic and hide them from Apple Guess which one is the only Apple approved option

zucker42 6y ago

> revoked their developer certificate in response, which would have essentially killed all installations of Fortnite iOS/Mac worldwide within 24 hours Yeah isn't that what people see as a problem? > Notarization is about protecting users who are not capable of making an informed decision about code safety from developers who refuse to comply with Apple's terms of service. My family owns a Mac on which we have played Fortnite in the past. We have no desire to be "protected" from Epic Games. I thought to point of notarization was to prevent malware, not to punish companies which Apple doesn't like.

untog 6y ago

> Notarization is about protecting users who are not capable of making an informed decision about code safety from developers who refuse to comply with Apple's terms of service. Epic willfully violated their terms with Apple to make a point, and Apple is responding in the same way that they did to Facebook: taking away their access to the users, because they cannot be trusted to comply with the restrictions placed on their behavior. You're conflating two things here: code safety, and what Epic did. At no point did Epic do anything unsafe, nor did they put their users in any danger. They simple violated a business rule Apple enforces.

floatingatoll 6y ago
If Epic chooses not to follow the rules, then Apple chooses not to trust them to deliver executable code to users. You are arguing that Apple is incorrect to assert that rulebreakers should not have privileges to deploy code to end-user devices worldwide, when the rule is not one that protects users. Apple's counter-argument would presumably be that this business rule exists specifically to protect users from being harmed by developers, given the prevalence of "free trial" subscription scams over the past X decades of Internet marketing (and before that, TV commercials). So, I don't buy the argument that Epic did nothing unsafe. It takes seconds to construct multiple scenarios where users have been abused by third-party payment systems, such that Apple would consider them "malicious behaviors that impact the user". ps. There's a technicality branch here on "malware" != "malicious behaviors", but, like, malicious payment processing is implemented using software, "malware" is "malicious software", so "malware" still applies to the scenario I constructed above — and that flexibility demonstrates why "malware" is a terrible abbreviation for whatever everyone individually thinks it means.
- dlubarov 6y ago
  You can make the case that using other payment systems sub-optimal from a security perspective, but malware? Would you also consider Uber, Lyft, and Amazon malware since they accept other payment systems?
- neop1x 6y ago
  The problem is the Apple, who owns the whole platform is deciding here on behalf of users. Taking 30% is like paying taxes to IRS. At the same time look at Apple's marketcap and tax evading practices in Ireland. Why is there still government and police if Apple can protect users themselves and dictate what users can and cannot do on their devices?

a2tech 6y ago

Agreed. This is a calm and well reasoned post. Epic knew what they were doing, knew what they were risking, and did it anyone. Now there's nothing to do but wait for the courts to figure it out while Epic cries crocodile tears over their perceived grievances with Apple (and Google lets not forget).

kelnos 6y ago

> Epic expressly snuck code through the door to activate a user-visible feature in direct prohibition to App Store rules. I don't think "snuck" is accurate. They did intentionally do it, but it was likely pretty obvious to the app reviewer. This was necessary, because you can't sue a company because they'll harm you for something you'd like to do, but haven't done yet. You have to do the thing, get harmed, and then sue. > Apple could have revoked their developer certificate in response, which would have essentially killed all installations of Fortnite iOS/Mac worldwide within 24 hours. That they are merely revoking their ability to sign new code and giving them 2 weeks to perform an orderly shutdown is far less draconian than they're capable of being here. Don't pretend they're doing this to be nice to Epic; they know that if they cut off all existing Fortnite users, they'd get a huge amount of customer complaints and bad press. At least here they can appear like they're being reasonable and only hurting the company that violated their policies.

floatingatoll 6y ago
In two weeks, when the developer access goes away, so will all in-app purchase. I'm not sure whether Restore Purchases will work or not at that point. I don't think they're trying to avoid complaints, or they wouldn't have taken this step at all.
- gpm 6y ago
  > so will all in-app purchase. Well, presumably only in-app purchases made with apples payment system.

rubber_duck 6y ago

> Most (if not all) of the restrictions on the App Store exist to protect users from app developers who prioritize their own greed over the rights of privacy and safety that Apple promises the users of the App Store. If Apple was about user protection then one would expect there to be a way for users to opt out of their safety sandbox if it didn't fit users needs. Their OS and store restrictions are about monetising the ecosystem as much as anything else, calling developers who try to circumvent the apple tax greedy while pretending Apple is doing this purely for user experience is some cognitive dissonance.

ibeckermayer 6y ago

Rather than building a platform that empowers developers to build the apps that best serve the varied needs and preferences of individuals, Apple have constructed a corporate walled garden in which they impose a drab lowest-common-denominator conformity on all developers and users. It takes a real sucker to fall for the “its for your own safety” propaganda while they arbitrarily tax you 30% on the fields you tilled like some medieval feudal lord.

fxtentacle 6y ago

Nah, the relevant part of the lawsuit is that Apple is revoking not only the Fortnite developer account (which could be considered fair) but that they threaten to revoke the developer accounts of everyone working on the Unreal Engine, too. I used to do consulting work as part of which I submitted Mac compatibility patches into the Unreal Engine source code repository. As is, it is not clear to me if I'll be hit by the Apple ban-hammer, too, or if they will limit it to "only" the 4000+ people directly employed by Epic.

systemBuilder 6y ago

Who was harmed by Epic change? Only the monopolist! I can see Apple getting cut down yo size by a 1982 AT&T-style antitrust consent decree within 6 months! Goodbye walled Golden.

vffhfhf 6y ago

Are Apple fanboys this dumb? This is why I want Epic to lose. This type of people need protection.

romanoderoma 6y ago

> Epic expressly snuck code through the door to activate a user-visible feature in direct prohibition to App Store rules That's not even the case here. Epic built an app using webviews and the web part of the view is loaded from a remote server controlled by Epic. Which is the most common way to build multiplatform apps nowadays. Epic simply updated the web part on the remote server. Which also proves Apple can't even provide the basic safety they are promoting to push notarization. Unless they ban webviews completely, we will never know how many apps are already doing it exploiting the less tech savy users, but still bringing profit to Apple.