8 ms·

Everybody complains about the walled garden, but damn I love to see things like this.

ProAm 6y ago
Doesn't Apple track every app you install, access and run? Track you if you want to develop your own code for your own fully paid for device?
- ffpip 6y ago
  > Doesn't Apple track every app you install, access and run? Do you have a source on the them tracking every app a user runs? Obviously they have to collect every app I install for updates and subscriptions, but collecting every run might be too much.
  - cblconfederate 6y ago
    Don't they verify executables for this reason? Do they provide info about whether they log this process?
    - Nextgrid 6y ago
      I believe iOS handles this process differently. Apps are signed in advance (when the app is approved and published to the Store) and the signatures are only checked locally against a hardcoded signing key. But even on Mac when it comes to notarization, I'm pretty sure the signatures are only checked on first run and then the result of that is cached (partly for performance reasons).
      - sroussey 6y ago
        Same on Mac AppStore.
    - ffpip 6y ago
      Why would they verify it everytime you run the app? It already goes through heavy review before it comes onto the app store.
  - izacus 6y ago
    They advertise a whole product which draws all this tracking data as nice graphs to developers: https://developer.apple.com/app-store-connect/analytics/ https://developer.apple.com/app-store-connect/analytics/ It's essentially Google Analytics, just for apps on iOS. Where do you think those "Daily active devices" data comes from?
    - anater 6y ago
      Users must opt in though. It’s part of the iOS set up to allow this and you can change it any time
      - lern_too_spel 6y ago
        This setting is opt out, not opt-in. It's unclear if opting out hides the data from Apple or just from the app developers.
        Nextgrid 6y ago
        It is opt-in now; when setting up iOS for the first time it asks you if you'd like to enable "iPhone analytics" (OS-wide analytics for Apple) and if you accept then it asks you whether you want to share the analytical data with the app developers.
      - Dahoon 6y ago
        It's opt out.
        saagarjha 6y ago
        No, it’s opt in when you set up your device.
      - deleted 6y ago
        [deleted]
- slipheen 6y ago
  That really does seem like whataboutism. No one is claiming Apple is perfect, but this is a marked improvement of apps requiring tracking to function.
  - ProAm 6y ago
    No its more about the pot calling the kettle black. Do as I say not as I do because I know whats best for you. I can see it seems to be whataboutism but that was not my intention, it's about hypocrisy.
    - birthdaydog 6y ago
      This is exactly whataboutism.
      - ProAm 6y ago
        I think we're arguing semantics about business philosophy.
    - samatman 6y ago
      whataboutism: n. An accusation of hypocrisy designed to deflect from bad behavior on the part of another party.
      - ProAm 6y ago
        Ha! Ive never actually looked the definition up. This is definitely whataboutism (I still havent looked the definition up so Im trusting this the actual definition)
        samatman 6y ago
        well, I did make that up. but here's dictionary.com on the subject, and I think it's congruent, you'll have to judge for yourself: https://www.dictionary.com/browse/whataboutism https://www.dictionary.com/browse/whataboutism
- sbuk 6y ago
  There has to be be some degree of tying purchases to an account. The real issue here is what is done with the data after it's been collected. Internal use is one thing; such as improving apps etc. When it's used to target individual in a bid to influence their thinking, that's when the real problem starts. Are Apple guilty of the latter?
  - lern_too_spel 6y ago
    Certainly. They use it in app store ads, to determine their own product development, and to market their products. On other platforms, I can install apps on my devices without telling anybody.
    - anater 6y ago
      Which platforms?
      - lern_too_spel 6y ago
        Most Android distributions, most Linux distributions, Windows, etc.
        threeseed 6y ago
        Pretty sure most of those would be sending telemetry including installed apps back to the company. And we know for a fact Windows does this.
        lern_too_spel 6y ago
        > Pretty sure... Now you know that you were wrong. Windows allows you to disable telemetry and certainly doesn't report apps you install to Microsoft if you don't want it to. Same for Android and obviously for desktop and server Linux distros. This is simply not possible on iOS.
        6y ago
- threeseed 6y ago
  On iOS under: Privacy -> Analytics & Improvements They (a) show what data is being sent e.g. stack traces and (b) provide the privacy policies. At least on my device I am not seeing a list of apps being sent to Apple.
  - withinboredom 6y ago
    Your device doesn’t need to send it. They know what apps you’ve downloaded already and on what device. The real question is, does it send when you remove an app? If so, they are tracking your apps you have installed. If your device offloads apps, they know when you download it again and thus can infer usage.
lern_too_spel 6y ago
This policy is straight from GDPR. The Play Store and the Amazon App Store also enforce this, despite neither enforcing walled gardens.
dayjobpork 6y ago
You do realise Apple could still do this in their app store AND allow 3rd party app stores?
- threeseed 6y ago
  But 3rd party app stores just mean a race to the bottom. The app store with the least oversight and cheapest prices would be the winner. Policies like this are good for users but bad for apps and by extension app stores.
  - fulafel 6y ago
    Doesn't seem to happen on Android.
    - yazaddaruvala 6y ago
      My previous experience with the PlayStore might have been different than yours. In the context of this guideline and other user focused non-tracking/permissions related things, the PlayStore is “already at bottom”.
      - deleted 6y ago
        [deleted]
      - fulafel 6y ago
        So more like race to the top?
        yazaddaruvala 6y ago
        Races to the top are significantly slower, but possible. Trust building is really, really hard.
- austhrow743 6y ago
  Not to the same effect. It means if developers don’t want to play by Apple’s rules they don’t have to completely surrender the iOS market. A big enough name could just direct users to the third party App Store.
sneak 6y ago
Note that “tracking” is used in an intentionally misleading way here. Apple’s guidelines expressly permit all sorts of silent, invisible, no-opt-in tracking within apps, and most apps in the app store embed this sort of spyware. The term “tracking” in this instance refers to GPS or contacts permission and other such things that Apple has built an opt-in switch for.
- beervirus 6y ago
  What sort of "silent, invisible, no-opt-in tracking" does Apple allow?
  - sneak 6y ago
    The maker of the app can send network requests, to themselves or any third party service they like, for every single action taken within the app: every launch, every click, every character typed, even every background refresh. They can include a unique tracking identifier to cross-reference these requests, they can further include any login/id information you’ve provided to the app, and they can include location information if the app has GPS permissions. Even without GPS permission, IP geolocation provides them a rough track log, enough to say “user x was in california on monday, new york on tuesday, then new jersey for the remainder of the month”.
  - Dahoon 6y ago
    Pretty much anything except location tracking via GPS, unless the users clicks allow. So exactly the same as Google.
- Nextgrid 6y ago
  The way I read this (as well as their recently-postponed change regarding the advertising ID) is that they are explicitly tightening up the rules and will hopefully crack down on the behavior your describe (malware - aka the Facebook SDK - being embedded in every single app).
stefan_ 6y ago
Remember that app SDK that decided to hijack every URL open and leak auth tokens back to the mothership? That's all right with Apple: https://www.securityweek.com/malicious-behavior-found-advertising-sdk-used-1200-ios-apps https://www.securityweek.com/malicious-behavior-found-advert... These rules are not worth the bytes used to transfer them. It's the epitome of selective enforcement.
- lilyball 6y ago
  I’m not sure what your point is. > […] the tech giant has found no evidence that apps using the Mintegral SDK are harming users. […] The company says app developers are responsible for the behavior of their products, including the behavior of third-party code, and they should exercise caution when using third-party code to insure it does not accidentally undermine security and privacy. This seems to be correct. This is an SDK the application developer chose to use. Its behavior may be harmful to other ad networks, but doesn’t seem to have any effect on the user. Which is to say, the SDK isn’t doing anything the app itself couldn’t just do itself. The SDK may be doing stuff the developer isn’t aware of, but that’s true of any third-party code, and this is why developers need to ensure they validate third-party code appropriately.
apexalpha 6y ago
This is literally what GDPR will enforce. Under GDPR you're not allowed to 'trade' extra functionality or access for tracking. I'm still applauding Apple for taking this stance on privacy, but want to point out that privacy in no way requires a walled garden approach to software.

Doesn't Apple track every app you install, access and run? Track you if you want to develop your own code for your own fully paid for device?

ffpip 6y ago
> Doesn't Apple track every app you install, access and run? Do you have a source on the them tracking every app a user runs? Obviously they have to collect every app I install for updates and subscriptions, but collecting every run might be too much.
- cblconfederate 6y ago
  Don't they verify executables for this reason? Do they provide info about whether they log this process?
  - Nextgrid 6y ago
    I believe iOS handles this process differently. Apps are signed in advance (when the app is approved and published to the Store) and the signatures are only checked locally against a hardcoded signing key. But even on Mac when it comes to notarization, I'm pretty sure the signatures are only checked on first run and then the result of that is cached (partly for performance reasons).
    - sroussey 6y ago
      Same on Mac AppStore.
  - ffpip 6y ago
    Why would they verify it everytime you run the app? It already goes through heavy review before it comes onto the app store.
- izacus 6y ago
  They advertise a whole product which draws all this tracking data as nice graphs to developers: https://developer.apple.com/app-store-connect/analytics/ https://developer.apple.com/app-store-connect/analytics/ It's essentially Google Analytics, just for apps on iOS. Where do you think those "Daily active devices" data comes from?
  - anater 6y ago
    Users must opt in though. It’s part of the iOS set up to allow this and you can change it any time
    - lern_too_spel 6y ago
      This setting is opt out, not opt-in. It's unclear if opting out hides the data from Apple or just from the app developers.
      - Nextgrid 6y ago
        It is opt-in now; when setting up iOS for the first time it asks you if you'd like to enable "iPhone analytics" (OS-wide analytics for Apple) and if you accept then it asks you whether you want to share the analytical data with the app developers.
    - Dahoon 6y ago
      It's opt out.
      - saagarjha 6y ago
        No, it’s opt in when you set up your device.
    - deleted 6y ago
      [deleted]
slipheen 6y ago
That really does seem like whataboutism. No one is claiming Apple is perfect, but this is a marked improvement of apps requiring tracking to function.
- ProAm 6y ago
  No its more about the pot calling the kettle black. Do as I say not as I do because I know whats best for you. I can see it seems to be whataboutism but that was not my intention, it's about hypocrisy.
  - birthdaydog 6y ago
    This is exactly whataboutism.
    - ProAm 6y ago
      I think we're arguing semantics about business philosophy.
  - samatman 6y ago
    whataboutism: n. An accusation of hypocrisy designed to deflect from bad behavior on the part of another party.
    - ProAm 6y ago
      Ha! Ive never actually looked the definition up. This is definitely whataboutism (I still havent looked the definition up so Im trusting this the actual definition)
      - samatman 6y ago
        well, I did make that up. but here's dictionary.com on the subject, and I think it's congruent, you'll have to judge for yourself: https://www.dictionary.com/browse/whataboutism https://www.dictionary.com/browse/whataboutism
sbuk 6y ago
There has to be be some degree of tying purchases to an account. The real issue here is what is done with the data after it's been collected. Internal use is one thing; such as improving apps etc. When it's used to target individual in a bid to influence their thinking, that's when the real problem starts. Are Apple guilty of the latter?
- lern_too_spel 6y ago
  Certainly. They use it in app store ads, to determine their own product development, and to market their products. On other platforms, I can install apps on my devices without telling anybody.
  - anater 6y ago
    Which platforms?
    - lern_too_spel 6y ago
      Most Android distributions, most Linux distributions, Windows, etc.
      - threeseed 6y ago
        Pretty sure most of those would be sending telemetry including installed apps back to the company. And we know for a fact Windows does this.
        lern_too_spel 6y ago
        > Pretty sure... Now you know that you were wrong. Windows allows you to disable telemetry and certainly doesn't report apps you install to Microsoft if you don't want it to. Same for Android and obviously for desktop and server Linux distros. This is simply not possible on iOS.
        6y ago
threeseed 6y ago
On iOS under: Privacy -> Analytics & Improvements They (a) show what data is being sent e.g. stack traces and (b) provide the privacy policies. At least on my device I am not seeing a list of apps being sent to Apple.
- withinboredom 6y ago
  Your device doesn’t need to send it. They know what apps you’ve downloaded already and on what device. The real question is, does it send when you remove an app? If so, they are tracking your apps you have installed. If your device offloads apps, they know when you download it again and thus can infer usage.

lern_too_spel 6y ago

This policy is straight from GDPR. The Play Store and the Amazon App Store also enforce this, despite neither enforcing walled gardens.

dayjobpork 6y ago

You do realise Apple could still do this in their app store AND allow 3rd party app stores?

threeseed 6y ago
But 3rd party app stores just mean a race to the bottom. The app store with the least oversight and cheapest prices would be the winner. Policies like this are good for users but bad for apps and by extension app stores.
- fulafel 6y ago
  Doesn't seem to happen on Android.
  - yazaddaruvala 6y ago
    My previous experience with the PlayStore might have been different than yours. In the context of this guideline and other user focused non-tracking/permissions related things, the PlayStore is “already at bottom”.
    - deleted 6y ago
      [deleted]
    - fulafel 6y ago
      So more like race to the top?
      - yazaddaruvala 6y ago
        Races to the top are significantly slower, but possible. Trust building is really, really hard.
austhrow743 6y ago
Not to the same effect. It means if developers don’t want to play by Apple’s rules they don’t have to completely surrender the iOS market. A big enough name could just direct users to the third party App Store.

sneak 6y ago

Note that “tracking” is used in an intentionally misleading way here. Apple’s guidelines expressly permit all sorts of silent, invisible, no-opt-in tracking within apps, and most apps in the app store embed this sort of spyware. The term “tracking” in this instance refers to GPS or contacts permission and other such things that Apple has built an opt-in switch for.

beervirus 6y ago
What sort of "silent, invisible, no-opt-in tracking" does Apple allow?
- sneak 6y ago
  The maker of the app can send network requests, to themselves or any third party service they like, for every single action taken within the app: every launch, every click, every character typed, even every background refresh. They can include a unique tracking identifier to cross-reference these requests, they can further include any login/id information you’ve provided to the app, and they can include location information if the app has GPS permissions. Even without GPS permission, IP geolocation provides them a rough track log, enough to say “user x was in california on monday, new york on tuesday, then new jersey for the remainder of the month”.
- Dahoon 6y ago
  Pretty much anything except location tracking via GPS, unless the users clicks allow. So exactly the same as Google.
Nextgrid 6y ago
The way I read this (as well as their recently-postponed change regarding the advertising ID) is that they are explicitly tightening up the rules and will hopefully crack down on the behavior your describe (malware - aka the Facebook SDK - being embedded in every single app).

stefan_ 6y ago

Remember that app SDK that decided to hijack every URL open and leak auth tokens back to the mothership? That's all right with Apple: https://www.securityweek.com/malicious-behavior-found-advertising-sdk-used-1200-ios-apps https://www.securityweek.com/malicious-behavior-found-advert... These rules are not worth the bytes used to transfer them. It's the epitome of selective enforcement.

lilyball 6y ago
I’m not sure what your point is. > […] the tech giant has found no evidence that apps using the Mintegral SDK are harming users. […] The company says app developers are responsible for the behavior of their products, including the behavior of third-party code, and they should exercise caution when using third-party code to insure it does not accidentally undermine security and privacy. This seems to be correct. This is an SDK the application developer chose to use. Its behavior may be harmful to other ad networks, but doesn’t seem to have any effect on the user. Which is to say, the SDK isn’t doing anything the app itself couldn’t just do itself. The SDK may be doing stuff the developer isn’t aware of, but that’s true of any third-party code, and this is why developers need to ensure they validate third-party code appropriately.

apexalpha 6y ago

This is literally what GDPR will enforce. Under GDPR you're not allowed to 'trade' extra functionality or access for tracking. I'm still applauding Apple for taking this stance on privacy, but want to point out that privacy in no way requires a walled garden approach to software.