5 ms·

> this number of completly inexperienced user is not proven to be as large, if you look at Android or OSX you don't see 51% of users having malware on their mac

> this number of completly inexperienced user is not proven to be as large, if you look at Android or OSX you don't see 51% of users having malware on their machine > "protecting" an unknown small number of users by limiting the rest makes no sense, what makes more sense is MONEY For creating policies 51% is a bad measure. Its inherently biased to be regressive. Setting policies at 51% disproportionately hurts the bottom 1%, 10% and 25% of the populations that need our help the most. This is true of all policies and especially laws. Meanwhile, if you've ever helped your grandma or parents with their computers, you'll realize just how much malware they have already downloaded. I also remember what I was like on Limewire and Kazaa as a kid. There is/was an entire industry built around it for Anti-virus and Malware protection. iOS doesn't require anti-virus or malware protection because Apple builds protection and privacy into the product as a core feature. Sadly, built into Android is malware but even Android is less susceptible to malware from unknown entities.

simion314 6y ago
I understand your point but we don't even know if the number of this users that need protecting is even 10%. This imaginary group of people must have this properties: - they are gullible , so bad people can trick them to ignore OS security warnings,create some extra account or security key to unlock the device (Apple can do it hard enough it must not be just 1 click) - at the same time this users are not that gullible to paste their credit card in random websites or on Apple approved chat messages - at the same time this users can be trusted with the app permissions for files,contacts, camera, location For me if I intersect all this sets of users I get void and your argument should be that everything should be locked down, no permissions allowed for this users, there should only Apple approved websites, apple approved contacts, Apple should scan your messages not to send your card details or do stupid things. This people should use an iOS version made for children and adults could use the unlocked version.
- yazaddaruvala 6y ago
  > they are gullible , so bad people can trick them to ignore OS security warnings > For me if I intersect all this sets of users I get void I work at a pretty big company, where we are trusted to make a lot of important decisions but as I understand it even small companies have trainings to identify "phishing, clickbait, social engineering, etc". Every relatively big company also pre-approves devices that can connected and access the internal network. Installing software needs to be pre-approved. Even my browser Firefox or Chrome settings are pre-selected to ensure no compromising behavior can occur. I know from past-experience, friends and colleagues that my current company is not unique. Because all humans (even the smartest sets) are gullible, it just depends how time constrained, sleep deprived or drunk they are. Additionally, preventative protections on devices are used often even in personal contexts. When I help my mom set up her computer I pre-install everything and she doesn't have the admin password. This is the general recommendation for and by anyone helping someone under-educated about technology and abuse vectors. I've asked if she would rather me teach her and she just prefers using the computer without worry. Neither her, not this situation is unique. That said, I have previously and do agree, Apple should make it easier to boot non-iOS iPhones. However, Apple should only provide that to the registered adult owner of the device, in person at an Apple store after delivering the caveats that the device will no longer be supported by Apple (regardless of resale) and any warranty is void.
  - simion314 6y ago
    The issues you describe are happening on computers where by default there is no sandbox, so an evil game or a bad application can do a lot of damage. But in an OS with strong sandbox and a good permission model the fact you add a dude to review your app does not add some extra security, from what I see this review people will check to make sure you follow the GUI /UX guidelines and also make sure you don't give the users information Apple won't like (like you could buy this cheaper from this webpage)
    - yazaddaruvala 6y ago
      I agree, with a strong enough sandbox I am very happy to use sideloading. Fortunately, iOS provides Safari for such a sandbox. According to screen time on iOS, I use Safari 2x more than all my other native applications combined. Including to play games. Especially with "Login with Apple", and "Apple Pay" I find that most websites are as easy to use as native applications.
leetcrew 6y ago
I absolutely resent the implication that protecting the bottom n% of gullible users is mutually exclusive with giving power users the access they desire. they seem to do a decent job of it on their OSX machines, so why not iOS?
- yazaddaruvala 6y ago
  You're right! I disagree that the perfectly balanced system is OSX but overall I agree iPhones should have better "hack-ability". As I've posted elsewhere: I agree, Apple should make it easier to boot non-iOS iPhones. Even provide some tools to write custom OSes for the iPhone hardware. However, Apple should only provide that service to the registered adult owner of the device, in person at an Apple store after delivering the caveats that the device will no longer be supported by Apple (regardless of resale) and any warranty is void.
  - simion314 6y ago
    Can you think of what a bad application can do to a user when side loading but is impossible to do when Apple reviews it, If I am a bad actor I can submit an app for review and activate an evil mode after the application is approved. Maybe we can stop pretending that the lock is in place to protect the users, most Android users do not root their devices or install random evil applications and then complain to Google about it, can't we just be sincere and say , "yeah is the way Apple keeps control on things for financial reason" . we could focus on the correct stuff then like how we can protect the small set of very gullible users from bad apps(that can be in the store) or bad webpages or evil messages.
    - yazaddaruvala 6y ago
      Sure totally! With sideloading allowed, an application/appstore that is actually a trojan horse could request permissions once to "download X" where X is innocuous. Later the trojan auto-downloads other applications to your phone to mine bitcoin, run a bot net, etc. Basically selling your hardware, bandwidth and battery life to the highest bidder. With sideloading, alternate APIs could be scraped together into a "new std lib". These APIs would just be some C/asm lib that is a part of any application and accesses hardware without any permission management. At that point every possible bad thing can happen. "Sandbox it!" sure... but that is what Apple is currently doing... its just also auditing source code to ensure no one is maliciously trying to break out of the sandbox. With enough time, people will break the sandbox or people will complain the sandbox is too limiting and not "true sideloading". All this said, is Apple's auditing system a 100% guarantee? No. But at least I know once the bug/issue is found Apple will close the hole. Meanwhile, its in a company like FB or GOOG's best interest to force ever more tracking onto users, and they know people will continue to use their services regardless of the complaints (like what happens today). You might argue, "this is where government should step in". I agree! The problem is that the government isn't doing a good enough job protecting users from digital abuse (arguably might make it worse with weaker encryption). So in the meanwhile, I'm happy that at least Apple currently is trying to protect users.

simion314 6y ago

I understand your point but we don't even know if the number of this users that need protecting is even 10%. This imaginary group of people must have this properties: - they are gullible , so bad people can trick them to ignore OS security warnings,create some extra account or security key to unlock the device (Apple can do it hard enough it must not be just 1 click) - at the same time this users are not that gullible to paste their credit card in random websites or on Apple approved chat messages - at the same time this users can be trusted with the app permissions for files,contacts, camera, location For me if I intersect all this sets of users I get void and your argument should be that everything should be locked down, no permissions allowed for this users, there should only Apple approved websites, apple approved contacts, Apple should scan your messages not to send your card details or do stupid things. This people should use an iOS version made for children and adults could use the unlocked version.

yazaddaruvala 6y ago
> they are gullible , so bad people can trick them to ignore OS security warnings > For me if I intersect all this sets of users I get void I work at a pretty big company, where we are trusted to make a lot of important decisions but as I understand it even small companies have trainings to identify "phishing, clickbait, social engineering, etc". Every relatively big company also pre-approves devices that can connected and access the internal network. Installing software needs to be pre-approved. Even my browser Firefox or Chrome settings are pre-selected to ensure no compromising behavior can occur. I know from past-experience, friends and colleagues that my current company is not unique. Because all humans (even the smartest sets) are gullible, it just depends how time constrained, sleep deprived or drunk they are. Additionally, preventative protections on devices are used often even in personal contexts. When I help my mom set up her computer I pre-install everything and she doesn't have the admin password. This is the general recommendation for and by anyone helping someone under-educated about technology and abuse vectors. I've asked if she would rather me teach her and she just prefers using the computer without worry. Neither her, not this situation is unique. That said, I have previously and do agree, Apple should make it easier to boot non-iOS iPhones. However, Apple should only provide that to the registered adult owner of the device, in person at an Apple store after delivering the caveats that the device will no longer be supported by Apple (regardless of resale) and any warranty is void.
- simion314 6y ago
  The issues you describe are happening on computers where by default there is no sandbox, so an evil game or a bad application can do a lot of damage. But in an OS with strong sandbox and a good permission model the fact you add a dude to review your app does not add some extra security, from what I see this review people will check to make sure you follow the GUI /UX guidelines and also make sure you don't give the users information Apple won't like (like you could buy this cheaper from this webpage)
  - yazaddaruvala 6y ago
    I agree, with a strong enough sandbox I am very happy to use sideloading. Fortunately, iOS provides Safari for such a sandbox. According to screen time on iOS, I use Safari 2x more than all my other native applications combined. Including to play games. Especially with "Login with Apple", and "Apple Pay" I find that most websites are as easy to use as native applications.

leetcrew 6y ago

I absolutely resent the implication that protecting the bottom n% of gullible users is mutually exclusive with giving power users the access they desire. they seem to do a decent job of it on their OSX machines, so why not iOS?

yazaddaruvala 6y ago
You're right! I disagree that the perfectly balanced system is OSX but overall I agree iPhones should have better "hack-ability". As I've posted elsewhere: I agree, Apple should make it easier to boot non-iOS iPhones. Even provide some tools to write custom OSes for the iPhone hardware. However, Apple should only provide that service to the registered adult owner of the device, in person at an Apple store after delivering the caveats that the device will no longer be supported by Apple (regardless of resale) and any warranty is void.
- simion314 6y ago
  Can you think of what a bad application can do to a user when side loading but is impossible to do when Apple reviews it, If I am a bad actor I can submit an app for review and activate an evil mode after the application is approved. Maybe we can stop pretending that the lock is in place to protect the users, most Android users do not root their devices or install random evil applications and then complain to Google about it, can't we just be sincere and say , "yeah is the way Apple keeps control on things for financial reason" . we could focus on the correct stuff then like how we can protect the small set of very gullible users from bad apps(that can be in the store) or bad webpages or evil messages.
  - yazaddaruvala 6y ago
    Sure totally! With sideloading allowed, an application/appstore that is actually a trojan horse could request permissions once to "download X" where X is innocuous. Later the trojan auto-downloads other applications to your phone to mine bitcoin, run a bot net, etc. Basically selling your hardware, bandwidth and battery life to the highest bidder. With sideloading, alternate APIs could be scraped together into a "new std lib". These APIs would just be some C/asm lib that is a part of any application and accesses hardware without any permission management. At that point every possible bad thing can happen. "Sandbox it!" sure... but that is what Apple is currently doing... its just also auditing source code to ensure no one is maliciously trying to break out of the sandbox. With enough time, people will break the sandbox or people will complain the sandbox is too limiting and not "true sideloading". All this said, is Apple's auditing system a 100% guarantee? No. But at least I know once the bug/issue is found Apple will close the hole. Meanwhile, its in a company like FB or GOOG's best interest to force ever more tracking onto users, and they know people will continue to use their services regardless of the complaints (like what happens today). You might argue, "this is where government should step in". I agree! The problem is that the government isn't doing a good enough job protecting users from digital abuse (arguably might make it worse with weaker encryption). So in the meanwhile, I'm happy that at least Apple currently is trying to protect users.