2 ms·

Wrong. Completely. The vast majority of people you're talking about don't realise they're having their prices jacked up with taxes or their options curtailed

Wrong. Completely. The vast majority of people you're talking about don't realise they're having their prices jacked up with taxes or their options curtailed by Apple. They just assume the App Store is where you get the apps because it's been programmed into them over the last 12 years. Allowing third party app stores doesn't change the API or permissions system already baked into the OS. If Epic wants to start an App Store with lax policies then if you and Apple are right about the value of their policies then that'll become apparent quickly enough and will still be a selling point of the App Store. This is nothing like what happened with desktop computers, where the security model had to be welded on after the horse had already bolted. Windows (just as an example) wouldn't allow blanket admin permissions to software if there was a way to stuff the legacy software genie back in it's bottle. Unfortunately fixing permissions retrospectively would break a multitude of legacy software that hasn't been updated in years, in some cases decades. Apple is not being punished for success, and you don't understand the problem or the legal case, which is entirely not at all related to Apple protecting or not protecting their users from pop-up ads. Consumer choice didn't chose anything. Most phone users don't even understand that they are in a walled garden. tldr; This isn't The Beach, it's The Truman Show.

sneak 6y ago
> Allowing third party app stores doesn't change the API or permissions system already baked into the OS. It does precisely that. Apple invests huge amounts of money into people and infrastructure to ensure that exploit code (that can subvert platform security) never makes it into the store or gets signed by Apple. If it does, they can immediately revoke it. Third parties providing app downloads would not invest the anywhere near same level of care, for the most part. Platform security can only do so much if you can run any code you want to try to attack it.
- headmelted 6y ago
  But you cant run any code you want. You’re still in a restrictive sandbox, and you still need to explicitly request the limited expansions to the permissions scope that the OS allows the user to grant you - neither of which is dependent on the App Store.
  - sneak 6y ago
    I don't believe you understood my comment. Third party app stores with more lax, less resourced app review procedures would result in arbitrary attacker code being run on end-user devices, that, given enough time, would escape the sandbox. It's a layered defense: signing/developer identity account, app store review, sandboxing, specific user-approved permissions. No one part of it is bulletproof, as we saw with CVE-2020-3883.

sneak 6y ago

> Allowing third party app stores doesn't change the API or permissions system already baked into the OS. It does precisely that. Apple invests huge amounts of money into people and infrastructure to ensure that exploit code (that can subvert platform security) never makes it into the store or gets signed by Apple. If it does, they can immediately revoke it. Third parties providing app downloads would not invest the anywhere near same level of care, for the most part. Platform security can only do so much if you can run any code you want to try to attack it.

headmelted 6y ago
But you cant run any code you want. You’re still in a restrictive sandbox, and you still need to explicitly request the limited expansions to the permissions scope that the OS allows the user to grant you - neither of which is dependent on the App Store.
- sneak 6y ago
  I don't believe you understood my comment. Third party app stores with more lax, less resourced app review procedures would result in arbitrary attacker code being run on end-user devices, that, given enough time, would escape the sandbox. It's a layered defense: signing/developer identity account, app store review, sandboxing, specific user-approved permissions. No one part of it is bulletproof, as we saw with CVE-2020-3883.