7 ms·

You're right! I disagree that the perfectly balanced system is OSX but overall I agree iPhones should have better "hack-ability". As I've posted elsewhere: I

You're right! I disagree that the perfectly balanced system is OSX but overall I agree iPhones should have better "hack-ability". As I've posted elsewhere: I agree, Apple should make it easier to boot non-iOS iPhones. Even provide some tools to write custom OSes for the iPhone hardware. However, Apple should only provide that service to the registered adult owner of the device, in person at an Apple store after delivering the caveats that the device will no longer be supported by Apple (regardless of resale) and any warranty is void.

simion314 6y ago
Can you think of what a bad application can do to a user when side loading but is impossible to do when Apple reviews it, If I am a bad actor I can submit an app for review and activate an evil mode after the application is approved. Maybe we can stop pretending that the lock is in place to protect the users, most Android users do not root their devices or install random evil applications and then complain to Google about it, can't we just be sincere and say , "yeah is the way Apple keeps control on things for financial reason" . we could focus on the correct stuff then like how we can protect the small set of very gullible users from bad apps(that can be in the store) or bad webpages or evil messages.
- yazaddaruvala 6y ago
  Sure totally! With sideloading allowed, an application/appstore that is actually a trojan horse could request permissions once to "download X" where X is innocuous. Later the trojan auto-downloads other applications to your phone to mine bitcoin, run a bot net, etc. Basically selling your hardware, bandwidth and battery life to the highest bidder. With sideloading, alternate APIs could be scraped together into a "new std lib". These APIs would just be some C/asm lib that is a part of any application and accesses hardware without any permission management. At that point every possible bad thing can happen. "Sandbox it!" sure... but that is what Apple is currently doing... its just also auditing source code to ensure no one is maliciously trying to break out of the sandbox. With enough time, people will break the sandbox or people will complain the sandbox is too limiting and not "true sideloading". All this said, is Apple's auditing system a 100% guarantee? No. But at least I know once the bug/issue is found Apple will close the hole. Meanwhile, its in a company like FB or GOOG's best interest to force ever more tracking onto users, and they know people will continue to use their services regardless of the complaints (like what happens today). You might argue, "this is where government should step in". I agree! The problem is that the government isn't doing a good enough job protecting users from digital abuse (arguably might make it worse with weaker encryption). So in the meanwhile, I'm happy that at least Apple currently is trying to protect users.
  - simion314 6y ago
    Apple is not reviewing the source code, they probably looking at what system calls you use and maybe they do what anti-virus software do on Windows, check for signatures or something like that. From my limited knowledge you can have your executable very obfuscated and make it impossible for someone to easily understand what is happening. The thing is nobody would force the normal users to side load things, the number of applications for Android that are not in the store is small and I think only Fortnite was one with popularity and the number of people sideloading it was not that big.
- nodamage 6y ago
  > If I am a bad actor I can submit an app for review and activate an evil mode after the application is approved. While this is of course still possible, the store model allows you to disable the app and remove the store listing to prevent further distribution of the bad app. You would be giving this up ability if you allowed third-party distribution. The fact that review is necessary in the first place also serves as a deterrent, and if a bad actor is caught their developer account can be banned to prevent them from submitting any more apps. > Maybe we can stop pretending that the lock is in place to protect the users Not sure why you think this is a pretense. In 2019, Android devices were responsible for 47.15% of malware infections compared to 0.85% of iPhones (https://onestore.nokia.com/asset/205835 https://onestore.nokia.com/asset/205835). There is a clear security benefit to the locked-down store model.
  - simion314 6y ago
    >the store model allows you to disable the app and remove the store listing to prevent further distribution You do not need a store to blacklist a known bad application, you can have the OS do what OSX is doing now(I read on HN about this, I don't run any newer OSX versions) check an app when it starts against a blacklist. I agree that a review will catch low level effort of malware and I am not advocating for no official store if is possible users should use applications from the sore or on Linux from the official repositories but if some application is not in the store/repo (maybe you live in one of those countries that ban apps) you can have the option to side load the application. The statistics for malware on iOS vs Android could be problematic if you don't compare equal user groups, Like a rich kid will buy the games from Steam or Apple store, some poor kid will try to get some free games so IMO we should compare similar population.
    - nodamage 6y ago
      Blacklisting may be an appropriate solution for malware but doesn't help with privacy issues because apps distributed outside the App Store by definition won't be subject to the App Store privacy rules. > The statistics for malware on iOS vs Android could be problematic if you don't compare equal user groups, Like a rich kid will buy the games from Steam or Apple store, some poor kid will try to get some free games so IMO we should compare similar population. Even within the Android platform Google has reported an 8x difference in malware between devices that use side-loading compared to devices that use only the Google Play Store (https://source.android.com/security/reports/Google_Android_Security_2018_Report_Final.pdf https://source.android.com/security/reports/Google_Android_S...). In other words, it is specifically side-loading and third-party app stores that cause the biggest problem. We've already seen this same story play out on Windows. Why would we expect it to be any different here?
leetcrew 6y ago
> I agree, Apple should make it easier to boot non-iOS iPhones. Even provide some tools to write custom OSes for the iPhone hardware. However, Apple should only provide that service to the registered adult owner of the device, in person at an Apple store after delivering the caveats that the device will no longer be supported by Apple (regardless of resale) and any warranty is void. this kinda misses the point. I don't want to write my own OS for the phone or run ubuntu or someone else's jailbroken iOS image. I just want to run normal iOS, get updates, and also have the ability to escalate privileges from time to time. why is there not an amount of money I can pay for this? also, does apple distribute any third party drivers in iOS? if so, they might not be able to make non-iOS iphones possible, even if they wanted to. not as familiar with the apple world but IIRC, this has been a longstanding issue for true alternative OSes on android phones.
- yazaddaruvala 6y ago
  I think I'm onboard as long as the procedure is cumbersome enough, and the registered adult owner of the device confirms that they understand and agree the warranty and support is void. If you want to keep iOS as well... at that point, I do feel Apple is also in its right to remove all trademarked content from the phone running an iOS-like OS. AppStore, applications, remove all reference to words like "iPhone". So it would be a very bare-bones iOS-like. Because otherwise it could negatively impact their brand. Their brand is built on the premise they build amazing products for customers who want those products. If someone looks at your "modified, uncurated iPhone" and thinks it "feels janky" or "poor UX" or "bad battery life" or ..."" that could result in that person not buying/recommending an iPhone. Apple clearly values its brand highly and I can see why they would want their brand to be distanced from the type of device you would like.

simion314 6y ago

Can you think of what a bad application can do to a user when side loading but is impossible to do when Apple reviews it, If I am a bad actor I can submit an app for review and activate an evil mode after the application is approved. Maybe we can stop pretending that the lock is in place to protect the users, most Android users do not root their devices or install random evil applications and then complain to Google about it, can't we just be sincere and say , "yeah is the way Apple keeps control on things for financial reason" . we could focus on the correct stuff then like how we can protect the small set of very gullible users from bad apps(that can be in the store) or bad webpages or evil messages.

yazaddaruvala 6y ago
Sure totally! With sideloading allowed, an application/appstore that is actually a trojan horse could request permissions once to "download X" where X is innocuous. Later the trojan auto-downloads other applications to your phone to mine bitcoin, run a bot net, etc. Basically selling your hardware, bandwidth and battery life to the highest bidder. With sideloading, alternate APIs could be scraped together into a "new std lib". These APIs would just be some C/asm lib that is a part of any application and accesses hardware without any permission management. At that point every possible bad thing can happen. "Sandbox it!" sure... but that is what Apple is currently doing... its just also auditing source code to ensure no one is maliciously trying to break out of the sandbox. With enough time, people will break the sandbox or people will complain the sandbox is too limiting and not "true sideloading". All this said, is Apple's auditing system a 100% guarantee? No. But at least I know once the bug/issue is found Apple will close the hole. Meanwhile, its in a company like FB or GOOG's best interest to force ever more tracking onto users, and they know people will continue to use their services regardless of the complaints (like what happens today). You might argue, "this is where government should step in". I agree! The problem is that the government isn't doing a good enough job protecting users from digital abuse (arguably might make it worse with weaker encryption). So in the meanwhile, I'm happy that at least Apple currently is trying to protect users.
- simion314 6y ago
  Apple is not reviewing the source code, they probably looking at what system calls you use and maybe they do what anti-virus software do on Windows, check for signatures or something like that. From my limited knowledge you can have your executable very obfuscated and make it impossible for someone to easily understand what is happening. The thing is nobody would force the normal users to side load things, the number of applications for Android that are not in the store is small and I think only Fortnite was one with popularity and the number of people sideloading it was not that big.
nodamage 6y ago
> If I am a bad actor I can submit an app for review and activate an evil mode after the application is approved. While this is of course still possible, the store model allows you to disable the app and remove the store listing to prevent further distribution of the bad app. You would be giving this up ability if you allowed third-party distribution. The fact that review is necessary in the first place also serves as a deterrent, and if a bad actor is caught their developer account can be banned to prevent them from submitting any more apps. > Maybe we can stop pretending that the lock is in place to protect the users Not sure why you think this is a pretense. In 2019, Android devices were responsible for 47.15% of malware infections compared to 0.85% of iPhones (https://onestore.nokia.com/asset/205835 https://onestore.nokia.com/asset/205835). There is a clear security benefit to the locked-down store model.
- simion314 6y ago
  >the store model allows you to disable the app and remove the store listing to prevent further distribution You do not need a store to blacklist a known bad application, you can have the OS do what OSX is doing now(I read on HN about this, I don't run any newer OSX versions) check an app when it starts against a blacklist. I agree that a review will catch low level effort of malware and I am not advocating for no official store if is possible users should use applications from the sore or on Linux from the official repositories but if some application is not in the store/repo (maybe you live in one of those countries that ban apps) you can have the option to side load the application. The statistics for malware on iOS vs Android could be problematic if you don't compare equal user groups, Like a rich kid will buy the games from Steam or Apple store, some poor kid will try to get some free games so IMO we should compare similar population.
  - nodamage 6y ago
    Blacklisting may be an appropriate solution for malware but doesn't help with privacy issues because apps distributed outside the App Store by definition won't be subject to the App Store privacy rules. > The statistics for malware on iOS vs Android could be problematic if you don't compare equal user groups, Like a rich kid will buy the games from Steam or Apple store, some poor kid will try to get some free games so IMO we should compare similar population. Even within the Android platform Google has reported an 8x difference in malware between devices that use side-loading compared to devices that use only the Google Play Store (https://source.android.com/security/reports/Google_Android_Security_2018_Report_Final.pdf https://source.android.com/security/reports/Google_Android_S...). In other words, it is specifically side-loading and third-party app stores that cause the biggest problem. We've already seen this same story play out on Windows. Why would we expect it to be any different here?

leetcrew 6y ago

> I agree, Apple should make it easier to boot non-iOS iPhones. Even provide some tools to write custom OSes for the iPhone hardware. However, Apple should only provide that service to the registered adult owner of the device, in person at an Apple store after delivering the caveats that the device will no longer be supported by Apple (regardless of resale) and any warranty is void. this kinda misses the point. I don't want to write my own OS for the phone or run ubuntu or someone else's jailbroken iOS image. I just want to run normal iOS, get updates, and also have the ability to escalate privileges from time to time. why is there not an amount of money I can pay for this? also, does apple distribute any third party drivers in iOS? if so, they might not be able to make non-iOS iphones possible, even if they wanted to. not as familiar with the apple world but IIRC, this has been a longstanding issue for true alternative OSes on android phones.

yazaddaruvala 6y ago
I think I'm onboard as long as the procedure is cumbersome enough, and the registered adult owner of the device confirms that they understand and agree the warranty and support is void. If you want to keep iOS as well... at that point, I do feel Apple is also in its right to remove all trademarked content from the phone running an iOS-like OS. AppStore, applications, remove all reference to words like "iPhone". So it would be a very bare-bones iOS-like. Because otherwise it could negatively impact their brand. Their brand is built on the premise they build amazing products for customers who want those products. If someone looks at your "modified, uncurated iPhone" and thinks it "feels janky" or "poor UX" or "bad battery life" or ..."" that could result in that person not buying/recommending an iPhone. Apple clearly values its brand highly and I can see why they would want their brand to be distanced from the type of device you would like.