5 ms·

Blacklisting may be an appropriate solution for malware but doesn't help with privacy issues because apps distributed outside the App Store by definition won't

Blacklisting may be an appropriate solution for malware but doesn't help with privacy issues because apps distributed outside the App Store by definition won't be subject to the App Store privacy rules. > The statistics for malware on iOS vs Android could be problematic if you don't compare equal user groups, Like a rich kid will buy the games from Steam or Apple store, some poor kid will try to get some free games so IMO we should compare similar population. Even within the Android platform Google has reported an 8x difference in malware between devices that use side-loading compared to devices that use only the Google Play Store (https://source.android.com/security/reports/Google_Android_Security_2018_Report_Final.pdf https://source.android.com/security/reports/Google_Android_S...). In other words, it is specifically side-loading and third-party app stores that cause the biggest problem. We've already seen this same story play out on Windows. Why would we expect it to be any different here?

simion314 6y ago
> because apps distributed outside the App Store by definition won't be subject to the App Store privacy rules. Can you explain? Side loading apps won't disable the sandbox so the app won't have access to your files, sensors or peripherals without permissions. The OS could be even more privacy focused by allowing power users to enable an option to fake private data like contacts,photos,location etc for apps that would refuse to run without this permissions. Second thing, what extra privacy a manual review of a guy would add to an app that can't be done better on the device by sandboxing and code? Side loading would be used by power users most of the time or people in countries with censorship. We will not repeat the Windows story , we would repeat the Linux story where we always had trusted apps on trusted repos and only power users would "side load" stuff, on Windows the story wad different, you needed something you used google and run the first thing you find.
- nodamage 6y ago
  Consider, for example, an app that might initially request access to your contacts for a legitimate purpose (like messaging your friends), but secretly scrapes your contacts and sells it to third parties. This is a privacy abuse that is not prevented by sandboxing since the user explicitly granted those permissions. The problem is the user has no control what the developer actually does with the data after the permission is granted. At least with an app review policy you can say this type of behavior is not acceptable and you will be banned if you abuse it. I'm not saying that will perfectly catch all abuses but at least it serves as a powerful deterrent that otherwise would not exist if all apps were directly distributed with no oversight. > Side loading would be used by power users most of the time or people in countries with censorship. Not sure why you think this but it simply doesn't match existing statistics. Side-loading and third-party stores are quite common in certain countries and it leads to large numbers of regular people getting infected by malware. For example, Kaspersky reports that 60% of mobile users in Iran and 38% of mobile users in India have been attacked by mobile malware. (https://securelist.com/mobile-malware-evolution-2019/96280/ https://securelist.com/mobile-malware-evolution-2019/96280/)
  - simion314 6y ago
    Those poor people will never buy an iPhone or expensive phone, you should compare how many Samsung Galaxy or Pixel users in US vs iPhone users in US that have same financial situation get infected, otherwise you could compare iOS users in US with XP users in China it is "lying with statistics". The guy that reviews the Apple Store has no idea if the developer sells the data to a third party, the chances that somehow Apple finds this out in time to help you is minimal, it would help if Apple would let you give this people fake data or more granular data (like I want to give them a first name, 1 picture, and a city location but not much more details). Many existing apps are using FB SDKs, other advertising related library in the apps, loot boxes and other dark patterns and Apple is not blocking this because they have a financial interest.
    - yazaddaruvala 6y ago
      It is my expectation that Apple verifies the identity of developers submitting to the AppStore. It is my expectation that if the initial review doesn't catch the abuse, and my contacts list is scraped and sold that Apple will eventually find out and ban the app from the store. It is also my expectation that Apple will file a suit for damages, and help a legal firm file a class action suit against the developer on behalf of the victims. If you are right and this isn't happening yet, I hope Apple starts doing it.
      - simion314 6y ago
        Yes Apple will terminate a dev account for not respecting the terms but I am not aware of Apple or Google trying to bring to justice developers that sold private data, at least in US there is a big resistance against having a GDPR like law so you could use the courts to punish some developers. Also we know that Apple (like Amazon and others) used contractors to have them listen to private recordings of users without asking consent (like hey user , I do not understand this can I send it to the cloud so strangers can listen and do stuff with it ?) , so for Apple privacy is a tool for making money, it aligns with your interest until a point (but as with Siri example you can see it is not 100% aligned with your interests)
    - 6y ago

simion314 6y ago

> because apps distributed outside the App Store by definition won't be subject to the App Store privacy rules. Can you explain? Side loading apps won't disable the sandbox so the app won't have access to your files, sensors or peripherals without permissions. The OS could be even more privacy focused by allowing power users to enable an option to fake private data like contacts,photos,location etc for apps that would refuse to run without this permissions. Second thing, what extra privacy a manual review of a guy would add to an app that can't be done better on the device by sandboxing and code? Side loading would be used by power users most of the time or people in countries with censorship. We will not repeat the Windows story , we would repeat the Linux story where we always had trusted apps on trusted repos and only power users would "side load" stuff, on Windows the story wad different, you needed something you used google and run the first thing you find.

nodamage 6y ago
Consider, for example, an app that might initially request access to your contacts for a legitimate purpose (like messaging your friends), but secretly scrapes your contacts and sells it to third parties. This is a privacy abuse that is not prevented by sandboxing since the user explicitly granted those permissions. The problem is the user has no control what the developer actually does with the data after the permission is granted. At least with an app review policy you can say this type of behavior is not acceptable and you will be banned if you abuse it. I'm not saying that will perfectly catch all abuses but at least it serves as a powerful deterrent that otherwise would not exist if all apps were directly distributed with no oversight. > Side loading would be used by power users most of the time or people in countries with censorship. Not sure why you think this but it simply doesn't match existing statistics. Side-loading and third-party stores are quite common in certain countries and it leads to large numbers of regular people getting infected by malware. For example, Kaspersky reports that 60% of mobile users in Iran and 38% of mobile users in India have been attacked by mobile malware. (https://securelist.com/mobile-malware-evolution-2019/96280/ https://securelist.com/mobile-malware-evolution-2019/96280/)
- simion314 6y ago
  Those poor people will never buy an iPhone or expensive phone, you should compare how many Samsung Galaxy or Pixel users in US vs iPhone users in US that have same financial situation get infected, otherwise you could compare iOS users in US with XP users in China it is "lying with statistics". The guy that reviews the Apple Store has no idea if the developer sells the data to a third party, the chances that somehow Apple finds this out in time to help you is minimal, it would help if Apple would let you give this people fake data or more granular data (like I want to give them a first name, 1 picture, and a city location but not much more details). Many existing apps are using FB SDKs, other advertising related library in the apps, loot boxes and other dark patterns and Apple is not blocking this because they have a financial interest.
  - yazaddaruvala 6y ago
    It is my expectation that Apple verifies the identity of developers submitting to the AppStore. It is my expectation that if the initial review doesn't catch the abuse, and my contacts list is scraped and sold that Apple will eventually find out and ban the app from the store. It is also my expectation that Apple will file a suit for damages, and help a legal firm file a class action suit against the developer on behalf of the victims. If you are right and this isn't happening yet, I hope Apple starts doing it.
    - simion314 6y ago
      Yes Apple will terminate a dev account for not respecting the terms but I am not aware of Apple or Google trying to bring to justice developers that sold private data, at least in US there is a big resistance against having a GDPR like law so you could use the courts to punish some developers. Also we know that Apple (like Amazon and others) used contractors to have them listen to private recordings of users without asking consent (like hey user , I do not understand this can I send it to the cloud so strangers can listen and do stuff with it ?) , so for Apple privacy is a tool for making money, it aligns with your interest until a point (but as with Siri example you can see it is not 100% aligned with your interests)
  - 6y ago