7 ms·

> there are a lot of folks reasonably asking if they can trust Apple to be in the loop of deciding what apps should or should not run on their Macs. My argument

> there are a lot of folks reasonably asking if they can trust Apple to be in the loop of deciding what apps should or should not run on their Macs. My argument is - who better than Apple? ... The user?

nojito 6y ago
Anyone who has programmed or developed anything....knows that the end user can never be trusted.
- hellcow 6y ago
  I have programmed and developed things. I am also a user. I want to run the apps I want to run, thank you very much. No one else should have any say in that. It's my computer.
  - ben_w 6y ago
    Likewise, I am a developer, a user, and I have fond memories of the old days of 2003 when I could download and run whatever I wanted on my Mac without any fear or security concerns. Unfortunately, that world is no longer the one we live in. One of the things I’ve learned about software security is the need to minimise the attack surface of your systems — don’t keep a database running on your web server unless you actually need it, don’t keep ports open unless they’re important, don’t install packages or dependencies you can do without — because everything has the potential for a zero-day exploit. Likewise for my own productive output: the only code guaranteed to be bug free is the absence of code. For any computer not attached to the public internet, I agree that you should be free to run whatever you want. For anything networked? That’s anarchy, and although I would like the freedom of anarchy I experienced in 2003, unfortunately I don’t like the consequences of everyone else having the freedoms of anarchy in 2020. I don’t have any fun, easy, side-effect free, solutions.
    - ZanyProgrammer 6y ago
      So many serious, power user-ish Mac users will just put up with SO much. That’s it.
  - zepto 6y ago
    Don’t buy a Mac.
- alpaca128 6y ago
  That alone isn't a justification to take away the user's rights and responsibilities. Let people make mistakes, they'll learn from it.
  - zepto 6y ago
    If they want to make painful mistakes and learn from them, they can buy a Linux box. If they don’t, they can buy a Mac. Don’t force them to choose an unsafe tool when they don’t want to.
    - alpaca128 6y ago
      Should we also get rid of photoshop because users could lack practice drawing and feel frustrated while trying to improve? After all they could just google a couple nice images and be done with it. We learn from mistakes, not from success.
      - xvector 6y ago
        Mistakes in the modern world can have devastating consequences. It’s not as simple as your computer freezing up and becoming part of a bot net. Your files will be stolen, your accounts hacked, you will lose money. Most users would gladly take protection from that as opposed to “learning” by making mistakes (getting infected).
        deleted 6y ago
        [deleted]
      - zepto 6y ago
        A mistake in securing your personal data and ending up the victim of fraud or blackmail is very different from a mistake learning to draw. But, more importantly - people use photoshop because they want to edit images. Most people do not buy computers because they want to learn how to defeat cyberattacks. You know what some users learn after dealing with insecure systems? They learn to buy a Mac.
black_puppydog 6y ago
I was really torn on whether to up or downvote here... On the one hand, no. Probably, statistically, apple will know better. On the other hand, despite the above, if you want to call apple devices "owned" (vs "leased") then yes, the user must be the ultimate decision maker. They might want to delegate these things to apple (or someone else for that matter) most of the time. But they must have the possibility to simply run what they want. I think we're seeing the "HN crowd" be so frustrated about this because it is a pretty transparently anti freedom thing to do, and HN folks do love themselves some freedom.
- Someone 6y ago
  So, if they started leasing their hardware to users, it would be fine? I can see the argument, but at the same time, if they really did, I’m not sure I would agree. I also am not sure that’s completely theoretical. Apple (almost?) has the money to do so (yearly revenues about $260 billion, cash reserves about $190 billion), and I think ‘the world’ is getting used to not owning stuff more and more. Many users already pay per month for their phones, anyways.
  - black_puppydog 6y ago
    Personally I'd be very much more fine with them honestly stating: you get a compute resource, don't expect to control it, pay a monthly fee. Would I sign up for that? Certainly not. But if that sounds unattractive, then they should just accept that when you sell something and the buyer owns it, you don't control over anymore. I keep pushing this distinction in DRM contexts, too. It's kinda my personal soapbox. :)
    - zepto 6y ago
      The issue I have with this, is that anyone who is technical enough to install an operating system from source, must necessarily have an understanding what hardware they will be able to install it on. I’m curious if you have ever done this. No such person would have any illusion about what Mac hardware they could use. Everyone else, reasonably expects Apple to take care of the OS for them. Indeed that is arguably the selling point and key differentiator of the Mac. Nobody is misled. See elsewhere where I respond to the distinction you are making about ownership: https://news.ycombinator.com/item?id=25093873 https://news.ycombinator.com/item?id=25093873
jariel 6y ago
Users will never have the vast operational knowledge that most organizations do, and are generally very unsophisticated. This is why there is no 'File Access' API in the browser, because it'd be like giving guns to teenagers, even with 'safety training' it would get out of hand. So the issue then becomes one of 'power' as much as 'knowledge' of security, and of course all the peripherial abuse surrounding the 'security rules' that have nothing to do with security. Involving 3rd parties, giving proper security notifications but still letting users have the final say etc. etc. there are definitely middle paths and reasonable choices we coudl make. But there's just too much money on the table for the powers that be to look the other way, they will continue to infringe until they are stopped.
throw0101a 6y ago
> ... The user? As someone who works in IT: not for most users. Certainly not for any of my relatives, as successful/smart as they may be in other fields. Certainly have manual overrides for Alpha Geeks (to use O'Reilly's term), but even if a person is on the right-hand side of the Bell curve generally, that doesn't necessarily mean they can make informed software decisions specifically. I'm fine with automatic seatbelts as long as there's a Terminal.app command I can run to disable them on an as-needed basis.
- sneak 6y ago
  Then the fake tech support call center scammers just add having the user enter that command to their script. This is why 1TR became a thing, I imagine.
zepto 6y ago
How many users would have the ability to do something about this: https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-server-automatic-removal-silent-update-webcam-vulnerability https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-s...
AshWolfy 6y ago
yes, because at least the user is trying to act in their own best interest, even if they fail

nojito 6y ago

Anyone who has programmed or developed anything....knows that the end user can never be trusted.

hellcow 6y ago
I have programmed and developed things. I am also a user. I want to run the apps I want to run, thank you very much. No one else should have any say in that. It's my computer.
- ben_w 6y ago
  Likewise, I am a developer, a user, and I have fond memories of the old days of 2003 when I could download and run whatever I wanted on my Mac without any fear or security concerns. Unfortunately, that world is no longer the one we live in. One of the things I’ve learned about software security is the need to minimise the attack surface of your systems — don’t keep a database running on your web server unless you actually need it, don’t keep ports open unless they’re important, don’t install packages or dependencies you can do without — because everything has the potential for a zero-day exploit. Likewise for my own productive output: the only code guaranteed to be bug free is the absence of code. For any computer not attached to the public internet, I agree that you should be free to run whatever you want. For anything networked? That’s anarchy, and although I would like the freedom of anarchy I experienced in 2003, unfortunately I don’t like the consequences of everyone else having the freedoms of anarchy in 2020. I don’t have any fun, easy, side-effect free, solutions.
  - ZanyProgrammer 6y ago
    So many serious, power user-ish Mac users will just put up with SO much. That’s it.
- zepto 6y ago
  Don’t buy a Mac.
alpaca128 6y ago
That alone isn't a justification to take away the user's rights and responsibilities. Let people make mistakes, they'll learn from it.
- zepto 6y ago
  If they want to make painful mistakes and learn from them, they can buy a Linux box. If they don’t, they can buy a Mac. Don’t force them to choose an unsafe tool when they don’t want to.
  - alpaca128 6y ago
    Should we also get rid of photoshop because users could lack practice drawing and feel frustrated while trying to improve? After all they could just google a couple nice images and be done with it. We learn from mistakes, not from success.
    - xvector 6y ago
      Mistakes in the modern world can have devastating consequences. It’s not as simple as your computer freezing up and becoming part of a bot net. Your files will be stolen, your accounts hacked, you will lose money. Most users would gladly take protection from that as opposed to “learning” by making mistakes (getting infected).
      - deleted 6y ago
        [deleted]
    - zepto 6y ago
      A mistake in securing your personal data and ending up the victim of fraud or blackmail is very different from a mistake learning to draw. But, more importantly - people use photoshop because they want to edit images. Most people do not buy computers because they want to learn how to defeat cyberattacks. You know what some users learn after dealing with insecure systems? They learn to buy a Mac.

black_puppydog 6y ago

I was really torn on whether to up or downvote here... On the one hand, no. Probably, statistically, apple will know better. On the other hand, despite the above, if you want to call apple devices "owned" (vs "leased") then yes, the user must be the ultimate decision maker. They might want to delegate these things to apple (or someone else for that matter) most of the time. But they must have the possibility to simply run what they want. I think we're seeing the "HN crowd" be so frustrated about this because it is a pretty transparently anti freedom thing to do, and HN folks do love themselves some freedom.

Someone 6y ago
So, if they started leasing their hardware to users, it would be fine? I can see the argument, but at the same time, if they really did, I’m not sure I would agree. I also am not sure that’s completely theoretical. Apple (almost?) has the money to do so (yearly revenues about $260 billion, cash reserves about $190 billion), and I think ‘the world’ is getting used to not owning stuff more and more. Many users already pay per month for their phones, anyways.
- black_puppydog 6y ago
  Personally I'd be very much more fine with them honestly stating: you get a compute resource, don't expect to control it, pay a monthly fee. Would I sign up for that? Certainly not. But if that sounds unattractive, then they should just accept that when you sell something and the buyer owns it, you don't control over anymore. I keep pushing this distinction in DRM contexts, too. It's kinda my personal soapbox. :)
  - zepto 6y ago
    The issue I have with this, is that anyone who is technical enough to install an operating system from source, must necessarily have an understanding what hardware they will be able to install it on. I’m curious if you have ever done this. No such person would have any illusion about what Mac hardware they could use. Everyone else, reasonably expects Apple to take care of the OS for them. Indeed that is arguably the selling point and key differentiator of the Mac. Nobody is misled. See elsewhere where I respond to the distinction you are making about ownership: https://news.ycombinator.com/item?id=25093873 https://news.ycombinator.com/item?id=25093873

jariel 6y ago

Users will never have the vast operational knowledge that most organizations do, and are generally very unsophisticated. This is why there is no 'File Access' API in the browser, because it'd be like giving guns to teenagers, even with 'safety training' it would get out of hand. So the issue then becomes one of 'power' as much as 'knowledge' of security, and of course all the peripherial abuse surrounding the 'security rules' that have nothing to do with security. Involving 3rd parties, giving proper security notifications but still letting users have the final say etc. etc. there are definitely middle paths and reasonable choices we coudl make. But there's just too much money on the table for the powers that be to look the other way, they will continue to infringe until they are stopped.

throw0101a 6y ago

> ... The user? As someone who works in IT: not for most users. Certainly not for any of my relatives, as successful/smart as they may be in other fields. Certainly have manual overrides for Alpha Geeks (to use O'Reilly's term), but even if a person is on the right-hand side of the Bell curve generally, that doesn't necessarily mean they can make informed software decisions specifically. I'm fine with automatic seatbelts as long as there's a Terminal.app command I can run to disable them on an as-needed basis.

sneak 6y ago
Then the fake tech support call center scammers just add having the user enter that command to their script. This is why 1TR became a thing, I imagine.

zepto 6y ago

How many users would have the ability to do something about this: https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-server-automatic-removal-silent-update-webcam-vulnerability https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-s...

AshWolfy 6y ago

yes, because at least the user is trying to act in their own best interest, even if they fail