4 ms·

“Transmission”, a popular Mac bit torrent client did it the simple way. They ended up distributing a disk destroying malware to their users. If you only distri

by jws 6y ago

“Transmission”, a popular Mac bit torrent client did it the simple way. They ended up distributing a disk destroying malware to their users. If you only distribute your Mac software outside the store, and aren’t inherently ineligible for the store (like a full disk space measuring program) I just assume you are up to no good or don’t care enough about my security and pass on your product. If you aren’t willing to fork over $100/year to at least minimally tie an identity to your actions and go through all the signing nuisance then you don’t get control of my computer. Now that we are living in a notarized application world I may have to rethink this and loosen up, so the nuisance you go through notarizing your app is in some sense the entry fee to sell to some security conscious customers.

deleted 6y ago
[deleted]
kranner 6y ago
The $100 fee is not the issue. You also give up 15% or 30% of revenue to Apple; have to go through app review on every update facing arbitrary rejection; have no direct relationship with your users; can't offer upgrade pricing on significant new releases (existing users either get the new release for free or you make it a new SKU thus forcing everyone to pay full price, including existing users).
- ogre_codes 6y ago
  Well Gumroad, the storefront he's using charges 5% or 3.5% + $10/ month so unless you are earning more than $1m/ year you are only saving 10-11.5%. Plus you have to host your own code which is another (very small) fee. You also lose access to some of Apple's cloud service like Sign in With Apple which some customers prefer (self included). There are also some additional sales just due to being in the App Store. Which is to say, the getting rid of that 15% fee isn't a slam dunk. Even before the Apple Tax cut, many developers chose to use the App Store even when the fee was 30% for good reason. I suspect if you are earning $900k in the App Store and launching a new product the math gets quite weird.
  - foepys 6y ago
    > unless you are earning more than $1m/ year you are only saving 10-11.5% 10% is a lot.
    - ogre_codes 6y ago
      If you sell 50 copies independently for $100 you save $10 or $500. If listing it in the App Store means you would sell 150 copies instead, how much is that savings worth? I didn't suggest it was cheap, I said many people find it's worth spending the money.
- webmobdev 6y ago
  For me, $100 annual fees is also an issue. It's just an unnecessary and useless burden for not just open source softwares, but commercial wares too. Moreover, why should Apple get a monopoly on this - non-profits like EFF or the FSF should be allowed to do something similar, or even other corporates. Isn't that what we do currently with browsers and certificates?
- p0nce 6y ago
  For $100 you get a precious _codesigning_ certificate, the equivalent cost more money on Windows because it's not organized by Microsoft but left to 3rd-party vendors that abuse their position. Codesigning is essential for security.
  - kranner 6y ago
    I actually argued that $100 is not a big hurdle, but now I feel I should ask why it can't be $10? SSL certificates used to cost a lot until LetsEncrypt made them free.
    - p0nce 6y ago
      IIRC LetsEncrypt provide website certificates but not codesigning certificates. The entities giving codesigning cert need to verify you exist by checking an company index and phonecalling you. Apple makes it way easier on their platform.
webmobdev 6y ago
> "Transmission", a popular Mac bit torrent client did it the simple way. They ended up distributing a disk destroying malware to their users. APPLE APP STORE, a popular app store also distributed a malware / spyware bundled within a messenger app - https://www.bbc.com/news/technology-50890846 https://www.bbc.com/news/technology-50890846 > If you aren’t willing to fork over $100/year to at least minimally tie an identity to your actions and go through all the signing nuisance then you don’t get control of my computer. You don't need to pay $100 to a corporate to verify your identity and gain the trust of your users. Open source users have been doing it without paying a single penny to any corporates so far.
jws 6y ago
Just a little more info and a meta-HN fact: I don't ordinarily use bit torrent, but I was downloading a couple OS images and the provider requested I use bit torrent so I went and got Transmission during the period while the malware was up, but before Transmission discovered it. I got lucky and saw a news article, perhaps on HN, about the infection the next day or two, verified I had it, removed it, and ran a set of offline backups. Had I not caught it, after a several day waiting period the malware would have encrypted my drives for ransomware. So I got ridiculously unlucky to get the infection, and then ridiculously lucky to see an article suggesting I might have it before it went off. About HN, the parent comment is getting a disappointing amount of up and down voting relative to its total score.
hda2 6y ago
> If you aren’t willing to fork over $100/year to at least minimally tie an identity to your actions and go through all the signing nuisance then you don’t get control of my computer. I think what people who think like you are missing is that developers also don't want to control your computer if they have to go though all this hassle. It's a two way street.

by jws 6y ago

deleted 6y ago

[deleted]

kranner 6y ago

The $100 fee is not the issue. You also give up 15% or 30% of revenue to Apple; have to go through app review on every update facing arbitrary rejection; have no direct relationship with your users; can't offer upgrade pricing on significant new releases (existing users either get the new release for free or you make it a new SKU thus forcing everyone to pay full price, including existing users).

ogre_codes 6y ago
Well Gumroad, the storefront he's using charges 5% or 3.5% + $10/ month so unless you are earning more than $1m/ year you are only saving 10-11.5%. Plus you have to host your own code which is another (very small) fee. You also lose access to some of Apple's cloud service like Sign in With Apple which some customers prefer (self included). There are also some additional sales just due to being in the App Store. Which is to say, the getting rid of that 15% fee isn't a slam dunk. Even before the Apple Tax cut, many developers chose to use the App Store even when the fee was 30% for good reason. I suspect if you are earning $900k in the App Store and launching a new product the math gets quite weird.
- foepys 6y ago
  > unless you are earning more than $1m/ year you are only saving 10-11.5% 10% is a lot.
  - ogre_codes 6y ago
    If you sell 50 copies independently for $100 you save $10 or $500. If listing it in the App Store means you would sell 150 copies instead, how much is that savings worth? I didn't suggest it was cheap, I said many people find it's worth spending the money.
webmobdev 6y ago
For me, $100 annual fees is also an issue. It's just an unnecessary and useless burden for not just open source softwares, but commercial wares too. Moreover, why should Apple get a monopoly on this - non-profits like EFF or the FSF should be allowed to do something similar, or even other corporates. Isn't that what we do currently with browsers and certificates?
p0nce 6y ago
For $100 you get a precious _codesigning_ certificate, the equivalent cost more money on Windows because it's not organized by Microsoft but left to 3rd-party vendors that abuse their position. Codesigning is essential for security.
- kranner 6y ago
  I actually argued that $100 is not a big hurdle, but now I feel I should ask why it can't be $10? SSL certificates used to cost a lot until LetsEncrypt made them free.
  - p0nce 6y ago
    IIRC LetsEncrypt provide website certificates but not codesigning certificates. The entities giving codesigning cert need to verify you exist by checking an company index and phonecalling you. Apple makes it way easier on their platform.

webmobdev 6y ago

> "Transmission", a popular Mac bit torrent client did it the simple way. They ended up distributing a disk destroying malware to their users. APPLE APP STORE, a popular app store also distributed a malware / spyware bundled within a messenger app - https://www.bbc.com/news/technology-50890846 https://www.bbc.com/news/technology-50890846 > If you aren’t willing to fork over $100/year to at least minimally tie an identity to your actions and go through all the signing nuisance then you don’t get control of my computer. You don't need to pay $100 to a corporate to verify your identity and gain the trust of your users. Open source users have been doing it without paying a single penny to any corporates so far.

jws 6y ago

Just a little more info and a meta-HN fact: I don't ordinarily use bit torrent, but I was downloading a couple OS images and the provider requested I use bit torrent so I went and got Transmission during the period while the malware was up, but before Transmission discovered it. I got lucky and saw a news article, perhaps on HN, about the infection the next day or two, verified I had it, removed it, and ran a set of offline backups. Had I not caught it, after a several day waiting period the malware would have encrypted my drives for ransomware. So I got ridiculously unlucky to get the infection, and then ridiculously lucky to see an article suggesting I might have it before it went off. About HN, the parent comment is getting a disappointing amount of up and down voting relative to its total score.

hda2 6y ago

> If you aren’t willing to fork over $100/year to at least minimally tie an identity to your actions and go through all the signing nuisance then you don’t get control of my computer. I think what people who think like you are missing is that developers also don't want to control your computer if they have to go though all this hassle. It's a two way street.