11 ms·

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app an

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtake. Apps that offer what should have been offered by the OS vendor in the first place. Why should the app developer refuse the money if what their app offers will be incorporated in a next OS update by anyways? Why defend your mini-adapter-app in an ocean of mini-adapter-apps, with yours becoming so large just because of a random seed and path dependency? This can have a big impact for end users. Imagine an authenticator app ending service to all their users in such a scheme and how you will be cut out from all your accounts by this. How many authenticator apps do you have to use in parallel to mitigate this risk of a single point of failure?

iKevinShah 6y ago
> This can have a big impact for end users. Imagine an authenticator app ending service to all their users in such a scheme and how you will be cut out from all your accounts by this. How many authenticator apps do you have to use in parallel to mitigate this risk of a single point of failure? This right here is a big reason, apart from actual restorable backups, why I root my Android device. Sure it is not required nowadays but it does give a sense of control if thats the right word. So many times I had to restore older copies of apps like Chess or even Yoga app. The older apps allowed a functionality (downloadable content for offline view) which was straightup removed in newer versions. Same for Authenticator or any other app which does things locally.
- davchana 6y ago
  I, like many other HNers, simply store the secret passphrase & QR code in a separate keypass database. Recently Google Authenticator app added the ability to move all codes to next phone by displaying multiple sequence of QR codes, but I coded a simple no internet just local storage & javascript app to to utilize otpauth:// protocol to eadily readd the codes on new phone https://spa.bydav.in/otp.html https://spa.bydav.in/otp.html
ce4 6y ago
You can write down the code for all authenticator entries upon scanning the installation code with a barcode reader app for later reuse :) (I suggest to use fdroid versions for both barcode reader and authenticator anyway to mitigate the issue)
HenryBemis 6y ago
> Imagine an authenticator app I will imagine that anyone who creates an authenticator is half-decent enough to NOT take that bribe and serve the greater good. I will also imagine that when people install authenticators, they would NOT trust one from HenryBemis but only from sources that they recognize (Google, Microsoft, Yubikey, etc.) It always amazes me how come all smartphone OS creators switch every connectivity option to ON by default on every new app installation. It would take a use another 3-4 seconds per app installation to prompt the user whether they want this app to access Wifi/Data/Background/Roaming. In the same sense than the OS asks you whether you allow access to Calendar, Contacts, Camera, etc. At least half my apps on my Android do NOT need access to the internet to function. They may 'want', but definitely not need.
- Silhouette 6y ago
  Sadly, the permissions-by-default problem is not unique to Android. I bought a new iPhone a couple of years ago and spent nearly an hour straight away just turning off all the junk I didn't want. That is now the way of the world, if all you want is a phone for communications and running a small number of essential apps because too many organisations now assume everyone will have a smartphone. I suppose I should be grateful that I can turn off a lot of permissions for apps at all these days, unlike the malware built into recent versions of the major desktop operating systems. :-(
- strictfp 6y ago
  You cannot trust established players either. For instance, cheaper Samsung phones ship with a lot of shady software, as I found out helping relatives. And a lot of reputable software companies have sold out to peddling adware. Adobe is one, and there are a lot of others. Abandoned shareware or open source often resurface with adware installers.
  - matkoniecz 6y ago
    https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk... > When inserted into a computer, the CDs installed one of two pieces of software which provided a form of digital rights management (DRM) by modifying the operating system to interfere with CD copying. Neither program could easily be uninstalled, and they created vulnerabilities that were exploited by unrelated malware. One of the programs would install and "phone home" with reports on the user's private listening habits - even if the user refused its end-user license agreement (EULA), while the other was not mentioned in the EULA at all. Both programs contained code from several pieces of copylefted free software in an apparent infringement of copyright, and configured the operating system to hide the software's existence, leading to both programs being classified as rootkits. > on about 22 million CDs https://en.wikipedia.org/wiki/Superfish https://en.wikipedia.org/wiki/Superfish > The installation included a universal self-signed certificate authority; the certificate authority allows a man-in-the-middle attack to introduce ads even on encrypted pages. The certificate authority had the same private key across laptops; this allows third-party eavesdroppers to intercept or modify HTTPS secure communications without triggering browser warnings by either extracting the private key or using a self-signed certificate.
bjarneh 6y ago
> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual barcode scanning). To make matters worse, scanning a barcode when you enter a store/cafe (to register your location), is now begin done everywhere in order to track potential covid19 spreaders. This forces anyone without an iPhone to install at least one of these potentially harmful apps.
- captn3m0 6y ago
  It is 2021 and Android still doesn't have a QR code scanner by default.
  - welly 6y ago
    I don't know if it differs from various vendor releases of android but certainly on my Samsung S20, QR codes can be read without an additional app just by pointing the camera app at one. I seem to recall my Pixel XL did the same.
  - danielsamuels 6y ago
    It's built into the camera app
    - pjc50 6y ago
      There is no "the camera app"; the manufacturer often provides their own. It may well be in recent versions of GCam, but quite often it requires you to bail out to Google Lens for some reason. Android is like Forrest Gump's box of chocolates: you never quite know what you're going to get. And sometimes it's stale.
  - martyvis 6y ago
    Actually they do if they have Google Assistant, which I imagine anyone with Android 7 or later will. If you use the Google Lens feature it will decode barcodes and QR codes. But unfortunately this feature is pretty much self-discovery rather than a publicised function
nobodywasishere 6y ago
This is why I get all of these kinds of apps from F-Droid instead of the Play Store. Here's the QR code scanner I use: https://f-droid.org/en/packages/de.t_dankworth.secscanqr/ https://f-droid.org/en/packages/de.t_dankworth.secscanqr/
- hilbert42 6y ago
  Right, I'm an avid user of F-Droid and a large percentage of my apps come via this route. The trouble is that I have found that QR code scanners are very significantly different in both their feature sets and in their ability to recognize different barcode/QR code scans. That's to say: (a) The time for a given barcode to be accurately detected varies considerably from app to app. (b) And various apps have different detection capabilities with respect to one another (i.e.: the detection performance varies from app to app depending on the contrast across the barcode image, camera focus or lack thereof, etc.). (c) For a given app, the detection capability for different types of barcode scans can vary considerably. For that reason, I have five different QR scanners installed including SecScanQR that you've mentioned and the one with the same namesake as mentioned in this Malwarebytes article. It seems there's a great deal of variability in the detection algorithms between apps. Unfortunately, from my experience I've found that some of the commercial apps have better detection performance than those on F-Droid—but granted that's only from my limited testing. Which app I use sometimes depends on other features, for instance, the fact that it has a better database or export ability, etc. is more important than the fact that it's insensitive in the detection department. I wish someone with more knowledge and experience could give others and me the good oil on this. Reckon it'd save us considerable time experimenting.
- sp1rit 6y ago
  Anything wrong with binary eye? https://f-droid.org/packages/de.markusfisch.android.binaryeye https://f-droid.org/packages/de.markusfisch.android.binaryey... I'm very happy with it
  - stonesweep 6y ago
    Binary Eye can also be found on the Play store - I personally check to see if apps are on both to add a bit of confidence, its not a negative if they're not but a positive +1 if they are co-listed when I'm deciding which widget to use.
pcthrowaway 6y ago
I'm terrified of browser extensions for this very same reason (and yes, I still use them). I wish the browser vendors supported some kind of pinning to source code for open source extensions. Right now I have at least 2 extensions running that I know could access my passwords on any website as I enter them. One of those is Lastpass, which I use for storing/generating those passwords anyway, and the other is AdBlock Plus. Could other extensions access sensitive information? I'm not sure, but I hate not being able to see the source code of apps which need so many permissions.
- mcdevilkiller 6y ago
  Given the reputation of ABP, I'd be worried too.
- mafuy 6y ago
  Re AdblockPlus, I can recommend Ublock Origin instead. The UBO developer (Raymond Hill) repeatedly chose ethical behavior over money.
- leonroy 6y ago
  Alas the Great Suspender just fell prey to malware after its creator sold it off: https://news.ycombinator.com/item?id=25846504 https://news.ycombinator.com/item?id=25846504 I think Apple have the right idea with app review on browser extensions for Safari.
  - teddyh 6y ago
    I hear that a lot of companies are doing unethical things. Maybe the government should only grant corporations to form which are headed by approved people? /s
    - emayljames 6y ago
      Not a bad idea, even if sarcastic.
  - josho 6y ago
krageon 6y ago
Most apps never need to be updated, problem solved. Especially stuff like barcode scanners, authenticator apps and other apps that I'd call phone infrastructure can just be static from the time of install.
- fendy3002 6y ago
  And then the app isn't working anymore due to newer os breaking change Or it suddenly gone from app / play store
  - krageon 6y ago
    If it's gone from the play store that doesn't matter, you have it installed. Breaking OS changes are a problem, it's true. Thankfully they basically never happen on phones (certainly if you have a phone that stopped updates ~4-5 years ago it will still work).
    - fendy3002 6y ago
      It's true if you don't need to change device. In 3 or 4 years (my usual device lifetime) many non updated apps is no longer supported at newer os version.
    - BoorishBears 6y ago
      You're on HN. You should say such blatantly false things like "Thankfully they basically never happen on phones" There has probably never been a phone OS update that didn't break things. And not in a "technically something broke so haha gotcha! way" Broken in a "half the apps out there need to be rebuilt with a new SDK version and/or deprecated or there'll be obvious bugs" way
wodenokoto 6y ago
I think you are absolutely right about how easy it is to fall prey to lots of money for adding a simple payload. In the early days Wordpress sold use of their domain to black hat seo / spammers.
varispeed 6y ago
> Apps that offer what should have been offered by the OS vendor in the first place. Wouldn't that be anti-competitive? Similar situation when Microsoft was including IE on their system that made them a quasi monopolist with subpar product. I'd rather have Google having stricter rules when it comes to malware.
- protoman3000 6y ago
  You’re right. How dare Microsoft abuses their monopoly and ships Windows with a clock in the taskbar! And why stop here? We should open the market for TCP implementations. The status quo is anti-competitive and stifles innovation!
  - bbarn 6y ago
    Funny how Microsoft's including a useful tool for you know, getting on the internet, with their OS was the subject of an anti-trust suit just a few decades ago and now it's ok to force users to purchase all apps from the apple store, which takes 30% from every company wanting to sell an app on iOS.
    - Ensorceled 6y ago
      Anti-trust has many fewer teeth that it used to.
  - pjc50 6y ago
    I'm just about old enough to remember the versions of Windows which didn't ship with TCP and you had to install "Trumpet Winsock" to get on the Internet. This was silly. The key to understanding the browser case is that, as MS wanted it, it would have tied client and server and rich application development together, all of which would have necessitated Windows. IE was a threat because of ActiveX.
    - fogihujy 6y ago
      It wasn't silly. It was third-party software which provided functionality that the OS simply lacked.
II2II 6y ago
> Apps that offer what should have been offered by the OS vendor in the first place. The questions are: how do you decide is necessary and how do you present it to the user? Different people have different needs and making every should have been feature visible ends up making every other feature less visible. That may be fine if you're developing software for a specialist who will take the time to learn a particular application which is relevant to them, but it's a drawback when you're creating software for a general audience since only a handful of enthusiasts will take the time to learn the software.
Chris2048 6y ago
> Imagine an authenticator app ending service imagine android version of Google Authenticator having no way to export data to the iphone version.. oh wait..
oauea 6y ago
> How many authenticator apps do you have to use in parallel to mitigate this risk of a single point of failure? Just one, together with alternative forms of 2 factor auth, such as a Yubikey (U2F token) or printed backup codes.
wsc981 6y ago
One or two years ago a Chinese guy contacted me asking me if I wanted to put an app or multiple apps on the AppStore for his company. In return I would receive 1.000 USD per month or so. I found this really suspicious, so I never accepted the offer. I also didn't want to risk getting banned by Apple for an offence like distributing malware. I wouldn't be surprised if there are app developers that actually do accept these kinds of offers though.
dspillett 6y ago
> Don’t be naive, the majority will accept the money and gladly. I wouldn't accept it to sneak the change in, but I'd probably be
dfxm12 6y ago
Apps that offer what should have been offered by the OS vendor in the first place. Bundling can be seen as bad in terms of competition [0], but it can also be good for the user experience. I wonder if these apps go unimplemented for fear of regulation. It might be silly to think of a barcode scanner (or other small utility) in that way, but, if the app is so silly, then is it really worth the risk (not just from regulation, but from having to deal with bugs)? 0 - https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor....
dspillett 6y ago
> Don’t be naive, the majority will accept the money and gladly. I wouldn't accept it to sneak the change in, but I'd probably be perfectly willing to take their hand off and sell rights to the product. Assuming of course I didn't just delete the message assuming it was some sort of phishing scam or other rather than a genuine offer. I'd feel obligated to make it known that I'd done this, perhaps via a notification in the app prior to hand-over and in its README. Something along the lines of a normal change of ownership message (copyright has been transferred to X, contact them for further information, future official releases will come from their fork, of course existing open source releases remain open source even if they change licencing arrangements for future releases, yadda yadda). Though we all know how often people just click through notifications, so I'm not sure how much difference that would really make - so if I were a robot I might be considered culpable under the second half of the first law... If the buyer would walk away if I didn't agree to a more silent sale then I wouldn't touch it. It is a thin line that I won't cross, but still a line I like to think wouldn't cross. Then again I have the luxury of being relatively comfortable at this point in my life (decent day job at a company which is weathering the current collection of world crises pretty well, the little flat's mortgage near paid), for many others out there the financial incentive would be much harder to ignore. I'm not sure that I like that I wouldn't draw my line in a different place, but I'd be dishonest if I tried to claim that I would.

iKevinShah 6y ago

> This can have a big impact for end users. Imagine an authenticator app ending service to all their users in such a scheme and how you will be cut out from all your accounts by this. How many authenticator apps do you have to use in parallel to mitigate this risk of a single point of failure? This right here is a big reason, apart from actual restorable backups, why I root my Android device. Sure it is not required nowadays but it does give a sense of control if thats the right word. So many times I had to restore older copies of apps like Chess or even Yoga app. The older apps allowed a functionality (downloadable content for offline view) which was straightup removed in newer versions. Same for Authenticator or any other app which does things locally.

davchana 6y ago
I, like many other HNers, simply store the secret passphrase & QR code in a separate keypass database. Recently Google Authenticator app added the ability to move all codes to next phone by displaying multiple sequence of QR codes, but I coded a simple no internet just local storage & javascript app to to utilize otpauth:// protocol to eadily readd the codes on new phone https://spa.bydav.in/otp.html https://spa.bydav.in/otp.html

ce4 6y ago

You can write down the code for all authenticator entries upon scanning the installation code with a barcode reader app for later reuse :) (I suggest to use fdroid versions for both barcode reader and authenticator anyway to mitigate the issue)

HenryBemis 6y ago

> Imagine an authenticator app I will imagine that anyone who creates an authenticator is half-decent enough to NOT take that bribe and serve the greater good. I will also imagine that when people install authenticators, they would NOT trust one from HenryBemis but only from sources that they recognize (Google, Microsoft, Yubikey, etc.) It always amazes me how come all smartphone OS creators switch every connectivity option to ON by default on every new app installation. It would take a use another 3-4 seconds per app installation to prompt the user whether they want this app to access Wifi/Data/Background/Roaming. In the same sense than the OS asks you whether you allow access to Calendar, Contacts, Camera, etc. At least half my apps on my Android do NOT need access to the internet to function. They may 'want', but definitely not need.

Silhouette 6y ago
Sadly, the permissions-by-default problem is not unique to Android. I bought a new iPhone a couple of years ago and spent nearly an hour straight away just turning off all the junk I didn't want. That is now the way of the world, if all you want is a phone for communications and running a small number of essential apps because too many organisations now assume everyone will have a smartphone. I suppose I should be grateful that I can turn off a lot of permissions for apps at all these days, unlike the malware built into recent versions of the major desktop operating systems. :-(
strictfp 6y ago
You cannot trust established players either. For instance, cheaper Samsung phones ship with a lot of shady software, as I found out helping relatives. And a lot of reputable software companies have sold out to peddling adware. Adobe is one, and there are a lot of others. Abandoned shareware or open source often resurface with adware installers.
- matkoniecz 6y ago
  https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk... > When inserted into a computer, the CDs installed one of two pieces of software which provided a form of digital rights management (DRM) by modifying the operating system to interfere with CD copying. Neither program could easily be uninstalled, and they created vulnerabilities that were exploited by unrelated malware. One of the programs would install and "phone home" with reports on the user's private listening habits - even if the user refused its end-user license agreement (EULA), while the other was not mentioned in the EULA at all. Both programs contained code from several pieces of copylefted free software in an apparent infringement of copyright, and configured the operating system to hide the software's existence, leading to both programs being classified as rootkits. > on about 22 million CDs https://en.wikipedia.org/wiki/Superfish https://en.wikipedia.org/wiki/Superfish > The installation included a universal self-signed certificate authority; the certificate authority allows a man-in-the-middle attack to introduce ads even on encrypted pages. The certificate authority had the same private key across laptops; this allows third-party eavesdroppers to intercept or modify HTTPS secure communications without triggering browser warnings by either extracting the private key or using a self-signed certificate.

bjarneh 6y ago

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual barcode scanning). To make matters worse, scanning a barcode when you enter a store/cafe (to register your location), is now begin done everywhere in order to track potential covid19 spreaders. This forces anyone without an iPhone to install at least one of these potentially harmful apps.

captn3m0 6y ago
It is 2021 and Android still doesn't have a QR code scanner by default.
- welly 6y ago
  I don't know if it differs from various vendor releases of android but certainly on my Samsung S20, QR codes can be read without an additional app just by pointing the camera app at one. I seem to recall my Pixel XL did the same.
- danielsamuels 6y ago
  It's built into the camera app
  - pjc50 6y ago
    There is no "the camera app"; the manufacturer often provides their own. It may well be in recent versions of GCam, but quite often it requires you to bail out to Google Lens for some reason. Android is like Forrest Gump's box of chocolates: you never quite know what you're going to get. And sometimes it's stale.
- martyvis 6y ago
  Actually they do if they have Google Assistant, which I imagine anyone with Android 7 or later will. If you use the Google Lens feature it will decode barcodes and QR codes. But unfortunately this feature is pretty much self-discovery rather than a publicised function

nobodywasishere 6y ago

This is why I get all of these kinds of apps from F-Droid instead of the Play Store. Here's the QR code scanner I use: https://f-droid.org/en/packages/de.t_dankworth.secscanqr/ https://f-droid.org/en/packages/de.t_dankworth.secscanqr/

hilbert42 6y ago
Right, I'm an avid user of F-Droid and a large percentage of my apps come via this route. The trouble is that I have found that QR code scanners are very significantly different in both their feature sets and in their ability to recognize different barcode/QR code scans. That's to say: (a) The time for a given barcode to be accurately detected varies considerably from app to app. (b) And various apps have different detection capabilities with respect to one another (i.e.: the detection performance varies from app to app depending on the contrast across the barcode image, camera focus or lack thereof, etc.). (c) For a given app, the detection capability for different types of barcode scans can vary considerably. For that reason, I have five different QR scanners installed including SecScanQR that you've mentioned and the one with the same namesake as mentioned in this Malwarebytes article. It seems there's a great deal of variability in the detection algorithms between apps. Unfortunately, from my experience I've found that some of the commercial apps have better detection performance than those on F-Droid—but granted that's only from my limited testing. Which app I use sometimes depends on other features, for instance, the fact that it has a better database or export ability, etc. is more important than the fact that it's insensitive in the detection department. I wish someone with more knowledge and experience could give others and me the good oil on this. Reckon it'd save us considerable time experimenting.
sp1rit 6y ago
Anything wrong with binary eye? https://f-droid.org/packages/de.markusfisch.android.binaryeye https://f-droid.org/packages/de.markusfisch.android.binaryey... I'm very happy with it
- stonesweep 6y ago
  Binary Eye can also be found on the Play store - I personally check to see if apps are on both to add a bit of confidence, its not a negative if they're not but a positive +1 if they are co-listed when I'm deciding which widget to use.

pcthrowaway 6y ago

I'm terrified of browser extensions for this very same reason (and yes, I still use them). I wish the browser vendors supported some kind of pinning to source code for open source extensions. Right now I have at least 2 extensions running that I know could access my passwords on any website as I enter them. One of those is Lastpass, which I use for storing/generating those passwords anyway, and the other is AdBlock Plus. Could other extensions access sensitive information? I'm not sure, but I hate not being able to see the source code of apps which need so many permissions.

mcdevilkiller 6y ago
Given the reputation of ABP, I'd be worried too.
mafuy 6y ago
Re AdblockPlus, I can recommend Ublock Origin instead. The UBO developer (Raymond Hill) repeatedly chose ethical behavior over money.
leonroy 6y ago
Alas the Great Suspender just fell prey to malware after its creator sold it off: https://news.ycombinator.com/item?id=25846504 https://news.ycombinator.com/item?id=25846504 I think Apple have the right idea with app review on browser extensions for Safari.
- teddyh 6y ago
  I hear that a lot of companies are doing unethical things. Maybe the government should only grant corporations to form which are headed by approved people? /s
  - emayljames 6y ago
    Not a bad idea, even if sarcastic.
- josho 6y ago

krageon 6y ago

Most apps never need to be updated, problem solved. Especially stuff like barcode scanners, authenticator apps and other apps that I'd call phone infrastructure can just be static from the time of install.

fendy3002 6y ago
And then the app isn't working anymore due to newer os breaking change Or it suddenly gone from app / play store
- krageon 6y ago
  If it's gone from the play store that doesn't matter, you have it installed. Breaking OS changes are a problem, it's true. Thankfully they basically never happen on phones (certainly if you have a phone that stopped updates ~4-5 years ago it will still work).
  - fendy3002 6y ago
    It's true if you don't need to change device. In 3 or 4 years (my usual device lifetime) many non updated apps is no longer supported at newer os version.
  - BoorishBears 6y ago
    You're on HN. You should say such blatantly false things like "Thankfully they basically never happen on phones" There has probably never been a phone OS update that didn't break things. And not in a "technically something broke so haha gotcha! way" Broken in a "half the apps out there need to be rebuilt with a new SDK version and/or deprecated or there'll be obvious bugs" way

wodenokoto 6y ago

I think you are absolutely right about how easy it is to fall prey to lots of money for adding a simple payload. In the early days Wordpress sold use of their domain to black hat seo / spammers.

varispeed 6y ago

> Apps that offer what should have been offered by the OS vendor in the first place. Wouldn't that be anti-competitive? Similar situation when Microsoft was including IE on their system that made them a quasi monopolist with subpar product. I'd rather have Google having stricter rules when it comes to malware.

protoman3000 6y ago
You’re right. How dare Microsoft abuses their monopoly and ships Windows with a clock in the taskbar! And why stop here? We should open the market for TCP implementations. The status quo is anti-competitive and stifles innovation!
- bbarn 6y ago
  Funny how Microsoft's including a useful tool for you know, getting on the internet, with their OS was the subject of an anti-trust suit just a few decades ago and now it's ok to force users to purchase all apps from the apple store, which takes 30% from every company wanting to sell an app on iOS.
  - Ensorceled 6y ago
    Anti-trust has many fewer teeth that it used to.
- pjc50 6y ago
  I'm just about old enough to remember the versions of Windows which didn't ship with TCP and you had to install "Trumpet Winsock" to get on the Internet. This was silly. The key to understanding the browser case is that, as MS wanted it, it would have tied client and server and rich application development together, all of which would have necessitated Windows. IE was a threat because of ActiveX.
  - fogihujy 6y ago
    It wasn't silly. It was third-party software which provided functionality that the OS simply lacked.

II2II 6y ago

> Apps that offer what should have been offered by the OS vendor in the first place. The questions are: how do you decide is necessary and how do you present it to the user? Different people have different needs and making every should have been feature visible ends up making every other feature less visible. That may be fine if you're developing software for a specialist who will take the time to learn a particular application which is relevant to them, but it's a drawback when you're creating software for a general audience since only a handful of enthusiasts will take the time to learn the software.

Chris2048 6y ago

> Imagine an authenticator app ending service imagine android version of Google Authenticator having no way to export data to the iphone version.. oh wait..

oauea 6y ago

> How many authenticator apps do you have to use in parallel to mitigate this risk of a single point of failure? Just one, together with alternative forms of 2 factor auth, such as a Yubikey (U2F token) or printed backup codes.

wsc981 6y ago

One or two years ago a Chinese guy contacted me asking me if I wanted to put an app or multiple apps on the AppStore for his company. In return I would receive 1.000 USD per month or so. I found this really suspicious, so I never accepted the offer. I also didn't want to risk getting banned by Apple for an offence like distributing malware. I wouldn't be surprised if there are app developers that actually do accept these kinds of offers though.

dspillett 6y ago

> Don’t be naive, the majority will accept the money and gladly. I wouldn't accept it to sneak the change in, but I'd probably be

dfxm12 6y ago

Apps that offer what should have been offered by the OS vendor in the first place. Bundling can be seen as bad in terms of competition [0], but it can also be good for the user experience. I wonder if these apps go unimplemented for fear of regulation. It might be silly to think of a barcode scanner (or other small utility) in that way, but, if the app is so silly, then is it really worth the risk (not just from regulation, but from having to deal with bugs)? 0 - https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor....

dspillett 6y ago

> Don’t be naive, the majority will accept the money and gladly. I wouldn't accept it to sneak the change in, but I'd probably be perfectly willing to take their hand off and sell rights to the product. Assuming of course I didn't just delete the message assuming it was some sort of phishing scam or other rather than a genuine offer. I'd feel obligated to make it known that I'd done this, perhaps via a notification in the app prior to hand-over and in its README. Something along the lines of a normal change of ownership message (copyright has been transferred to X, contact them for further information, future official releases will come from their fork, of course existing open source releases remain open source even if they change licencing arrangements for future releases, yadda yadda). Though we all know how often people just click through notifications, so I'm not sure how much difference that would really make - so if I were a robot I might be considered culpable under the second half of the first law... If the buyer would walk away if I didn't agree to a more silent sale then I wouldn't touch it. It is a thin line that I won't cross, but still a line I like to think wouldn't cross. Then again I have the luxury of being relatively comfortable at this point in my life (decent day job at a company which is weathering the current collection of world crises pretty well, the little flat's mortgage near paid), for many others out there the financial incentive would be much harder to ignore. I'm not sure that I like that I wouldn't draw my line in a different place, but I'd be dishonest if I tried to claim that I would.