8 ms·

How would the security model work with side loaded apps. How would they get access to OS resources, services and share data with other apps, e.g through the cli

by simonh 6y ago

How would the security model work with side loaded apps. How would they get access to OS resources, services and share data with other apps, e.g through the clipboard? Who would verify them against malware, or ensure they didn’t violate security constraints? It’s not like Apple could disavow all responsibility for any data leaked from the system, a lot of users simply wouldn’t see it that way. There’s a lot wrong with the current state of apps in the App Store, but right now at least I know who’s job it is to get it fixed.

egocentric 6y ago
“Sideloading Apps Would ‘Break’ the Security and Privacy of iPhone”, said Tim Cook. But instead of gaslighting us, Apple could let us sideload notarized apps. This means: - Automated scan for malware - Remote kill switch, just in case They already do this for macOS [1]: > “Notarization is not App Review. The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly.” They could give users a choice, much like they're doing with the new App Tracking Transparency prompt. But when pressed on why Apple should have control, Cook said "Somebody has to." That's… not a very convincing argument. [1]: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution https://developer.apple.com/documentation/xcode/notarizing_m...
- Apocryphon 6y ago
  Yeah, the whole "there is no alternative to the App Store" argument completely falls apart in the face of the existence of the Mac, and how the Mac isn't constrained by the Mac App Store.
  - zepto 6y ago
    Obviously not, because the Mac has only ever had minor sales relative to the PC even, and minuscule compared to iOS. It’s never been a serious target.
    - Apocryphon 6y ago
      Your Apple bashing is really quite tiresome. Macs are serious machines and have grown in leaps and bounds over the past two decades. Are you seriously saying the de facto development platform for Silicon Valley startups, as well as the home for Apple Silicon, is no longer a “serious target”? No need to shill for Windows here.
      - zepto 6y ago
        It’s not a serious target for App Store scams, or scam software in general, because the user base is tiny compared to iOS. I think you know this.
        Apocryphon 6y ago
        Actually, the Mac App Store has received its share of scams. https://www.howtogeek.com/281849/dont-be-fooled-the-mac-app-store-is-full-of-scams/ https://www.howtogeek.com/281849/dont-be-fooled-the-mac-app-... https://www.laptopmag.com/articles/mac-app-store-scam-apps https://www.laptopmag.com/articles/mac-app-store-scam-apps
        zepto 6y ago
        And ransomware and botnets too: https://www.avg.com/en/signal/mac-ransomware-remove-protect https://www.avg.com/en/signal/mac-ransomware-remove-protect Fortunately iOS users don’t have those problems because of the security model that you are so quick to dismiss.
        Apocryphon 6y ago
        https://us.norton.com/internetsecurity-emerging-threats-ios-malware-xcodeghost-infects-millions-of-apple-store-customers.html https://us.norton.com/internetsecurity-emerging-threats-ios-... https://www.wired.com/story/apple-app-store-malware-click-fraud/ https://www.wired.com/story/apple-app-store-malware-click-fr...
bogwog 6y ago
> How would they get access to OS resources, services and share data with other apps, e.g through the clipboard? Through the same system APIs that exist right now. Why would that change? > Who would verify them against malware The distributor of the app, most likely. If you downloaded a game though Steam for iOS or whatever, and it had malware, that's Valve's fault. If you went to virus.com and downloaded a virus, that's your problem. > or ensure they didn’t violate security constraints? You mean ensure they don't violate one of the operating system's security protections? That's called finding an exploit, and it's the developer of the operating system's responsibility. Exploits for iOS exist today, and they'll continue to exist in the future. > It’s not like Apple could disavow all responsibility for any data leaked from the system, a lot of users simply wouldn’t see it that way Of course not. A "leak" due to an exploit/vulnerability in iOS that Apple failed to patch would be their fault. A third party app leaking personal info online would be the third party developer's fault. People didn't get pissed at Apple when Facebook leaked all that data a ~week ago. > There’s a lot wrong with the current state of apps in the App Store, but right now at least I know who’s job it is to get it fixed. It's their job to get it fixed. It's been their job for over 13 years, and they've failed at it again and again. It's about time they're fired.
abstract_put 6y ago
Would this be significantly different than desktop apps? It seems like we have decades of experience solving (and failing) to solve this in the desktop world.

by simonh 6y ago

egocentric 6y ago

“Sideloading Apps Would ‘Break’ the Security and Privacy of iPhone”, said Tim Cook. But instead of gaslighting us, Apple could let us sideload notarized apps. This means: - Automated scan for malware - Remote kill switch, just in case They already do this for macOS [1]: > “Notarization is not App Review. The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly.” They could give users a choice, much like they're doing with the new App Tracking Transparency prompt. But when pressed on why Apple should have control, Cook said "Somebody has to." That's… not a very convincing argument. [1]: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution https://developer.apple.com/documentation/xcode/notarizing_m...

Apocryphon 6y ago
Yeah, the whole "there is no alternative to the App Store" argument completely falls apart in the face of the existence of the Mac, and how the Mac isn't constrained by the Mac App Store.
- zepto 6y ago
  Obviously not, because the Mac has only ever had minor sales relative to the PC even, and minuscule compared to iOS. It’s never been a serious target.
  - Apocryphon 6y ago
    Your Apple bashing is really quite tiresome. Macs are serious machines and have grown in leaps and bounds over the past two decades. Are you seriously saying the de facto development platform for Silicon Valley startups, as well as the home for Apple Silicon, is no longer a “serious target”? No need to shill for Windows here.
    - zepto 6y ago
      It’s not a serious target for App Store scams, or scam software in general, because the user base is tiny compared to iOS. I think you know this.
      - Apocryphon 6y ago
        Actually, the Mac App Store has received its share of scams. https://www.howtogeek.com/281849/dont-be-fooled-the-mac-app-store-is-full-of-scams/ https://www.howtogeek.com/281849/dont-be-fooled-the-mac-app-... https://www.laptopmag.com/articles/mac-app-store-scam-apps https://www.laptopmag.com/articles/mac-app-store-scam-apps
        zepto 6y ago
        And ransomware and botnets too: https://www.avg.com/en/signal/mac-ransomware-remove-protect https://www.avg.com/en/signal/mac-ransomware-remove-protect Fortunately iOS users don’t have those problems because of the security model that you are so quick to dismiss.
        Apocryphon 6y ago
        https://us.norton.com/internetsecurity-emerging-threats-ios-malware-xcodeghost-infects-millions-of-apple-store-customers.html https://us.norton.com/internetsecurity-emerging-threats-ios-... https://www.wired.com/story/apple-app-store-malware-click-fraud/ https://www.wired.com/story/apple-app-store-malware-click-fr...

bogwog 6y ago

> How would they get access to OS resources, services and share data with other apps, e.g through the clipboard? Through the same system APIs that exist right now. Why would that change? > Who would verify them against malware The distributor of the app, most likely. If you downloaded a game though Steam for iOS or whatever, and it had malware, that's Valve's fault. If you went to virus.com and downloaded a virus, that's your problem. > or ensure they didn’t violate security constraints? You mean ensure they don't violate one of the operating system's security protections? That's called finding an exploit, and it's the developer of the operating system's responsibility. Exploits for iOS exist today, and they'll continue to exist in the future. > It’s not like Apple could disavow all responsibility for any data leaked from the system, a lot of users simply wouldn’t see it that way Of course not. A "leak" due to an exploit/vulnerability in iOS that Apple failed to patch would be their fault. A third party app leaking personal info online would be the third party developer's fault. People didn't get pissed at Apple when Facebook leaked all that data a ~week ago. > There’s a lot wrong with the current state of apps in the App Store, but right now at least I know who’s job it is to get it fixed. It's their job to get it fixed. It's been their job for over 13 years, and they've failed at it again and again. It's about time they're fired.

abstract_put 6y ago

Would this be significantly different than desktop apps? It seems like we have decades of experience solving (and failing) to solve this in the desktop world.