3 ms·

> Which is exactly why Apple should open up iOS to other app stores, and in order to keep iOS users secure they should focus on more things like App Tracking an

> Which is exactly why Apple should open up iOS to other app stores, and in order to keep iOS users secure they should focus on more things like App Tracking and Transparency, not on monopolizing app stores. This is self-contradictory. If Apple allows third-parties to distribute apps outside the App Store, they lose the ability to enforce their App Tracking and Transparency rules.

fastball 5y ago
With all due respect, have you ever developed an application for iOS? Because it doesn't sound like it, as this is not how it works. Apps are sandboxed. In order to access certain features, they need to request permission from the operating system. e.g. there is a GPS chip in your iPhone. Apps, through the design of the OS (not the App Store), are unable to access the raw data coming from this unit themselves. Instead, they tell the OS "hey, I want access to location data", at which point the OS throws up a notification to the user asking if they want to allow the app access to that data. The user says yes, and the OS starts to provide the app with location data. At any point, the user can tell the OS "hey, stop giving this app access" and the OS will oblige. The App Store does not enforce this functionality at all, it is enforced at the OS level. Allowing 3rd party app stores would not change this. If Apple's App Store vetting process disappeared tomorrow, Spotify would not be able to get location data without the user's permission. As a side note, I keep saying "at the OS level", but this is a simplification on my part. In more than a few places, Apple has gone further and done things like have the Secure Enclave which has complex interactions with the OS / kernel to make certain actions difficult even if you break out of the OS-level sandbox.
- nodamage 5y ago
  I have done mobile development (both iOS and Android) for a long time and am well aware how sandboxing works. You've misunderstood the issue if you think sandboxing sufficiently solves this problem. Let me flip the question, are you aware what types of data apps collect in order to fingerprint a device? These are the same low level APIs that apps need for legitimate purposes, you can't simply disable them or put a permissions prompt in front of each one.
  - fastball 5y ago
    Yes, I am very aware of what types of data apps collect in order to fingerprint a device. That is exactly why I firmly believe this problem should be solved at the OS level, not at the App Store level. Because I trust a technological solutions much more than I trust App Store reviewers at Apple. This is why I prefer an E2EE chat service to a service that is not but says "we promise we won't read your messages".
    - nodamage 5y ago
      Do you really expect the OS to block apps from accessing screen size, locale, fonts, time zone, GPU metrics, accessibility settings, etc. when they actually need these APIs for legitimate purposes? Location and microphone permissions are red herrings when it comes to fingerprinting. You're also neglecting the fact that malicious apps can mislead the user by prompting for permissions for a seemingly legitimate purpose and then abuse those permissions once granted.

fastball 5y ago

With all due respect, have you ever developed an application for iOS? Because it doesn't sound like it, as this is not how it works. Apps are sandboxed. In order to access certain features, they need to request permission from the operating system. e.g. there is a GPS chip in your iPhone. Apps, through the design of the OS (not the App Store), are unable to access the raw data coming from this unit themselves. Instead, they tell the OS "hey, I want access to location data", at which point the OS throws up a notification to the user asking if they want to allow the app access to that data. The user says yes, and the OS starts to provide the app with location data. At any point, the user can tell the OS "hey, stop giving this app access" and the OS will oblige. The App Store does not enforce this functionality at all, it is enforced at the OS level. Allowing 3rd party app stores would not change this. If Apple's App Store vetting process disappeared tomorrow, Spotify would not be able to get location data without the user's permission. As a side note, I keep saying "at the OS level", but this is a simplification on my part. In more than a few places, Apple has gone further and done things like have the Secure Enclave which has complex interactions with the OS / kernel to make certain actions difficult even if you break out of the OS-level sandbox.

nodamage 5y ago
I have done mobile development (both iOS and Android) for a long time and am well aware how sandboxing works. You've misunderstood the issue if you think sandboxing sufficiently solves this problem. Let me flip the question, are you aware what types of data apps collect in order to fingerprint a device? These are the same low level APIs that apps need for legitimate purposes, you can't simply disable them or put a permissions prompt in front of each one.
- fastball 5y ago
  Yes, I am very aware of what types of data apps collect in order to fingerprint a device. That is exactly why I firmly believe this problem should be solved at the OS level, not at the App Store level. Because I trust a technological solutions much more than I trust App Store reviewers at Apple. This is why I prefer an E2EE chat service to a service that is not but says "we promise we won't read your messages".
  - nodamage 5y ago
    Do you really expect the OS to block apps from accessing screen size, locale, fonts, time zone, GPU metrics, accessibility settings, etc. when they actually need these APIs for legitimate purposes? Location and microphone permissions are red herrings when it comes to fingerprinting. You're also neglecting the fact that malicious apps can mislead the user by prompting for permissions for a seemingly legitimate purpose and then abuse those permissions once granted.