10 ms·

And a quick reminder to everybody else that walled gardens don't actually help the consumer. They only arbitrarily restrict choice, they don't actually improve

And a quick reminder to everybody else that walled gardens don't actually help the consumer. They only arbitrarily restrict choice, they don't actually improve security (if any, that's provided by the sandboxing, not by the store "review"). If this company (ENEL) wasn't a huge state-wide electric company (inheriting their power and ties from the previous state-owned monopoly) how many chances do you think they had to fight? As a small fish you're just dumped.

oblio 5y ago
Walled gardens are just security theater. The App Store revenue was $72bn in 2020, yet the review time for an app is a few hours. App reviewers barely have any qualifications, they're just "call center operators" running off a script.
- user-the-name 5y ago
  It is a lot more than "theatre". The first line of defence is the sandboxing built into the OS. The second line is a lot of automated analysis of the binaries that are uploaded. The human review is the third line, but that is much less about security.
  - dalbasal 5y ago
    ..and the last line of defense is removing a bad app to prevent further harm. Drivers licenses aren't only about competence. Sure, there's a test. But, there's also the ability to revoke a license.
    - Siira 5y ago
      So please explain why the licenses need to cost a fortune? Simple Bayesian thinking will tell you what the real motive is, and what is being used as the coverup motive.
      - dalbasal 5y ago
        There is no "real" motive, only history. One thing led to another. Now we are here.
        Siira 5y ago
        Your theory has zero predictive powers, unlike mine.
        dalbasal 5y ago
        What does it predict?
      - user-the-name 5y ago
        Is $99 a year really "a fortune"? It's less than the price of a Netflix subscription.
- threeseed 5y ago
  a) Apple has invested heavily in automated review methods over the years. b) I don't know what qualifications you think an app reviewer needs. They are not looking through the code but simply playing with the app on a range of devices. c) It is only a few hours for updates. Initial app submissions often take days/weeks and are very thorough.
  - swiley 5y ago
    Your definition of "thorough" and mine are very different. I highly doubt they could do a meaningful review without the complete source code for the app. It's not unusual that apps change their behavior after the review and this sometimes comes from binary dylibs that the developer didn't write. The whole thing is a scam.
    - zepto 5y ago
      > It's not unusual that apps change their behavior after the review Which leads to the account being banned. > and this sometimes comes from binary dylibs that the developer didn't write. Which are detected through analysis if they are common spyware. >The whole thing is a scam. Clearly not.
      - swiley 5y ago
        >> It's not unusual that apps change their behavior after the review >Which leads to the account being banned. Only if it gets noticed. >> and this sometimes comes from binary dylibs that the developer didn't write. >Which are detected through analysis if they are common spyware. Facebook got away with it for many years. >>The whole thing is a scam. >Clearly not. If it weren't then they would let people choose to use the App Store. It only exists to protect Apple's services from competition.
        zepto 5y ago
        > Only if it gets noticed. True, but they are getting better at noticing. >> and this sometimes comes from binary dylibs that the developer didn't write. >Which are detected through analysis if they are common spyware. > Facebook got away with it for many years. You know about that because they were stopped. And since then Apple has tightened the rules and stepped up detection. >>The whole thing is a scam. >Clearly not. > If it weren't then they would let people choose to use the App Store. No, because that would enable social engineering attacks once again. > It only exists to protect Apple's services from competition. This is straight up bullshit. You keep saying it, but it’s false at face value. Millions of scams have been stopped. https://www.apple.com/newsroom/2021/05/app-store-stopped-over-1-5-billion-in-suspect-transactions-in-2020/ https://www.apple.com/newsroom/2021/05/app-store-stopped-ove...
- spoonjim 5y ago
  I've watched the App Store reviewers try out apps (not in person, from logging) and they do seem to do a pretty thorough job of exercising the functionality.
  - danuker 5y ago
    How do you know those were not automated systems?
    - spoonjim 5y ago
      Could have been, but then we got rejected for something which would have been hard to detect automatically.
  - mupuff1234 5y ago
    That makes me wonder how easy it is to just hide certain features during the review process.
    - bassdropvroom 5y ago
      VW should hire this person!
      - oblio 5y ago
        https://github.com/auchenberg/volkswagen https://github.com/auchenberg/volkswagen
    - bugfix 5y ago
      It is actually pretty easy. As long as you don't use any private APIs, you can completely change the behavior of your app after the review by changing server side settings.
      - zepto 5y ago
        Yes, but if they catch you, you’ll get kicked out of the store altogether.
- simias 5y ago
  If we judge by the result these app store seem to do fairly well security-wise, no? Compared to Windows as a case study of what happens when you let users install anything they want from untrusted sources, it seems that the app stores do fairly well at culling obvious malware. At least that's what I experienced comparing the number of time I had to cleanup a friend or family member's computer filled with malware and browser toolbars vs. iphones and androids.
  - zimbatm 5y ago
    A large part of the stability can be attributed to sandboxing. This is what prevents apps from gaining unprivileged access and destabilizing the system. This is the time where relatives will call you. What you don't see, is all the apps that steal the user's data. Curation obviously helps but it's difficult to measure to what extent.
    - sneak 5y ago
      It has to be both to work; the sandbox would fail in a day if there were no review/revocation system.
      - nickflood 5y ago
        Web browsers don't have widely known glaring security holes in them even though their vendors don't approve the content that's viewed through them. On the other hand, you can't be completely sure that sandboxes on mobile devices don't have actively exploited security issues as there are many ways to bypass app review from discovering the true functionality of an app.
        sneak 5y ago
        > Web browsers don't have widely known glaring security holes in them even though their vendors don't approve the content that's viewed through them. Anything widely known gets fixed quickly. There are plenty of holes in browser sandboxing. The number approximately doubles as soon as you look at anything !Chrome, too.
- kolinko 5y ago
  And yet, over it’s 13 years of history there were only single instances of viruses/malware. Compare that to Google Play
  - grawprog 5y ago
    https://www.techradar.com/news/apple-app-store-is-apparently-still-littered-with-malicious-apps https://www.techradar.com/news/apple-app-store-is-apparently... https://threatpost.com/click-fraud-malware-apple-app-store/149496/ https://threatpost.com/click-fraud-malware-apple-app-store/1... https://www.tomsguide.com/news/iphone-apps-infected-malware https://www.tomsguide.com/news/iphone-apps-infected-malware https://9to5mac.com/2021/05/07/emails-reveal-128-million-ios-users-were-affected-by-xcodeghost-malware/ https://9to5mac.com/2021/05/07/emails-reveal-128-million-ios... https://www.theiphonewiki.com/wiki/Malware_for_iOS https://www.theiphonewiki.com/wiki/Malware_for_iOS
    - kolinko 5y ago
      Did you read the links you provided? The last article explicitly mentions that most of the malware needs iPhone to be jailbroken or the app to be installed outside of the App Store, which kind of proves my point. The research by Panda Security also showed that the ratio of malware on Android compared to iPhone is 50 to 1. https://www.pandasecurity.com/en/mediacenter/mobile-security/android-more-infected-than-ios/ https://www.pandasecurity.com/en/mediacenter/mobile-security...
- antipaul 5y ago
  Details on app review process, including picture of reviewer workstation, surfaced in the Epic game trial: https://www.macrumors.com/2021/05/07/app-store-35-percent-of-apps-rejected/ https://www.macrumors.com/2021/05/07/app-store-35-percent-of...
dalbasal 5y ago
IMO, walled gardens are besides the point. Whatever the working definition of walled garden, we can find some consumer or situation for whom it arguably makes sense. The real problem isn't the wall, it's the gate. Adwords, Android, FB, Twitter, Spotify, Steam... those are all about controlling the gate. At that point, others do the work and the gatekeeper makes the profit.
WanderPanda 5y ago
It’s not all black and white. Walled gardens can have upsides for the consumer. Ruling that out discredits your argument
PaulHoule 5y ago
When Apple's App store first came out consumers were sour about a decade of "crapp(s)" on Microsoft Windows. That is, you pretty much expected to download software and have it trash your machine on a regular basis. Things are better today, half of that is people realizing that it has to get better ("national security" today, but it's much bigger than national in scope) and the other half is people realizing it is possible to get better, and Apple's App store is one reason for that. --- Improvements in HW and SW are what helped Microsoft, not the Microsoft store -- since Win 8 I think I've had a Windows machine where it was really possible to download third-party apps from the Microsoft store about 10% of machine*years. Part of that is that it was disabled on corporate laptops I've used, the other part is that the metadata database for the Microsoft store gets corrupted on a regular basis. I've contacted Microsofties about that and what they tell me is that I should delete my account on my computer and then reinstall the account and spend or two work days reconfigurings all of the "normal" Windows apps that I used on an everyday basis (Firefox, Jetbrains, Creative Cloud, Python, ...) I tell them "there's a procedure to rebuild the metadata database because I've see the database get rebuilt when the six month OS updates happen" and they act as if they didn't hear anything. For that matter Microsoft seems to be a counter-example to "the power of monopoly". For instance there are several third-party gaming "app" stores for Windows such as Steam. One thing they all have in common is that they work. When Win 8 came out DropBox and a number of imitators had apps that worked for Windows. There was one DropBox imitator that didn't work, and that was Microsoft's OneDrive. Office was jiggered to push you to save files to OneDrive, but if you were saving files to OneDrive you could frequently NOT BE ABLE TO SAVE FILES AT ALL! To add insult to injury, this would also trigger harassment from Word the next time I open it about the files it didn't let me save. It's like this https://tonyortega.org/2021/04/12/scientology-answers-danny-masterson-accusers-at-california-supreme-court-and-its-ugly/ https://tonyortega.org/2021/04/12/scientology-answers-danny-... I guess it proves that running an "app store" without brand awareness doesn't lead to industry dominance.
rattlesnakedave 5y ago
As an Apple consumer, having a “walled garden” is great for UX, IMO. I don’t have to deal with a ton of shitty wallet apps, everything is in one App Store, etc. I find this much preferable to the situation on Android.
zepto 5y ago
> And a quick reminder to everybody else that walled gardens don't actually help the consumer. This is not supported by the article at all. > They only arbitrarily restrict choice, This statement is total bullshit. Even if a few scams get through, and even if Google has abused its store, it’s not only arbitrary. > they don't actually improve security (if any, that's provided by the sandboxing, not by the store "review"). No, Sandboxing cannot stop large classes of well known social engineering scams. https://www.apple.com/newsroom/2021/05/app-store-stopped-over-1-5-billion-in-suspect-transactions-in-2020/ https://www.apple.com/newsroom/2021/05/app-store-stopped-ove... Here is data proving that walled gardens do in fact protect consumers greatly. You don’t have to like them, and of course there are downsides, but let’s not pretend there are no benefits.
- deleted 5y ago
  [deleted]
permo-w 5y ago
I agree that the downsides outweigh the positives, but they do provide security to a certain extent. For example, you can give your grandma an iPad or a chromebook, and there’s very little chance of her accidentally installing x nasty malware. Give her a proper laptop, and at any one time she’s about 6 clicks from something dodgy, especially if she’s on social media.
- egocentric 5y ago
  That's because of system-level protections like the sandbox, not App Review or the App Store.
  - permo-w 5y ago
    yes but if you allow alternative app stores, then what? it’s either regulated by apple, which defeats the point, or it’s a security risk. I’m against walled gardens, I just disagree that there’s no security upside to it
    - Barrin92 5y ago
      put a system setting in place that lets you lock down the device if necessary with a password so grandma can use it safely? As OP points out you do not need an app store monopoly, you just need adjustable device settings.
      - deleted 5y ago
        [deleted]

oblio 5y ago

Walled gardens are just security theater. The App Store revenue was $72bn in 2020, yet the review time for an app is a few hours. App reviewers barely have any qualifications, they're just "call center operators" running off a script.

user-the-name 5y ago
It is a lot more than "theatre". The first line of defence is the sandboxing built into the OS. The second line is a lot of automated analysis of the binaries that are uploaded. The human review is the third line, but that is much less about security.
- dalbasal 5y ago
  ..and the last line of defense is removing a bad app to prevent further harm. Drivers licenses aren't only about competence. Sure, there's a test. But, there's also the ability to revoke a license.
  - Siira 5y ago
    So please explain why the licenses need to cost a fortune? Simple Bayesian thinking will tell you what the real motive is, and what is being used as the coverup motive.
    - dalbasal 5y ago
      There is no "real" motive, only history. One thing led to another. Now we are here.
      - Siira 5y ago
        Your theory has zero predictive powers, unlike mine.
        dalbasal 5y ago
        What does it predict?
    - user-the-name 5y ago
      Is $99 a year really "a fortune"? It's less than the price of a Netflix subscription.
threeseed 5y ago
a) Apple has invested heavily in automated review methods over the years. b) I don't know what qualifications you think an app reviewer needs. They are not looking through the code but simply playing with the app on a range of devices. c) It is only a few hours for updates. Initial app submissions often take days/weeks and are very thorough.
- swiley 5y ago
  Your definition of "thorough" and mine are very different. I highly doubt they could do a meaningful review without the complete source code for the app. It's not unusual that apps change their behavior after the review and this sometimes comes from binary dylibs that the developer didn't write. The whole thing is a scam.
  - zepto 5y ago
    > It's not unusual that apps change their behavior after the review Which leads to the account being banned. > and this sometimes comes from binary dylibs that the developer didn't write. Which are detected through analysis if they are common spyware. >The whole thing is a scam. Clearly not.
    - swiley 5y ago
      >> It's not unusual that apps change their behavior after the review >Which leads to the account being banned. Only if it gets noticed. >> and this sometimes comes from binary dylibs that the developer didn't write. >Which are detected through analysis if they are common spyware. Facebook got away with it for many years. >>The whole thing is a scam. >Clearly not. If it weren't then they would let people choose to use the App Store. It only exists to protect Apple's services from competition.
      - zepto 5y ago
        > Only if it gets noticed. True, but they are getting better at noticing. >> and this sometimes comes from binary dylibs that the developer didn't write. >Which are detected through analysis if they are common spyware. > Facebook got away with it for many years. You know about that because they were stopped. And since then Apple has tightened the rules and stepped up detection. >>The whole thing is a scam. >Clearly not. > If it weren't then they would let people choose to use the App Store. No, because that would enable social engineering attacks once again. > It only exists to protect Apple's services from competition. This is straight up bullshit. You keep saying it, but it’s false at face value. Millions of scams have been stopped. https://www.apple.com/newsroom/2021/05/app-store-stopped-over-1-5-billion-in-suspect-transactions-in-2020/ https://www.apple.com/newsroom/2021/05/app-store-stopped-ove...
spoonjim 5y ago
I've watched the App Store reviewers try out apps (not in person, from logging) and they do seem to do a pretty thorough job of exercising the functionality.
- danuker 5y ago
  How do you know those were not automated systems?
  - spoonjim 5y ago
    Could have been, but then we got rejected for something which would have been hard to detect automatically.
- mupuff1234 5y ago
  That makes me wonder how easy it is to just hide certain features during the review process.
  - bassdropvroom 5y ago
    VW should hire this person!
    - oblio 5y ago
      https://github.com/auchenberg/volkswagen https://github.com/auchenberg/volkswagen
  - bugfix 5y ago
    It is actually pretty easy. As long as you don't use any private APIs, you can completely change the behavior of your app after the review by changing server side settings.
    - zepto 5y ago
      Yes, but if they catch you, you’ll get kicked out of the store altogether.
simias 5y ago
If we judge by the result these app store seem to do fairly well security-wise, no? Compared to Windows as a case study of what happens when you let users install anything they want from untrusted sources, it seems that the app stores do fairly well at culling obvious malware. At least that's what I experienced comparing the number of time I had to cleanup a friend or family member's computer filled with malware and browser toolbars vs. iphones and androids.
- zimbatm 5y ago
  A large part of the stability can be attributed to sandboxing. This is what prevents apps from gaining unprivileged access and destabilizing the system. This is the time where relatives will call you. What you don't see, is all the apps that steal the user's data. Curation obviously helps but it's difficult to measure to what extent.
  - sneak 5y ago
    It has to be both to work; the sandbox would fail in a day if there were no review/revocation system.
    - nickflood 5y ago
      Web browsers don't have widely known glaring security holes in them even though their vendors don't approve the content that's viewed through them. On the other hand, you can't be completely sure that sandboxes on mobile devices don't have actively exploited security issues as there are many ways to bypass app review from discovering the true functionality of an app.
      - sneak 5y ago
        > Web browsers don't have widely known glaring security holes in them even though their vendors don't approve the content that's viewed through them. Anything widely known gets fixed quickly. There are plenty of holes in browser sandboxing. The number approximately doubles as soon as you look at anything !Chrome, too.
kolinko 5y ago
And yet, over it’s 13 years of history there were only single instances of viruses/malware. Compare that to Google Play
- grawprog 5y ago
  https://www.techradar.com/news/apple-app-store-is-apparently-still-littered-with-malicious-apps https://www.techradar.com/news/apple-app-store-is-apparently... https://threatpost.com/click-fraud-malware-apple-app-store/149496/ https://threatpost.com/click-fraud-malware-apple-app-store/1... https://www.tomsguide.com/news/iphone-apps-infected-malware https://www.tomsguide.com/news/iphone-apps-infected-malware https://9to5mac.com/2021/05/07/emails-reveal-128-million-ios-users-were-affected-by-xcodeghost-malware/ https://9to5mac.com/2021/05/07/emails-reveal-128-million-ios... https://www.theiphonewiki.com/wiki/Malware_for_iOS https://www.theiphonewiki.com/wiki/Malware_for_iOS
  - kolinko 5y ago
    Did you read the links you provided? The last article explicitly mentions that most of the malware needs iPhone to be jailbroken or the app to be installed outside of the App Store, which kind of proves my point. The research by Panda Security also showed that the ratio of malware on Android compared to iPhone is 50 to 1. https://www.pandasecurity.com/en/mediacenter/mobile-security/android-more-infected-than-ios/ https://www.pandasecurity.com/en/mediacenter/mobile-security...
antipaul 5y ago
Details on app review process, including picture of reviewer workstation, surfaced in the Epic game trial: https://www.macrumors.com/2021/05/07/app-store-35-percent-of-apps-rejected/ https://www.macrumors.com/2021/05/07/app-store-35-percent-of...

dalbasal 5y ago

IMO, walled gardens are besides the point. Whatever the working definition of walled garden, we can find some consumer or situation for whom it arguably makes sense. The real problem isn't the wall, it's the gate. Adwords, Android, FB, Twitter, Spotify, Steam... those are all about controlling the gate. At that point, others do the work and the gatekeeper makes the profit.

WanderPanda 5y ago

It’s not all black and white. Walled gardens can have upsides for the consumer. Ruling that out discredits your argument

PaulHoule 5y ago

When Apple's App store first came out consumers were sour about a decade of "crapp(s)" on Microsoft Windows. That is, you pretty much expected to download software and have it trash your machine on a regular basis. Things are better today, half of that is people realizing that it has to get better ("national security" today, but it's much bigger than national in scope) and the other half is people realizing it is possible to get better, and Apple's App store is one reason for that. --- Improvements in HW and SW are what helped Microsoft, not the Microsoft store -- since Win 8 I think I've had a Windows machine where it was really possible to download third-party apps from the Microsoft store about 10% of machine*years. Part of that is that it was disabled on corporate laptops I've used, the other part is that the metadata database for the Microsoft store gets corrupted on a regular basis. I've contacted Microsofties about that and what they tell me is that I should delete my account on my computer and then reinstall the account and spend or two work days reconfigurings all of the "normal" Windows apps that I used on an everyday basis (Firefox, Jetbrains, Creative Cloud, Python, ...) I tell them "there's a procedure to rebuild the metadata database because I've see the database get rebuilt when the six month OS updates happen" and they act as if they didn't hear anything. For that matter Microsoft seems to be a counter-example to "the power of monopoly". For instance there are several third-party gaming "app" stores for Windows such as Steam. One thing they all have in common is that they work. When Win 8 came out DropBox and a number of imitators had apps that worked for Windows. There was one DropBox imitator that didn't work, and that was Microsoft's OneDrive. Office was jiggered to push you to save files to OneDrive, but if you were saving files to OneDrive you could frequently NOT BE ABLE TO SAVE FILES AT ALL! To add insult to injury, this would also trigger harassment from Word the next time I open it about the files it didn't let me save. It's like this https://tonyortega.org/2021/04/12/scientology-answers-danny-masterson-accusers-at-california-supreme-court-and-its-ugly/ https://tonyortega.org/2021/04/12/scientology-answers-danny-... I guess it proves that running an "app store" without brand awareness doesn't lead to industry dominance.

rattlesnakedave 5y ago

As an Apple consumer, having a “walled garden” is great for UX, IMO. I don’t have to deal with a ton of shitty wallet apps, everything is in one App Store, etc. I find this much preferable to the situation on Android.

zepto 5y ago

> And a quick reminder to everybody else that walled gardens don't actually help the consumer. This is not supported by the article at all. > They only arbitrarily restrict choice, This statement is total bullshit. Even if a few scams get through, and even if Google has abused its store, it’s not only arbitrary. > they don't actually improve security (if any, that's provided by the sandboxing, not by the store "review"). No, Sandboxing cannot stop large classes of well known social engineering scams. https://www.apple.com/newsroom/2021/05/app-store-stopped-over-1-5-billion-in-suspect-transactions-in-2020/ https://www.apple.com/newsroom/2021/05/app-store-stopped-ove... Here is data proving that walled gardens do in fact protect consumers greatly. You don’t have to like them, and of course there are downsides, but let’s not pretend there are no benefits.

deleted 5y ago
[deleted]

permo-w 5y ago

I agree that the downsides outweigh the positives, but they do provide security to a certain extent. For example, you can give your grandma an iPad or a chromebook, and there’s very little chance of her accidentally installing x nasty malware. Give her a proper laptop, and at any one time she’s about 6 clicks from something dodgy, especially if she’s on social media.

egocentric 5y ago
That's because of system-level protections like the sandbox, not App Review or the App Store.
- permo-w 5y ago
  yes but if you allow alternative app stores, then what? it’s either regulated by apple, which defeats the point, or it’s a security risk. I’m against walled gardens, I just disagree that there’s no security upside to it
  - Barrin92 5y ago
    put a system setting in place that lets you lock down the device if necessary with a password so grandma can use it safely? As OP points out you do not need an app store monopoly, you just need adjustable device settings.
    - deleted 5y ago
      [deleted]