4 ms·

I just don't buy this argument that Apple maintaining control over iOS is necessary for privacy. I think it's a false dichotomy. If you build a good OS, with go

I just don't buy this argument that Apple maintaining control over iOS is necessary for privacy. I think it's a false dichotomy. If you build a good OS, with good strong APIs, you can achieve both privacy and a more open ecosystem.

simonh 5y ago
Lets say Apple allowed side-loading. They would have no way to examine side-loaded apps to see what they do. iOS would have to provide access to various basic services like networking and connectivity, but not e.g. your address book without checking with the user. All well and good. So I could write an app that interrogates the cellular network and other sources to implement location tracking (cruder than GPS but good enough for many purposes), snoops local wifi networks for information about connected devices. Even if it couldn't run in the background, it could snoop network traffic from iOS built in background services while it was running. If it had a built-in browser function it could track whatever browsing activity it liked. I'm sure there are plenty of other snooping activities that could be implemented that I can't think of in 5 minutes. So there are plenty of ways such an app could violate your privacy, and you would never know. Right now, such apps have to pass App Store Review and such activity can be detected and the App kicked out. So side-loading potentially bypasses a lot of controls that can't really be implemented directly in the OS. Users like yourself might assume that Apple could prevent these things in the OS, might think that even with side loading this is Apple's responsibility to protect you from it, as you seem to do. That a "good OS" as you put it would not allow these things to happen even in side loaded apps, therefore iOS can't be a "good OS" if side loaded apps break your privacy in ways you hadn't anticipated. But it's not all about the OS. This is the sort of reputational damage Apple is trying to avoid.
- abecedarius 5y ago
  Your argument presumes apps get capabilities by default. OSes have been invented where apps get nothing implicitly (the object-capability model); it's a design problem to install mass-market apps with usable security in that paradigm, and it might be a difficult one. But there's been a little work on it and it's worth pursuing.
  - simonh 5y ago
    Sure, but when you grant capabilities you can't be sure what is being done with them. That's why you need static analysis, behavioural analysis and the whole test regime of App Store review to catch these sorts of activities. That's why Apple has an app store review process, otherwise they could bake all the restrictions into the OS itself. With permissioning for side loaded apps you can't know or enforce activities with the granted services. Yet people like framecowbird will still blame Apple for not producing a "good OS" that protects them anyway.
    - abecedarius 5y ago
      The capability you give an app for X doesn't have to be the raw system X. It can interpose some policy or tracking-of-use, or let you revoke just the X, or fake the whole X to begin with, etc. This is one of the things distinguishing the object capability model from basic sandboxing. Another is that the set of kinds of X's is open-ended -- anyone can make up higher-level abstractions like an advertising server with a defined protocol, so that users who've gotta have a free ad-supported app can use one without giving it unlimited and unaudited network access. I'd expect the store to come with standardized packages of capabilities for common kinds of apps.
      - simonh 5y ago
        Do you really think that companies lobbying for side-loading of their apps, and getting legislation through to force it on Apple, would be satisfied with heavily locked down access to subsets of functionality? To more restricted access than App Store apps? Somehow I don't see that being acceptable to the side-loading lobby. An App Store App can be granted low level network access etc because it can be vetted and censured if found in violation of policies. Side loaded app developers will demand the same access.
        abecedarius 5y ago
        Every hardware capability is potentially available in this kind of framework. It's ultimately up to the user whether an app can get at it, or with what limits. This is an inevitable source of problems for sufficiently reckless users, but it should be possible for reasonable users to keep reasonable control -- not just hacker types. A "side-loading lobby" wouldn't have grounds to demand more. (The overenthusiastic copyright lobby would probably have better luck in getting their demands wired in, going by history, but that's another issue.)
- StavrosK 5y ago
  Android allows sideloading today and none of the things you claim are possible. If you want to interrogate the cellular network for tower locations, you need location permission. Same for WiFi and BT.
amelius 5y ago
Also, Apple is conflating AppStore with ContentFilter. They are separate things which can be installed separately depending on the user's wishes.

simonh 5y ago

Lets say Apple allowed side-loading. They would have no way to examine side-loaded apps to see what they do. iOS would have to provide access to various basic services like networking and connectivity, but not e.g. your address book without checking with the user. All well and good. So I could write an app that interrogates the cellular network and other sources to implement location tracking (cruder than GPS but good enough for many purposes), snoops local wifi networks for information about connected devices. Even if it couldn't run in the background, it could snoop network traffic from iOS built in background services while it was running. If it had a built-in browser function it could track whatever browsing activity it liked. I'm sure there are plenty of other snooping activities that could be implemented that I can't think of in 5 minutes. So there are plenty of ways such an app could violate your privacy, and you would never know. Right now, such apps have to pass App Store Review and such activity can be detected and the App kicked out. So side-loading potentially bypasses a lot of controls that can't really be implemented directly in the OS. Users like yourself might assume that Apple could prevent these things in the OS, might think that even with side loading this is Apple's responsibility to protect you from it, as you seem to do. That a "good OS" as you put it would not allow these things to happen even in side loaded apps, therefore iOS can't be a "good OS" if side loaded apps break your privacy in ways you hadn't anticipated. But it's not all about the OS. This is the sort of reputational damage Apple is trying to avoid.

abecedarius 5y ago
Your argument presumes apps get capabilities by default. OSes have been invented where apps get nothing implicitly (the object-capability model); it's a design problem to install mass-market apps with usable security in that paradigm, and it might be a difficult one. But there's been a little work on it and it's worth pursuing.
- simonh 5y ago
  Sure, but when you grant capabilities you can't be sure what is being done with them. That's why you need static analysis, behavioural analysis and the whole test regime of App Store review to catch these sorts of activities. That's why Apple has an app store review process, otherwise they could bake all the restrictions into the OS itself. With permissioning for side loaded apps you can't know or enforce activities with the granted services. Yet people like framecowbird will still blame Apple for not producing a "good OS" that protects them anyway.
  - abecedarius 5y ago
    The capability you give an app for X doesn't have to be the raw system X. It can interpose some policy or tracking-of-use, or let you revoke just the X, or fake the whole X to begin with, etc. This is one of the things distinguishing the object capability model from basic sandboxing. Another is that the set of kinds of X's is open-ended -- anyone can make up higher-level abstractions like an advertising server with a defined protocol, so that users who've gotta have a free ad-supported app can use one without giving it unlimited and unaudited network access. I'd expect the store to come with standardized packages of capabilities for common kinds of apps.
    - simonh 5y ago
      Do you really think that companies lobbying for side-loading of their apps, and getting legislation through to force it on Apple, would be satisfied with heavily locked down access to subsets of functionality? To more restricted access than App Store apps? Somehow I don't see that being acceptable to the side-loading lobby. An App Store App can be granted low level network access etc because it can be vetted and censured if found in violation of policies. Side loaded app developers will demand the same access.
      - abecedarius 5y ago
        Every hardware capability is potentially available in this kind of framework. It's ultimately up to the user whether an app can get at it, or with what limits. This is an inevitable source of problems for sufficiently reckless users, but it should be possible for reasonable users to keep reasonable control -- not just hacker types. A "side-loading lobby" wouldn't have grounds to demand more. (The overenthusiastic copyright lobby would probably have better luck in getting their demands wired in, going by history, but that's another issue.)
StavrosK 5y ago
Android allows sideloading today and none of the things you claim are possible. If you want to interrogate the cellular network for tower locations, you need location permission. Same for WiFi and BT.

amelius 5y ago

Also, Apple is conflating AppStore with ContentFilter. They are separate things which can be installed separately depending on the user's wishes.