4 ms·

>> Doesn’t seem remotely true - here’s just one recent example: > Your example is a vulnerability in an app that can be exploited to access that app's data. It

by zepto 5y ago

>> Doesn’t seem remotely true - here’s just one recent example: > Your example is a vulnerability in an app that can be exploited to access that app's data. It is not a malware app, and there is no evidence that any users had malware that attacked that… It doesn’t matter. Your claim: “Google's and Amazon's app stores are not open source but built for an open source platform, together have far more users than the Apple App Store and far fewer malware installations.” is still bullshit. https://www.pandasecurity.com/en/mediacenter/mobile-security/android-more-infected-than-ios/ https://www.pandasecurity.com/en/mediacenter/mobile-security... > I gave the absolute numbers thinking you were smart enough to convert 0 proportionally. We’ve established that this the targets are not proportionally attractive. > I certainly didn't know that it would confuse you. This is a public conversation, I’m sure you didn’t expect It would confuse me, but it would obviously mislead casual readers. Have you considered this? > That would be a good point if the stores were incompatible. However, it is possible to write an app that you can publish to the Amazon App Store, the Google Play Store, F-Droid, and the hundreds of Chinese app stores. Despite this, F-Droid has had zero infections. That still doesn’t mean it’s worth targeting f-droid. Unless you have numbers on attempted malware that has been blocked from the f-droid store, and similar numbers for the other Android stores, this like of reasoning is complete bullshit. > Despite the Play Store having far more users than the App Store, it has infected far fewer users. How do you know? >> This is complete bullshit. Apps are signed by developed and by Apple. Were you not aware of that? >> You are clearly not aware that the package submitted to Apple is signed by the the developer, and the package delivered to the user is signed only by Apple. What makes you think I’m not aware of this? > Apple (or China) Are you suggesting that China gets to re-sign software going to devices either a) inside and/or b) outside China? Everyone knows that all governments can legally require Apple to block apps. Unless you are claiming that China can do more than this, this is another obviously misleading statement. > determines what app actually gets to the device. https://developer.apple.com/forums/thread/12880 https://developer.apple.com/forums/thread/12880 Yes, Apple determines what app gets to the device. Who in the world would think otherwise? - it’s part of their marketing for the iPhone.

lern_too_spel 5y ago
> What makes you think I’m not aware of this? > Yes, Apple determines what app gets to the device. Who in the world would think otherwise? - it’s part of their marketing for the iPhone. You used to think otherwise. You claimed that the package sent to the device was signed by the developer. It is not. Apple (or China) works as a MITM who can modify the package however they like with no way for the user to verify that malware hasn't been inserted. F-Droid allows the user to verify that the package contents hash the same as what they would build locally. > Are you suggesting that China gets to re-sign software going to devices either a) inside and/or b) outside China? Yes. Because the App Store has this MITM vulnerability and China gets to MITM all US services (with blessed MITM status for iCloud that even defeats Apple's "E2E" encryption for their other services), they can replace the Signal package with a compromised one. >> Despite the Play Store having far more users than the App Store, it has infected far fewer users. > How do you know? Unlike Apple; F-Droid, Google, and Amazon allow security researchers to analyze apps on their respective stores instead of blocking their access. Lower case count despite higher test rate isn't a guarantee that fewer people have been infected, but it is strong evidence for that conclusion.
- zepto 5y ago
  > You used to think otherwise. You claimed that the package sent to the device was signed by the developer. False. If I claimed that, you’d be able to quote me. > … (or China) works as a MITM who can modify the package however they like Seems like this is total bullshit. Do you have any evidence that China can modify the packages? > Are you suggesting that China gets to re-sign software going to devices either a) inside and/or b) outside China? Yes. Because the App Store has this MITM vulnerability and China gets to MITM all US services (with blessed MITM status for iCloud that even defeats Apple's "E2E" encryption for their other services), they can replace the Signal package with a compromised one. The seems like bullshit. There is no indication of an MITM vulnerability between the developers and Apple, nor is there one between Apple and users. China cannot MITM packages based on what you have said so far. Yes, Apple can change package contents. Numerous App Store features make use of this to deliver partial packages and device specific binaries. Nothing about this mechanism gives China an MITM. >> Despite the Play Store having far more users than the App Store, it has infected far fewer users. > How do you know? Unlike Apple; F-Droid, Google, and Amazon allow security researchers to analyze apps on their respective stores instead of blocking their access. Lower case count despite higher test rate isn't a guarantee that fewer people have been infected, but it is strong evidence for that conclusion. So you misled people by claiming this as fact, when it’s actually just speculation. How do you know the case count is lower, and the test rate is higher? Your claim about aggregate Android malware numbers being lower than iOS was false: https://www.pandasecurity.com/en/mediacenter/mobile-security/android-more-infected-than-ios/ https://www.pandasecurity.com/en/mediacenter/mobile-security...

by zepto 5y ago

lern_too_spel 5y ago

> What makes you think I’m not aware of this? > Yes, Apple determines what app gets to the device. Who in the world would think otherwise? - it’s part of their marketing for the iPhone. You used to think otherwise. You claimed that the package sent to the device was signed by the developer. It is not. Apple (or China) works as a MITM who can modify the package however they like with no way for the user to verify that malware hasn't been inserted. F-Droid allows the user to verify that the package contents hash the same as what they would build locally. > Are you suggesting that China gets to re-sign software going to devices either a) inside and/or b) outside China? Yes. Because the App Store has this MITM vulnerability and China gets to MITM all US services (with blessed MITM status for iCloud that even defeats Apple's "E2E" encryption for their other services), they can replace the Signal package with a compromised one. >> Despite the Play Store having far more users than the App Store, it has infected far fewer users. > How do you know? Unlike Apple; F-Droid, Google, and Amazon allow security researchers to analyze apps on their respective stores instead of blocking their access. Lower case count despite higher test rate isn't a guarantee that fewer people have been infected, but it is strong evidence for that conclusion.

zepto 5y ago
> You used to think otherwise. You claimed that the package sent to the device was signed by the developer. False. If I claimed that, you’d be able to quote me. > … (or China) works as a MITM who can modify the package however they like Seems like this is total bullshit. Do you have any evidence that China can modify the packages? > Are you suggesting that China gets to re-sign software going to devices either a) inside and/or b) outside China? Yes. Because the App Store has this MITM vulnerability and China gets to MITM all US services (with blessed MITM status for iCloud that even defeats Apple's "E2E" encryption for their other services), they can replace the Signal package with a compromised one. The seems like bullshit. There is no indication of an MITM vulnerability between the developers and Apple, nor is there one between Apple and users. China cannot MITM packages based on what you have said so far. Yes, Apple can change package contents. Numerous App Store features make use of this to deliver partial packages and device specific binaries. Nothing about this mechanism gives China an MITM. >> Despite the Play Store having far more users than the App Store, it has infected far fewer users. > How do you know? Unlike Apple; F-Droid, Google, and Amazon allow security researchers to analyze apps on their respective stores instead of blocking their access. Lower case count despite higher test rate isn't a guarantee that fewer people have been infected, but it is strong evidence for that conclusion. So you misled people by claiming this as fact, when it’s actually just speculation. How do you know the case count is lower, and the test rate is higher? Your claim about aggregate Android malware numbers being lower than iOS was false: https://www.pandasecurity.com/en/mediacenter/mobile-security/android-more-infected-than-ios/ https://www.pandasecurity.com/en/mediacenter/mobile-security...