4 ms·

Apple claims 'sideloading' apps is 'serious' security risk

16 points by frumper 5y ago

frumper 5y ago
Something has to give. Apple controls what apps are allowed, how those apps behave, how those apps operate and then point to the web as the alternative, which they also control the only browser they allowed on the system. Then stories like https://www.theverge.com/2021/6/11/22528701/apple-rank-own-app-over-competitor-files-dropbox-wwdc-2017 https://www.theverge.com/2021/6/11/22528701/apple-rank-own-a... show why all that power concentrated has already lead to anti-competitive behavior. While I don't think there is a single perfect solution, I do think that if they don't flex in some of these areas that the governments of the world will break them.
- FriendlyNormie 5y ago
  Literally what in the fuck are you talking about. NO ONE complains about how Apple runs the App Store except Tim Sweeney and a very small handful of irrelevant bandwagoning whiny bitches such as yourself.
jsnell 5y ago
https://news.ycombinator.com/item?id=27565002 https://news.ycombinator.com/item?id=27565002 https://news.ycombinator.com/item?id=27603849 https://news.ycombinator.com/item?id=27603849
anonymousiam 5y ago
Sideloading has worked well for Android. Users are not idiots and there are enough warnings so they know that they should not sideload an application unless they really know what they're doing. Apples argument serves Apple's 30% interest in iTunes revenue and removes the choice from the user.
- grawprog 5y ago
  That's how they get you. First you sideload one app, you think you can stop with just one, then next thing you know you've got F-Droid on your phone, your sideloading left and right. Then before you know it, all your money now belongs to a Nigerian Prince and hackers are ransomwaring your grandma. Yeah kids sideloading might seem fun, but it's a gateway to disaster. Just say No to sideloading.
  - frumper 5y ago
    It sounds like we need to get the hackers to ransomware the Nigerian Prince's grandma.
    - grawprog 5y ago
      Nah, better to just stick to the walled garden and let Almighty arbiters of all that is safe to install guide us.
  - cyanydeez 5y ago
    hey man, sideloading is just the start, next thing you know theyll be saving progressive webapps and never leaving their browsers!
- threatofrain 5y ago
  Something troublesome to people who worry about privacy would be FB asking people to side-load, which in a sense they did when they bought a VPN and asked kids to grant all access to network traffic [1]. Kids will ignore warnings, and they are thought to be savvier than their folks. Kids are the ones who will download games that basically train you to love ads. And Apple doesn't collect revenue from FB, but FB is probably the heaviest in its weight class. If FB asks, parents will say yes. If Fortnite asks, children will say yes. [1]: https://techcrunch.com/2019/01/29/facebook-project-atlas/ https://techcrunch.com/2019/01/29/facebook-project-atlas/
  - rektide 5y ago
    it's amazing to me how much imagination & concern people put in to 0.000001% of side loading cases. if a computer is a bicycle for the mind, these people insist we go out fully padded, with front & back training wheels, walk our bikes up & down hills. never exceed 10mph or your eyeballs might pop out. building a smarter culture able to avoid dangerous & bad forms of computing seems much more like the end I think we should spend time promoting. give people choice, visibility, and an ambient social network that can help provide background & discussion around the tech you've started dabbling in, that can warn you.
    - throwaway3neu94 5y ago
      So, how much do you know about pharmaceuticals, building safety and cows? We tightly regulate all those industries precisely so that people can rely on vendors and not get hurt, even if it might be more profitable to substitute a few components in a vaccine, skip the earthquake retrofit and ignore whatever animal disease popped up. And this is without getting into the issues of oligopolies, network effects, vendor lock in and user manipulation/deception by vendors. The companies dedicate entire specialist teams worth of effort to this. The average person doesn't stand a chance without help. IT in general is really not so special that it should be exempt from governmental consumer protection efforts. Especially since it is one of the most profitable sectors by far, so you really can't argue that there isn't room for tighter controls. Apple and Facebook specifically are two of the most profitable companies in the world. They can afford it. And if they drop to "merely" being in the fortune 500, that is still completely fine with me. And if some exploitative business models become unprofitable, that's fine as well. That's kinda the point. And before you argue that it would kill innovation: there is ample precedent for regulations that depend on the size of the company or the customer base.
- cyanydeez 5y ago
  it serves their entire ecosystem, what next, users loading PWA and bypassing their entire ecosystem? heave fordbid! apple is like the malevocence of hardware software walled garden, they make it easy to do what makes them tied to the platform and e erything else a struggle.
maxharris 5y ago
Simply allowing sideloading is the best solution because it disrupts users the least while maximizing their freedom. Web apps are not the answer because they will never cut it for every use case (even if that use case is just the installation of a non-Apple browser engine).
jnwatson 5y ago
This would be evidence that the last 50 years of OS research is for naught. If we can't run two apps at the same time, and have some confidence that the interaction between those apps is constrained, why in the world did so many computer scientists and engineers spend all this time on permissions schemes and information flow control?
api 5y ago
Why is it not a risk on MacOS? Answer: the MacOS customer base expects a computer they can run stuff on, and would not tolerate it without defecting.
- FriendlyNormie 5y ago
  This is one of those “whataboutisms” you liberal faggots claim are automatically bad arguments
- klipklop 5y ago
  They are slowly moving in the direction of only letting you run apps from their app store. Look at all the warnings and prompts you get if you try to run a program you downloaded outside of it.
  - frumper 5y ago
    This is definitely my fear for the future of MacOS, though it will likely cause me to just get an iPad and a windows computer instead.
  - mcphage 5y ago
    They're not pushing you in the direction of running apps from their store, but they are pushing in the direction of having apps be notarized: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution https://developer.apple.com/documentation/security/notarizin...
  - api 5y ago
    For many years the secret incantation to run an unsigned app is right click open twice in a row and confirming at the warning. “Run this… yes, and I really mean it!” Once you do this once it remembers and opens normally. This is still the case in Big Sur and on the M1. This idiom is fine with me. It’s easy to remember but kind of hidden from the non-technical. It also forces you to think a little which protects from accidentally launching an unsigned app. An alternative idiom that would work would be a red warning and requiring the user to type “YES.” This is also common in non-reversible delete dialogs.
klipklop 5y ago
At the very least they should let you self sign and run applications you built yourself. I feel that is enough barrier to entry to keep Grandma from sideloading a virus. I just wanna build and run RetroArch dammit.
- makecheck 5y ago
  I remember going on vacation away from my computer and discovering my own app failing to launch after a few days. I guess I had tended to rebuild and reinstall it so often that I never saw their signing expire before. It is pure crap that Apple has any ability to prevent you from running software you created and installed yourself.
kolyaio 5y ago
I think this is just an excuse to keep users locked to the App Store. Yeah, it could be more secure to some extent but Apple’s walled garden isn’t unbreachable. There were cases that scum and fraud entered the stores. I’d say that Apple’s approach makes the users more ignorant of security issues. Because they assume that their device 100% which isn’t possible. I don’t understand why they are limiting the advanced users so much ? If I bought iPad Pro that means I am an advanced enough user to know what kind of apps I need and I can avoid problematic apps. The iPad Pro has Mac level CPU - M1 Chip. Why shouldn’t users be able to leverage it fully ? Programming isn’t really possible on a iPad just because of this BS Also, a lot of the features iOS got are inspired by the jailbreak community. And even on macs there are apps that really offer big improvements to usability like bettersnap or bettertouchtool.

16 points by frumper 5y ago

Something has to give. Apple controls what apps are allowed, how those apps behave, how those apps operate and then point to the web as the alternative, which they also control the only browser they allowed on the system. Then stories like https://www.theverge.com/2021/6/11/22528701/apple-rank-own-app-over-competitor-files-dropbox-wwdc-2017 https://www.theverge.com/2021/6/11/22528701/apple-rank-own-a... show why all that power concentrated has already lead to anti-competitive behavior. While I don't think there is a single perfect solution, I do think that if they don't flex in some of these areas that the governments of the world will break them.

FriendlyNormie 5y ago
Literally what in the fuck are you talking about. NO ONE complains about how Apple runs the App Store except Tim Sweeney and a very small handful of irrelevant bandwagoning whiny bitches such as yourself.

jsnell 5y ago

https://news.ycombinator.com/item?id=27565002 https://news.ycombinator.com/item?id=27565002 https://news.ycombinator.com/item?id=27603849 https://news.ycombinator.com/item?id=27603849

anonymousiam 5y ago

Sideloading has worked well for Android. Users are not idiots and there are enough warnings so they know that they should not sideload an application unless they really know what they're doing. Apples argument serves Apple's 30% interest in iTunes revenue and removes the choice from the user.

grawprog 5y ago
That's how they get you. First you sideload one app, you think you can stop with just one, then next thing you know you've got F-Droid on your phone, your sideloading left and right. Then before you know it, all your money now belongs to a Nigerian Prince and hackers are ransomwaring your grandma. Yeah kids sideloading might seem fun, but it's a gateway to disaster. Just say No to sideloading.
- frumper 5y ago
  It sounds like we need to get the hackers to ransomware the Nigerian Prince's grandma.
  - grawprog 5y ago
    Nah, better to just stick to the walled garden and let Almighty arbiters of all that is safe to install guide us.
- cyanydeez 5y ago
  hey man, sideloading is just the start, next thing you know theyll be saving progressive webapps and never leaving their browsers!
threatofrain 5y ago
Something troublesome to people who worry about privacy would be FB asking people to side-load, which in a sense they did when they bought a VPN and asked kids to grant all access to network traffic [1]. Kids will ignore warnings, and they are thought to be savvier than their folks. Kids are the ones who will download games that basically train you to love ads. And Apple doesn't collect revenue from FB, but FB is probably the heaviest in its weight class. If FB asks, parents will say yes. If Fortnite asks, children will say yes. [1]: https://techcrunch.com/2019/01/29/facebook-project-atlas/ https://techcrunch.com/2019/01/29/facebook-project-atlas/
- rektide 5y ago
  it's amazing to me how much imagination & concern people put in to 0.000001% of side loading cases. if a computer is a bicycle for the mind, these people insist we go out fully padded, with front & back training wheels, walk our bikes up & down hills. never exceed 10mph or your eyeballs might pop out. building a smarter culture able to avoid dangerous & bad forms of computing seems much more like the end I think we should spend time promoting. give people choice, visibility, and an ambient social network that can help provide background & discussion around the tech you've started dabbling in, that can warn you.
  - throwaway3neu94 5y ago
    So, how much do you know about pharmaceuticals, building safety and cows? We tightly regulate all those industries precisely so that people can rely on vendors and not get hurt, even if it might be more profitable to substitute a few components in a vaccine, skip the earthquake retrofit and ignore whatever animal disease popped up. And this is without getting into the issues of oligopolies, network effects, vendor lock in and user manipulation/deception by vendors. The companies dedicate entire specialist teams worth of effort to this. The average person doesn't stand a chance without help. IT in general is really not so special that it should be exempt from governmental consumer protection efforts. Especially since it is one of the most profitable sectors by far, so you really can't argue that there isn't room for tighter controls. Apple and Facebook specifically are two of the most profitable companies in the world. They can afford it. And if they drop to "merely" being in the fortune 500, that is still completely fine with me. And if some exploitative business models become unprofitable, that's fine as well. That's kinda the point. And before you argue that it would kill innovation: there is ample precedent for regulations that depend on the size of the company or the customer base.
cyanydeez 5y ago
it serves their entire ecosystem, what next, users loading PWA and bypassing their entire ecosystem? heave fordbid! apple is like the malevocence of hardware software walled garden, they make it easy to do what makes them tied to the platform and e erything else a struggle.

maxharris 5y ago

Simply allowing sideloading is the best solution because it disrupts users the least while maximizing their freedom. Web apps are not the answer because they will never cut it for every use case (even if that use case is just the installation of a non-Apple browser engine).

jnwatson 5y ago

This would be evidence that the last 50 years of OS research is for naught. If we can't run two apps at the same time, and have some confidence that the interaction between those apps is constrained, why in the world did so many computer scientists and engineers spend all this time on permissions schemes and information flow control?

api 5y ago

Why is it not a risk on MacOS? Answer: the MacOS customer base expects a computer they can run stuff on, and would not tolerate it without defecting.

FriendlyNormie 5y ago
This is one of those “whataboutisms” you liberal faggots claim are automatically bad arguments
klipklop 5y ago
They are slowly moving in the direction of only letting you run apps from their app store. Look at all the warnings and prompts you get if you try to run a program you downloaded outside of it.
- frumper 5y ago
  This is definitely my fear for the future of MacOS, though it will likely cause me to just get an iPad and a windows computer instead.
- mcphage 5y ago
  They're not pushing you in the direction of running apps from their store, but they are pushing in the direction of having apps be notarized: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution https://developer.apple.com/documentation/security/notarizin...
- api 5y ago
  For many years the secret incantation to run an unsigned app is right click open twice in a row and confirming at the warning. “Run this… yes, and I really mean it!” Once you do this once it remembers and opens normally. This is still the case in Big Sur and on the M1. This idiom is fine with me. It’s easy to remember but kind of hidden from the non-technical. It also forces you to think a little which protects from accidentally launching an unsigned app. An alternative idiom that would work would be a red warning and requiring the user to type “YES.” This is also common in non-reversible delete dialogs.

klipklop 5y ago

At the very least they should let you self sign and run applications you built yourself. I feel that is enough barrier to entry to keep Grandma from sideloading a virus. I just wanna build and run RetroArch dammit.

makecheck 5y ago
I remember going on vacation away from my computer and discovering my own app failing to launch after a few days. I guess I had tended to rebuild and reinstall it so often that I never saw their signing expire before. It is pure crap that Apple has any ability to prevent you from running software you created and installed yourself.

kolyaio 5y ago

I think this is just an excuse to keep users locked to the App Store. Yeah, it could be more secure to some extent but Apple’s walled garden isn’t unbreachable. There were cases that scum and fraud entered the stores. I’d say that Apple’s approach makes the users more ignorant of security issues. Because they assume that their device 100% which isn’t possible. I don’t understand why they are limiting the advanced users so much ? If I bought iPad Pro that means I am an advanced enough user to know what kind of apps I need and I can avoid problematic apps. The iPad Pro has Mac level CPU - M1 Chip. Why shouldn’t users be able to leverage it fully ? Programming isn’t really possible on a iPad just because of this BS Also, a lot of the features iOS got are inspired by the jailbreak community. And even on macs there are apps that really offer big improvements to usability like bettersnap or bettertouchtool.