10 ms·

So where can I go if I want a device that does not allow sideloading? I want a device that has a single trusted root that takes a hard stance on all apps to mak

by chomp 5y ago

So where can I go if I want a device that does not allow sideloading? I want a device that has a single trusted root that takes a hard stance on all apps to make sure they’re not abusing privileges, and signs the apps that are validated. Is that going to be gone now? Should I just go to a feature phone?

bobviolier 5y ago
I mean, you don't _have_ to install another marketplace for apps.
- chomp 5y ago
  I do not want the option to install other apps, because it gives me plausible deniability when my employer or someone is like “install this app or you’re fired”. Or if someone gets a hold of my phone and now I have a brand new app with all permissions installed. Having the ability to side load gives the ability to people to coerce you into installing things that wouldn’t fly under a single root model. I do not feel that computing is headed to a good place in terms of privacy and I feel like giving the Googles, Facebooks, and spyware companies more levers to pull is going in the wrong direction. (Well, maybe the right direction under normal circumstances if the tech industry was more ethical)
  - marderfarker2 5y ago
    Just recently my company’s HR forced us to download a payroll vendor’s app on our phones. The app was downloaded from the App Store.
    - extra88 5y ago
      Because it’s from the Apple App Store, you can be reasonably sure it does what it says and isn’t monitoring your communications. You can also use permissions to deny it things like background app refresh or location data.
      - celsoazevedo 5y ago
        No review from Apple is a downside, but I doubt iOS' system permissions are tied to the App Store. On Android (and Windows/macOS, to a certain extent), the OS asks you if you let <app> access/use <feature> independently of how the app was installed. Also, can apps monitor your communications on iOS? On Android you can replace the apps that control calls, sms, etc, but that wasn't possible on iOS last time I used it.
        extra88 5y ago
        To be honest, I don’t know what an app literally can’t do on an iOS device (or Android device), regardless of how it gets there. I expect there are private APIs that could be exploited to do things an app otherwise couldn’t do that could be against the user’s interests.
        celsoazevedo 5y ago
        Apps on iOS and Android run inside a sandbox. If Apple allows apps to bypass the sandbox like that, then iOS isn't very secure/private. I know there are downsides if they allow sideloading, but iOS is very restrictive and Apple would still control iOS. They can add more restrictions and fix flaws if needed.
  - ginko 5y ago
    >I do not want the option to install other apps, because it gives me plausible deniability when my employer or someone is like “install this app or you’re fired” Tell your employer to give you a work phone then. No way I'm going to install work-related sw on a private device.
  - ClumsyPilot 5y ago
    If you are being abused by your employer, and you want the rest of society to help, the way to do that is though employment law, and not through taking away rights from the rest of us and giving them to Apple
  - celsoazevedo 5y ago
    > Or if someone gets a hold of my phone and now I have a brand new app with all permissions installed. System permissions aren't tied to the App Store as far as I know (same on Android). You still need to give apps permission to access your camera, mic, location, etc. While allowing sideloading would bypass Apple's review process (which can be bad), if someone has that type of access to your phone, there's nothing stopping them from installing tracking/spyware apps from the App Store right now.
  - northwest65 5y ago
    >install this app or you’re fired What sort of backward country do you live in where that's even remotely legal?
  - ThatPlayer 5y ago
    >it gives me plausible deniability when my employer or someone is like “install this app or you’re fired” Employers can already sideload through MDM. If anything MDM will give them more control than just an app.
  - heavyset_go 5y ago
    > I do not want the option to install other apps, because it gives me plausible deniability when my employer or someone is like “install this app or you’re fired”. Employers have enterprise certificates and ability to install custom apps on both iOS and Android, and they can do so while bypassing their respective app stores.
doobeeus 5y ago
Apple does not actually "take a hard stance on all apps to make sure they're not abusing privileges" though they say that they do in their advertising.
- chomp 5y ago
  I see plenty of complaints from devs about Apple dropping their app because it runs unverified code, and that’s enough for me to know that the system is working.
  - Dah00n 5y ago
    If you read HN regularly you also know the app store has a huge share of scam apps that Apple has been made aware of multiple times and that perfectly legitimate apps gets removed for strange and suspect reasons (like because Apple is making a competing app for example). Earth's population shouldn't be forced to do something for your sake. If you have a problem like what you mention with your job, solving it for yourself is much better than wanting to force something on everyone. It's very egotistical to even think that another person shouldn't be able to sideload apps because you have a shitty boss or job.
stale2002 5y ago
> if I want a device that does not allow sideloading It's pretty simple. Just don't sideload apps. Or perhaps there could be a setting that you turn on, that disallows sideloading. If you turn on a setting, that disallows sideloading, then in that case you would have a platform that does what you want.
- danaris 5y ago
  This does not solve the problem. If sideloading is available, there will be a nonzero number of developers who choose to provide their app only through sideloading, and eschew Apple's App Store. Some of these will be doing so merely so they don't have to take the extra effort (or pay the extra money) to submit apps to Apple. No malicious intent, but they still won't be reviewed, so unintentional danger can still get through. Others will be deliberately avoiding Apple's App Review so they can steal your passwords and spy on your banking apps, or hell, just install a rootkit if there's one available at the time. And still others will be trying to create commercial-grade apps that provide full functionality, but can violate your privacy without asking permission because that's their business model (particularly Facebook and Google). And some of these will replace apps that are currently available from the App Store, with all the protections that entails. Particularly Facebook and Google.
  - the8472 5y ago
    > Others will be deliberately avoiding Apple's App Review so they can steal your passwords and spy on your banking apps, or hell, just install a rootkit if there's one available at the time. Sideloading and app permissions are orthogonal.
  - summm 5y ago
    For the 1000th time: just don't use those sideloaded apps. Nobody is forcing you to install Facebook or any other trendy app of the day except your own weakness and childishness. The argument goes the other way for actual adults: currently, on android I can only choose between app backup on Google drive, or no backup at all. I cant firewall untrusted apps. or disable intrusive features. With full access (i.e. root) I can do all those things that improve my privacy tremendously. However currently phone manufacturers in concert with Google make it harder and harder to control your own phone. I'm calling out android here because it seems to follow apple regarding the war on general computation.
ClumsyPilot 5y ago
"I want a device that has a single trusted root that takes a hard stance on all apps" Every corporate IT department configures windows this way
webmobdev 5y ago
What you are asking can be implemented in the phone OS. Apple's macOS shows one way to do it - System Integrity Protection - https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection ... you need to disable it in macOS to make any system changes, like installing a Kernel Extension. Another way is how you have to jump through some hoops to enable root or unlock the bootloader in some phones.
Synaesthesia 5y ago
Maybe don't blindly trust a corporate entity that doesnt have your interests at heart snd had been oroven before to be cooperating with the NSA and foreign state entities
dmz73 5y ago
China.

by chomp 5y ago

bobviolier 5y ago

I mean, you don't _have_ to install another marketplace for apps.

chomp 5y ago
I do not want the option to install other apps, because it gives me plausible deniability when my employer or someone is like “install this app or you’re fired”. Or if someone gets a hold of my phone and now I have a brand new app with all permissions installed. Having the ability to side load gives the ability to people to coerce you into installing things that wouldn’t fly under a single root model. I do not feel that computing is headed to a good place in terms of privacy and I feel like giving the Googles, Facebooks, and spyware companies more levers to pull is going in the wrong direction. (Well, maybe the right direction under normal circumstances if the tech industry was more ethical)
- marderfarker2 5y ago
  Just recently my company’s HR forced us to download a payroll vendor’s app on our phones. The app was downloaded from the App Store.
  - extra88 5y ago
    Because it’s from the Apple App Store, you can be reasonably sure it does what it says and isn’t monitoring your communications. You can also use permissions to deny it things like background app refresh or location data.
    - celsoazevedo 5y ago
      No review from Apple is a downside, but I doubt iOS' system permissions are tied to the App Store. On Android (and Windows/macOS, to a certain extent), the OS asks you if you let <app> access/use <feature> independently of how the app was installed. Also, can apps monitor your communications on iOS? On Android you can replace the apps that control calls, sms, etc, but that wasn't possible on iOS last time I used it.
      - extra88 5y ago
        To be honest, I don’t know what an app literally can’t do on an iOS device (or Android device), regardless of how it gets there. I expect there are private APIs that could be exploited to do things an app otherwise couldn’t do that could be against the user’s interests.
        celsoazevedo 5y ago
        Apps on iOS and Android run inside a sandbox. If Apple allows apps to bypass the sandbox like that, then iOS isn't very secure/private. I know there are downsides if they allow sideloading, but iOS is very restrictive and Apple would still control iOS. They can add more restrictions and fix flaws if needed.
- ginko 5y ago
  >I do not want the option to install other apps, because it gives me plausible deniability when my employer or someone is like “install this app or you’re fired” Tell your employer to give you a work phone then. No way I'm going to install work-related sw on a private device.
- ClumsyPilot 5y ago
  If you are being abused by your employer, and you want the rest of society to help, the way to do that is though employment law, and not through taking away rights from the rest of us and giving them to Apple
- celsoazevedo 5y ago
  > Or if someone gets a hold of my phone and now I have a brand new app with all permissions installed. System permissions aren't tied to the App Store as far as I know (same on Android). You still need to give apps permission to access your camera, mic, location, etc. While allowing sideloading would bypass Apple's review process (which can be bad), if someone has that type of access to your phone, there's nothing stopping them from installing tracking/spyware apps from the App Store right now.
- northwest65 5y ago
  >install this app or you’re fired What sort of backward country do you live in where that's even remotely legal?
- ThatPlayer 5y ago
  >it gives me plausible deniability when my employer or someone is like “install this app or you’re fired” Employers can already sideload through MDM. If anything MDM will give them more control than just an app.
- heavyset_go 5y ago
  > I do not want the option to install other apps, because it gives me plausible deniability when my employer or someone is like “install this app or you’re fired”. Employers have enterprise certificates and ability to install custom apps on both iOS and Android, and they can do so while bypassing their respective app stores.

doobeeus 5y ago

Apple does not actually "take a hard stance on all apps to make sure they're not abusing privileges" though they say that they do in their advertising.

chomp 5y ago
I see plenty of complaints from devs about Apple dropping their app because it runs unverified code, and that’s enough for me to know that the system is working.
- Dah00n 5y ago
  If you read HN regularly you also know the app store has a huge share of scam apps that Apple has been made aware of multiple times and that perfectly legitimate apps gets removed for strange and suspect reasons (like because Apple is making a competing app for example). Earth's population shouldn't be forced to do something for your sake. If you have a problem like what you mention with your job, solving it for yourself is much better than wanting to force something on everyone. It's very egotistical to even think that another person shouldn't be able to sideload apps because you have a shitty boss or job.

stale2002 5y ago

> if I want a device that does not allow sideloading It's pretty simple. Just don't sideload apps. Or perhaps there could be a setting that you turn on, that disallows sideloading. If you turn on a setting, that disallows sideloading, then in that case you would have a platform that does what you want.

danaris 5y ago
This does not solve the problem. If sideloading is available, there will be a nonzero number of developers who choose to provide their app only through sideloading, and eschew Apple's App Store. Some of these will be doing so merely so they don't have to take the extra effort (or pay the extra money) to submit apps to Apple. No malicious intent, but they still won't be reviewed, so unintentional danger can still get through. Others will be deliberately avoiding Apple's App Review so they can steal your passwords and spy on your banking apps, or hell, just install a rootkit if there's one available at the time. And still others will be trying to create commercial-grade apps that provide full functionality, but can violate your privacy without asking permission because that's their business model (particularly Facebook and Google). And some of these will replace apps that are currently available from the App Store, with all the protections that entails. Particularly Facebook and Google.
- the8472 5y ago
  > Others will be deliberately avoiding Apple's App Review so they can steal your passwords and spy on your banking apps, or hell, just install a rootkit if there's one available at the time. Sideloading and app permissions are orthogonal.
- summm 5y ago
  For the 1000th time: just don't use those sideloaded apps. Nobody is forcing you to install Facebook or any other trendy app of the day except your own weakness and childishness. The argument goes the other way for actual adults: currently, on android I can only choose between app backup on Google drive, or no backup at all. I cant firewall untrusted apps. or disable intrusive features. With full access (i.e. root) I can do all those things that improve my privacy tremendously. However currently phone manufacturers in concert with Google make it harder and harder to control your own phone. I'm calling out android here because it seems to follow apple regarding the war on general computation.

ClumsyPilot 5y ago

"I want a device that has a single trusted root that takes a hard stance on all apps" Every corporate IT department configures windows this way

webmobdev 5y ago

What you are asking can be implemented in the phone OS. Apple's macOS shows one way to do it - System Integrity Protection - https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection ... you need to disable it in macOS to make any system changes, like installing a Kernel Extension. Another way is how you have to jump through some hoops to enable root or unlock the bootloader in some phones.

Synaesthesia 5y ago

Maybe don't blindly trust a corporate entity that doesnt have your interests at heart snd had been oroven before to be cooperating with the NSA and foreign state entities

dmz73 5y ago

China.