3 ms·

I own about 4-5 computers and 3 phones. One of those computers is a Mac and one of the phones is an iPhone. The only claim I made was that I would be more satis

by pg_bot 5y ago

I own about 4-5 computers and 3 phones. One of those computers is a Mac and one of the phones is an iPhone. The only claim I made was that I would be more satisfied if the iPhone could support third party stores or sideloading. I will continue to stand by that claim.

tshaddox 5y ago
I don't dispute your prediction that you would be more satisfied if your iPhone could support third party stores or sideloading. My prediction is about customer satisfaction in aggregate.
- pg_bot 5y ago
  I don't understand your logic here. Adding additional third party stores wouldn't affect the availability of Apps in the App Store if Apple is truly providing value to customers. If third party stores or sideloading is not valuable, most people would continue to use the App Store exclusively. Almost all developers would continue listing their App on the App Store as well. If third party app stores and sideloading do provide value, then consumers will use those methods to get their apps. I don't get why anyone would be less happy to get software directly from a vendor. If I am dissatisfied there is always an intermediary (bank / credit card company) to intervene on my behalf if an actor is behaving badly. Can you elaborate on why you believe people would be unhappy if this were the case? I truly don't understand the position.
  - tshaddox 5y ago
    For the most blatant example, if it was possible to sideload software, people would be convinced to install software that deliberately does back things or unintentionally causes system-wide problems. There would be crap all over the Internet about how to get free stuff in Fortnite, or read your spouse's messages, or record phone calls, or clean malware off your phone, etc. No matter how many warnings there are in the UI or how clear Apple is that it's your fault if you do this, people will do it. Some of the software might even work! But some of it will be blatant malware, or violate privacy even worse than current popular apps, or make the whole system unstable, or drain battery life. Even for relatively savvy people who are aware of the danger, suddenly you need to become an expert on how to protect yourself and spot malware or scams (this is already advisable to some extent with the App Store, but it would surely become much more crucial). It's worse for less savvy people who aren't aware of the danger, as I'm sure is the case with many current iPhone users.
    - bradknowles 5y ago
      Indeed, this even happens today with the current system, because Apple does allow alternative app stores. You just have to have the right type of corporate account with them, and a Mobile Device Manager profile that you distribute to all your devices that you want to have the alternate App Store. Apple uses this internally for delivering apps to employees who work at the retail Apple stores. I helped support the Retail Software Engineering group at Apple that develops those applications. One of the current common advanced methods is for attackers to get you to install their MDM profile on your device, and then they can do anything at all that they want with it, regardless. Fortunately, it’s only possible to have one MDM profile on a machine at a time, so if you install your own MDM profile (e.g. through JAMF or whatever), then you can prevent this type of attack from working. Yes, everyone in my family already has an MDM profile installed on their devices from a system I manage, so that we can prevent this type of attack. So, Apple already supports alternative app stores. You just have pay for a license from Apple that lets you run it. With more recent versions of iOS, they offer device profiles that can be installed, so that the owner doesn’t even have to run their own app store. They can just provide you links to apps to be installed, and the signed device profile to go along with them so that Apple will allow the app to be installed. And this will even work if there is already an MDM profile installed on the device. I know this because I recently started work at a new employer, and they gave me device profiles to install on my personal iPhone, so that I could install some internal applications on it. And those device profiles were installed and activated, despite the fact that I already had my personal MDM profile installed on the device. So, now the attack pattern is even easier. You no longer have to install a full MDM profile, you can just install a simple developer device profile and get the person at the other end to trust you. Okay, you won’t have full control over the device like you would with a full MDM profile, but at least you’ll be able to get your nefarious app onto their device. So, this is a known, active vulnerability that is currently being exploited on regular basis by attackers. Apple knows exactly what this looks like in the small scale, and they know what will happen in the large scale. I suspect that Apple will show the politicians what the risk is on their own personal devices, and then show them how many people around the world already get tricked on a daily basis. Once the politicians see how that sausage is made, I think they’re going to want to roll back any requirements for mandatory alternative app stores.

by pg_bot 5y ago

tshaddox 5y ago

I don't dispute your prediction that you would be more satisfied if your iPhone could support third party stores or sideloading. My prediction is about customer satisfaction in aggregate.

pg_bot 5y ago
I don't understand your logic here. Adding additional third party stores wouldn't affect the availability of Apps in the App Store if Apple is truly providing value to customers. If third party stores or sideloading is not valuable, most people would continue to use the App Store exclusively. Almost all developers would continue listing their App on the App Store as well. If third party app stores and sideloading do provide value, then consumers will use those methods to get their apps. I don't get why anyone would be less happy to get software directly from a vendor. If I am dissatisfied there is always an intermediary (bank / credit card company) to intervene on my behalf if an actor is behaving badly. Can you elaborate on why you believe people would be unhappy if this were the case? I truly don't understand the position.
- tshaddox 5y ago
  For the most blatant example, if it was possible to sideload software, people would be convinced to install software that deliberately does back things or unintentionally causes system-wide problems. There would be crap all over the Internet about how to get free stuff in Fortnite, or read your spouse's messages, or record phone calls, or clean malware off your phone, etc. No matter how many warnings there are in the UI or how clear Apple is that it's your fault if you do this, people will do it. Some of the software might even work! But some of it will be blatant malware, or violate privacy even worse than current popular apps, or make the whole system unstable, or drain battery life. Even for relatively savvy people who are aware of the danger, suddenly you need to become an expert on how to protect yourself and spot malware or scams (this is already advisable to some extent with the App Store, but it would surely become much more crucial). It's worse for less savvy people who aren't aware of the danger, as I'm sure is the case with many current iPhone users.
  - bradknowles 5y ago
    Indeed, this even happens today with the current system, because Apple does allow alternative app stores. You just have to have the right type of corporate account with them, and a Mobile Device Manager profile that you distribute to all your devices that you want to have the alternate App Store. Apple uses this internally for delivering apps to employees who work at the retail Apple stores. I helped support the Retail Software Engineering group at Apple that develops those applications. One of the current common advanced methods is for attackers to get you to install their MDM profile on your device, and then they can do anything at all that they want with it, regardless. Fortunately, it’s only possible to have one MDM profile on a machine at a time, so if you install your own MDM profile (e.g. through JAMF or whatever), then you can prevent this type of attack from working. Yes, everyone in my family already has an MDM profile installed on their devices from a system I manage, so that we can prevent this type of attack. So, Apple already supports alternative app stores. You just have pay for a license from Apple that lets you run it. With more recent versions of iOS, they offer device profiles that can be installed, so that the owner doesn’t even have to run their own app store. They can just provide you links to apps to be installed, and the signed device profile to go along with them so that Apple will allow the app to be installed. And this will even work if there is already an MDM profile installed on the device. I know this because I recently started work at a new employer, and they gave me device profiles to install on my personal iPhone, so that I could install some internal applications on it. And those device profiles were installed and activated, despite the fact that I already had my personal MDM profile installed on the device. So, now the attack pattern is even easier. You no longer have to install a full MDM profile, you can just install a simple developer device profile and get the person at the other end to trust you. Okay, you won’t have full control over the device like you would with a full MDM profile, but at least you’ll be able to get your nefarious app onto their device. So, this is a known, active vulnerability that is currently being exploited on regular basis by attackers. Apple knows exactly what this looks like in the small scale, and they know what will happen in the large scale. I suspect that Apple will show the politicians what the risk is on their own personal devices, and then show them how many people around the world already get tricked on a daily basis. Once the politicians see how that sausage is made, I think they’re going to want to roll back any requirements for mandatory alternative app stores.