6 ms·

I appreciate that requiring the use of the App Store makes security easier but I think the current situation gives Apple and Governments too much power over dev

I appreciate that requiring the use of the App Store makes security easier but I think the current situation gives Apple and Governments too much power over developers and users. Side-loading should be permitted. I am okay with it not being allowed by default but it should be something a user can override.

simion314 5y ago
With the NSO revelations we know that Apple can secure their own apps and from the other releases of zero days we know Apple is bad at communicating with security researchers and that their automatic security review is a joke, honestly someone motivated could implement a better security scanner that could actually catch the "private" API usage though we all know that the solution is to not have private/hidden APIs that are shared only with special apps like Apple ones and partners. TLDR there could be a safer store alternative.
- HatchedLake721 5y ago
  I think you deeply misunderstand what it takes to run a marketplace generating $60+ billion revenue and serving over billion users thinking “we can just run a safer store ourselves” by “simply implementing better security scanner”
  - simion314 5y ago
    >I think you deeply misunderstand what it takes to run a marketplace generating $60+ billion revenue A monopoly is an easy way to do it, then inconsistent review and bad security scanners are irrelevant, you need to add some PR team to try to defend all the bad stuff and misdirect.
keehun 5y ago
One of the salient points Apple makes in the document is that by the mere ability for sideloading to be possible, it would be forced upon users by schools and jobs. It also opens an entirely new attack vector by spoofing and other means of deceiving the user into either sideloading an app they didn't mean to.
- horsawlarway 5y ago
  Except all of those things exist in the wild today - using the enterprise management tools that Apple already provides. Apple is happy as can be to let enterprise (and schools/gov/etc) force users to install apps. They just fight tooth and fucking nail to hang onto their rent-seeking in the app store. As a customer, you're getting fucked twice.
  - kenferry 5y ago
    Those mandated apps still go through App Store review. Apple’s point is those entities would bypass review if they could.
    - horsawlarway 5y ago
      I don't believe this is true (disclosure: I'm about 2 years out of date). Last I checked - you can distribute private & proprietary apps using an enterprise deployment provisioning profile. It requires that the signing entity (usually an enterprise) is registered with Apple (and pays a $300 fee), but it does not require store review.
    - frumper 5y ago
      This is definitely not true. I publish enterprise apps for my org and there is no review
      - Hamuko 5y ago
        I guess it's telling in a way of the PR push if users believe that Apple is constantly and always protecting them, even when they do absolutely nothing.
    - jjcon 5y ago
      > Those mandated apps still go through App Store review. Not true - the company can push whatever they like to their managed devices making that whole line of argument moot
  - 5y ago

simion314 5y ago

With the NSO revelations we know that Apple can secure their own apps and from the other releases of zero days we know Apple is bad at communicating with security researchers and that their automatic security review is a joke, honestly someone motivated could implement a better security scanner that could actually catch the "private" API usage though we all know that the solution is to not have private/hidden APIs that are shared only with special apps like Apple ones and partners. TLDR there could be a safer store alternative.

HatchedLake721 5y ago
I think you deeply misunderstand what it takes to run a marketplace generating $60+ billion revenue and serving over billion users thinking “we can just run a safer store ourselves” by “simply implementing better security scanner”
- simion314 5y ago
  >I think you deeply misunderstand what it takes to run a marketplace generating $60+ billion revenue A monopoly is an easy way to do it, then inconsistent review and bad security scanners are irrelevant, you need to add some PR team to try to defend all the bad stuff and misdirect.

keehun 5y ago

One of the salient points Apple makes in the document is that by the mere ability for sideloading to be possible, it would be forced upon users by schools and jobs. It also opens an entirely new attack vector by spoofing and other means of deceiving the user into either sideloading an app they didn't mean to.

horsawlarway 5y ago
Except all of those things exist in the wild today - using the enterprise management tools that Apple already provides. Apple is happy as can be to let enterprise (and schools/gov/etc) force users to install apps. They just fight tooth and fucking nail to hang onto their rent-seeking in the app store. As a customer, you're getting fucked twice.
- kenferry 5y ago
  Those mandated apps still go through App Store review. Apple’s point is those entities would bypass review if they could.
  - horsawlarway 5y ago
    I don't believe this is true (disclosure: I'm about 2 years out of date). Last I checked - you can distribute private & proprietary apps using an enterprise deployment provisioning profile. It requires that the signing entity (usually an enterprise) is registered with Apple (and pays a $300 fee), but it does not require store review.
  - frumper 5y ago
    This is definitely not true. I publish enterprise apps for my org and there is no review
    - Hamuko 5y ago
      I guess it's telling in a way of the PR push if users believe that Apple is constantly and always protecting them, even when they do absolutely nothing.
  - jjcon 5y ago
    > Those mandated apps still go through App Store review. Not true - the company can push whatever they like to their managed devices making that whole line of argument moot
- 5y ago