4 ms·

> The important thing to appreciate is that App Tracking Transparency isn't something Apple can enforce with code Wait - why not? Apple controls iOS, they cont

> The important thing to appreciate is that App Tracking Transparency isn't something Apple can enforce with code Wait - why not? Apple controls iOS, they control the sandbox apps run in. Of all protections, app tracking seems like they aren't really fixing the problem by using monopoly power and threatening to pull apps.

whimsicalism 4y ago
It is pretty difficult to ensure that tracking IDs are not passed between apps with a sandbox. The legal enforcement is a much bigger deal on these things.
kec 4y ago
How do you keep an application from taking an entitlement it shouldn't have (such as location or bluetooth access for fingerprinting) via code? Sandboxes can be enforced via entitlement checks in code, but the act of holding an entitlement is policy.
- hermitdev 4y ago
  Surely the entitlements are enforced via code on iOS, right? It cannot be on the honor system.
  - kec 4y ago
    Using the entitlements are enforced at runtime yes, but granting them in the first place is enforced at app review time. If an app asserts an entitlement the developer can't justify it will fail review.
- sitharus 4y ago
  The usual way - entitlements are held in a kernel data structure, and the kernel and associated system services won't allow access to APIs when the entitlement isn't there. Try it on iOS, if you don't have the right entitlements system API calls will fail.
- deleted 4y ago
  [deleted]
simondotau 4y ago
The entitlement cannot be enforced by the kernel. There is literally no API call associated with it. If the user requests no third-party tracking, there's literally no API for the sandbox to lock out. The entitlement is enforced by legal contract. The only thing stopping Meta from blatantly ignoring this policy is the fear of consequences by Apple.
- everforward 4y ago
  Then the corollary is that viruses can't be stopped, because there's no "don't install viruses" API call? Apple can absolutely make API changes to prevent tracking. They could implement DNS blocking as part of the DNS lookup API. They could add a toggle that requires the user to whitelist any network connections. They could do analysis and provide users reports of which apps they think are doing tracking, with options to disable whichever feature they think is accomplishing the tracking. They could add temporary grants (i.e. "allow network access for the next 15 seconds"). Hell, Apple doesn't even need it's own app store to threaten Meta. They can blacklist binaries and network connections at the OS layer. Apple likes this setup because they remain the gatekeepers of users, which is extremely profitable.
native_samples 4y ago
It's because "tracking" isn't a well defined thing to begin with, so it can't be enforced in code because. Doing so would require privacy advocates to figure out precisely what it is they are getting upset about.

whimsicalism 4y ago

It is pretty difficult to ensure that tracking IDs are not passed between apps with a sandbox. The legal enforcement is a much bigger deal on these things.

kec 4y ago

How do you keep an application from taking an entitlement it shouldn't have (such as location or bluetooth access for fingerprinting) via code? Sandboxes can be enforced via entitlement checks in code, but the act of holding an entitlement is policy.

hermitdev 4y ago
Surely the entitlements are enforced via code on iOS, right? It cannot be on the honor system.
- kec 4y ago
  Using the entitlements are enforced at runtime yes, but granting them in the first place is enforced at app review time. If an app asserts an entitlement the developer can't justify it will fail review.
sitharus 4y ago
The usual way - entitlements are held in a kernel data structure, and the kernel and associated system services won't allow access to APIs when the entitlement isn't there. Try it on iOS, if you don't have the right entitlements system API calls will fail.
deleted 4y ago
[deleted]

simondotau 4y ago

The entitlement cannot be enforced by the kernel. There is literally no API call associated with it. If the user requests no third-party tracking, there's literally no API for the sandbox to lock out. The entitlement is enforced by legal contract. The only thing stopping Meta from blatantly ignoring this policy is the fear of consequences by Apple.

everforward 4y ago
Then the corollary is that viruses can't be stopped, because there's no "don't install viruses" API call? Apple can absolutely make API changes to prevent tracking. They could implement DNS blocking as part of the DNS lookup API. They could add a toggle that requires the user to whitelist any network connections. They could do analysis and provide users reports of which apps they think are doing tracking, with options to disable whichever feature they think is accomplishing the tracking. They could add temporary grants (i.e. "allow network access for the next 15 seconds"). Hell, Apple doesn't even need it's own app store to threaten Meta. They can blacklist binaries and network connections at the OS layer. Apple likes this setup because they remain the gatekeepers of users, which is extremely profitable.

native_samples 4y ago

It's because "tracking" isn't a well defined thing to begin with, so it can't be enforced in code because. Doing so would require privacy advocates to figure out precisely what it is they are getting upset about.