13 ms·

There's several very good provisions in this legislation (3rd party payment processors, non-preferential treatment for 1st party apps), there are several that h

There's several very good provisions in this legislation (3rd party payment processors, non-preferential treatment for 1st party apps), there are several that have a mix of upsides and downsides (sideloading is one--I personally like knowing that Facebook can't ask people to sideload some privacy destroying crap on iOS). Then there's: - Allow developers to integrate their apps and digital services directly with those belonging to a gatekeeper. This includes making messaging, voice-calling, and video-calling services interoperable with third-party services upon request. - Give developers access to any hardware feature, such as "near-field communication technology, secure elements and processors, authentication mechanisms, and the software used to control those technologies." Apps will use near-field communication technology and other mechanisms to track us (consider how many device related APIs have restrictions in web browsers for just this reason), and I think it's credible that the interoperability requirements are going to be used to smash end-to-end encrypted messaging. You can have a decentralized end to end encrypted protocol. Can you retrofit every existing messaging service to use it in the short-term? Probably not. As an end user, the things that give developers maximum freedom are not necessarily the things that let me use my device with maximum freedom. I support people who want a FOSS device that is in no way locked down. I just don't want that, because I don't want to play systems administrator for an always on tracker in my pocket.

erk__ 4y ago
The near-field communication have a clear reason. Apple was only allowing access to their own banking app as a payment provider in shops. As I understand there was not even a way to get access with any kind of forms or such if you had a competing plastic card firm. That is pretty much the only reason that clause is the legislation.
- madeofpalk 4y ago
  > there was not even a way to get access with any kind of forms or such if you had a competing plastic card firm What does this mean? Apple is not a payment processor. The banks sign deals with Apple put make their cards available through Apple Pay, but the payment still goes through the payment networks (visa, mastercard, amex) and the banks.
  - martin_a 4y ago
    Don't you think that's actually a problem? Apple can dictacte all the conditions and if they don't like anything, $PaymentNetwork will just not work with Apple devices at all with no option to change that by installing another app?
  - enragedcacti 4y ago
    They aren't a payment processor, they are a payment provider. You are correct that most banks have deals with Apple and thus cards are available, but Paypal, Venmo, Cashapp, Google Pay, etc. can't be used as a default payment provider for purchases on the iPhone. Apple reportedly makes about 0.15% of each purchase through Apple Pay[1]. [1] http://www.macrumors.com/2014/09/12/more-apple-pay-details/ http://www.macrumors.com/2014/09/12/more-apple-pay-details/
    - jahewson 4y ago
      Of course they can’t, because they’re not credit/debit cards. What’s the PoS going to do with a PayPal NFC? Nothing. It’s like complaining they don’t support bitcoin - neither do the stores!
      - vorpalhex 4y ago
        This is incorrect. Paypal DOES issue virtual cards that can do NFC through your phone, the same as Google Pay.
      - cycomanic 4y ago
        There are lots of payment services that are not credit/debit cards and are widely used (swish in Sweden is another one). All these cannot use NFC on IOS.
  - erk__ 4y ago
    A example from Denmark would be MobilePay [0] which is the most use payment solution for mobiles in Denmark. They would like to make it possible to use NFC to transfer information about a transaction in shops, but cannot do that on Apple Phones. Instead they rely on QR codes and short number codes for payment. They cannot in any way get NFC access on Apple devices as it is now. Another and probably more relevant concrete example of the above is the Danish Dankort [1] which is a national equivalent of visa/mastercard/amex. Again they cannot use NFC for their app. Some banks have signed contracts that allows their users to use Dankort with Apple pay, but it is not all of them yet. I don't know if there is any fee or similar to Apple pay tbh, but if there is then NFC acces should not be monopolized by Apple. [0]: https://en.wikipedia.org/wiki/MobilePay https://en.wikipedia.org/wiki/MobilePay [1]: https://en.wikipedia.org/wiki/Dankort https://en.wikipedia.org/wiki/Dankort
Someone 4y ago
I think (and hope) the platform will still be allowed to pop up a “do you want to give this app permission to do Foo?” dialog, as long as it does so the same for all apps, independent of developer or app store it was downloaded from. I also would hope the platform can still restrict browsers in what they can do, as long as that’s applied uniformly across all browsers, but I’m less certain about that.
- grishka 4y ago
  So, exactly how Android does?
rekoil 4y ago
I haven't read the DMA/DSA, so if this is actually written out in them then I'll happily be corrected here. The way I see it, the EU probably doesn't really care if Apple keep ALL the restrictions they currently have on their App Store in actuality, as long as options exist on the platform. So the solution to allowing access to NFC hardware will probably just be Apple opening up sideloading. I personally hope that Apple implements sideloading in a way that allows those who don't want to use it to keep their device secure, and I'm confident they will. Regarding the messaging platforms, I'm pretty sure the EU are not going to push us into a situation where E2E is broken, in fact, I was under the impression that the bills specifically required that E2E be maintained.
- layer8 4y ago
  Maybe Apple will lift some of the App Store restrictions for Europe in order to reduce the need for sideloading. They certainly don’t want their customers to become used to sideloading all the time and stop primarily using the App Store.
  - rekoil 4y ago
    Yeah this seems likely to me as well, I was more or less just making a point that there are more than one ways to be compliant with certain parts of the DMA.
- devStorms 4y ago
  I'm worried that apps that does not honor user's privacy would just leave App Store and have users sideload their app. Sometimes users have very little choice about whether or not to use certain phenomenal IM/social apps since everyone is using them and it would be a problem if they can now force user to sideload their unrestricted/unaudited version.
  - idle_zealot 4y ago
    Some might try this move, but my guess is that sideloading will involve enough friction that user retention will drop and developers will be heavily disincentivized from relying on it for distribution. In particular I expect that every update will require user action to re-install the new version of every sideloaded app, which is the reason most developers don't go that route on Android today.
patrickaljord 4y ago
> I just don't want that, because I don't want to play systems administrator for an always on tracker in my pocket. You should stop using smartphones then.
blfr 4y ago
> I think it's credible that the interoperability requirements are going to be used to smash end-to-end encrypted messaging Why and how? I already use Signal to handle the plain old, almost completely unencrypted text messages. It has no impact on security of Signal-to-Signal communication.
- jachee 4y ago
  If Signal is forced to interoperate with e.g. WhatsApp, the end-to-end encryption of one or both will have to be compromised. If the integration is forced, then there’s no barrier for either app grabbing all the info from the other in plain-text.
  - concinds 4y ago
    > If Signal is forced to interoperate with e.g. WhatsApp, the end-to-end encryption of one or both will have to be compromised Wrong https://matrix.org/blog/2022/03/25/interoperability-without-sacrificing-privacy-matrix-and-the-dma https://matrix.org/blog/2022/03/25/interoperability-without-...
- judge2020 4y ago
  My take on this is that they want iOS to integrate RCS directly into Messages, given tons of other features are already widely supported by the os [0][1][2]. Google Messages (runs on top of RCS) currently only provides encryption when both sides are using Google Messages, so unless Apple and Google create a unified standard it won't be E2EE. 0: https://developer.apple.com/documentation/callkit https://developer.apple.com/documentation/callkit 1: https://developer.apple.com/documentation/usernotificationsui/customizing_the_appearance_of_notifications https://developer.apple.com/documentation/usernotificationsu... 2: https://developer.apple.com/documentation/usernotifications/untextinputnotificationresponse https://developer.apple.com/documentation/usernotifications/...
  - threeseed 4y ago
    RCS is such an awful protocol that is seriously going to harm users. It was clearly designed to allow governments to maintain their ability to monitor user communications at scale.
ryandrake 4y ago
> As an end user, the things that give developers maximum freedom are not necessarily the things that let me use my device with maximum freedom. From the article's list, even the ones that are described with "allow users to" are firmly aligned with 3rd party developer's best interests, not aligned with the end user's best interest. There was once a time when these were roughly the same, but I don't think anyone can agree this is true anymore. It's gotten so bad that I'd guess that the platform owners' interests are more closely aligned with the end user's interests than 3rd party developers. It's more of a triangle though with nobody's best interests aligned.
saurik 4y ago
> Allow developers to integrate their apps and digital services directly with those belonging to a gatekeeper. This includes making messaging, voice-calling, and video-calling services interoperable with third-party services upon request. I would think this requirement is satisfied merely by providing a public API / protocol documentation for your protocol, to allow for third-party access and integration, not some weird backend integration that everyone has to support. This would have effects on business models of running chat services for free and it would have an effect on how they handle spam and abuse, but I honestly think both of these changes are likely to be for the better... Now, I (importantly) have NOT read the actual law text yet, but given the high-level summaries I feel like a lot of people have been worried about this over nothing: having the ability to write a third-party iMessage client would ALLOW someone to build a server-mediated client for it, but I think that SHOULD be allowed, I don't think that in any way destroys the ability to create or use end-to-end clients and services, it would also allow people to build alternative e2e clients and even integrations (imagine a Samsung Android device shipping with iMessage support in their local client) without hurting the existence of end-to-end encryption.
- judge2020 4y ago
  They already do this to an extent[0], but maybe they're trying to make iMessage interop with RCS by force. 0: https://developer.apple.com/documentation/callkit https://developer.apple.com/documentation/callkit
  - Deukhoofd 4y ago
    Let's be real, within the EU the main communication platform is WhatsApp. This is very much aimed there, as that is most definitely not a public API.
  - threeseed 4y ago
    This one I can definitely see backfiring for the EU. Apple will just release a MessagesKit (maybe even an Android version) which will allow third party apps to read/write messages to the network. Which will simply grow its footprint and promote inoperability.
seydor 4y ago
Developers are end users too
cycomanic 4y ago
Can we stop pretending that Apple has the users best interest in mind? They just want to be the gatekeeper for lucrative applications/functions so they can charge for it. That they somehow convinced apple users that it's somehow in their interest just shows how good their marketing is.
- hyperpape 4y ago
  Apple is a company, and it’s interested in making profits. Right now, its methods of making profits are slightly more aligned with what privacy conscious users desire than some other companies’, and that’s good. Apple absolutely needs to be checked in other ways—-the fact that it’s selling advertising while setting policies that hurt other advertisers stinks to high heaven. Let antitrust rake them over the coals for that.
  - samatman 4y ago
    I don't agree with the second paragraph at all. Apple sets a restrictive and privacy-centric set of rules for advertisers, which it then follows. The fact that this is a problem for other advertising companies is an indictment of those companies and their bleak surveillance-enabling business model. Contrast this with the "use WebKit or go home" rule, which, like it or not, is favoring Apple's product over others. It's not like these advertising policies are "be headquartered in Cupertino", it's "if you want to track our users you must ask them first".
    - judge2020 4y ago
      Exactly. This is the popup for app store personalized ads[0], which is a full-screen popup that forces you to choose one or the other before you can access the app. It's super transparent and easy to decline the personalization. 0: https://videoweek.com/wp-content/uploads/2021/09/Apple-permission-1.jpg https://videoweek.com/wp-content/uploads/2021/09/Apple-permi...
      - majewsky 4y ago
oaiey 4y ago
There is nothing in this article which would prohibit the gatekeepers to extensively warn the user when accessing these features. Apple had tons of trust from its users. They can just say that this third party usage is dangerous one the first time and re - reporting bad usage later.
DavideNL 4y ago
> Apps will use near-field communication technology and other mechanisms to track us So, then do not allow any apps the NFC permission... problem solved. The point is, Apple should not be the one dictating what users can and can not use; Example: on macOS you can disable SIP. 99% of the people i know do not even know what SIP is, nor that this possibility exists. However, if we/Developers/researchers/etc. want it, they can choose to do as they like. Which is really useful. Researchers should not be limited in finding (security) flaws, neither should users be limited by Apple to use their hardware as they wish.
- threeseed 4y ago
  > So, then do not allow any apps the NFC permission... problem solved. So the world of malware, viruses, data exfiltration, phishing etc is "solved ?
- martimarkov 4y ago
  The main problem is that users can be tricked to do it. Used to happen to my parents all the time on Android. They'd install random apps and the website will "guide" them how to install this app by going to settings and enabling "untrusted developers". This is my issue with all these devs screaming at apple. Your customers chose a product for whatever reason. Don't like it? I don't care - respect their choices. It speaks volumes to me how much they will respect me and my privacy when they want to optimise for their own profits instead of my XP and privacy.
  - DavideNL 4y ago
    > "The main problem is that users can be tricked to do it." That's because the GUI is badly implemented; On macOS, your parents would never disable SIP (system integrity protection), because it's quite cumbersome to disable and there are enough warnings and hurdles. This is already has been reality for years: it is simply not an issue.
  - dingleberry420 4y ago
    What happened to personal agency? Let people make mistakes, you don't need to infantilize them.
deleted 4y ago
[deleted]
krzyk 4y ago
All that already exists on Android and the negatives didn't happen (with modern android versions), on the contrary. My phone supports multiple payment vendors using nfc. I can have Tasker do magic with my phone etc.
- stjohnswarts 4y ago
  And that's great! but why force apple to do it when it doesn't have a monopoly status in the phone market?
  - kaba0 4y ago
    Because they have better hardware I would like to use, but can’t on a supposedly general purpose handheld computer I paid a shitton of money for.
  - pavlov 4y ago
    Because it will be a benefit to consumers? The EU has the authority to create new regulations, it’s not limited to antitrust.
    - KerrAvon 4y ago
      It will not be a benefit to consumers. If I have a choice of an Android phone or an Android-like phone with an Apple logo on it, I don’t have a real choice.
      - stale2002 4y ago
        Sure you do have a real choice. Simply only use the Apple app store and you will have the same phone you had before.
        jlokier 4y ago
        > Simply only use the Apple app store and you will have the same phone you had before. That's not really true. Apps you need and currently use may well be moved from the Apple app store. For example WhatsApp. Some people have to use it, not because they want to. Some have to use it for work. One day they may have to install the Meta app store to get WhatsApp, and agree to permissions and access to their personal data that they don't like at all, because there will be no gatekeeping pressure from Apple on WhatsApp to not do that. Maybe Chrome, the world's only browser by then that most sites are tested on, will require the Google app store with special advertisement and behaviour influencing hooks enabled. Don't like them? No Chrome for you and your banking website doesn't work on your phone. Maybe the banking apps will move to SecurTrust Special Banking App Store With Device Verify(tm) too.
bryanrasmussen 4y ago
>Apps will use near-field communication technology and other mechanisms to track us Ok, well, the EU mandates opening up this tech to apps, some apps then violate GDPR in various ways leading to big fines for those apps. Now someone is going to say fines with GDPR have not been big enough, but I think they are slowly increasing (because really that is typical gov. policy, don't go in with big fines, start small, and later when hitting big you can say but we have been very reasonable), and also, just maybe the fines for people moving into a new field with predatory tracking from the get-go will get the big fines and be shut down quick.
- NonNefarious 4y ago
  "Big fines?" Seriously? How are you going to wring "big fines" out of piddly-ass hacks troweling out junk apps?
  - bryanrasmussen 4y ago
    you don't, you give them the maximum fine and they go out of business. If they don't pay the fine they are criminals, they get removed from platforms they are on.
dingleberry420 4y ago
You can fearmonger all you want, but this is a good thing: People should actually own their devices.
dalbasal 4y ago
This is what you call an awful dichotomy. Security Vs Autonomy... weaponized. I agree with you. I also agree with the other side though. Allowing these monopolies to squat all the bottlenecks in protocols of media and communication channels is also intolerable. It is perfectly reasonable for you as an individual to prefer privacy. It's perfectly reasonable for a regulator to strike at a problem. Look... the can't provide the technical solutions. Mandate a protocol or whatnot. They might, maybe be able that eventually makes adoption of reasonably secure, open protocols happen. WhatsApp can't be the end state. It appears to be the economic Maxima though.
- emn13 4y ago
  It would indeed be bad if the requirement were to scream YOLO and allow all apps to always access potentially privacy eroding features like NFC. But surely the proposal isn't that - is it? If it's merely that the OS be required to be _allow_ NFC features just as it does for first-party apps, what's the risk exactly here? I think these kind of special permission requests work at least sort of reasonably on web-browsers, and less brilliantly but acceptably on android. Yes, users will need to think before clicking OK, but the way those dialogs often work (and surely can work) means that they're no longer conveniently able to throw up take-it-or-leave-it modal dialogs. It's at least a little better than the nonsense that is an EULA. But the real critical issue here is that we should not let ourselves be held hostage by apple. Yes, apple hasn't made it _at all_ easy to secure third party access to potentially privileged functionality. But... that's their _choice._ They choose to make a really high first-party moat, because that's convenient for them. But the alternative isn't throwing users to the wolves, it's actually thinking about how to limit access securely even while delegating access. If we have to wait until big tech decides to do that out of the goodness of their heart... we'll die waiting.
gernb 4y ago
> Facebook can't ask people to sideload some privacy destroying crap on iOS That is arguably the responsibility of the OS and the user. Lots of ways to do that. Examples: Network, no network access unless use gives permission. App manifest lists up to 10 domains or "all". If "all", user is prompted "App would like to access entire network Y/N"? What else is there? Camera access? Camera can be multiple permissions (a) User gives app full access (b) User gives app access only when app is active (c) User doesn't give access. Note: iOS already does a good job at this. I don't give the Messenger app access to my camera, nor do I give it direct access to photos, only selected ones. Same with NFC etc. I'm guessing Apple will come up with clever ways to allow the user to limit access. Bluetooth, no idea what they do here and I don't know bluetooth but I'd just guess devices have ids and the OS could require an app to list a limited id filter so an app can only talk to devices built for that app unless the user gives blanket permission I suppose FB can put an app on another store that doesn't run without full access. If user says "no" then app says "can't run". That's fine. I won't run it. Individual stores are still allowed to enforce their own rules. I can't imagine Apple's store to not be the dominate store and therefore apps from it will be safer. (Unless someone steps up to make an even safer store ;)
takeda 4y ago
> I personally like knowing that Facebook can't ask people to sideload some privacy destroying crap on iOS). No company like Facebook requires app side loading on Android. The side-loading is used for other apps that one way or another couldn't be on Play Store. For example other stores (F-Droid is the most popular with open source applications) or other apps that one way or another are not allowed in the store. Another example is GPSLogger[1], Play Store makes it very difficult to support older versions or Android. Author got frustrated and just moved to alternative store. [1] https://github.com/mendhak/gpslogger/issues/849 https://github.com/mendhak/gpslogger/issues/849
tikiman163 4y ago
Interoperability means that hardware and hardware related OS capabilities have to be accessible to third-party developers. End to end encryption isn't a hardware capability, it's software. Also, they only have to give them a mechanism to access it, they don't have to remove the already existing security mechanisms like notifying the user that an app has requested access to things user contacts or bluetooth. If users don't want to grant an app permissions that's not the fault of the platform developer.
ls15 4y ago
> I support people who want a FOSS device that is in no way locked down. I just don't want that, because I don't want to play systems administrator for an always on tracker in my pocket. Settings > General > Enable Expert Mode Problem solved
raxxorraxor 4y ago
Smartphones would be far more useful devices and we would have a far healthier software landscape if developers could just access these features and deploy software as is. It is the official provisioned apps through proprietary stores that track users far more than apps you can download and install on other systems. Apple would deny this but they have a clear business incentive here. Sure, the user would have the responsibility again but it is easy to explain to them that they shouldn't do anything they have no idea about. > As an end user, the things that give developers maximum freedom are not necessarily the things that let me use my device with maximum freedom. No, that is usually untrue and the distinction is arbitrary. The exception is malicious software perhaps but this is an edge case. But even with that the user can choose to just don't install software he doesn't know. You can be pretty sure the average FOSS device will track you far less than Apple or Google alternatives and it is not even close on pretty much all metrics. You also don't need to play administrator if you don't want to. What tracks you is the random H&M app that has access to bluetooth you got provision through the app store.

erk__ 4y ago

The near-field communication have a clear reason. Apple was only allowing access to their own banking app as a payment provider in shops. As I understand there was not even a way to get access with any kind of forms or such if you had a competing plastic card firm. That is pretty much the only reason that clause is the legislation.

madeofpalk 4y ago
> there was not even a way to get access with any kind of forms or such if you had a competing plastic card firm What does this mean? Apple is not a payment processor. The banks sign deals with Apple put make their cards available through Apple Pay, but the payment still goes through the payment networks (visa, mastercard, amex) and the banks.
- martin_a 4y ago
  Don't you think that's actually a problem? Apple can dictacte all the conditions and if they don't like anything, $PaymentNetwork will just not work with Apple devices at all with no option to change that by installing another app?
- enragedcacti 4y ago
  They aren't a payment processor, they are a payment provider. You are correct that most banks have deals with Apple and thus cards are available, but Paypal, Venmo, Cashapp, Google Pay, etc. can't be used as a default payment provider for purchases on the iPhone. Apple reportedly makes about 0.15% of each purchase through Apple Pay[1]. [1] http://www.macrumors.com/2014/09/12/more-apple-pay-details/ http://www.macrumors.com/2014/09/12/more-apple-pay-details/
  - jahewson 4y ago
    Of course they can’t, because they’re not credit/debit cards. What’s the PoS going to do with a PayPal NFC? Nothing. It’s like complaining they don’t support bitcoin - neither do the stores!
    - vorpalhex 4y ago
      This is incorrect. Paypal DOES issue virtual cards that can do NFC through your phone, the same as Google Pay.
    - cycomanic 4y ago
      There are lots of payment services that are not credit/debit cards and are widely used (swish in Sweden is another one). All these cannot use NFC on IOS.
- erk__ 4y ago
  A example from Denmark would be MobilePay [0] which is the most use payment solution for mobiles in Denmark. They would like to make it possible to use NFC to transfer information about a transaction in shops, but cannot do that on Apple Phones. Instead they rely on QR codes and short number codes for payment. They cannot in any way get NFC access on Apple devices as it is now. Another and probably more relevant concrete example of the above is the Danish Dankort [1] which is a national equivalent of visa/mastercard/amex. Again they cannot use NFC for their app. Some banks have signed contracts that allows their users to use Dankort with Apple pay, but it is not all of them yet. I don't know if there is any fee or similar to Apple pay tbh, but if there is then NFC acces should not be monopolized by Apple. [0]: https://en.wikipedia.org/wiki/MobilePay https://en.wikipedia.org/wiki/MobilePay [1]: https://en.wikipedia.org/wiki/Dankort https://en.wikipedia.org/wiki/Dankort

Someone 4y ago

I think (and hope) the platform will still be allowed to pop up a “do you want to give this app permission to do Foo?” dialog, as long as it does so the same for all apps, independent of developer or app store it was downloaded from. I also would hope the platform can still restrict browsers in what they can do, as long as that’s applied uniformly across all browsers, but I’m less certain about that.

grishka 4y ago
So, exactly how Android does?

rekoil 4y ago

I haven't read the DMA/DSA, so if this is actually written out in them then I'll happily be corrected here. The way I see it, the EU probably doesn't really care if Apple keep ALL the restrictions they currently have on their App Store in actuality, as long as options exist on the platform. So the solution to allowing access to NFC hardware will probably just be Apple opening up sideloading. I personally hope that Apple implements sideloading in a way that allows those who don't want to use it to keep their device secure, and I'm confident they will. Regarding the messaging platforms, I'm pretty sure the EU are not going to push us into a situation where E2E is broken, in fact, I was under the impression that the bills specifically required that E2E be maintained.

layer8 4y ago
Maybe Apple will lift some of the App Store restrictions for Europe in order to reduce the need for sideloading. They certainly don’t want their customers to become used to sideloading all the time and stop primarily using the App Store.
- rekoil 4y ago
  Yeah this seems likely to me as well, I was more or less just making a point that there are more than one ways to be compliant with certain parts of the DMA.
devStorms 4y ago
I'm worried that apps that does not honor user's privacy would just leave App Store and have users sideload their app. Sometimes users have very little choice about whether or not to use certain phenomenal IM/social apps since everyone is using them and it would be a problem if they can now force user to sideload their unrestricted/unaudited version.
- idle_zealot 4y ago
  Some might try this move, but my guess is that sideloading will involve enough friction that user retention will drop and developers will be heavily disincentivized from relying on it for distribution. In particular I expect that every update will require user action to re-install the new version of every sideloaded app, which is the reason most developers don't go that route on Android today.

patrickaljord 4y ago

> I just don't want that, because I don't want to play systems administrator for an always on tracker in my pocket. You should stop using smartphones then.

blfr 4y ago

> I think it's credible that the interoperability requirements are going to be used to smash end-to-end encrypted messaging Why and how? I already use Signal to handle the plain old, almost completely unencrypted text messages. It has no impact on security of Signal-to-Signal communication.

jachee 4y ago
If Signal is forced to interoperate with e.g. WhatsApp, the end-to-end encryption of one or both will have to be compromised. If the integration is forced, then there’s no barrier for either app grabbing all the info from the other in plain-text.
- concinds 4y ago
  > If Signal is forced to interoperate with e.g. WhatsApp, the end-to-end encryption of one or both will have to be compromised Wrong https://matrix.org/blog/2022/03/25/interoperability-without-sacrificing-privacy-matrix-and-the-dma https://matrix.org/blog/2022/03/25/interoperability-without-...
judge2020 4y ago
My take on this is that they want iOS to integrate RCS directly into Messages, given tons of other features are already widely supported by the os [0][1][2]. Google Messages (runs on top of RCS) currently only provides encryption when both sides are using Google Messages, so unless Apple and Google create a unified standard it won't be E2EE. 0: https://developer.apple.com/documentation/callkit https://developer.apple.com/documentation/callkit 1: https://developer.apple.com/documentation/usernotificationsui/customizing_the_appearance_of_notifications https://developer.apple.com/documentation/usernotificationsu... 2: https://developer.apple.com/documentation/usernotifications/untextinputnotificationresponse https://developer.apple.com/documentation/usernotifications/...
- threeseed 4y ago
  RCS is such an awful protocol that is seriously going to harm users. It was clearly designed to allow governments to maintain their ability to monitor user communications at scale.

ryandrake 4y ago

> As an end user, the things that give developers maximum freedom are not necessarily the things that let me use my device with maximum freedom. From the article's list, even the ones that are described with "allow users to" are firmly aligned with 3rd party developer's best interests, not aligned with the end user's best interest. There was once a time when these were roughly the same, but I don't think anyone can agree this is true anymore. It's gotten so bad that I'd guess that the platform owners' interests are more closely aligned with the end user's interests than 3rd party developers. It's more of a triangle though with nobody's best interests aligned.

saurik 4y ago

> Allow developers to integrate their apps and digital services directly with those belonging to a gatekeeper. This includes making messaging, voice-calling, and video-calling services interoperable with third-party services upon request. I would think this requirement is satisfied merely by providing a public API / protocol documentation for your protocol, to allow for third-party access and integration, not some weird backend integration that everyone has to support. This would have effects on business models of running chat services for free and it would have an effect on how they handle spam and abuse, but I honestly think both of these changes are likely to be for the better... Now, I (importantly) have NOT read the actual law text yet, but given the high-level summaries I feel like a lot of people have been worried about this over nothing: having the ability to write a third-party iMessage client would ALLOW someone to build a server-mediated client for it, but I think that SHOULD be allowed, I don't think that in any way destroys the ability to create or use end-to-end clients and services, it would also allow people to build alternative e2e clients and even integrations (imagine a Samsung Android device shipping with iMessage support in their local client) without hurting the existence of end-to-end encryption.

judge2020 4y ago
They already do this to an extent[0], but maybe they're trying to make iMessage interop with RCS by force. 0: https://developer.apple.com/documentation/callkit https://developer.apple.com/documentation/callkit
- Deukhoofd 4y ago
  Let's be real, within the EU the main communication platform is WhatsApp. This is very much aimed there, as that is most definitely not a public API.
- threeseed 4y ago
  This one I can definitely see backfiring for the EU. Apple will just release a MessagesKit (maybe even an Android version) which will allow third party apps to read/write messages to the network. Which will simply grow its footprint and promote inoperability.

seydor 4y ago

Developers are end users too

cycomanic 4y ago

Can we stop pretending that Apple has the users best interest in mind? They just want to be the gatekeeper for lucrative applications/functions so they can charge for it. That they somehow convinced apple users that it's somehow in their interest just shows how good their marketing is.

hyperpape 4y ago
Apple is a company, and it’s interested in making profits. Right now, its methods of making profits are slightly more aligned with what privacy conscious users desire than some other companies’, and that’s good. Apple absolutely needs to be checked in other ways—-the fact that it’s selling advertising while setting policies that hurt other advertisers stinks to high heaven. Let antitrust rake them over the coals for that.
- samatman 4y ago
  I don't agree with the second paragraph at all. Apple sets a restrictive and privacy-centric set of rules for advertisers, which it then follows. The fact that this is a problem for other advertising companies is an indictment of those companies and their bleak surveillance-enabling business model. Contrast this with the "use WebKit or go home" rule, which, like it or not, is favoring Apple's product over others. It's not like these advertising policies are "be headquartered in Cupertino", it's "if you want to track our users you must ask them first".
  - judge2020 4y ago
    Exactly. This is the popup for app store personalized ads[0], which is a full-screen popup that forces you to choose one or the other before you can access the app. It's super transparent and easy to decline the personalization. 0: https://videoweek.com/wp-content/uploads/2021/09/Apple-permission-1.jpg https://videoweek.com/wp-content/uploads/2021/09/Apple-permi...
    - majewsky 4y ago

oaiey 4y ago

There is nothing in this article which would prohibit the gatekeepers to extensively warn the user when accessing these features. Apple had tons of trust from its users. They can just say that this third party usage is dangerous one the first time and re - reporting bad usage later.

DavideNL 4y ago

> Apps will use near-field communication technology and other mechanisms to track us So, then do not allow any apps the NFC permission... problem solved. The point is, Apple should not be the one dictating what users can and can not use; Example: on macOS you can disable SIP. 99% of the people i know do not even know what SIP is, nor that this possibility exists. However, if we/Developers/researchers/etc. want it, they can choose to do as they like. Which is really useful. Researchers should not be limited in finding (security) flaws, neither should users be limited by Apple to use their hardware as they wish.

threeseed 4y ago
> So, then do not allow any apps the NFC permission... problem solved. So the world of malware, viruses, data exfiltration, phishing etc is "solved ?
martimarkov 4y ago
The main problem is that users can be tricked to do it. Used to happen to my parents all the time on Android. They'd install random apps and the website will "guide" them how to install this app by going to settings and enabling "untrusted developers". This is my issue with all these devs screaming at apple. Your customers chose a product for whatever reason. Don't like it? I don't care - respect their choices. It speaks volumes to me how much they will respect me and my privacy when they want to optimise for their own profits instead of my XP and privacy.
- DavideNL 4y ago
  > "The main problem is that users can be tricked to do it." That's because the GUI is badly implemented; On macOS, your parents would never disable SIP (system integrity protection), because it's quite cumbersome to disable and there are enough warnings and hurdles. This is already has been reality for years: it is simply not an issue.
- dingleberry420 4y ago
  What happened to personal agency? Let people make mistakes, you don't need to infantilize them.

deleted 4y ago

[deleted]

krzyk 4y ago

All that already exists on Android and the negatives didn't happen (with modern android versions), on the contrary. My phone supports multiple payment vendors using nfc. I can have Tasker do magic with my phone etc.

stjohnswarts 4y ago
And that's great! but why force apple to do it when it doesn't have a monopoly status in the phone market?
- kaba0 4y ago
  Because they have better hardware I would like to use, but can’t on a supposedly general purpose handheld computer I paid a shitton of money for.
- pavlov 4y ago
  Because it will be a benefit to consumers? The EU has the authority to create new regulations, it’s not limited to antitrust.
  - KerrAvon 4y ago
    It will not be a benefit to consumers. If I have a choice of an Android phone or an Android-like phone with an Apple logo on it, I don’t have a real choice.
    - stale2002 4y ago
      Sure you do have a real choice. Simply only use the Apple app store and you will have the same phone you had before.
      - jlokier 4y ago
        > Simply only use the Apple app store and you will have the same phone you had before. That's not really true. Apps you need and currently use may well be moved from the Apple app store. For example WhatsApp. Some people have to use it, not because they want to. Some have to use it for work. One day they may have to install the Meta app store to get WhatsApp, and agree to permissions and access to their personal data that they don't like at all, because there will be no gatekeeping pressure from Apple on WhatsApp to not do that. Maybe Chrome, the world's only browser by then that most sites are tested on, will require the Google app store with special advertisement and behaviour influencing hooks enabled. Don't like them? No Chrome for you and your banking website doesn't work on your phone. Maybe the banking apps will move to SecurTrust Special Banking App Store With Device Verify(tm) too.

bryanrasmussen 4y ago

>Apps will use near-field communication technology and other mechanisms to track us Ok, well, the EU mandates opening up this tech to apps, some apps then violate GDPR in various ways leading to big fines for those apps. Now someone is going to say fines with GDPR have not been big enough, but I think they are slowly increasing (because really that is typical gov. policy, don't go in with big fines, start small, and later when hitting big you can say but we have been very reasonable), and also, just maybe the fines for people moving into a new field with predatory tracking from the get-go will get the big fines and be shut down quick.

NonNefarious 4y ago
"Big fines?" Seriously? How are you going to wring "big fines" out of piddly-ass hacks troweling out junk apps?
- bryanrasmussen 4y ago
  you don't, you give them the maximum fine and they go out of business. If they don't pay the fine they are criminals, they get removed from platforms they are on.

dingleberry420 4y ago

You can fearmonger all you want, but this is a good thing: People should actually own their devices.

dalbasal 4y ago

This is what you call an awful dichotomy. Security Vs Autonomy... weaponized. I agree with you. I also agree with the other side though. Allowing these monopolies to squat all the bottlenecks in protocols of media and communication channels is also intolerable. It is perfectly reasonable for you as an individual to prefer privacy. It's perfectly reasonable for a regulator to strike at a problem. Look... the can't provide the technical solutions. Mandate a protocol or whatnot. They might, maybe be able that eventually makes adoption of reasonably secure, open protocols happen. WhatsApp can't be the end state. It appears to be the economic Maxima though.

emn13 4y ago
It would indeed be bad if the requirement were to scream YOLO and allow all apps to always access potentially privacy eroding features like NFC. But surely the proposal isn't that - is it? If it's merely that the OS be required to be _allow_ NFC features just as it does for first-party apps, what's the risk exactly here? I think these kind of special permission requests work at least sort of reasonably on web-browsers, and less brilliantly but acceptably on android. Yes, users will need to think before clicking OK, but the way those dialogs often work (and surely can work) means that they're no longer conveniently able to throw up take-it-or-leave-it modal dialogs. It's at least a little better than the nonsense that is an EULA. But the real critical issue here is that we should not let ourselves be held hostage by apple. Yes, apple hasn't made it _at all_ easy to secure third party access to potentially privileged functionality. But... that's their _choice._ They choose to make a really high first-party moat, because that's convenient for them. But the alternative isn't throwing users to the wolves, it's actually thinking about how to limit access securely even while delegating access. If we have to wait until big tech decides to do that out of the goodness of their heart... we'll die waiting.

gernb 4y ago

> Facebook can't ask people to sideload some privacy destroying crap on iOS That is arguably the responsibility of the OS and the user. Lots of ways to do that. Examples: Network, no network access unless use gives permission. App manifest lists up to 10 domains or "all". If "all", user is prompted "App would like to access entire network Y/N"? What else is there? Camera access? Camera can be multiple permissions (a) User gives app full access (b) User gives app access only when app is active (c) User doesn't give access. Note: iOS already does a good job at this. I don't give the Messenger app access to my camera, nor do I give it direct access to photos, only selected ones. Same with NFC etc. I'm guessing Apple will come up with clever ways to allow the user to limit access. Bluetooth, no idea what they do here and I don't know bluetooth but I'd just guess devices have ids and the OS could require an app to list a limited id filter so an app can only talk to devices built for that app unless the user gives blanket permission I suppose FB can put an app on another store that doesn't run without full access. If user says "no" then app says "can't run". That's fine. I won't run it. Individual stores are still allowed to enforce their own rules. I can't imagine Apple's store to not be the dominate store and therefore apps from it will be safer. (Unless someone steps up to make an even safer store ;)

takeda 4y ago

> I personally like knowing that Facebook can't ask people to sideload some privacy destroying crap on iOS). No company like Facebook requires app side loading on Android. The side-loading is used for other apps that one way or another couldn't be on Play Store. For example other stores (F-Droid is the most popular with open source applications) or other apps that one way or another are not allowed in the store. Another example is GPSLogger[1], Play Store makes it very difficult to support older versions or Android. Author got frustrated and just moved to alternative store. [1] https://github.com/mendhak/gpslogger/issues/849 https://github.com/mendhak/gpslogger/issues/849

tikiman163 4y ago

Interoperability means that hardware and hardware related OS capabilities have to be accessible to third-party developers. End to end encryption isn't a hardware capability, it's software. Also, they only have to give them a mechanism to access it, they don't have to remove the already existing security mechanisms like notifying the user that an app has requested access to things user contacts or bluetooth. If users don't want to grant an app permissions that's not the fault of the platform developer.

ls15 4y ago

> I support people who want a FOSS device that is in no way locked down. I just don't want that, because I don't want to play systems administrator for an always on tracker in my pocket. Settings > General > Enable Expert Mode Problem solved

raxxorraxor 4y ago

Smartphones would be far more useful devices and we would have a far healthier software landscape if developers could just access these features and deploy software as is. It is the official provisioned apps through proprietary stores that track users far more than apps you can download and install on other systems. Apple would deny this but they have a clear business incentive here. Sure, the user would have the responsibility again but it is easy to explain to them that they shouldn't do anything they have no idea about. > As an end user, the things that give developers maximum freedom are not necessarily the things that let me use my device with maximum freedom. No, that is usually untrue and the distinction is arbitrary. The exception is malicious software perhaps but this is an edge case. But even with that the user can choose to just don't install software he doesn't know. You can be pretty sure the average FOSS device will track you far less than Apple or Google alternatives and it is not even close on pretty much all metrics. You also don't need to play administrator if you don't want to. What tracks you is the random H&M app that has access to bluetooth you got provision through the app store.