6 ms·

> Allow users to install apps from third-party app stores and sideload directly from the internet. While I love the idea of being able to finally install SNES

by ttul 4y ago

> Allow users to install apps from third-party app stores and sideload directly from the internet. While I love the idea of being able to finally install SNES emulators and the like, many malicious actors will now pray on unsuspecting iOS users to install spyware, malware, and other crap via third-party app stores. Not everyone is as sophisticated as the typical Hacker News reader; younger and more naive users will be taken in as victims of various types of fraud. I think that a better path for the European Union would have been to force some regulation of the app store process. Leave in place the parts of Apple's process that provide reasonable guarantees of security and privacy for users, but allow Apple to continue to be the gatekeeper, just with some oversight from regulators. There are plenty of examples of governments regulating things that we might wish to be a little freer if only such additional freedom didn't come with perilous consequences for consumers. I submit the example of cryptocurrencies. Lots of freedom; very little regulation; many vulnerable people have lost their savings.

mattnewton 4y ago
> While I love the idea of being able to finally install SNES emulators and the like, many malicious actors will now pray on unsuspecting iOS users to install spyware, malware, and other crap via third-party app stores. Not everyone is as sophisticated as the typical Hacker News reader; younger and more naive users will be taken in as victims of various types of fraud. Think of the naive users argument has never made sense to me, just allow someone to flip a switch in settings that says “do not flip or your phone could be taken over by hostile viruses” or something to that effect. If someone is going to flip that switch and then install what someone tells them over the phone, why wouldn’t the attacker just ask for them to log into a fake bank site at that point? How much is the App Store saving them?
- ttul 4y ago
  Let me sketch a scenario for you. Your grandmother receives an email from a trustworthy-sounding man who asks her to follow these easy steps to get a free app. Granny taps "Allow third-party app stores" and then installs whatever garbage the fraudster is hoping she will install. Multiply this by tens of thousands of vulnerable users and you have the makings of a significant problem that will cost society a lot of money and lead to much misery. With the locked-down Apple app store, it's very difficult for granny to install malware even if the trustworthy-sounding man in her inbox is being "helpful". But as soon as you allow a switch of any kind, it will be exploited.
  - mattnewton 4y ago
    Both my grandmothers used to run android phones and windows computers where this is possible and neither were ever successfully attacked this way. However, one grandmother did experience people trying to scam her into giving them money through other means. I think simply requiring a “I know what I am doing and want to open up the hood” button is sufficient.
  - stale2002 4y ago
    > With the locked-down Apple app store If people actually cared about this argument, then they would jump to the immediate and obvious solution to it. Simply allow users to choose an option, that allows the phone to be locked down. If you want to go hardcore, make it require a factory reset to change, if you actually care that much. This way everyone wins. People who want some locked down, gimped phone, can choose to do that. And everyone else can choose to not turn on "child mode".
  - simion314 4y ago
    Let me update your scenario, instead of the innocent granny installing an iOS app the evil dude asks her to just give her the security code she just revived from a bank, or she should open a link and login to her bank. I think you need a Big Brother for your granny, Apple needs to make Safari granny proof and whitelist websites and they should also force user to provide a national ID before calling to an iOS device, think of all the grannies. Imagine though an universe where Apple could hire some competent people that could create a genius popup that would explain granny that she should not enable that, and to enable that maybe she needs to use a code that is printed on the phone box.
robonerd 4y ago
The "malicious actors" argument can be made anywhere people have freedom of association. The postal system, the phone system, even the mere right to walk out your front door. These all allow people to associate with whoever they please, and they all expose people to malicious actors.
zeroonetwothree 4y ago
This has been true for computers forever and somehow we’ve survived.
tsimionescu 4y ago
> I submit the example of cryptocurrencies. Lots of freedom; very little regulation; many vulnerable people have lost their savings. And yet the solution isn't for your bank to white-list what you're going to do with your money, is it? This would be the equivalent of the app store: your bank would have a "transaction store" of companies you're allowed to send and receive money from, to protect you from accidentally sending money to a scammer. Do you think that would be a good solution for banking? If not, why do you think it is a good solution for software distribution? Instead of course, the right solution is legislate against the bad actors, and have law enforcement agencies that take malware seriously and pursue those who have created it. Additionally, educating the public, at least with mandatory courses in school for the new generations, about basic computer safety is another part of the fix for this.

by ttul 4y ago

mattnewton 4y ago

> While I love the idea of being able to finally install SNES emulators and the like, many malicious actors will now pray on unsuspecting iOS users to install spyware, malware, and other crap via third-party app stores. Not everyone is as sophisticated as the typical Hacker News reader; younger and more naive users will be taken in as victims of various types of fraud. Think of the naive users argument has never made sense to me, just allow someone to flip a switch in settings that says “do not flip or your phone could be taken over by hostile viruses” or something to that effect. If someone is going to flip that switch and then install what someone tells them over the phone, why wouldn’t the attacker just ask for them to log into a fake bank site at that point? How much is the App Store saving them?

ttul 4y ago
Let me sketch a scenario for you. Your grandmother receives an email from a trustworthy-sounding man who asks her to follow these easy steps to get a free app. Granny taps "Allow third-party app stores" and then installs whatever garbage the fraudster is hoping she will install. Multiply this by tens of thousands of vulnerable users and you have the makings of a significant problem that will cost society a lot of money and lead to much misery. With the locked-down Apple app store, it's very difficult for granny to install malware even if the trustworthy-sounding man in her inbox is being "helpful". But as soon as you allow a switch of any kind, it will be exploited.
- mattnewton 4y ago
  Both my grandmothers used to run android phones and windows computers where this is possible and neither were ever successfully attacked this way. However, one grandmother did experience people trying to scam her into giving them money through other means. I think simply requiring a “I know what I am doing and want to open up the hood” button is sufficient.
- stale2002 4y ago
  > With the locked-down Apple app store If people actually cared about this argument, then they would jump to the immediate and obvious solution to it. Simply allow users to choose an option, that allows the phone to be locked down. If you want to go hardcore, make it require a factory reset to change, if you actually care that much. This way everyone wins. People who want some locked down, gimped phone, can choose to do that. And everyone else can choose to not turn on "child mode".
- simion314 4y ago
  Let me update your scenario, instead of the innocent granny installing an iOS app the evil dude asks her to just give her the security code she just revived from a bank, or she should open a link and login to her bank. I think you need a Big Brother for your granny, Apple needs to make Safari granny proof and whitelist websites and they should also force user to provide a national ID before calling to an iOS device, think of all the grannies. Imagine though an universe where Apple could hire some competent people that could create a genius popup that would explain granny that she should not enable that, and to enable that maybe she needs to use a code that is printed on the phone box.

robonerd 4y ago

The "malicious actors" argument can be made anywhere people have freedom of association. The postal system, the phone system, even the mere right to walk out your front door. These all allow people to associate with whoever they please, and they all expose people to malicious actors.

zeroonetwothree 4y ago

This has been true for computers forever and somehow we’ve survived.

tsimionescu 4y ago

> I submit the example of cryptocurrencies. Lots of freedom; very little regulation; many vulnerable people have lost their savings. And yet the solution isn't for your bank to white-list what you're going to do with your money, is it? This would be the equivalent of the app store: your bank would have a "transaction store" of companies you're allowed to send and receive money from, to protect you from accidentally sending money to a scammer. Do you think that would be a good solution for banking? If not, why do you think it is a good solution for software distribution? Instead of course, the right solution is legislate against the bad actors, and have law enforcement agencies that take malware seriously and pursue those who have created it. Additionally, educating the public, at least with mandatory courses in school for the new generations, about basic computer safety is another part of the fix for this.