3 ms·

the first two are very important questions. For example, if I make $500 “unhackablePhone”, where it literally doesn’t run web apps and every app is vetted by to

by judge2020 4y ago

the first two are very important questions. For example, if I make $500 “unhackablePhone”, where it literally doesn’t run web apps and every app is vetted by top-talent security researchers for weeks, and then I sell billions of these devices, do I then have to open up the ecosystem to allow anyone to be able to take a phone, punch in the passcode, and install a third party App Store? This is synonymous with the current iPhone situation as many people only buy it for the benefit of Apple screening everything that can run on their phone, albeit at a lower security level where some mistakes are fine assuming Apple almost never allows known exploits to exist on the most up-to-date iOS release.

frostburg 4y ago
Yes. Users will just elect not to do that if they want to benefit from your curation.
- judge2020 4y ago
  The selling point for this theoretical device is that, even if someone steals your passcode, it can’t be hacked. This enabled evil maid (or customs processors, nation-state agencies, etc) attacks on the most vulnerable users looking to have defense-in-depth. To avoid this it seems you’d either be forced to sell it at an insane markup (to avoid having too many users) or means test people to make sure they don’t purchase it if they’re not super vulnerable to attacks that matter.
  - Vogtinator 4y ago
    Or just have a way that prevents those kind of attacks. Like having the trusted bootloader light a LED or show a hash code of the configuration on screen.
    - judge2020 4y ago
      What are the chances some third-party OS vendor complains that they have to work with iBoot to launch their OS and demand they be able to replace it?
  - stale2002 4y ago
    I think there are easy to think of solutions to the problem, that let's everyone win. The obvious solution, for your hypothetical, would be to give a setting to the user, that turns on "safe mode" and make this setting only changeable on factory reset. So any user could choose, at startup, to have safe mode on or off, on their own device. Problem solved.
  - shaky-carrousel 4y ago
    Easy, do it like android. In (some) android devices you can unlock the bootloader. But doing so will inevitably wipe out the device.
  - leereeves 4y ago
    You wouldn't need to do anything to prevent people from buying it. The restrictions inherent in the device (including only having a few apps that have been thoroughly reviewed by security researchers) would keep most people away.
visarga 4y ago
The App Store is a garbage dump anyway. There are few apps you can pay upfront, the rest are ad-infested or require you to repeatedly do in app purchases to keep using them, to the point that I can't find games for my kids.
- colinmhayes 4y ago
  You can run DNS based ad blockers on iOS. It’s just a setting you change, mine is called adguard. Still get YouTube ads, but most others are blocked.
  - wnkrshm 4y ago
    But in theory, someone controlling a walled garden could do the same that youtube does with any kind of content. If the app doesn't work in a transparent manner anymore, you can just shoehorn unblockable ads into it.
    - colinmhayes 4y ago
      Sort of, it’d be tough though. YouTube ads aren’t blocked because they’re not using a third party ad vendor. They’re big enough that they run their own auctions. The vast majority of services aren’t capable of creating the auction themselves, so their ads can be blocked.
hoffs 4y ago
Well people who chose to use other app store don't get access to your curated list of apps. They still remain your selling point
- judge2020 4y ago
  > Well people who chose to use other app store don't get access to your curated list of apps This is how Xbox currently works in that you can’t play any regular games if you enable developer mode to run unsigned code. I’m going to go out on a limb here and say that, if Apple complied by disabling apps downloaded via their own store when a user is using a 3p store, then the EU would laugh and fine then $x millions of dollars per week.
M2Ys4U 4y ago
>For example, if I make $500 “unhackablePhone”, where it literally doesn’t run web apps and every app is vetted by top-talent security researchers for weeks, and then I sell billions of these devices, do I then have to open up the ecosystem to allow anyone to be able to take a phone, punch in the passcode, and install a third party App Store? Well that would depend, are you a "gatekeeper", as defined in the Regulation? That is, do you have a significant impact on the EU's internal market (a turnover of €7.5bn or a €75bn market cap), provide a core platform service which is important for business users to reach end users (have have 45m monthly active end-users in the EU or 10k monthly active business users), enjoy an entrenched and durable position in your operations or foresee that you will enjoy such a position in the near future (i.e. you meet the above for three consecutive years)? If you answered "no" to any part of that then you are not a gatekeeper, and these regulations do not apply to you.
- creato 4y ago
  It seems clear that the hypothetical company would meet this definition, and the regulation would completely defeat the purpose of the proposed company. I don’t know how useful this particular hypothetical is, but it’s definitely a “code smell” that the proposed company’s seemingly only options would be to limit sales to retain the “not a gatekeeper” status or stop doing business in the EU.
piaste 4y ago
> This is synonymous with the current iPhone situation as many people only buy it for the benefit of Apple screening everything that can run on their phone I would love to read some surveys on this matter, because I highly doubt that security/privacy is a significant factor for more than a few percent points of iPhone buyers. (I base this hypothesis on the fact that, in virtually every field of technology, end users have shown that they will overwhelmingly sacrifice privacy and security in exchange for convenience and cost savings.) I expect that the main motivations for iPhone purchases are aesthetics, performance, ease of use, integration with the Apple ecosystem, and especially fashion/status symbol factor. As for the rest of the comment, as other people have already pointed out, you can prevent evil maid attacks by putting the legally-required "open" mode behind a factory reset. Which is roughly what Android phones do with their unlockable bootloaders.
- warkdarrior 4y ago
  Apple's advertising for the last few years has continuously focused on privacy. There must be some interest from iPhone buyers if Apple spends their advertising money this way.
bluSCALE4 4y ago
"assuming Apple almost never allows known exploits to exist on the most up-to-date iOS release" That's a false assumption. At the end of the day, consumers aren't children. If they so choose to destroy what the manufacturer gives them, that is their choice. I did some cool things with early Android that made the phone tailored to me. If I wanted stock, it was just a reflash away. This is the way.
hirako2000 4y ago
They will still be able to choose the apple ecosystem. Feigning to see? The regulation is to put a stop to walled gardens tynany. The players this regulation target are pretty obvious. It's those that have gained such market dominance along the years that it has become unfair competition for newer players. It is the outcome of years of consumer pressures and entrepreneurs who are calling out for some government actions because markets are regulated anyway everywhere in the world, and these US based companies (for the most part for now) have lobbied along the years to get away with their practice but the EU has decided their lobbying won't do with them. At least not anymore.

frostburg 4y ago

Yes. Users will just elect not to do that if they want to benefit from your curation.

judge2020 4y ago
The selling point for this theoretical device is that, even if someone steals your passcode, it can’t be hacked. This enabled evil maid (or customs processors, nation-state agencies, etc) attacks on the most vulnerable users looking to have defense-in-depth. To avoid this it seems you’d either be forced to sell it at an insane markup (to avoid having too many users) or means test people to make sure they don’t purchase it if they’re not super vulnerable to attacks that matter.
- Vogtinator 4y ago
  Or just have a way that prevents those kind of attacks. Like having the trusted bootloader light a LED or show a hash code of the configuration on screen.
  - judge2020 4y ago
    What are the chances some third-party OS vendor complains that they have to work with iBoot to launch their OS and demand they be able to replace it?
- stale2002 4y ago
  I think there are easy to think of solutions to the problem, that let's everyone win. The obvious solution, for your hypothetical, would be to give a setting to the user, that turns on "safe mode" and make this setting only changeable on factory reset. So any user could choose, at startup, to have safe mode on or off, on their own device. Problem solved.
- shaky-carrousel 4y ago
  Easy, do it like android. In (some) android devices you can unlock the bootloader. But doing so will inevitably wipe out the device.
- leereeves 4y ago
  You wouldn't need to do anything to prevent people from buying it. The restrictions inherent in the device (including only having a few apps that have been thoroughly reviewed by security researchers) would keep most people away.

visarga 4y ago

The App Store is a garbage dump anyway. There are few apps you can pay upfront, the rest are ad-infested or require you to repeatedly do in app purchases to keep using them, to the point that I can't find games for my kids.

colinmhayes 4y ago
You can run DNS based ad blockers on iOS. It’s just a setting you change, mine is called adguard. Still get YouTube ads, but most others are blocked.
- wnkrshm 4y ago
  But in theory, someone controlling a walled garden could do the same that youtube does with any kind of content. If the app doesn't work in a transparent manner anymore, you can just shoehorn unblockable ads into it.
  - colinmhayes 4y ago
    Sort of, it’d be tough though. YouTube ads aren’t blocked because they’re not using a third party ad vendor. They’re big enough that they run their own auctions. The vast majority of services aren’t capable of creating the auction themselves, so their ads can be blocked.

hoffs 4y ago

Well people who chose to use other app store don't get access to your curated list of apps. They still remain your selling point

judge2020 4y ago
> Well people who chose to use other app store don't get access to your curated list of apps This is how Xbox currently works in that you can’t play any regular games if you enable developer mode to run unsigned code. I’m going to go out on a limb here and say that, if Apple complied by disabling apps downloaded via their own store when a user is using a 3p store, then the EU would laugh and fine then $x millions of dollars per week.

M2Ys4U 4y ago

>For example, if I make $500 “unhackablePhone”, where it literally doesn’t run web apps and every app is vetted by top-talent security researchers for weeks, and then I sell billions of these devices, do I then have to open up the ecosystem to allow anyone to be able to take a phone, punch in the passcode, and install a third party App Store? Well that would depend, are you a "gatekeeper", as defined in the Regulation? That is, do you have a significant impact on the EU's internal market (a turnover of €7.5bn or a €75bn market cap), provide a core platform service which is important for business users to reach end users (have have 45m monthly active end-users in the EU or 10k monthly active business users), enjoy an entrenched and durable position in your operations or foresee that you will enjoy such a position in the near future (i.e. you meet the above for three consecutive years)? If you answered "no" to any part of that then you are not a gatekeeper, and these regulations do not apply to you.

creato 4y ago
It seems clear that the hypothetical company would meet this definition, and the regulation would completely defeat the purpose of the proposed company. I don’t know how useful this particular hypothetical is, but it’s definitely a “code smell” that the proposed company’s seemingly only options would be to limit sales to retain the “not a gatekeeper” status or stop doing business in the EU.

piaste 4y ago

> This is synonymous with the current iPhone situation as many people only buy it for the benefit of Apple screening everything that can run on their phone I would love to read some surveys on this matter, because I highly doubt that security/privacy is a significant factor for more than a few percent points of iPhone buyers. (I base this hypothesis on the fact that, in virtually every field of technology, end users have shown that they will overwhelmingly sacrifice privacy and security in exchange for convenience and cost savings.) I expect that the main motivations for iPhone purchases are aesthetics, performance, ease of use, integration with the Apple ecosystem, and especially fashion/status symbol factor. As for the rest of the comment, as other people have already pointed out, you can prevent evil maid attacks by putting the legally-required "open" mode behind a factory reset. Which is roughly what Android phones do with their unlockable bootloaders.

warkdarrior 4y ago
Apple's advertising for the last few years has continuously focused on privacy. There must be some interest from iPhone buyers if Apple spends their advertising money this way.

bluSCALE4 4y ago

"assuming Apple almost never allows known exploits to exist on the most up-to-date iOS release" That's a false assumption. At the end of the day, consumers aren't children. If they so choose to destroy what the manufacturer gives them, that is their choice. I did some cool things with early Android that made the phone tailored to me. If I wanted stock, it was just a reflash away. This is the way.

hirako2000 4y ago

They will still be able to choose the apple ecosystem. Feigning to see? The regulation is to put a stop to walled gardens tynany. The players this regulation target are pretty obvious. It's those that have gained such market dominance along the years that it has become unfair competition for newer players. It is the outcome of years of consumer pressures and entrepreneurs who are calling out for some government actions because markets are regulated anyway everywhere in the world, and these US based companies (for the most part for now) have lobbied along the years to get away with their practice but the EU has decided their lobbying won't do with them. At least not anymore.