6 ms·

> Apple-signed binaries tied to developer profiles prevent the vast majority of abuses. More unsubstantiated claims > Third party App Store? No problem. Non

> Apple-signed binaries tied to developer profiles prevent the vast majority of abuses. More unsubstantiated claims > Third party App Store? No problem. Nonsense. Giving people choice does not mean opening the floodgates to malware. You can disable sideloading apps by default, but also enable them upon explicit user request. You can call it a "I'm a responsible adult" button. You don't need walled gardens for this. A sensible safe default with a pathway to disabling it is sufficient. You can't restrict choice for everyone just because a couple of tech-illiterate folks might make bad choices. It's silly and soon also illegal.

fingerlocks 4y ago
I just gave you a fairly straightforward and realistic method of malware injection into an app. Signed binaries prevent me from re-uploading the malware. What is unsubstantiated here? And despite repeated claims of the loud and ignorant, you can side load to an iPhone without jail break. it does require a mere $100 a year and handful of terminal commands, but possible if you’re determined. I’m willing to belabor your last point: the floodgates can open if all the restrictions are relaxed. One very dangerous system call[0] stands between Webkit and your choice of any browser engine. It’s not clear to me on a technical level if allowing that freedom to exploit by one app prevents any app from exploiting. [0] https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man2/mmap.2.html https://developer.apple.com/library/archive/documentation/Sy...
- unity1001 4y ago
  > I just gave you a fairly straightforward and realistic method of malware injection into an app Now provide the statistics for it.
  - Spivak 4y ago
    Statistics for a thing that’s currently impossible due to Apple’s current policies?
    - alaric410 4y ago
      Apple loves to claim that Apple is more secure, without offering any data to back it up.
- alaric410 4y ago
  > I just gave you a fairly straightforward and realistic method of malware injection into an app. Signed binaries prevent me from re-uploading the malware. What is unsubstantiated here? You have not demonstrated that this is a serious and widespread problem. People have been sideloading for years without getting overrun with malware.
  - fingerlocks 4y ago
    I don’t believe you’re arguing in good faith because you ignore my responses and keep repeating the same demands for data. Is there any data in the universe that could wobble your staunch view a little bit? What would that data look like? I digress. I use both platforms daily. I’ve been working on smartphones since they’ve existed. I live and breathe them. Android has some great upsides, but security is definitely not one of them. Six years ago at a previous employer we had cardboard boxes full of completely bricked android phones from the Triada Trojan.[0] I have never seen anything like that on an iPhone. I can’t even recall witnessing a bricked iPhone (sans hw failure), but I won’t deny the possibility. [0]https://www.google.com/amp/s/usa.kaspersky.com/blog/triada-trojan/6802/amp/ https://www.google.com/amp/s/usa.kaspersky.com/blog/triada-t... Just a cursory search shows things haven’t improved much since: https://news.ycombinator.com/item?id=32154294 https://news.ycombinator.com/item?id=32154294 https://news.ycombinator.com/item?id=32084635 https://news.ycombinator.com/item?id=32084635 https://news.ycombinator.com/item?id=23027184 https://news.ycombinator.com/item?id=23027184
alickz 4y ago
> You can call it a "I'm a responsible adult" button. Apple even have the copy for it signed off by Steve Jobs. “Are you sure you want to open the application ‘Monkey Ball’ from the developer ‘Sega’?” https://embed.documentcloud.org/documents/21043913-2008-may-steve-jobs-scott-forstall-sideloading-was-a-thing/#document/p1 https://embed.documentcloud.org/documents/21043913-2008-may-... https://www.theverge.com/c/22611236/epic-v-apple-emails-project-liberty-app-store-schiller-sweeney-cook-jobs https://www.theverge.com/c/22611236/epic-v-apple-emails-proj...

fingerlocks 4y ago

I just gave you a fairly straightforward and realistic method of malware injection into an app. Signed binaries prevent me from re-uploading the malware. What is unsubstantiated here? And despite repeated claims of the loud and ignorant, you can side load to an iPhone without jail break. it does require a mere $100 a year and handful of terminal commands, but possible if you’re determined. I’m willing to belabor your last point: the floodgates can open if all the restrictions are relaxed. One very dangerous system call[0] stands between Webkit and your choice of any browser engine. It’s not clear to me on a technical level if allowing that freedom to exploit by one app prevents any app from exploiting. [0] https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man2/mmap.2.html https://developer.apple.com/library/archive/documentation/Sy...

unity1001 4y ago
> I just gave you a fairly straightforward and realistic method of malware injection into an app Now provide the statistics for it.
- Spivak 4y ago
  Statistics for a thing that’s currently impossible due to Apple’s current policies?
  - alaric410 4y ago
    Apple loves to claim that Apple is more secure, without offering any data to back it up.
alaric410 4y ago
> I just gave you a fairly straightforward and realistic method of malware injection into an app. Signed binaries prevent me from re-uploading the malware. What is unsubstantiated here? You have not demonstrated that this is a serious and widespread problem. People have been sideloading for years without getting overrun with malware.
- fingerlocks 4y ago
  I don’t believe you’re arguing in good faith because you ignore my responses and keep repeating the same demands for data. Is there any data in the universe that could wobble your staunch view a little bit? What would that data look like? I digress. I use both platforms daily. I’ve been working on smartphones since they’ve existed. I live and breathe them. Android has some great upsides, but security is definitely not one of them. Six years ago at a previous employer we had cardboard boxes full of completely bricked android phones from the Triada Trojan.[0] I have never seen anything like that on an iPhone. I can’t even recall witnessing a bricked iPhone (sans hw failure), but I won’t deny the possibility. [0]https://www.google.com/amp/s/usa.kaspersky.com/blog/triada-trojan/6802/amp/ https://www.google.com/amp/s/usa.kaspersky.com/blog/triada-t... Just a cursory search shows things haven’t improved much since: https://news.ycombinator.com/item?id=32154294 https://news.ycombinator.com/item?id=32154294 https://news.ycombinator.com/item?id=32084635 https://news.ycombinator.com/item?id=32084635 https://news.ycombinator.com/item?id=23027184 https://news.ycombinator.com/item?id=23027184

alickz 4y ago

> You can call it a "I'm a responsible adult" button. Apple even have the copy for it signed off by Steve Jobs. “Are you sure you want to open the application ‘Monkey Ball’ from the developer ‘Sega’?” https://embed.documentcloud.org/documents/21043913-2008-may-steve-jobs-scott-forstall-sideloading-was-a-thing/#document/p1 https://embed.documentcloud.org/documents/21043913-2008-may-... https://www.theverge.com/c/22611236/epic-v-apple-emails-project-liberty-app-store-schiller-sweeney-cook-jobs https://www.theverge.com/c/22611236/epic-v-apple-emails-proj...