3 ms·

So we have a technological solution to cross-app tracking, and we'd downgrade to a regulatory process that hopefully fines companies enough to actually cause a

by judge2020 4y ago

So we have a technological solution to cross-app tracking, and we'd downgrade to a regulatory process that hopefully fines companies enough to actually cause a difference. Oh, and you'd better hope those companies are actually located withing the EU or US, because if you PII gets siphoned to China you won't get any remediation whatsoever (at least for as long as they remain the world's manufacturing capital).

Apocryphon 4y ago
> we'd downgrade to a regulatory process that hopefully fines companies enough to actually cause a difference It is not a downgrade, because for those who live in democracies, such regulations are decided by we, the people, and thus we should ultimately place our faith in the democratic system, not in any private corporation, no matter how benevolent-seeming. > because if you PII gets siphoned to China you won't get any remediation whatsoever Evidence that this isn't already happening anyway? Whither current iOS users in China? > at least for as long as they remain the world's manufacturing capital Don't worry, Apple is hard at work shifting their supply chain to India and Vietnam. Right? Right?
- judge2020 4y ago
  > Evidence that this isn't already happening anyway? Whither current iOS users in China? I'm taking about a situation where a government, say a fictional United States, implements privacy regulations. For any legitimate company, they must follow these to operate in the United States. In this scenario, the Government has no way to protect vulnerable citizens who search "free clash of clans gems ios", download a third-party app store provided by some data company in China, and have their PII beamed to servers in China (bonus points if it uses a zero-day to do something like purchase a bunch of product from Amazon or otherwise use the person's phone as a zombie in a botnet or money-laundering scheme). This is currently impossible on iOS without the data firm having something like a hacked Apple Enterprise account it's using to distribute software outside of the App Store, where it's checked to ensure IDFA compliance and levels of static/dynamic behavior analysis & preventing JIT code compilation or most things that could run unaudited code.
  - Apocryphon 4y ago
    Then Apple will have to harden iOS's security model further. Do you doubt that they can? They've been able to, so far. For one thing, they'll likely be able to force notarization by default for all apps, regardless of origin.
    - judge2020 4y ago
      Most of Apple's security model is inherit to the human auditing and binary analysis that happens during app store submission; the inherit nature of computer software is to have unintended behavior due to unforeseen input and state. As Craig said, "Today, we have a level of malware on the Mac that we don’t find acceptable and that is much worse than iOS" https://www.cnbc.com/2021/05/19/apples-head-of-software-says-current-level-of-mac-malware-is-not-acceptable.html https://www.cnbc.com/2021/05/19/apples-head-of-software-says...
      - Apocryphon 4y ago
        Ah, well I stand corrected on that point. My other points also stand. I've also speculated elsewhere that perhaps Apple could open source binary analysis tools, or at least present some sort of public-facing service to scan binaries. They could manage the semi-opening of their platform themselves, if they wanted to. https://news.ycombinator.com/item?id=32170848 https://news.ycombinator.com/item?id=32170848

Apocryphon 4y ago

> we'd downgrade to a regulatory process that hopefully fines companies enough to actually cause a difference It is not a downgrade, because for those who live in democracies, such regulations are decided by we, the people, and thus we should ultimately place our faith in the democratic system, not in any private corporation, no matter how benevolent-seeming. > because if you PII gets siphoned to China you won't get any remediation whatsoever Evidence that this isn't already happening anyway? Whither current iOS users in China? > at least for as long as they remain the world's manufacturing capital Don't worry, Apple is hard at work shifting their supply chain to India and Vietnam. Right? Right?

judge2020 4y ago
> Evidence that this isn't already happening anyway? Whither current iOS users in China? I'm taking about a situation where a government, say a fictional United States, implements privacy regulations. For any legitimate company, they must follow these to operate in the United States. In this scenario, the Government has no way to protect vulnerable citizens who search "free clash of clans gems ios", download a third-party app store provided by some data company in China, and have their PII beamed to servers in China (bonus points if it uses a zero-day to do something like purchase a bunch of product from Amazon or otherwise use the person's phone as a zombie in a botnet or money-laundering scheme). This is currently impossible on iOS without the data firm having something like a hacked Apple Enterprise account it's using to distribute software outside of the App Store, where it's checked to ensure IDFA compliance and levels of static/dynamic behavior analysis & preventing JIT code compilation or most things that could run unaudited code.
- Apocryphon 4y ago
  Then Apple will have to harden iOS's security model further. Do you doubt that they can? They've been able to, so far. For one thing, they'll likely be able to force notarization by default for all apps, regardless of origin.
  - judge2020 4y ago
    Most of Apple's security model is inherit to the human auditing and binary analysis that happens during app store submission; the inherit nature of computer software is to have unintended behavior due to unforeseen input and state. As Craig said, "Today, we have a level of malware on the Mac that we don’t find acceptable and that is much worse than iOS" https://www.cnbc.com/2021/05/19/apples-head-of-software-says-current-level-of-mac-malware-is-not-acceptable.html https://www.cnbc.com/2021/05/19/apples-head-of-software-says...
    - Apocryphon 4y ago
      Ah, well I stand corrected on that point. My other points also stand. I've also speculated elsewhere that perhaps Apple could open source binary analysis tools, or at least present some sort of public-facing service to scan binaries. They could manage the semi-opening of their platform themselves, if they wanted to. https://news.ycombinator.com/item?id=32170848 https://news.ycombinator.com/item?id=32170848