25 ms·

iOS 17 will reportedly set the stage for sideloading apps on iPhone

381 points by mikece 4y ago

jt2190 4y ago
The source for this article is Mark Gurman’s newsletter at Bloomberg: “Apple Plans to Launch More Than Just Its New Headset at WWDC” https://www.bloomberg.com/news/newsletters/2023-04-16/apple-wwdc-2023-june-5-plan-reality-headset-new-macs-watchos-10-ios-17-lgjfj5bf https://www.bloomberg.com/news/newsletters/2023-04-16/apple-...
akmarinov 4y ago
Nice, can’t wait
zapdrive 4y ago
Don't hold your breath over it.
- Simulacra 4y ago
  I, too, am not optimistic but I hope a day comes when my Iphone does not need to be jailbroken..
  - rimliu 4y ago
    Interesting, my iPhone never needed to be jailbroken.
- bogwog 4y ago
  I expect it to be implemented in the most passive-aggressive way possible. Also, it will probably have the same bullshit tricks that Google uses to make it difficult, meaning it will only be useful to tech nerds.
  - EMIRELADERO 4y ago
    That bullshit won't stand up to EU scrutiny though.
  - arlcode 4y ago
    Following the typical cycle of adversial compliance by industry, politicans will immediatly start working on round 2 to plug the holes. I believe this is much better than being to broad on the first attempt. And maybe apple decides that this battle is not worth their time and preempts the need for further regulations.
wahnfrieden 4y ago
EU only. Not in the land of the free.
- ChuckNorris89 4y ago
  How will that geofencing be enforced? Is this EU feature dependent to the place you purchased your device or to the location registered on your Apple account? If you change your location in or out of the EU does it then apply or revert the feature?
  - supriyo-biswas 4y ago
    This isn't as difficult as you make it look. Many Android devices have the concept of carrier-specific configuration files (CSCs) which are baked into the ROM, and phones sold in the region come baked with the variant with only the specific CSCs in question. A similar implementation could be followed by Apple, where they have a separate image for the EU.
    - ChuckNorris89 4y ago
      In EU phones are also sold unlocked without any carrier info baked into the ROM.
      - rickdeckard 4y ago
        Phones of major vendors sold in EU still contain carrier info for the region even if they're sold unlocked. Outside of US and China, Samsung for example ships so-called "Multi-CSC" variants of their devices which permanently apply the region and country of your device on first power-on with a SIM-card. The required information for that is not pulled from the network but is already preloaded in the ROM of the device, a network connection can be used to get an updated version of these profiles though
    - smoldesu 4y ago
      I look forward to the US passing similar laws and getting the upgraded image!
archerx 4y ago
I just want first class PWAs.
- ascagnel_ 4y ago
  iOS 16.4 added a bunch of PWA-focused features. What gaps do you feel still exist?
  - akmarinov 4y ago
    Probably background services and processing, something even native apps can’t do.
  - NoMoreBro 4y ago
    Not OP, but I'd start with a one-click way to "install" the PWA apps using an API, e.g. with a banner (like on Android) instead of an item in the share menu.
    - musictubes 4y ago
      Oh God, this is one of the reasons people hate PWAs. No more banners on websites! I don’t want to see sites even more cluttered.
  - rabuse 4y ago
    More low-level camera access would be a nice improvement. Also, the ability to work with raw video data for trimming/editing.
    - kmlx 4y ago
      that's browser standards territory. also, this: https://developer.mozilla.org/en-US/docs/Web/API/WebCodecs_API https://developer.mozilla.org/en-US/docs/Web/API/WebCodecs_A...
      - rabuse 4y ago
        Ah, sweet. Haven't looked at the Web API specs in a bit, but just remember working with video was a PITA. Thanks.
EMIRELADERO 4y ago
The big question is: will there be some kind of "program" the user and/or developer needs to get into to be able to sideload/distribute independent apps? The ideal status quo would be one where developers can make native apps, and users download and run them, without entering into a contractual relationship with Apple period. (Beyond the iOS EULA, which stands on legally shaky ground)
- kroltan 4y ago
  Speaking of which, if you don't like that kind of thing, never use a Xiaomi phone. It requires registering for a Xiaomi account to "unlock" the bootloader and install alternative operating systems (such as one without most of the spyware - why does the calculator app or the pdf viewer need a privacy policy?) This account registration is baked into the phone while the bootloader is unlocked, and you have to factory-reset the phone and lock it back up to be able to dissociate the account from the phone.
  - mschuster91 4y ago
    That's a side effect of anti-theft measures. Samsung is the same, you can't unlock them any more without signing in into both Samsung and Google accounts which allows the two companies to detect if the device was registered as stolen. And for what it's worth, Samsung is the worst of the bunch anyway as rooting it permanently bricks the TEE via an e-fuse.
    - kroltan 4y ago
      I guess having an account enables that deterrance, but I don't see how it is related to unlocking the bootloader if there was not an account bound beforehand. If signing into an account can be preserved despite the "unlocked" bootloader, there has to be some sort of hypervisor/"secure chip" type deal denying access to the part of the device the account info is stored, no? Otherwise one could erase the account info and pass the device as untainted anyways. So, if that information is secured against alternative operating systems, then there is no harm in allowing them by default or upon local user authorization. In other words, if it was strictly for theft deterrence then surely you would need an account to be able to factory reset the device at all, even with the bootloader locked?
TexanFeller 4y ago
I'm dreading this. I want privacy hostile companies like Facebook to have to comply with the app store rules and respect system settings relating to privacy. As a user, I'm thrilled when Apple wields its big stick to stop big tech companies from overreaching. Before there was a bit of a compromise, I could use evil apps with some peace of mind that they wouldn't do something egregious. Now I suspect evil apps just won't be available in the App Store, or Apple will be forced to relax their control.
- throw10920 4y ago
  What? The most meaningful privacy controls are enforced at the OS layer as technical controls. The thing that prevents Facebook from accessing all your contacts is the design of iOS, not the App Store. Allowing sideloading of apps does nothing to weaken the technical features meant to enable privacy and security that are already in place. In fact, you shouldn't have been relying on the App Store in the first place, as malware/spyware can and does slip through their very human and very fallible approval process. This talking point is so common in every thread about sideloading Apple devices that I can't determine whether it's propaganda or ignorance.
- EMIRELADERO 4y ago
  Maybe it's just me, but I'd rather have my government defending my (and most citizen's) interests (with laws such as GDPR) rather than a private company's rules which, as evidenced by this article's existence, have pretty big "collateral damage".
- overthrow 4y ago
  You're dreading giving other people the freedom to make one choice, and yourself the freedom to make a different choice (yours being the default option from the factory btw), and everyone gets the privacy/control tradeoff they want?
  - Spivak 4y ago
    Software isn't fungible and right now today you have the ability to install facebook with app store restrictions on iOS and without on Android. If FB pulls from the app store that choice is taken away.
29083011397778 4y ago
> Historically, Apple execs including Tim Cook and Craig Federighi have staunchly opposed sideloading citing privacy and security reasons. Which is funny to me, because after flipping through the App Store for an email client, I found, on this heavily curated storefront, a single digit number of apps I would trust with my email credentials. Android, with it's option to "sideload" F-Droid, gives me dramatically more options that I trust. Security and trust do not require locking me out of my own hardware.
- Retric 4y ago
  Apps you trust is a really poor security mechanism for the general public. The Apple App Store is a dumpster fire, but there is a perfectly reasonable argument for locking down a device you’re handing to family members who aren’t security conscious.
  - nightski 4y ago
    I don't personally know a single person outside of developers that have side loaded apps on Android. Maybe I am an anomaly, but it just seems very rare.
    - dublinben 4y ago
      It's probably just you. Fortnite went sideload-only on Android in 2018, and had ~40m players on Android. Their userbase is 60% 18-24 years old, so you may not know many players. [0] Leading drone maker DJI's app for Android is also sideload-only, and they've sold hundreds of thousands of drones to people, many of whom probably use Android. [0] https://www.sportskeeda.com/esports/how-many-people-play-fortnite-2021 https://www.sportskeeda.com/esports/how-many-people-play-for...
      - m463 4y ago
        I wouldn't sideload a DJI app on my phone - for that matter any chinese manufacturer
    - 4y ago
vbezhenar 4y ago
For many years, everyone who wanted to sideload apps on an iPhone has been able to do so. I am unsure about what makes this so exciting.
- Karunamon 4y ago
  The EU found that argument unconvincing. As, likely, do you. Requiring a Mac and a reinstall every week and not more than three apps at a time is blatantly anti-competitive.
- hu3 4y ago
  How?
  - vbezhenar 4y ago
    For most convenience you need to have developer subscription. Then you can use something like sideloadly.
- deleted 4y ago
  [deleted]
- notsound 4y ago
  Except people that don't have a computer, a decent chunk of technical know-how, and if you want the apps to stick around for longer than a week, $99/year.
lewisflude 4y ago
If Apple do implement this, I hope they can ensure 3rd party apps live in a sandbox or otherwise need to be given explicit permissions. One big argument I've seen against side-loading on iOS is people like the confidence of knowing that an app has to play by iOS's rules, so if we can bring this to the world of side-loading then this could be a win-win for "both camps".
- jamil7 4y ago
  It will still run in a sandbox, that's how iOS works. It just will bypass app store review, meaning certain rules won't be enforced.
  - EMIRELADERO 4y ago
    Careful! 7. The gatekeeper shall allow providers of services and providers of hardware, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same hardware and software features accessed or controlled via the operating system or virtual assistant listed in the designation decision pursuant to Article 3(9) as are available to services or hardware provided by the gatekeeper. Furthermore, the gatekeeper shall allow business users and alternative providers of services provided together with, or in support of, core platform services, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same operating system, hardware or software features, regardless of whether those features are part of the operating system, as are available to, or used by, that gatekeeper when providing such services.
    - sixstringtheory 4y ago
      None of that negates what GP said. Apps have the ability to interoperate, but they still have to build that functionality. Apps can’t just take over other apps or their data at unawares.
- nashashmi 4y ago
  Interesting point. I also hope that Apple will allow sideloads into these permission-less sandboxes. Imagine two classes of sandbox: offline with loads of permissions, online with no permissions. Offline apps will obviously have to be paid for upfront. Online apps will have a subscription model.
PartiallyTyped 4y ago
This has been bugging me for a few minutes, and I'd be keen on hearing thoughts from other hackers. Given sideloading will be available, does this not create a broader attack vector that government agencies may use to access user data?
- criddell 4y ago
  Of course it does. In addition to governments, how long do you think it will take for companies and schools to roll out apps to monitor what people are doing with their phones? Companies will say you have a choice (you can always quit!) and schools will just be protecting children - who could oppose that? And you know when it comes to enterprise and software sold to school districts, it's usually top quality stuff.
  - EMIRELADERO 4y ago
    Can't they already do this with MDM?
    - rickdeckard 4y ago
      Yes, that "scary story" basically describes MDM
    - iamjake648 4y ago
      yes they can.
    - criddell 4y ago
      Yes, but this lowers the bar significantly.
  - izacus 4y ago
    Apple literally allows them to do that via MDM already so what exactly is your point here?
- wmf 4y ago
  Thanks to the sandbox, sideloaded apps will have no more access than regular apps. Of course every app will ask for every permission but that's a different problem.
FloatArtifact 4y ago
Having the power to choose side load is a net benefit. For those that have any sort of fear, they simply just get apps from the official store. Could and will people be taking advantage of by side loaded apps? The obvious answer is yes, it's a risk that allows for responsibility and freedom.
- mort96 4y ago
  What happens when the apps which used to be available on the app store get taken down and made sideload-only, like what Epic did with Fortnite on Android?
  - jacooper 4y ago
    It probably wont succeed, the play store still exists for a reason.
    - mort96 4y ago
      Fortnite seems plenty popular.
      - jacooper 4y ago
        Still it didn't kill the play store did it? No body is forcing you to install it.
      - raydev 4y ago
        Not because of the ability to sideload. Most people want to play it on console or PC.
  - wackget 4y ago
    Are you implying that allowing companies the choice to go sideload-only is a bad thing?
    - kube-system 4y ago
TheLoafOfBread 4y ago
I can't wait when Apple will stop being a little childish brat about "What obscure rule does this application break and I am not allowed to publish?" when I will have the ability to publish on competing app store and tell Apple to GFY. Apple users should also rejoice, because browsers coming to iOS will finally support full PWA functionality and Safari will either support all the features as well (not the current neutered one) or it will disappear into obscurity.
- londons_explore 4y ago
  Nah - Apple with drag its feet at every step. They will, at every point, do as little as possible to avoid EU fines, while simultaneously not opening up the platform to developers like you.
  - TheLoafOfBread 4y ago
    From my perspective I just need a PWA browser with working WebBLE API or Apple stop having set of obscure unpublished rules. I am betting that I will get working PWA sooner than Apple will stop being Apple.
jmull 4y ago
Having "side loading" -- also known as regular app installation on non-phone platforms -- hasn't caused chaos on desktop platforms or android. No reason to think it will on iOS either.
- wmf 4y ago
  A company can get taken down by a .pdf.scr file on Windows.
  - deleted 4y ago
    [deleted]
  - jmull 4y ago
    As if anyone is suggesting iOS adopt the Windows 95 security model.
    - tclancy 4y ago
      What people are suggesting is giving an entire new unsupervised point of entry and one with a lot of permissions is opening up unsuspecting users to these kinds of problems.
  - vinyl7 4y ago
    Does apple throw a .pdf.scr at every app during validation?
  - layer8 4y ago
    And iOS could by an iMessage [0]. OS bugs are OS bugs. On Windows, non-administrator accounts and GPO restrictions are the way to go, in an enterprise environment. [0] https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/ https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage...
  - m463 4y ago
    On the other hand, you can install 3rd party firewalls, virus scanners and more on windows. That also means you can install programs to know what microsoft is doing with your comptuer, and protect yourself. Currently there is no way on ios to know what an app is really doing, and what it is sending where.
techaqua 4y ago
is this epic related?
- ESMirro 4y ago
  No, this is as a consequence of the EU Digital Markets Act.
35208654 4y ago
It seems like everyone in these discussions sees only two worlds: lawless hellscape of intrusive, data-stealing apps that permit freedom or “walled garden” of good apps that restrict it and users’ freedom. The truth, as always, is already somewhere in between. And it will be after iOS 17. Let’s see how Apple innovates in this space. It’s time. The iPhone is 16 years old this year. Time to users get behind the wheel if they want to.
- throwaway290 4y ago
  My nightmare scenario is if every country and mobile reseller will come up with their own app store, and pre-load/make users use those. Once Apple gave in, they will press further to make this happen. These stores would onboard Facebook and other big apps, but regular solo dev will have to submit each app to a dozen of different stores and comply with a dozen of different requirements and review processes or pass on user share to some local dev who copies the idea quickly enough.
  - 35208654 4y ago
    The EU is pushing for (has already ratified?) rules against even pre-installing Apple apps, or at least making it easy to remove them. I’m certain that Apple, who sells their phones directly, will be able to keep the carrier bloat at bay. But I also share that concern. It’s one reason I don’t use android as a daily driver.
browningstreet 4y ago
One upside I haven't seen discussed a lot about this: sideloading your own apps. I don't care, and don't really imagine, sideloading others' apps... but this could give rise to a hobbyist/customization wave again.
- alden5 4y ago
  Apple already lets you sign your own apps, but i will admit the 1 week expiration is very quick and a $99/year developer subscription for 1 year signing is way too expensive for most hobbyists. It'll be great to see all the neat little apps that macos has come over to ios
  - sixstringtheory 4y ago
    I wonder if there will still be two classes. I imagine sideloadable apps will need notarization like they recently implemented for macOS apps delivered outside the mac app store. They can require a developer account for that, or make it behave differently for the separate classes.
- ye-olde-sysrq 4y ago
  This is my plan, I'm super excited about this change. I plan to sideload exactly 0 non-play-store apps except maybe dolphin or similar big-name open source things. I DO plan to sideload two apps of my own (currently web apps but they suffer for being so, as opposed to being native), and while I know apple has given some ways previously to let you have "private" apps etc, they still require paying a ton of money AND you still have to get them approved by Apple!! I was sad when I left android solely for the reason of sideloading apps, but given I'd used android for ages and only sideloaded two apps: dolphin and one of my own custom apps that I had stopped developing, I figured it wouldn't be a big deal. But I'm looking forward to this a lot now.
- tempodox 4y ago
  That's exactly what I want to do and what I hope this will eventually enable: Run my own apps on my own frigging devices (no distribution involved) without having to bribe Apple for the privilege (if you don't buy a Developer subscription, you have to re-install your apps weekly to keep them functional).
game_the0ry 4y ago
I get the intuition that this might be a form of government back door. Hope someone can convince me I am wrong.
YmiYugy 4y ago
I'm excited and afraid at the same time. Excited for all the stuff the community will come up with that wasn't possible on the app store, but afraid that some apps I rely on will leave the App Store to do evil things.
LeSaucy 4y ago
Did not expect to see Donald Fagen in the headline screenshot
- tempodox 4y ago
  Who doesn't have Donald Fagen / Steely Dan in their music collection? Even millenials ought to know him.
rickdeckard 4y ago
So many "Not good. I want [company I trust] to be free to regulate [company I don't trust]" comments here. Even more odd, its sometimes followed by the even stranger argument "If [company I trust] is legally forced to stop restricting its competitors and has to allow me to choose, I may be lured into choosing [company I don't trust]". Sorry, but all this is closer to religion than common sense.
- r053bud 4y ago
  It’s Apple Stockholm syndrome at it’s finest. But you are apt in your religion comparison. Anything the good lord Jobs, or his prophet Cook says or does is law
  - jutrewag 4y ago
    If this is Stockholm syndrome then it’s better than any experience I’ve had in a non-hostage situation.
  - TheHappyOddish 4y ago
    What an arrogent statement. You should read it over and think about how you interact with others.
c7DJTLrn 4y ago
Can't wait to have five different App Stores and be forced to install a spying app with full system access upon entering undemocratic countries. The average person does not care about the "walled garden." They want a phone that works and protects them.
- bakugo 4y ago
  None of this happens on android. It's time to step out of the Apple fantasy land and into the real world.
  - c7DJTLrn 4y ago
    What do you mean? There's plenty of examples on Android where users have been tricked into sideloading malicious apps.
    - daveoc64 4y ago
      You just said there would be "five different App Stores", yet this hasn't happened on Android. Amazon has an app store for Android, but its apps are all on the Google Play Store. It's really there to serve Amazon's Fire platform where Amazon doesn't licence Google Play. Samsung has an app store for Android, but again, all of its apps it makes available to other non-Samsung device users are on Google Play. Additional app stores on Android have so far been complementary to Google Play, which remains the place where the overwhelming majority of apps are obtained.
thiht 4y ago
Can't wait to finally be able to install a YouTube app with SponsorBlock.
CogitoCogito 4y ago
The comments to this article just scream Stockholm Syndrome.
g8oz 4y ago
Could this mean a F-Droid type app store on the iPhone? That would be a big deal.
gjsman-1000 4y ago
I think developers who don't want to give 30% are going to have to deal with a new enemy: Piracy. The moment sideloading is available for iPhone, I expect within weeks there will be a cool, first-of-its-kind piracy App Store. As well as, within months, a cool, first-of-its-kind hacked game clients for iOS App Store. I think Epic Games might quickly discover that 30% might be lost to Apple or Piracy, pick your poison.
olliecornelia 4y ago
Great, can’t wait to see what apps my parents get tricked into installing.
isthiseasymode 4y ago
I predict that this will probably be irrelevant to the majority of users. There’s no way apple makes side loading easy enough for anyone outside of HN to use.
- cloogshicer 4y ago
  If the DMA (Digital Markets Act) has any teeth, they'll have to.
- realusername 4y ago
  That's going to end up the same way as Android if I have to guess yeah, as complicated as it gets for a normal user to activate so that nobody uses this outside of tech workers. Then they can just say that it's technically "there" for the courts.
  - isthiseasymode 4y ago
    Hot take: that’s how it should be. After fixing laptops for less technical people, I don’t think the average person can be trusted to protect themselves against malware.
    - realusername 4y ago
      I don't agree there's any links between an appstore and malware. Sandboxing and app distribution are two concept which might or might not be linked depending on the implementation. For example, if somebody implemented an appstore for WindowsXP which had zero software protection, the appstore would have been a significant vector of distributing malware as well.
ChrisMarshallNY 4y ago
I would hope that Apple is going to try adding some kind of security guardrails on this. Not sure if they could do it, though. The one really big deal with cracked phones, is that the apps can do whatever the hell they want, and many app authors (I'll bet a number of them are on this very venue) will take advantage of that. I know that I can be circumspect, but many of my non-technical friends, cannot. They are highly likely to be manipulated into sideloading malware. Phones, these days, carry our whole freaking life. They are lucrative hacking targets. Many phone owners seem to be blissfully unaware. I have at least two friends, that deliberately don't engage locks or biometrics, for convenience, yet, their phones are loaded with banking apps and whatnot (I don't use any banking apps, myself).
DevKoala 4y ago
I hope there is an option to disable this by default. My parents already manage to install tons of awful apps somehow.
- tempodox 4y ago
  The AppStore is not there to protect your parents from awful software, it's there to protect Apple's interests. And they sure as hell won't force side-loading on you.
  - DevKoala 4y ago
    The Apple Store makes it incredibly easy to cancel subscriptions and getting charge refunds. Try getting a refund out of a side loaded app charge.
Traubenfuchs 4y ago
Isn‘t sideloading already available with sidelodely?
gumby 4y ago
If I wanted side loading I'd have gone for Android. With Apple I can install my own apps and those of a couple of my friends; for anything else I let Apple provide some modicum of security checking.
moomoo11 4y ago
Isn’t it a minority of people who want this? I’d bet 99% of Apple users don’t care nor want this. I know I don’t. I like Apple’s App Store standards. If I want to side load apps I’d use android. But I don’t. If companies don’t like it just don’t support iOS. Others will and I’ll use those apps.
- Hippocrates 4y ago
  Precisely. You'll find that within HN and consumer electronics communities, the concept is much more polarizing. How many of your friends know what side-loading is? How many would want it if they did know what it was? If app-store only is ANY more secure than side loading than that's what I'd want my friends and family using, based on their technical chops, and my desire to not be their IT guy.
jraph 4y ago
Many people here are afraid of being able to install apps on iOS from somewhere else than the Apple store because then Facebook will be able to be fully evil on iOS. A relationship without trust and with fear of evil actions is called a toxic relationship. If you don't trust Facebook, don't install it. Even from the app store. There is no world in which you need the app. First, if you use Facebook because of the network effect, don't stay passive. Advocate for using something else, like Signal, mastodon, anything. Second (in the meantime), if you still need Facebook, I'm sure you can access it from a browser in private mode. Get out of this toxic relationship now. Get your news and your fun from somewhere else not amenable to a filter that suits a manipulative company. We should be happy for such new possibilities. Of course it requires putting your time and money where your mouth is. But it's worth doing either way! Stop the dissonance!
- diebeforei485 4y ago
  For most of the world outside US/Canada, WhatsApp is as mandatory as SMS or Phone Calls.
  - jraph 4y ago
    WhatsApp is pervasive in France, where I live. I have resisted installing it from the start. Of course I felt some pressure about this. People never built the expectation I had WhatsApp. I never stopped advocating against it (in a nice way, without blaming people). Now, more and more people have been installing Signal and now I can have group discussions again. We are many who don't like Facebook. If enough of us resist, WhatsApp will stop being so pervasive and "mandatory". It has happened in my social circles. There's no drawback anymore for me to not having WhatsApp. When there was, I still had a fulfilling social life, with as many friends, or even more, than average. I was still invited to events, I was still able to organize events, etc. If people like you, they'll reach you. Having WhatsApp is just convenient, not a determining factor. Most people now understand that privacy is an important topic and will cope with you not having WhatsApp, or even embrace your action. The world needs you to become better. Of course it's not easy. But it's not inevitable. Again, WhatsApp might (still) be mandatory to you today. Okay! You are stuck with it for now. Fine. I understand. But do something about it! Advocate for something else! You can do it gently without pissing people off (which would be the best way to fail convincing them anyway) If nobody does anything about it, we are stuck with Meta.
tristor 4y ago
I have mixed feelings about this. I'm exactly the type of person who used to jailbreak my iPhone to run Cydia, and I used to build my own custom Android ROMs and spend hours on XDA-Developers before that. Now though, I appreciate how locked down iPhones are, and I keep it as locked down via Apple Configurator as possible, because the mobile web and mobile application space are fraught with peril. The vast majority of mobile apps are net-negative experiences unless it's a companion app to an in-person service (e.g. restaurant/airline/hotel/bank), and even those are often risky. If you look at the Android ecosystem, the Google Play Store is basically a ghetto where the lowest common denominator criminal gangs operate malware at scale with impunity, and Apple has been a haven away from this. I went through a lot of effort to switch my elderly parents into the Apple ecosystem, and since doing so I have been able to have a lot less support required and to sleep easy at night. With sideloading coming, I am not longer certain that their devices are safe and they won't be tricked into putting malware on the device.
- deleted 4y ago
  [deleted]
- trallnag 4y ago
  Do you wrap yourself with tinfoil at night to prevent your neighbors Android from scanning your thoughts?
  - tristor 4y ago
    > Do you wrap yourself with tinfoil at night to prevent your neighbors Android from scanning your thoughts? Do you think this sort of question is in line with HN guidelines? Nothing I said is driven by paranoia, it's driven by the reality we find ourselves in. As mentioned in my comment I've developed custom Android ROMs, my wife actually is an Android user (yes I'm in a house divided), but myself and my wife are also much more technology savvy than my elderly parents. If you cannot understand how those situations differ in our current reality, there's not much I can do for you. When it comes to non-technical users that don't have good opsec practices, Android is a ghetto that basically guarantees your mobile devices are running malware, and the Apple ecosystem is nearly the opposite. Arguably the App Store is fraught with danger, but it's many orders of magnitude better about the impact of apps on user security and privacy than the Google Play Store. You may feel strongly in your support of Android and its ecosystem for other reasons, but it's pretty indisputable that it is less secure and less privacy-respecting, especially in relation to third-party applications.
flax 4y ago
A lot of these arguments against this sound like long-term prisoners convinced that they can't make it on the outside. https://dictionary.cambridge.org/us/dictionary/english/institutionalized https://dictionary.cambridge.org/us/dictionary/english/insti...
- jutrewag 4y ago
  Eh, I’ve seen the outside and it belongs on my PC.
h1fra 4y ago
Once again, EU laws benefiting everyone. And even this article only acknowledge this at the 3rd paragraph, if you only read the title or the first few sentences it depict Apple as the good guy.
microflash 4y ago
I can't wait for my banking app to ask me to disable sideloading on iOS before I can actually use it. Such idiocy has been rampant on Android with banking apps refusing to launch when Developer Options are enabled. That aside, I am very happy with this development. I have personal apps that I'd like to sideload without paying for a developer account. I am also looking forward to a more lively open-source ecosystem around iOS apps which has been significantly lackluster compared to that on Android.
- layer8 4y ago
  I don’t think banking apps will have much reason to do so, given that sideloaded apps will still be sandboxed. This is not like a jailbreak. I would also assume that apps have no way to check what kind of other apps are installed.
  - microflash 4y ago
    I hope that sideloading detection will not be possible for other apps. Enabling Developer Options is not rooting Android devices but that hasn't stopped many banking apps forcing users to completely disable them before they can be opened.
- jutrewag 4y ago
  You can side load your personal apps now.
  - Pfhortune 4y ago
    ...but you have to refresh them every seven days or they stop launching. A very annoying tether for a mobile device. And you can install three personal apps at most.
kimmeld 4y ago
Sideloading, otherwise known as installing software you want, on hardware you own. Love how the term tries to make it sound so suspicious.
diebeforei485 4y ago
I'm not happy about this. If the dispute is around Apple's monopolistic 30% commission, regulate the commission.
diebeforei485 4y ago
I don't like this. I don't want my government or school or employer to coerce/"encourage" me to install apps on my personal device.
- McDev 4y ago
  Then don't install them.
  - diebeforei485 4y ago
    It is not optional in most of these cases.
- ThatPlayer 4y ago
  They can already sideload through MDM.
thescriptkiddie 4y ago
Apple is considering possibly removing one of the most anti-consumer features of its phones and there are people in the comments arguing against it. Not looking good for the future of society.
seanw444 4y ago
Apple has successfully convinced their base that leaving their walled garden is a danger. I wonder what particular word could be used to define that. Anyways, F-Droid is a clear example of how alternative sources of apps can be just as secure as the official one (and in F-Droid's case, more secure).
- jutrewag 4y ago
  The particular word is “comfort”. The App Store is comfy and they enforce a certain modicum of non-jank.
- gorbypark 4y ago
  I think everyone agrees that not only Apple has the ability to offer an malware free App Store, it’s just that if F-Droid exists than so can G-Droid, the fork made by criminals to exploit less technical users. I think it’s overblown, though. Android has side loading and there doesn’t seem to be an epidemic of sketchy app stores.
lykahb 4y ago
I find the term sideloading problematic. It carries the bias that the "correct" way is to install apps from the centralized app store. The term conveys that this is an alternative and undesirable thing to do. The concern of malware is legitimate, but having a centralized approved store is a weak barrier anyway. The iOS has a solid system of permissions and sandboxing that should take care of that. A more drastic change is that tgere are no technical means to impose UI that conforms to the Apple standards or enforce that the app payments go through the Apple payment system.
- TheHappyOddish 4y ago
  > It carries the bias that the "correct" way is to install apps from the centralized app store. The term conveys that this is an alternative and undesirable thing to do. But... It is. This is a designed for purpose device, chosen to be used freely and this the "correct" way to install. Who defines the "correct" way if not the OS developers?
concerned_ 4y ago
[flagged]
twalichiewicz 4y ago
It's understandable that people are eager for the potential of side loading on iOS, as it could provide more direct access to apps without the need for intermediaries / App Store policy misunderstandings. However, it's worth considering the potential downsides of this approach, particularly the risk of app and service balkanization. This is already happening in the gaming industry, where major studios force you to use their own launchers to capture valuable (sellable) data about their customers. But to play the optimist, perhaps inspiration can be taken from how macOS handles app installation from non-App Store sources: - You go to the developers website - You are presented with two links if the app is also available on the App Store with the alternative being direct download - After downloading the .dmg you are presented with a modified version of the Installer.app UI that runs you through what services the app uses, data that it collects, where it will install, additional options, etc. - One final confirmation of "Is this from a trusted developer" - Installer.app runs a virus / malware check against what is going to be installed - App is ready to go on the phone
tehlike 4y ago
There will be many ux frictions and restrictions that unless companies with stake in it complain, it won't make a meaningful dent.
jutrewag 4y ago
I can’t believe I’m arguing for this but why is this necessary. I’ve gotten comfortable with my walled garden…
stale2002 4y ago
Man, I remember arguing with so many people, who were on complete copium, regarding this decision. It should have been obvious, for anyone who has following this whole saga, that eventually Apple was going to be forced to open up. Sure, maybe it was the Epic lawsuit that did it, but there were a dozen different vulerabilities, and pathways to them being forced to open up. If it wasn't that lawsuit, then it was going to be a new law, if not in america, then instead in the EU.
ralphc 4y ago
I look forward to this, not for potentially sketchy third party apps but for my own apps. My phone is the computer, camera, etc. that I always carry with me and I'd like to be able to write my own apps, both for experimenting and for my utility. Just sideload them, no developer program, no yearly license fees, write in languages of my choice, have a VM on my phone if I want. If nothing else, imagine your own AI assistant that you know respects your privacy because it only communicates with your home server, or fits completely on your phone.
- smw 4y ago
  I think it's been quite easy to run your own apps on your iPhone for years now?
  - raydev 4y ago
    If you have a free developer account then you need to redeploy the app to your phone every 7 days. You can only add up to 3 devices to your free account, and there's no way to remove them without paying (at least that I could see when I let my subscription lapse), so good luck if you replace your phone too many times or try to share an app with a family member or friend. It's not impossible, and perhaps it's easy if you've already hit all the pitfalls and know where they are, but I would not describe it as easy.
- djxfade 4y ago
  That would still require Apple to open the various APIs. Even though we will be able to sideload apps, it dosent necessarily grant us access to everything we need to compete with let's say Siri (not from a technical standpoint, but from an integration perspective)
  - EMIRELADERO 4y ago
    The DMA law says they would have to. > 7. The gatekeeper shall allow providers of services and providers of hardware, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same hardware and software features accessed or controlled via the operating system or virtual assistant listed in the designation decision pursuant to Article 3(9) as are available to services or hardware provided by the gatekeeper. Furthermore, the gatekeeper shall allow business users and alternative providers of services provided together with, or in support of, core platform services, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same operating system, hardware or software features, regardless of whether those features are part of the operating system, as are available to, or used by, that gatekeeper when providing such services.
lisper 4y ago
This seems like a no-brainer to me: just make it opt-in with a huge warning label: "If you turn on this feature, many bad things might happen to you if you are not very careful, and we disclaim responsibility."
gcanyon 4y ago
When the App Store first opened, I wondered if Apple would allow an alternative App Store to launch, to carry apps that Apple was unwilling to. I wonder if that solution, instead of a side-loading free-for-all, would 1. Satisfy Europe 2. Protect users 3. Potentially get Apple everything they want. 1. Because Apple wouldn't have a monopoly on app distribution 2. Because there would still be a limited number of players who would need to commit to app review/security. 3. Because users would likely continue to use Apple's App Store almost exclusively, while allowing certain outliers (subscription-dependent apps) a way out.
Teamancer 4y ago
Is there a business opportunity here for an independent, transparent 3rd party, (side-loaded or not app)safety inspection/testing service? Right now customers rely on the word of outfits. mostly Google and Apple who make money on your use, that the software they will "allow" you to install is "safe." Yet a lot of malicious crap gets through and sometimes remains available until enough victims post reviews. A legitimate, transparent and disinterested 3rd party vetting service would not have a stake in whether or not a customer would download or sideload apps - from anywhere.
christkv 4y ago
I got a beat that they will launch this sounding like they made this decision to improve the user experience. One more thing now we have opened the iPhone so all developers can test their apps without the cumbersome approval process. We call it express deploy and it’s awesome.
dahwolf 4y ago
Mozilla should step into this space. Launch an alternative app store, cost-neutral or minor profit only, all apps privacy checked. Better than the writing of preachy blogs that do nothing. The problem with current Mozilla is that they have no platform. They have no reach.
- binarymax 4y ago
  I would totally pay for apps on a Mozilla store. This is a great idea.
  - dahwolf 4y ago
    The only risk I see is their progressive views at times being a little too progressive, leading to "safetyism" and a too restrictive policy on what can go in the store and what cannot, or this somehow affecting which app get prime real estate, whilst others are burried. Screw it, I might as well spit it out: it should not be a woke app store.
    - Pfhortune 4y ago
      What is woke? Can you quantify it?
      - dahwolf 4y ago
        Yes, it's anything I dislike.
dzogchen 4y ago
"Sideloading" is such a weird term. Why does "installing" something without Apple's approval need another word?
KingLancelot 4y ago
[dead]

381 points by mikece 4y ago

The source for this article is Mark Gurman’s newsletter at Bloomberg: “Apple Plans to Launch More Than Just Its New Headset at WWDC” https://www.bloomberg.com/news/newsletters/2023-04-16/apple-wwdc-2023-june-5-plan-reality-headset-new-macs-watchos-10-ios-17-lgjfj5bf https://www.bloomberg.com/news/newsletters/2023-04-16/apple-...

akmarinov 4y ago

Nice, can’t wait

zapdrive 4y ago

Don't hold your breath over it.

Simulacra 4y ago
I, too, am not optimistic but I hope a day comes when my Iphone does not need to be jailbroken..
- rimliu 4y ago
  Interesting, my iPhone never needed to be jailbroken.
bogwog 4y ago
I expect it to be implemented in the most passive-aggressive way possible. Also, it will probably have the same bullshit tricks that Google uses to make it difficult, meaning it will only be useful to tech nerds.
- EMIRELADERO 4y ago
  That bullshit won't stand up to EU scrutiny though.
- arlcode 4y ago
  Following the typical cycle of adversial compliance by industry, politicans will immediatly start working on round 2 to plug the holes. I believe this is much better than being to broad on the first attempt. And maybe apple decides that this battle is not worth their time and preempts the need for further regulations.

wahnfrieden 4y ago

EU only. Not in the land of the free.

ChuckNorris89 4y ago
How will that geofencing be enforced? Is this EU feature dependent to the place you purchased your device or to the location registered on your Apple account? If you change your location in or out of the EU does it then apply or revert the feature?
- supriyo-biswas 4y ago
  This isn't as difficult as you make it look. Many Android devices have the concept of carrier-specific configuration files (CSCs) which are baked into the ROM, and phones sold in the region come baked with the variant with only the specific CSCs in question. A similar implementation could be followed by Apple, where they have a separate image for the EU.
  - ChuckNorris89 4y ago
    In EU phones are also sold unlocked without any carrier info baked into the ROM.
    - rickdeckard 4y ago
      Phones of major vendors sold in EU still contain carrier info for the region even if they're sold unlocked. Outside of US and China, Samsung for example ships so-called "Multi-CSC" variants of their devices which permanently apply the region and country of your device on first power-on with a SIM-card. The required information for that is not pulled from the network but is already preloaded in the ROM of the device, a network connection can be used to get an updated version of these profiles though
  - smoldesu 4y ago
    I look forward to the US passing similar laws and getting the upgraded image!

archerx 4y ago

I just want first class PWAs.

ascagnel_ 4y ago
iOS 16.4 added a bunch of PWA-focused features. What gaps do you feel still exist?
- akmarinov 4y ago
  Probably background services and processing, something even native apps can’t do.
- NoMoreBro 4y ago
  Not OP, but I'd start with a one-click way to "install" the PWA apps using an API, e.g. with a banner (like on Android) instead of an item in the share menu.
  - musictubes 4y ago
    Oh God, this is one of the reasons people hate PWAs. No more banners on websites! I don’t want to see sites even more cluttered.
- rabuse 4y ago
  More low-level camera access would be a nice improvement. Also, the ability to work with raw video data for trimming/editing.
  - kmlx 4y ago
    that's browser standards territory. also, this: https://developer.mozilla.org/en-US/docs/Web/API/WebCodecs_API https://developer.mozilla.org/en-US/docs/Web/API/WebCodecs_A...
    - rabuse 4y ago
      Ah, sweet. Haven't looked at the Web API specs in a bit, but just remember working with video was a PITA. Thanks.

EMIRELADERO 4y ago

The big question is: will there be some kind of "program" the user and/or developer needs to get into to be able to sideload/distribute independent apps? The ideal status quo would be one where developers can make native apps, and users download and run them, without entering into a contractual relationship with Apple period. (Beyond the iOS EULA, which stands on legally shaky ground)

kroltan 4y ago
Speaking of which, if you don't like that kind of thing, never use a Xiaomi phone. It requires registering for a Xiaomi account to "unlock" the bootloader and install alternative operating systems (such as one without most of the spyware - why does the calculator app or the pdf viewer need a privacy policy?) This account registration is baked into the phone while the bootloader is unlocked, and you have to factory-reset the phone and lock it back up to be able to dissociate the account from the phone.
- mschuster91 4y ago
  That's a side effect of anti-theft measures. Samsung is the same, you can't unlock them any more without signing in into both Samsung and Google accounts which allows the two companies to detect if the device was registered as stolen. And for what it's worth, Samsung is the worst of the bunch anyway as rooting it permanently bricks the TEE via an e-fuse.
  - kroltan 4y ago
    I guess having an account enables that deterrance, but I don't see how it is related to unlocking the bootloader if there was not an account bound beforehand. If signing into an account can be preserved despite the "unlocked" bootloader, there has to be some sort of hypervisor/"secure chip" type deal denying access to the part of the device the account info is stored, no? Otherwise one could erase the account info and pass the device as untainted anyways. So, if that information is secured against alternative operating systems, then there is no harm in allowing them by default or upon local user authorization. In other words, if it was strictly for theft deterrence then surely you would need an account to be able to factory reset the device at all, even with the bootloader locked?

TexanFeller 4y ago

I'm dreading this. I want privacy hostile companies like Facebook to have to comply with the app store rules and respect system settings relating to privacy. As a user, I'm thrilled when Apple wields its big stick to stop big tech companies from overreaching. Before there was a bit of a compromise, I could use evil apps with some peace of mind that they wouldn't do something egregious. Now I suspect evil apps just won't be available in the App Store, or Apple will be forced to relax their control.

throw10920 4y ago
What? The most meaningful privacy controls are enforced at the OS layer as technical controls. The thing that prevents Facebook from accessing all your contacts is the design of iOS, not the App Store. Allowing sideloading of apps does nothing to weaken the technical features meant to enable privacy and security that are already in place. In fact, you shouldn't have been relying on the App Store in the first place, as malware/spyware can and does slip through their very human and very fallible approval process. This talking point is so common in every thread about sideloading Apple devices that I can't determine whether it's propaganda or ignorance.
EMIRELADERO 4y ago
Maybe it's just me, but I'd rather have my government defending my (and most citizen's) interests (with laws such as GDPR) rather than a private company's rules which, as evidenced by this article's existence, have pretty big "collateral damage".
overthrow 4y ago
You're dreading giving other people the freedom to make one choice, and yourself the freedom to make a different choice (yours being the default option from the factory btw), and everyone gets the privacy/control tradeoff they want?
- Spivak 4y ago
  Software isn't fungible and right now today you have the ability to install facebook with app store restrictions on iOS and without on Android. If FB pulls from the app store that choice is taken away.

29083011397778 4y ago

> Historically, Apple execs including Tim Cook and Craig Federighi have staunchly opposed sideloading citing privacy and security reasons. Which is funny to me, because after flipping through the App Store for an email client, I found, on this heavily curated storefront, a single digit number of apps I would trust with my email credentials. Android, with it's option to "sideload" F-Droid, gives me dramatically more options that I trust. Security and trust do not require locking me out of my own hardware.

Retric 4y ago
Apps you trust is a really poor security mechanism for the general public. The Apple App Store is a dumpster fire, but there is a perfectly reasonable argument for locking down a device you’re handing to family members who aren’t security conscious.
- nightski 4y ago
  I don't personally know a single person outside of developers that have side loaded apps on Android. Maybe I am an anomaly, but it just seems very rare.
  - dublinben 4y ago
    It's probably just you. Fortnite went sideload-only on Android in 2018, and had ~40m players on Android. Their userbase is 60% 18-24 years old, so you may not know many players. [0] Leading drone maker DJI's app for Android is also sideload-only, and they've sold hundreds of thousands of drones to people, many of whom probably use Android. [0] https://www.sportskeeda.com/esports/how-many-people-play-fortnite-2021 https://www.sportskeeda.com/esports/how-many-people-play-for...
    - m463 4y ago
      I wouldn't sideload a DJI app on my phone - for that matter any chinese manufacturer
  - 4y ago

vbezhenar 4y ago

For many years, everyone who wanted to sideload apps on an iPhone has been able to do so. I am unsure about what makes this so exciting.

Karunamon 4y ago
The EU found that argument unconvincing. As, likely, do you. Requiring a Mac and a reinstall every week and not more than three apps at a time is blatantly anti-competitive.
hu3 4y ago
How?
- vbezhenar 4y ago
  For most convenience you need to have developer subscription. Then you can use something like sideloadly.
deleted 4y ago
[deleted]
notsound 4y ago
Except people that don't have a computer, a decent chunk of technical know-how, and if you want the apps to stick around for longer than a week, $99/year.

lewisflude 4y ago

If Apple do implement this, I hope they can ensure 3rd party apps live in a sandbox or otherwise need to be given explicit permissions. One big argument I've seen against side-loading on iOS is people like the confidence of knowing that an app has to play by iOS's rules, so if we can bring this to the world of side-loading then this could be a win-win for "both camps".

jamil7 4y ago
It will still run in a sandbox, that's how iOS works. It just will bypass app store review, meaning certain rules won't be enforced.
- EMIRELADERO 4y ago
  Careful! 7. The gatekeeper shall allow providers of services and providers of hardware, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same hardware and software features accessed or controlled via the operating system or virtual assistant listed in the designation decision pursuant to Article 3(9) as are available to services or hardware provided by the gatekeeper. Furthermore, the gatekeeper shall allow business users and alternative providers of services provided together with, or in support of, core platform services, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same operating system, hardware or software features, regardless of whether those features are part of the operating system, as are available to, or used by, that gatekeeper when providing such services.
  - sixstringtheory 4y ago
    None of that negates what GP said. Apps have the ability to interoperate, but they still have to build that functionality. Apps can’t just take over other apps or their data at unawares.
nashashmi 4y ago
Interesting point. I also hope that Apple will allow sideloads into these permission-less sandboxes. Imagine two classes of sandbox: offline with loads of permissions, online with no permissions. Offline apps will obviously have to be paid for upfront. Online apps will have a subscription model.

PartiallyTyped 4y ago

This has been bugging me for a few minutes, and I'd be keen on hearing thoughts from other hackers. Given sideloading will be available, does this not create a broader attack vector that government agencies may use to access user data?

criddell 4y ago
Of course it does. In addition to governments, how long do you think it will take for companies and schools to roll out apps to monitor what people are doing with their phones? Companies will say you have a choice (you can always quit!) and schools will just be protecting children - who could oppose that? And you know when it comes to enterprise and software sold to school districts, it's usually top quality stuff.
- EMIRELADERO 4y ago
  Can't they already do this with MDM?
  - rickdeckard 4y ago
    Yes, that "scary story" basically describes MDM
  - iamjake648 4y ago
    yes they can.
  - criddell 4y ago
    Yes, but this lowers the bar significantly.
- izacus 4y ago
  Apple literally allows them to do that via MDM already so what exactly is your point here?
wmf 4y ago
Thanks to the sandbox, sideloaded apps will have no more access than regular apps. Of course every app will ask for every permission but that's a different problem.

FloatArtifact 4y ago

Having the power to choose side load is a net benefit. For those that have any sort of fear, they simply just get apps from the official store. Could and will people be taking advantage of by side loaded apps? The obvious answer is yes, it's a risk that allows for responsibility and freedom.

mort96 4y ago
What happens when the apps which used to be available on the app store get taken down and made sideload-only, like what Epic did with Fortnite on Android?
- jacooper 4y ago
  It probably wont succeed, the play store still exists for a reason.
  - mort96 4y ago
    Fortnite seems plenty popular.
    - jacooper 4y ago
      Still it didn't kill the play store did it? No body is forcing you to install it.
    - raydev 4y ago
      Not because of the ability to sideload. Most people want to play it on console or PC.
- wackget 4y ago
  Are you implying that allowing companies the choice to go sideload-only is a bad thing?
  - kube-system 4y ago

TheLoafOfBread 4y ago

I can't wait when Apple will stop being a little childish brat about "What obscure rule does this application break and I am not allowed to publish?" when I will have the ability to publish on competing app store and tell Apple to GFY. Apple users should also rejoice, because browsers coming to iOS will finally support full PWA functionality and Safari will either support all the features as well (not the current neutered one) or it will disappear into obscurity.

londons_explore 4y ago
Nah - Apple with drag its feet at every step. They will, at every point, do as little as possible to avoid EU fines, while simultaneously not opening up the platform to developers like you.
- TheLoafOfBread 4y ago
  From my perspective I just need a PWA browser with working WebBLE API or Apple stop having set of obscure unpublished rules. I am betting that I will get working PWA sooner than Apple will stop being Apple.

jmull 4y ago

Having "side loading" -- also known as regular app installation on non-phone platforms -- hasn't caused chaos on desktop platforms or android. No reason to think it will on iOS either.

wmf 4y ago
A company can get taken down by a .pdf.scr file on Windows.
- deleted 4y ago
  [deleted]
- jmull 4y ago
  As if anyone is suggesting iOS adopt the Windows 95 security model.
  - tclancy 4y ago
    What people are suggesting is giving an entire new unsupervised point of entry and one with a lot of permissions is opening up unsuspecting users to these kinds of problems.
- vinyl7 4y ago
  Does apple throw a .pdf.scr at every app during validation?
- layer8 4y ago
  And iOS could by an iMessage [0]. OS bugs are OS bugs. On Windows, non-administrator accounts and GPO restrictions are the way to go, in an enterprise environment. [0] https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/ https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage...
- m463 4y ago
  On the other hand, you can install 3rd party firewalls, virus scanners and more on windows. That also means you can install programs to know what microsoft is doing with your comptuer, and protect yourself. Currently there is no way on ios to know what an app is really doing, and what it is sending where.

techaqua 4y ago

is this epic related?

ESMirro 4y ago
No, this is as a consequence of the EU Digital Markets Act.

35208654 4y ago

It seems like everyone in these discussions sees only two worlds: lawless hellscape of intrusive, data-stealing apps that permit freedom or “walled garden” of good apps that restrict it and users’ freedom. The truth, as always, is already somewhere in between. And it will be after iOS 17. Let’s see how Apple innovates in this space. It’s time. The iPhone is 16 years old this year. Time to users get behind the wheel if they want to.

throwaway290 4y ago
My nightmare scenario is if every country and mobile reseller will come up with their own app store, and pre-load/make users use those. Once Apple gave in, they will press further to make this happen. These stores would onboard Facebook and other big apps, but regular solo dev will have to submit each app to a dozen of different stores and comply with a dozen of different requirements and review processes or pass on user share to some local dev who copies the idea quickly enough.
- 35208654 4y ago
  The EU is pushing for (has already ratified?) rules against even pre-installing Apple apps, or at least making it easy to remove them. I’m certain that Apple, who sells their phones directly, will be able to keep the carrier bloat at bay. But I also share that concern. It’s one reason I don’t use android as a daily driver.

browningstreet 4y ago

One upside I haven't seen discussed a lot about this: sideloading your own apps. I don't care, and don't really imagine, sideloading others' apps... but this could give rise to a hobbyist/customization wave again.

alden5 4y ago
Apple already lets you sign your own apps, but i will admit the 1 week expiration is very quick and a $99/year developer subscription for 1 year signing is way too expensive for most hobbyists. It'll be great to see all the neat little apps that macos has come over to ios
- sixstringtheory 4y ago
  I wonder if there will still be two classes. I imagine sideloadable apps will need notarization like they recently implemented for macOS apps delivered outside the mac app store. They can require a developer account for that, or make it behave differently for the separate classes.
ye-olde-sysrq 4y ago
This is my plan, I'm super excited about this change. I plan to sideload exactly 0 non-play-store apps except maybe dolphin or similar big-name open source things. I DO plan to sideload two apps of my own (currently web apps but they suffer for being so, as opposed to being native), and while I know apple has given some ways previously to let you have "private" apps etc, they still require paying a ton of money AND you still have to get them approved by Apple!! I was sad when I left android solely for the reason of sideloading apps, but given I'd used android for ages and only sideloaded two apps: dolphin and one of my own custom apps that I had stopped developing, I figured it wouldn't be a big deal. But I'm looking forward to this a lot now.
tempodox 4y ago
That's exactly what I want to do and what I hope this will eventually enable: Run my own apps on my own frigging devices (no distribution involved) without having to bribe Apple for the privilege (if you don't buy a Developer subscription, you have to re-install your apps weekly to keep them functional).

game_the0ry 4y ago

I get the intuition that this might be a form of government back door. Hope someone can convince me I am wrong.

YmiYugy 4y ago

I'm excited and afraid at the same time. Excited for all the stuff the community will come up with that wasn't possible on the app store, but afraid that some apps I rely on will leave the App Store to do evil things.

LeSaucy 4y ago

Did not expect to see Donald Fagen in the headline screenshot

tempodox 4y ago
Who doesn't have Donald Fagen / Steely Dan in their music collection? Even millenials ought to know him.

rickdeckard 4y ago

So many "Not good. I want [company I trust] to be free to regulate [company I don't trust]" comments here. Even more odd, its sometimes followed by the even stranger argument "If [company I trust] is legally forced to stop restricting its competitors and has to allow me to choose, I may be lured into choosing [company I don't trust]". Sorry, but all this is closer to religion than common sense.

r053bud 4y ago
It’s Apple Stockholm syndrome at it’s finest. But you are apt in your religion comparison. Anything the good lord Jobs, or his prophet Cook says or does is law
- jutrewag 4y ago
  If this is Stockholm syndrome then it’s better than any experience I’ve had in a non-hostage situation.
- TheHappyOddish 4y ago
  What an arrogent statement. You should read it over and think about how you interact with others.

c7DJTLrn 4y ago

Can't wait to have five different App Stores and be forced to install a spying app with full system access upon entering undemocratic countries. The average person does not care about the "walled garden." They want a phone that works and protects them.

bakugo 4y ago
None of this happens on android. It's time to step out of the Apple fantasy land and into the real world.
- c7DJTLrn 4y ago
  What do you mean? There's plenty of examples on Android where users have been tricked into sideloading malicious apps.
  - daveoc64 4y ago
    You just said there would be "five different App Stores", yet this hasn't happened on Android. Amazon has an app store for Android, but its apps are all on the Google Play Store. It's really there to serve Amazon's Fire platform where Amazon doesn't licence Google Play. Samsung has an app store for Android, but again, all of its apps it makes available to other non-Samsung device users are on Google Play. Additional app stores on Android have so far been complementary to Google Play, which remains the place where the overwhelming majority of apps are obtained.

thiht 4y ago

Can't wait to finally be able to install a YouTube app with SponsorBlock.

CogitoCogito 4y ago

The comments to this article just scream Stockholm Syndrome.

g8oz 4y ago

Could this mean a F-Droid type app store on the iPhone? That would be a big deal.

gjsman-1000 4y ago

I think developers who don't want to give 30% are going to have to deal with a new enemy: Piracy. The moment sideloading is available for iPhone, I expect within weeks there will be a cool, first-of-its-kind piracy App Store. As well as, within months, a cool, first-of-its-kind hacked game clients for iOS App Store. I think Epic Games might quickly discover that 30% might be lost to Apple or Piracy, pick your poison.

olliecornelia 4y ago

Great, can’t wait to see what apps my parents get tricked into installing.

isthiseasymode 4y ago

I predict that this will probably be irrelevant to the majority of users. There’s no way apple makes side loading easy enough for anyone outside of HN to use.

cloogshicer 4y ago
If the DMA (Digital Markets Act) has any teeth, they'll have to.
realusername 4y ago
That's going to end up the same way as Android if I have to guess yeah, as complicated as it gets for a normal user to activate so that nobody uses this outside of tech workers. Then they can just say that it's technically "there" for the courts.
- isthiseasymode 4y ago
  Hot take: that’s how it should be. After fixing laptops for less technical people, I don’t think the average person can be trusted to protect themselves against malware.
  - realusername 4y ago
    I don't agree there's any links between an appstore and malware. Sandboxing and app distribution are two concept which might or might not be linked depending on the implementation. For example, if somebody implemented an appstore for WindowsXP which had zero software protection, the appstore would have been a significant vector of distributing malware as well.

ChrisMarshallNY 4y ago

I would hope that Apple is going to try adding some kind of security guardrails on this. Not sure if they could do it, though. The one really big deal with cracked phones, is that the apps can do whatever the hell they want, and many app authors (I'll bet a number of them are on this very venue) will take advantage of that. I know that I can be circumspect, but many of my non-technical friends, cannot. They are highly likely to be manipulated into sideloading malware. Phones, these days, carry our whole freaking life. They are lucrative hacking targets. Many phone owners seem to be blissfully unaware. I have at least two friends, that deliberately don't engage locks or biometrics, for convenience, yet, their phones are loaded with banking apps and whatnot (I don't use any banking apps, myself).

DevKoala 4y ago

I hope there is an option to disable this by default. My parents already manage to install tons of awful apps somehow.

tempodox 4y ago
The AppStore is not there to protect your parents from awful software, it's there to protect Apple's interests. And they sure as hell won't force side-loading on you.
- DevKoala 4y ago
  The Apple Store makes it incredibly easy to cancel subscriptions and getting charge refunds. Try getting a refund out of a side loaded app charge.

Traubenfuchs 4y ago

Isn‘t sideloading already available with sidelodely?

gumby 4y ago

If I wanted side loading I'd have gone for Android. With Apple I can install my own apps and those of a couple of my friends; for anything else I let Apple provide some modicum of security checking.

moomoo11 4y ago

Isn’t it a minority of people who want this? I’d bet 99% of Apple users don’t care nor want this. I know I don’t. I like Apple’s App Store standards. If I want to side load apps I’d use android. But I don’t. If companies don’t like it just don’t support iOS. Others will and I’ll use those apps.

Hippocrates 4y ago
Precisely. You'll find that within HN and consumer electronics communities, the concept is much more polarizing. How many of your friends know what side-loading is? How many would want it if they did know what it was? If app-store only is ANY more secure than side loading than that's what I'd want my friends and family using, based on their technical chops, and my desire to not be their IT guy.

jraph 4y ago

Many people here are afraid of being able to install apps on iOS from somewhere else than the Apple store because then Facebook will be able to be fully evil on iOS. A relationship without trust and with fear of evil actions is called a toxic relationship. If you don't trust Facebook, don't install it. Even from the app store. There is no world in which you need the app. First, if you use Facebook because of the network effect, don't stay passive. Advocate for using something else, like Signal, mastodon, anything. Second (in the meantime), if you still need Facebook, I'm sure you can access it from a browser in private mode. Get out of this toxic relationship now. Get your news and your fun from somewhere else not amenable to a filter that suits a manipulative company. We should be happy for such new possibilities. Of course it requires putting your time and money where your mouth is. But it's worth doing either way! Stop the dissonance!

diebeforei485 4y ago
For most of the world outside US/Canada, WhatsApp is as mandatory as SMS or Phone Calls.
- jraph 4y ago
  WhatsApp is pervasive in France, where I live. I have resisted installing it from the start. Of course I felt some pressure about this. People never built the expectation I had WhatsApp. I never stopped advocating against it (in a nice way, without blaming people). Now, more and more people have been installing Signal and now I can have group discussions again. We are many who don't like Facebook. If enough of us resist, WhatsApp will stop being so pervasive and "mandatory". It has happened in my social circles. There's no drawback anymore for me to not having WhatsApp. When there was, I still had a fulfilling social life, with as many friends, or even more, than average. I was still invited to events, I was still able to organize events, etc. If people like you, they'll reach you. Having WhatsApp is just convenient, not a determining factor. Most people now understand that privacy is an important topic and will cope with you not having WhatsApp, or even embrace your action. The world needs you to become better. Of course it's not easy. But it's not inevitable. Again, WhatsApp might (still) be mandatory to you today. Okay! You are stuck with it for now. Fine. I understand. But do something about it! Advocate for something else! You can do it gently without pissing people off (which would be the best way to fail convincing them anyway) If nobody does anything about it, we are stuck with Meta.

tristor 4y ago

I have mixed feelings about this. I'm exactly the type of person who used to jailbreak my iPhone to run Cydia, and I used to build my own custom Android ROMs and spend hours on XDA-Developers before that. Now though, I appreciate how locked down iPhones are, and I keep it as locked down via Apple Configurator as possible, because the mobile web and mobile application space are fraught with peril. The vast majority of mobile apps are net-negative experiences unless it's a companion app to an in-person service (e.g. restaurant/airline/hotel/bank), and even those are often risky. If you look at the Android ecosystem, the Google Play Store is basically a ghetto where the lowest common denominator criminal gangs operate malware at scale with impunity, and Apple has been a haven away from this. I went through a lot of effort to switch my elderly parents into the Apple ecosystem, and since doing so I have been able to have a lot less support required and to sleep easy at night. With sideloading coming, I am not longer certain that their devices are safe and they won't be tricked into putting malware on the device.

deleted 4y ago
[deleted]
trallnag 4y ago
Do you wrap yourself with tinfoil at night to prevent your neighbors Android from scanning your thoughts?
- tristor 4y ago
  > Do you wrap yourself with tinfoil at night to prevent your neighbors Android from scanning your thoughts? Do you think this sort of question is in line with HN guidelines? Nothing I said is driven by paranoia, it's driven by the reality we find ourselves in. As mentioned in my comment I've developed custom Android ROMs, my wife actually is an Android user (yes I'm in a house divided), but myself and my wife are also much more technology savvy than my elderly parents. If you cannot understand how those situations differ in our current reality, there's not much I can do for you. When it comes to non-technical users that don't have good opsec practices, Android is a ghetto that basically guarantees your mobile devices are running malware, and the Apple ecosystem is nearly the opposite. Arguably the App Store is fraught with danger, but it's many orders of magnitude better about the impact of apps on user security and privacy than the Google Play Store. You may feel strongly in your support of Android and its ecosystem for other reasons, but it's pretty indisputable that it is less secure and less privacy-respecting, especially in relation to third-party applications.

flax 4y ago

A lot of these arguments against this sound like long-term prisoners convinced that they can't make it on the outside. https://dictionary.cambridge.org/us/dictionary/english/institutionalized https://dictionary.cambridge.org/us/dictionary/english/insti...

jutrewag 4y ago
Eh, I’ve seen the outside and it belongs on my PC.

h1fra 4y ago

Once again, EU laws benefiting everyone. And even this article only acknowledge this at the 3rd paragraph, if you only read the title or the first few sentences it depict Apple as the good guy.

microflash 4y ago

I can't wait for my banking app to ask me to disable sideloading on iOS before I can actually use it. Such idiocy has been rampant on Android with banking apps refusing to launch when Developer Options are enabled. That aside, I am very happy with this development. I have personal apps that I'd like to sideload without paying for a developer account. I am also looking forward to a more lively open-source ecosystem around iOS apps which has been significantly lackluster compared to that on Android.

layer8 4y ago
I don’t think banking apps will have much reason to do so, given that sideloaded apps will still be sandboxed. This is not like a jailbreak. I would also assume that apps have no way to check what kind of other apps are installed.
- microflash 4y ago
  I hope that sideloading detection will not be possible for other apps. Enabling Developer Options is not rooting Android devices but that hasn't stopped many banking apps forcing users to completely disable them before they can be opened.
jutrewag 4y ago
You can side load your personal apps now.
- Pfhortune 4y ago
  ...but you have to refresh them every seven days or they stop launching. A very annoying tether for a mobile device. And you can install three personal apps at most.

kimmeld 4y ago

Sideloading, otherwise known as installing software you want, on hardware you own. Love how the term tries to make it sound so suspicious.

diebeforei485 4y ago

I'm not happy about this. If the dispute is around Apple's monopolistic 30% commission, regulate the commission.

diebeforei485 4y ago

I don't like this. I don't want my government or school or employer to coerce/"encourage" me to install apps on my personal device.

McDev 4y ago
Then don't install them.
- diebeforei485 4y ago
  It is not optional in most of these cases.
ThatPlayer 4y ago
They can already sideload through MDM.

thescriptkiddie 4y ago

Apple is considering possibly removing one of the most anti-consumer features of its phones and there are people in the comments arguing against it. Not looking good for the future of society.

seanw444 4y ago

Apple has successfully convinced their base that leaving their walled garden is a danger. I wonder what particular word could be used to define that. Anyways, F-Droid is a clear example of how alternative sources of apps can be just as secure as the official one (and in F-Droid's case, more secure).

jutrewag 4y ago
The particular word is “comfort”. The App Store is comfy and they enforce a certain modicum of non-jank.
gorbypark 4y ago
I think everyone agrees that not only Apple has the ability to offer an malware free App Store, it’s just that if F-Droid exists than so can G-Droid, the fork made by criminals to exploit less technical users. I think it’s overblown, though. Android has side loading and there doesn’t seem to be an epidemic of sketchy app stores.

lykahb 4y ago

I find the term sideloading problematic. It carries the bias that the "correct" way is to install apps from the centralized app store. The term conveys that this is an alternative and undesirable thing to do. The concern of malware is legitimate, but having a centralized approved store is a weak barrier anyway. The iOS has a solid system of permissions and sandboxing that should take care of that. A more drastic change is that tgere are no technical means to impose UI that conforms to the Apple standards or enforce that the app payments go through the Apple payment system.

TheHappyOddish 4y ago
> It carries the bias that the "correct" way is to install apps from the centralized app store. The term conveys that this is an alternative and undesirable thing to do. But... It is. This is a designed for purpose device, chosen to be used freely and this the "correct" way to install. Who defines the "correct" way if not the OS developers?

concerned_ 4y ago

[flagged]

twalichiewicz 4y ago

It's understandable that people are eager for the potential of side loading on iOS, as it could provide more direct access to apps without the need for intermediaries / App Store policy misunderstandings. However, it's worth considering the potential downsides of this approach, particularly the risk of app and service balkanization. This is already happening in the gaming industry, where major studios force you to use their own launchers to capture valuable (sellable) data about their customers. But to play the optimist, perhaps inspiration can be taken from how macOS handles app installation from non-App Store sources: - You go to the developers website - You are presented with two links if the app is also available on the App Store with the alternative being direct download - After downloading the .dmg you are presented with a modified version of the Installer.app UI that runs you through what services the app uses, data that it collects, where it will install, additional options, etc. - One final confirmation of "Is this from a trusted developer" - Installer.app runs a virus / malware check against what is going to be installed - App is ready to go on the phone

tehlike 4y ago

There will be many ux frictions and restrictions that unless companies with stake in it complain, it won't make a meaningful dent.

jutrewag 4y ago

I can’t believe I’m arguing for this but why is this necessary. I’ve gotten comfortable with my walled garden…

stale2002 4y ago

Man, I remember arguing with so many people, who were on complete copium, regarding this decision. It should have been obvious, for anyone who has following this whole saga, that eventually Apple was going to be forced to open up. Sure, maybe it was the Epic lawsuit that did it, but there were a dozen different vulerabilities, and pathways to them being forced to open up. If it wasn't that lawsuit, then it was going to be a new law, if not in america, then instead in the EU.

ralphc 4y ago

I look forward to this, not for potentially sketchy third party apps but for my own apps. My phone is the computer, camera, etc. that I always carry with me and I'd like to be able to write my own apps, both for experimenting and for my utility. Just sideload them, no developer program, no yearly license fees, write in languages of my choice, have a VM on my phone if I want. If nothing else, imagine your own AI assistant that you know respects your privacy because it only communicates with your home server, or fits completely on your phone.

smw 4y ago
I think it's been quite easy to run your own apps on your iPhone for years now?
- raydev 4y ago
  If you have a free developer account then you need to redeploy the app to your phone every 7 days. You can only add up to 3 devices to your free account, and there's no way to remove them without paying (at least that I could see when I let my subscription lapse), so good luck if you replace your phone too many times or try to share an app with a family member or friend. It's not impossible, and perhaps it's easy if you've already hit all the pitfalls and know where they are, but I would not describe it as easy.
djxfade 4y ago
That would still require Apple to open the various APIs. Even though we will be able to sideload apps, it dosent necessarily grant us access to everything we need to compete with let's say Siri (not from a technical standpoint, but from an integration perspective)
- EMIRELADERO 4y ago
  The DMA law says they would have to. > 7. The gatekeeper shall allow providers of services and providers of hardware, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same hardware and software features accessed or controlled via the operating system or virtual assistant listed in the designation decision pursuant to Article 3(9) as are available to services or hardware provided by the gatekeeper. Furthermore, the gatekeeper shall allow business users and alternative providers of services provided together with, or in support of, core platform services, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same operating system, hardware or software features, regardless of whether those features are part of the operating system, as are available to, or used by, that gatekeeper when providing such services.

lisper 4y ago

This seems like a no-brainer to me: just make it opt-in with a huge warning label: "If you turn on this feature, many bad things might happen to you if you are not very careful, and we disclaim responsibility."

gcanyon 4y ago

When the App Store first opened, I wondered if Apple would allow an alternative App Store to launch, to carry apps that Apple was unwilling to. I wonder if that solution, instead of a side-loading free-for-all, would 1. Satisfy Europe 2. Protect users 3. Potentially get Apple everything they want. 1. Because Apple wouldn't have a monopoly on app distribution 2. Because there would still be a limited number of players who would need to commit to app review/security. 3. Because users would likely continue to use Apple's App Store almost exclusively, while allowing certain outliers (subscription-dependent apps) a way out.

Teamancer 4y ago

Is there a business opportunity here for an independent, transparent 3rd party, (side-loaded or not app)safety inspection/testing service? Right now customers rely on the word of outfits. mostly Google and Apple who make money on your use, that the software they will "allow" you to install is "safe." Yet a lot of malicious crap gets through and sometimes remains available until enough victims post reviews. A legitimate, transparent and disinterested 3rd party vetting service would not have a stake in whether or not a customer would download or sideload apps - from anywhere.

christkv 4y ago

I got a beat that they will launch this sounding like they made this decision to improve the user experience. One more thing now we have opened the iPhone so all developers can test their apps without the cumbersome approval process. We call it express deploy and it’s awesome.

dahwolf 4y ago

Mozilla should step into this space. Launch an alternative app store, cost-neutral or minor profit only, all apps privacy checked. Better than the writing of preachy blogs that do nothing. The problem with current Mozilla is that they have no platform. They have no reach.

binarymax 4y ago
I would totally pay for apps on a Mozilla store. This is a great idea.
- dahwolf 4y ago
  The only risk I see is their progressive views at times being a little too progressive, leading to "safetyism" and a too restrictive policy on what can go in the store and what cannot, or this somehow affecting which app get prime real estate, whilst others are burried. Screw it, I might as well spit it out: it should not be a woke app store.
  - Pfhortune 4y ago
    What is woke? Can you quantify it?
    - dahwolf 4y ago
      Yes, it's anything I dislike.

dzogchen 4y ago

"Sideloading" is such a weird term. Why does "installing" something without Apple's approval need another word?

KingLancelot 4y ago

[dead]