5 ms·

> Historically, Apple execs including Tim Cook and Craig Federighi have staunchly opposed sideloading citing privacy and security reasons. Which is funny to me

> Historically, Apple execs including Tim Cook and Craig Federighi have staunchly opposed sideloading citing privacy and security reasons. Which is funny to me, because after flipping through the App Store for an email client, I found, on this heavily curated storefront, a single digit number of apps I would trust with my email credentials. Android, with it's option to "sideload" F-Droid, gives me dramatically more options that I trust. Security and trust do not require locking me out of my own hardware.

Retric 4y ago
Apps you trust is a really poor security mechanism for the general public. The Apple App Store is a dumpster fire, but there is a perfectly reasonable argument for locking down a device you’re handing to family members who aren’t security conscious.
- nightski 4y ago
  I don't personally know a single person outside of developers that have side loaded apps on Android. Maybe I am an anomaly, but it just seems very rare.
  - dublinben 4y ago
    It's probably just you. Fortnite went sideload-only on Android in 2018, and had ~40m players on Android. Their userbase is 60% 18-24 years old, so you may not know many players. [0] Leading drone maker DJI's app for Android is also sideload-only, and they've sold hundreds of thousands of drones to people, many of whom probably use Android. [0] https://www.sportskeeda.com/esports/how-many-people-play-fortnite-2021 https://www.sportskeeda.com/esports/how-many-people-play-for...
    - m463 4y ago
      I wouldn't sideload a DJI app on my phone - for that matter any chinese manufacturer
  - squeaky-clean 4y ago
    My mom got tricked into installing an "emoji pack" that would make her phone give her constant notifications for a gambling website. She doesn't know she sideloaded an app, but that's what happened.
    - ianlevesque 4y ago
      On Android you have to download the app, open it, navigate a dialog with no Next or OK buttons (it requires you to toggle on a permission switch for the application you are using out of a list of applications) and then go back and try again, then click install. If you are doing all of that, you are very determined to install that malware. I don't think protecting against that is worth denying everyone else the freedom to use their device as they see fit.
      - TheHappyOddish 3y ago
        I'm going to assume you're coming from a place of ignorance here. A significant portion of people (often > 50) will absolutely follow this process if guided maliciously. Many people are incapable of grokking a warning message, as using a misunderstood device already sets their anxiety high. I'm not saying Apples method is necessarily the right method, but stating that these people aren't worth protecting - or at least not worth protecting at the cost of opening up a device you bought knowing it was closed and had alternatives for - comes across as callous as best.
- galleywest200 4y ago
  > perfectly reasonable argument for locking down a device you’re handing to family members who aren’t security conscious Then enable a more limited App Store mode as an opt-in feature.
  - CharlesW 4y ago
    > Then enable a more limited App Store mode as an opt-in feature. As on macOS (with SIP, etc.) it'll be the opposite: Users will need to opt-in to this new less-secure mode, as they do the ultra-secure Lockdown Mode.
    - rootusrootus 4y ago
      > As on macOS I'm on the latest version of MacOS and I routinely install software outside of the App Store (in fact, nearly 100% of the software I install is outside the app store).
      - squeaky-clean 4y ago
        You only have to enable the setting once, but you probably did change the "Allow apps downloaded from" setting at some point in the past. https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491
- deleted 4y ago
  [deleted]
- layer8 4y ago
  I’m sure you’ll still be able to do so with MDM using Configurator.
mft_ 4y ago
Genuine question: what are you basing these 'trust' judgements on, especialy in the case of the Android apps? Open source, or something else?
- sneak 4y ago
  For me, it's where the apps send the credentials or usage information off to. Most apps in the iOS App Store are chock full of spyware that reports on everything you do in the app. Many of the Apple system apps function the same way too (even with analytics disabled).
  - mft_ 4y ago
    Again, totally genuine question: how do you know this? From a (my) relatively uninformed perspective, I'd have expected the opposite - that the iOS App store was more of a 'controlled' environment, and the Play store more like the wild west. But maybe this is just me believing Apple's marketing...
    - smoldesu 4y ago
      Well, any app can make web requests for starters. If Facebook/Meta/Whoever wants to exfiltrate data from their app, they probably can. So, the issue on most apps becomes limiting the amount of personally identifying data that can reach that runtime in the first place. Both Android and iOS now do a fairly good job sandboxing the filesystem, but both cannot protect against advanced fingerprinting/data processing. Apple can outline acceptable data processing terms in the App Store, but that doesn't stop bad actors from taking data and processing it remotely. In Facebook and TikTok's case, this is almost certainly what's happening - and why the government is the only one capable of holding them in check. The "alternative" is restricting the amount of entropy a user can generate to near-zero, which isn't really useful for app developers. Suffice to say it's an unsolved issue, even with a singular App Store.
    - sneak 4y ago
      Most apps disclose this in their app privacy label in the app store.
nicce 4y ago
The problem is that most of the mainstream apps will not be in F-Droid et al. when they are the ones which should be in there. We lose all transparency for the big players. Meta does not want us to know precisely how much it collects data. If they can start somehow avoid Apples privacy restrictions and reduce transparency with side loading, they will do it. There isn’t really problem with the lack of sideloading in iOS. It is just that costly developer licence and strict requiremets of App store to increase the quality of the apps. Sideloading just makes it easier to install lower quality software and some random oss projects where maintainers do not have either Apple’s licence or time to maintain app store releases. Of course, there is the payment fee but that is another story.

Retric 4y ago

Apps you trust is a really poor security mechanism for the general public. The Apple App Store is a dumpster fire, but there is a perfectly reasonable argument for locking down a device you’re handing to family members who aren’t security conscious.

nightski 4y ago
I don't personally know a single person outside of developers that have side loaded apps on Android. Maybe I am an anomaly, but it just seems very rare.
- dublinben 4y ago
  It's probably just you. Fortnite went sideload-only on Android in 2018, and had ~40m players on Android. Their userbase is 60% 18-24 years old, so you may not know many players. [0] Leading drone maker DJI's app for Android is also sideload-only, and they've sold hundreds of thousands of drones to people, many of whom probably use Android. [0] https://www.sportskeeda.com/esports/how-many-people-play-fortnite-2021 https://www.sportskeeda.com/esports/how-many-people-play-for...
  - m463 4y ago
    I wouldn't sideload a DJI app on my phone - for that matter any chinese manufacturer
- squeaky-clean 4y ago
  My mom got tricked into installing an "emoji pack" that would make her phone give her constant notifications for a gambling website. She doesn't know she sideloaded an app, but that's what happened.
  - ianlevesque 4y ago
    On Android you have to download the app, open it, navigate a dialog with no Next or OK buttons (it requires you to toggle on a permission switch for the application you are using out of a list of applications) and then go back and try again, then click install. If you are doing all of that, you are very determined to install that malware. I don't think protecting against that is worth denying everyone else the freedom to use their device as they see fit.
    - TheHappyOddish 3y ago
      I'm going to assume you're coming from a place of ignorance here. A significant portion of people (often > 50) will absolutely follow this process if guided maliciously. Many people are incapable of grokking a warning message, as using a misunderstood device already sets their anxiety high. I'm not saying Apples method is necessarily the right method, but stating that these people aren't worth protecting - or at least not worth protecting at the cost of opening up a device you bought knowing it was closed and had alternatives for - comes across as callous as best.
galleywest200 4y ago
> perfectly reasonable argument for locking down a device you’re handing to family members who aren’t security conscious Then enable a more limited App Store mode as an opt-in feature.
- CharlesW 4y ago
  > Then enable a more limited App Store mode as an opt-in feature. As on macOS (with SIP, etc.) it'll be the opposite: Users will need to opt-in to this new less-secure mode, as they do the ultra-secure Lockdown Mode.
  - rootusrootus 4y ago
    > As on macOS I'm on the latest version of MacOS and I routinely install software outside of the App Store (in fact, nearly 100% of the software I install is outside the app store).
    - squeaky-clean 4y ago
      You only have to enable the setting once, but you probably did change the "Allow apps downloaded from" setting at some point in the past. https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491
deleted 4y ago
[deleted]
layer8 4y ago
I’m sure you’ll still be able to do so with MDM using Configurator.

mft_ 4y ago

Genuine question: what are you basing these 'trust' judgements on, especialy in the case of the Android apps? Open source, or something else?

sneak 4y ago
For me, it's where the apps send the credentials or usage information off to. Most apps in the iOS App Store are chock full of spyware that reports on everything you do in the app. Many of the Apple system apps function the same way too (even with analytics disabled).
- mft_ 4y ago
  Again, totally genuine question: how do you know this? From a (my) relatively uninformed perspective, I'd have expected the opposite - that the iOS App store was more of a 'controlled' environment, and the Play store more like the wild west. But maybe this is just me believing Apple's marketing...
  - smoldesu 4y ago
    Well, any app can make web requests for starters. If Facebook/Meta/Whoever wants to exfiltrate data from their app, they probably can. So, the issue on most apps becomes limiting the amount of personally identifying data that can reach that runtime in the first place. Both Android and iOS now do a fairly good job sandboxing the filesystem, but both cannot protect against advanced fingerprinting/data processing. Apple can outline acceptable data processing terms in the App Store, but that doesn't stop bad actors from taking data and processing it remotely. In Facebook and TikTok's case, this is almost certainly what's happening - and why the government is the only one capable of holding them in check. The "alternative" is restricting the amount of entropy a user can generate to near-zero, which isn't really useful for app developers. Suffice to say it's an unsolved issue, even with a singular App Store.
  - sneak 4y ago
    Most apps disclose this in their app privacy label in the app store.

nicce 4y ago

The problem is that most of the mainstream apps will not be in F-Droid et al. when they are the ones which should be in there. We lose all transparency for the big players. Meta does not want us to know precisely how much it collects data. If they can start somehow avoid Apples privacy restrictions and reduce transparency with side loading, they will do it. There isn’t really problem with the lack of sideloading in iOS. It is just that costly developer licence and strict requiremets of App store to increase the quality of the apps. Sideloading just makes it easier to install lower quality software and some random oss projects where maintainers do not have either Apple’s licence or time to maintain app store releases. Of course, there is the payment fee but that is another story.