4 ms·

The App Store is a poor line of defense, because it isn't about user security, it's about securing Apple's billion dollar app distribution monopoly moneyhose. U

The App Store is a poor line of defense, because it isn't about user security, it's about securing Apple's billion dollar app distribution monopoly moneyhose. User security is just a rhetorical afterthought. When we forgo real system safety in favor of gatekeeping corporate revenue, that isn't security. In fact, such a scheme is responsible for mass distribution of malware. Apple's App Store is responsible for distributing over half a billion copies of Xcodeghost to iPhone and iPad users[1], and that's just one piece of malware. [1] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is-exposing-details-about-the-biggest-iphone-hack-of-all-time https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...

hayst4ck 4y ago
I think you need to look at the system of incentives and alignment If apple's billion dollar app distribution monopoly money hose results in security problems for people, then their billion dollar app distribution monopoly money hose will be in jeopardy since it's justification comes into question. So what you see as a problem is what makes me feel the best about it. Apple is aligned with only secure apps on their store and apple is very unaligned with insecure apps. To apple security is not just a cost center, but a pillar of the justification for their monopoly position.
- smoldesu 4y ago
  It's a poor justification. You can cleanly implement a signing system for trusted developers (they've done it before), and it's obviously possible to distribute iPhone package files. All the pieces are in place, if it weren't for their $80 billion annual hayday then they wouldn't be dying on this hill in particular. Maybe part of it is this security alignment issue, but upon scrutiny it's clearly a small and solvable piece of the puzzle. Imagine if Keurig tried using user safety to justify a 30% cut off every K-cup sold. Such an ecosystem is doomed to fail, especially at-scale and with completely arbitrary enforcement.
  - geocar 4y ago
    It sounds more like you’re upset about apples revshare model on their channel; Why do you care if all your competitors also have to pay it? I don’t think the world got better because we got more channels on Tv, and I even think some of them might be dangerous and harmful to life…
    - smoldesu 4y ago
      That's fine. I'm not arguing for more channels, I just want them to let me use it for things other than the pre-approved and Apple-sponsored channels. This is akin to your TV manufacturer removing your HDMI input to force you to pay for cable.
      - deleted 4y ago
        [deleted]
      - geocar 4y ago
        Erm, Apple shares the cable subscription revenue with the people who make the content. People like me. You are literally talking about stealing my money. To me. And this doesn’t seem strange to you?
    - moonchrome 4y ago
      > Why do you care if all your competitors also have to pay it? Did you ever publish to appstore ? The amount of bullshit you have to go through so that an alternative payment method isn't reachable from mobile is insane, and they want % of a lot of things, not just sales/subscription - a lot of business ideas are unviable because of the policy. Not to mention that your competitors don't have to pay the same, big players get special deals and exemptions, and Apple has first party advantage on the platform.
      - illiarian 4y ago
        You've described literally every platform and physical store under the sun except desktop OSes.
- vhanda 4y ago
  > then their billion dollar app distribution monopoly money hose will be in jeopardy It only comes under jeopardy, if there are reasonable alternatives the Apple app store (not move to Android). Otherwise, it's easy for Apple to say - we are now taking step x, y and z, and "trust us".
hayst4ck 4y ago
As a further separate but distinct response: You are justifying why a monopoly app store is bad by showing a hack that resulted from downloading an app (xcode) from a source other than the app store. Security firm Palo Alto Networks surmised that because network speeds were slower in China, developers in the country looked for local copies of the Apple Xcode development environment, and encountered altered versions that had been posted on domestic web sites. This opened the door for the malware to be inserted into high profile apps used on iOS devices. I think you are also ignoring that apples app store position made it possible to authoritatively reach out to all who were effected as well as enact other remediation efforts.
- heavyset_go 4y ago
  This just shows that the App Store model is insufficient for user security, as the the security model was supposed to prevent malware from being distributed to users in the first place, no matter what malicious developers upload to the App Store. If Apple treats Xcode as App Store blessed because it believes it came from blessed sources like the App Store, instead of using real security measures, exploits will continue to be shipped to users. Similarly, if OSes don't implement real security that's independent of the App Store model, users will continue to be exploited in this way. > I think you are also ignoring that apples app store position made it possible to authoritatively reach out to all who were effected as well as enact other remediation efforts. Microsoft is able to do the same thing with Windows Defender without using the App Store model at all.
  - hayst4ck 4y ago
    I can't give you a black and white response because I don't think the issue is as black and white as most seem to. I think the app store is a tool and I think it is a powerful and useful tool. Can the tool be used for good? of course. Can it also be used for bad? most definitely. Can it be wielded poorly? yes. I've used windows, linux, apple, and android, and I like Apple's environment the best. That environment is a consequence of apples choices. Apple limits my choices and I like that. I like having less choices. I don't want to have to think about software security, I want to think about how to spend time with my friends, and apple is a an environment that lets me think about how best to spend time with friends instead of thinking about software security. Apple's restriction of my choices benefits me. I want apple to restrict my choices. I want there to be only one way to get apps on my device. That simplifies my life. I will pay more to have a more simple life. I will pay someone else to make better choices than I can make with my limited time. I want to do that. If you don't like that, then don't use Apple. There is a perfectly working alternative to apple that you can use if you want to experience other choices. Apple has a monopoly on apple devices, but apple by no means has a monopoly on smart phones. I'm not sure there are even any major apps exclusive to apple. Apple is better because apple has more money to spend. > Microsoft is able to do the same thing with Windows Defender without using the App Store model at all. If apple scanned the apps I side-loaded and reported information about them to their servers that would upset me, that feels like a privacy violation. Apple's bullying of companies with monopoly power to force privacy labels won me over greatly. They have a lot of good will for that. If apple continues to do things like that, I will continue to support an app store monopoly.

hayst4ck 4y ago

I think you need to look at the system of incentives and alignment If apple's billion dollar app distribution monopoly money hose results in security problems for people, then their billion dollar app distribution monopoly money hose will be in jeopardy since it's justification comes into question. So what you see as a problem is what makes me feel the best about it. Apple is aligned with only secure apps on their store and apple is very unaligned with insecure apps. To apple security is not just a cost center, but a pillar of the justification for their monopoly position.

smoldesu 4y ago
It's a poor justification. You can cleanly implement a signing system for trusted developers (they've done it before), and it's obviously possible to distribute iPhone package files. All the pieces are in place, if it weren't for their $80 billion annual hayday then they wouldn't be dying on this hill in particular. Maybe part of it is this security alignment issue, but upon scrutiny it's clearly a small and solvable piece of the puzzle. Imagine if Keurig tried using user safety to justify a 30% cut off every K-cup sold. Such an ecosystem is doomed to fail, especially at-scale and with completely arbitrary enforcement.
- geocar 4y ago
  It sounds more like you’re upset about apples revshare model on their channel; Why do you care if all your competitors also have to pay it? I don’t think the world got better because we got more channels on Tv, and I even think some of them might be dangerous and harmful to life…
  - smoldesu 4y ago
    That's fine. I'm not arguing for more channels, I just want them to let me use it for things other than the pre-approved and Apple-sponsored channels. This is akin to your TV manufacturer removing your HDMI input to force you to pay for cable.
    - deleted 4y ago
      [deleted]
    - geocar 4y ago
      Erm, Apple shares the cable subscription revenue with the people who make the content. People like me. You are literally talking about stealing my money. To me. And this doesn’t seem strange to you?
  - moonchrome 4y ago
    > Why do you care if all your competitors also have to pay it? Did you ever publish to appstore ? The amount of bullshit you have to go through so that an alternative payment method isn't reachable from mobile is insane, and they want % of a lot of things, not just sales/subscription - a lot of business ideas are unviable because of the policy. Not to mention that your competitors don't have to pay the same, big players get special deals and exemptions, and Apple has first party advantage on the platform.
    - illiarian 4y ago
      You've described literally every platform and physical store under the sun except desktop OSes.
vhanda 4y ago
> then their billion dollar app distribution monopoly money hose will be in jeopardy It only comes under jeopardy, if there are reasonable alternatives the Apple app store (not move to Android). Otherwise, it's easy for Apple to say - we are now taking step x, y and z, and "trust us".

hayst4ck 4y ago

As a further separate but distinct response: You are justifying why a monopoly app store is bad by showing a hack that resulted from downloading an app (xcode) from a source other than the app store. Security firm Palo Alto Networks surmised that because network speeds were slower in China, developers in the country looked for local copies of the Apple Xcode development environment, and encountered altered versions that had been posted on domestic web sites. This opened the door for the malware to be inserted into high profile apps used on iOS devices. I think you are also ignoring that apples app store position made it possible to authoritatively reach out to all who were effected as well as enact other remediation efforts.

heavyset_go 4y ago
This just shows that the App Store model is insufficient for user security, as the the security model was supposed to prevent malware from being distributed to users in the first place, no matter what malicious developers upload to the App Store. If Apple treats Xcode as App Store blessed because it believes it came from blessed sources like the App Store, instead of using real security measures, exploits will continue to be shipped to users. Similarly, if OSes don't implement real security that's independent of the App Store model, users will continue to be exploited in this way. > I think you are also ignoring that apples app store position made it possible to authoritatively reach out to all who were effected as well as enact other remediation efforts. Microsoft is able to do the same thing with Windows Defender without using the App Store model at all.
- hayst4ck 4y ago
  I can't give you a black and white response because I don't think the issue is as black and white as most seem to. I think the app store is a tool and I think it is a powerful and useful tool. Can the tool be used for good? of course. Can it also be used for bad? most definitely. Can it be wielded poorly? yes. I've used windows, linux, apple, and android, and I like Apple's environment the best. That environment is a consequence of apples choices. Apple limits my choices and I like that. I like having less choices. I don't want to have to think about software security, I want to think about how to spend time with my friends, and apple is a an environment that lets me think about how best to spend time with friends instead of thinking about software security. Apple's restriction of my choices benefits me. I want apple to restrict my choices. I want there to be only one way to get apps on my device. That simplifies my life. I will pay more to have a more simple life. I will pay someone else to make better choices than I can make with my limited time. I want to do that. If you don't like that, then don't use Apple. There is a perfectly working alternative to apple that you can use if you want to experience other choices. Apple has a monopoly on apple devices, but apple by no means has a monopoly on smart phones. I'm not sure there are even any major apps exclusive to apple. Apple is better because apple has more money to spend. > Microsoft is able to do the same thing with Windows Defender without using the App Store model at all. If apple scanned the apps I side-loaded and reported information about them to their servers that would upset me, that feels like a privacy violation. Apple's bullying of companies with monopoly power to force privacy labels won me over greatly. They have a lot of good will for that. If apple continues to do things like that, I will continue to support an app store monopoly.