5 ms·

Side-loaded apps still have the same permission model?

by orf 3y ago

nine_k 3y ago
Yes. There's no way for an app to sidestep that. AFAICT the only way to sidestep things on Android is to root the phone, then explicitly install some native-code binaries that do direct access to things normally controlled by permissions. This is not something that can easily happen by mistake, let alone by normal operation.
deleted 3y ago
[deleted]
Terretta 3y ago
Permissions I've read side-loaders insisting are crucial to them: - permission to ignore my subscription intents - permission to bypass my private relay prefs - permission to share my PII and purchase profile to third parties - permission to share my browsing with adtech - permission to dynamically load unvetted code - permission to bully the user into letting the app out of the sandbox model - permission to bully users into granting elevated privs There are any number of permissions devs think side-loading will give them, and any number of these actively misused by app devs today on MacOS side. A majority of the side-loading table thumpers build business models on the user as the product, the user's data as the thing of value. These firms are not on the user's side. Of course not you, gentle reader. You only want side-loading for good. The government only wants encryption backdoors for the children. If we think back and side doors weaken security posture or tempt legislatures, we should maintain that stance. Instead of building holes we pinky swear are only for the good guys, imagine there were no holes.
- i5-2520M 3y ago
  You are hallucinating holes. I don't even know exactly on a OS permission level what you mean by some of these, but at least forsome of these, I know for a fact you currently can't do by sideloading an app.
  - Terretta 3y ago
    Didn't say you could. I said these are among the reasons growth hackers cite in public for side-loading. I'd be happiest if even payments and subscriptions were still required to go through the customer-centric system Apple set up, the number one dev complaint. For users, ideally Apple would relax nothing for a side-loaded app, and would maintain a stringent review process for whose certs can authorize apps, and a zero strikes policy for revoking such certs. Unfortunately, some of these will be relaxed.
    - i5-2520M 3y ago
      > I'd be happiest if even payments and subscriptions were still required to go through the customer-centric system Apple set up, the number one dev complaint. It is the number one complaint due to the 15-30% cut they take, but even now, entities such as Amazon, Uber and others dealing in real life goods don't have to use Apple's system. It is not customer centric, it is profit centric. > For users, ideally Apple would relax nothing for a side-loaded app, and would maintain a stringent review process for whose certs can authorize apps, and a zero strikes policy for revoking such certs. Unfortunately, some of these will be relaxed. Could Microsoft release an Xcloud client under these rules? Torrent apps? Emulators? These are all perfectly legal and some of these don't even require payments. Could apple still collect the 100$ per year from these devs?

Side-loaded apps still have the same permission model?

by orf 3y ago

Side-loaded apps still have the same permission model?

Yes. There's no way for an app to sidestep that. AFAICT the only way to sidestep things on Android is to root the phone, then explicitly install some native-code binaries that do direct access to things normally controlled by permissions. This is not something that can easily happen by mistake, let alone by normal operation.

deleted 3y ago

[deleted]

Terretta 3y ago

Permissions I've read side-loaders insisting are crucial to them: - permission to ignore my subscription intents - permission to bypass my private relay prefs - permission to share my PII and purchase profile to third parties - permission to share my browsing with adtech - permission to dynamically load unvetted code - permission to bully the user into letting the app out of the sandbox model - permission to bully users into granting elevated privs There are any number of permissions devs think side-loading will give them, and any number of these actively misused by app devs today on MacOS side. A majority of the side-loading table thumpers build business models on the user as the product, the user's data as the thing of value. These firms are not on the user's side. Of course not you, gentle reader. You only want side-loading for good. The government only wants encryption backdoors for the children. If we think back and side doors weaken security posture or tempt legislatures, we should maintain that stance. Instead of building holes we pinky swear are only for the good guys, imagine there were no holes.

i5-2520M 3y ago
You are hallucinating holes. I don't even know exactly on a OS permission level what you mean by some of these, but at least forsome of these, I know for a fact you currently can't do by sideloading an app.
- Terretta 3y ago
  Didn't say you could. I said these are among the reasons growth hackers cite in public for side-loading. I'd be happiest if even payments and subscriptions were still required to go through the customer-centric system Apple set up, the number one dev complaint. For users, ideally Apple would relax nothing for a side-loaded app, and would maintain a stringent review process for whose certs can authorize apps, and a zero strikes policy for revoking such certs. Unfortunately, some of these will be relaxed.
  - i5-2520M 3y ago
    > I'd be happiest if even payments and subscriptions were still required to go through the customer-centric system Apple set up, the number one dev complaint. It is the number one complaint due to the 15-30% cut they take, but even now, entities such as Amazon, Uber and others dealing in real life goods don't have to use Apple's system. It is not customer centric, it is profit centric. > For users, ideally Apple would relax nothing for a side-loaded app, and would maintain a stringent review process for whose certs can authorize apps, and a zero strikes policy for revoking such certs. Unfortunately, some of these will be relaxed. Could Microsoft release an Xcloud client under these rules? Torrent apps? Emulators? These are all perfectly legal and some of these don't even require payments. Could apple still collect the 100$ per year from these devs?