8 ms·

This was talked about by Phillip Shoemaker (head of App Store Review 2009-2016) in this talk[0], where some developers figured out that if they hired marketing

by judge2020 3y ago

This was talked about by Phillip Shoemaker (head of App Store Review 2009-2016) in this talk[0], where some developers figured out that if they hired marketing firms to commit review fraud on a competitor’s app, their competitor would get terminated because there’s no clear way to actually attribute the fraud to the developer. I guess the App Store fraud prevention team hasn’t necessarily found a good solution yet. 0: https://youtu.be/tJeEuxn9mug?t=22m57s&si=CVfkqSqEULyFTx-8 https://youtu.be/tJeEuxn9mug?t=22m57s&si=CVfkqSqEULyFTx-8

echelon 3y ago
> I guess the App Store fraud prevention team hasn’t necessarily found a good solution yet. The most essential device of the century is owned by two companies. The ability for them to completely control software and business activities on top of something that is almost as essential as public transportation is appalling. The DOJ needs to remove the "app store" racket for essential computing devices. Software needs to be freely installable, sans vendor control, unfair competition, scare tactics, mandatory taxation, and adversarial ad placement by the cellphone duopoly. Not only is cell phone compute freedom essential, but we desperately need more than just two vendors.
- judge2020 3y ago
  One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. Requiring third party app stores disproportionately harms those that purchased the device specifically for these purposes (such as people at higher risks of being targeted by nation state actors). And this isn’t something that can be addressed with a new uber-secure product just for these people, because the EU will deem it a gatekeeper if enough people buy it - so I guess you have to create a hard cutoff for how many can purchase the product ever, or means test “do you actually deserve security?”.
  - echelon 3y ago
    > Requiring third party app stores No stores. Web install. Web first class. No "only Safari/webkit engine" limitation. If Apple is so genius, they can solve malware with all of those engineering minds and dollars they have. They don't need to hind behind a store to do that. The tools and techniques are readily available and accessible for a company of their size and stature. Permission layer, app runtime heuristics, and fingerprints are a start. They can do this. They just don't want to / have to, because they're currently Gods of the Phone Universe with unfettered and completely unfair control over "their domain".
    - judge2020 3y ago
      Stores is synonymous with side loading. Pedantically your website could be considered a “store” for the single app you distribute for it. And the threat surface of the iOS sandbox is so large that it’s impossible to secure everything everywhere the first time. Every iOS jailbreak since at least iOS 10 starts with a sandbox escape exploit and executed via a sideloaded app (besides the single hardware exploit found in recent years, checkm8)
    - xienze 3y ago
      > If Apple is so genius, they can solve malware with all of those engineering minds and dollars they have. They don't need to hind behind a store to do that. The tools and techniques are readily available and accessible for a company of their size and stature. An App Store with a human review process is one tool in the toolbox. > Permission layer, app runtime heuristics, and fingerprints are a start. They can do this. I think this is Google’s approach. How’s that been going?
    - chongli 3y ago
      No stores. Web install. Web first class... Permission layer, app runtime heuristics, and fingerprints are a start. How does that work? If it's open web download and install with no notarization (because that's also gatekeeping) then we're back to the good ol' days of the 90's and early 00's. In other words, anything goes and it's up to the user to keep themselves secure, which in practice means rampant security failures and users getting scammed and hit with ransomware at every turn. I don't like Apple having so much control over everything. I really preferred the old days of the web and the anything goes, full control over my computers I had back then. But the web is absolutely way nastier today. It's jam packed with scammers and ransomware gangs and botnets. It's really quite sad and frustrating for anyone who grew up with the full potential of computing.
  - Manuel_D 3y ago
    Just don't use the third party app store if you're worried about scams. Requiring that apple permit 3rd party app stores does not force users to use said 3rd part stores.
    - quitit 3y ago
      This sounds like a fair point until remembering that things like Boss-ware exist. An insurer/ health insurer, employer, government, etc will require it, and just like that the "just don't use them" crowd will hold up their hands and pretend that no one could have imagined this disaster. If the problem is truly Apple exhibiting favouritism or limiting competition through their app approval process: then the EU should have just forced them to spin it out into an independent entity for the EU stores, or even take control of it themselves - but they didn't and 2024/25 is going to be a shitshow for it. Legislating for side loading and multiple app stores is the least imaginative and most obviously flawed approach to the competition problem and the sole reason why Android's share of malware is staggering in comparison to iOS.
      - waprin 3y ago
        If you’re required to install software on your phone for work then your employer should be legally required to pay for your phone. And then if you want your own phone you pay for it yourself. And if your employers IT team lets corporate devices get malware that’s on them. This is a weird edge case to get hung up on. You’re making a very simple issue way more complicated than it needs to be. Having Apple spin out EU specific new corporate entities with unclear relationships to its parent company sounds extremely complex. Requiring Apple to allow people to install apps they want on their own device is pretty simple and should be a fundamental expectation of a free society. If normal user wants the walled garden Apple experience, that’s fine. Make it unintuitive to install third party apps. Require checking a big red disclaimer that you might brick your phone. But just have some sort of path where if party A made an app and party B wants it on the device they paid a lot of money for, they can do that without some unqualified drone in Cupertino blocking it . Countless examples of the App Store review being broken , and just on principle, Apple has what’s effectively a monopoly on mobile phones in that you can’t make a mobile app and ignore iPhone and for them to unilaterally decide all software that’s allowed is way too much power. Somehow Microsoft went to the Supreme Court for putting IE on the desktop but Apple is off the hook for a complete lockdown. At least you could download Netscape on Windows 95! What Apple is doing is like if AOL and AOL keywords became the only entry point to the web. Then you go on Hacker News and people say that’s s good thing because AOL only allows quality websites and otherwise people make malware and scam websites. It doesn’t matter, it’s too much power for one company and mobile phones are more critical to society in 2023 than the web was in the 90s. Mobile phones are not appliances. It’s still unfathomable to me this is even a conversation on this website. Apples complete lockdown of the most important computing devices is plainly bad for consumers and society.
  - erikerikson 3y ago
    > Requiring third party app stores That's doing a lot of work. There's "... to be usable" but also "... to be automatically and unfilterably merged". They are very different situations. What specifically are you concerned about? I'd guess that latter but you seem to be defending the former as though it is the latter.
  - deleted 3y ago
    [deleted]
  - Keyframe 3y ago
    One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. Have we visited the same appstore? Just few days ago I tried to find a puzzle game for my kid and myself to play together. A whole bunch of them, from top results, resulted in games which had shady dark UI initial screens trying to get to $14.99 or similar monthly subscriptions. Eventually I caved in to arcade sub because I couldn't trust any of the results or find a normal paid one (once). Scammy at best.
    - TylerE 3y ago
      Looked at android recently? It’s far far worse. Also “has ads” isn’t a synonym for “malware”.
      - janc_ 3y ago
        That's only true for some Android application stores.
      - Keyframe 3y ago
        Yes, I have and to be honest I haven't noticed a difference at all, apart google at least pretending it cares with play protect.
  - lapcat 3y ago
    > One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. The crApp Store is full of scams. https://www.washingtonpost.com/technology/2021/06/06/apple-app-store-scams-fraud/ https://www.washingtonpost.com/technology/2021/06/06/apple-a... https://www.wired.com/story/chatgpt-scams-apple-app-store-google-play/ https://www.wired.com/story/chatgpt-scams-apple-app-store-go... https://arstechnica.com/information-technology/2023/02/pig-butchering-scam-apps-sneak-into-apples-app-store-and-google-play/ https://arstechnica.com/information-technology/2023/02/pig-b... https://www.forbes.com/sites/gordonkelly/2021/05/15/apple-iphone-ipad-warning-app-store-security-new-fleeceware-scams/ https://www.forbes.com/sites/gordonkelly/2021/05/15/apple-ip... https://9to5mac.com/2022/01/11/developer-exposes-another-multimillion-dollar-scam-app-on-the-app-store/ https://9to5mac.com/2022/01/11/developer-exposes-another-mul... There's practically endless proof and documentation for this. The App Store is actually a honeypot for scammers. It's a single point of failure, because once you get past app review, which is easy, you're home free, and it's also relatively easy to manipulate App Store search, App Store ratings and reviews, and App Store Search Ads. As a non-scam App Store developer, my biggest problem is discovery, i.e., getting my app in front of the eyeballs of potential customers. It's vastly easier to do that in the App Store than it is via so-called sideloading, especially if you have no ethics. (Unfortunately, I do have ethics, which significantly limits my options for discovery.)
    - quitit 3y ago
      I hear your argument, but it's not convincing. Your logic states that because an app can occasionally slip through the review process, that we should remove -all- protections. That isn't better, that's worse. A scam is also a relatively low bar to set for such drastic change, since scams also frequently occur over chat apps and the kinds of access that side-loading and 3rd party stores can avail opens the door to significantly more sophisticated malware. If you truly think the situation right now is bad, just wait until there are no protections for users. You should also recognise that there is actual data for malware on these platforms. Every year Nokia drive home the same point for why Android has such an outsized share of malware: "...most smartphone malware is distributed as trojanized applications and since Android users can load application from just about anywhere, it’s much easier to trick them into installing applications that are infected with malware." Since all experts point to the same sources of malware - perhaps that's not the change we should be legislating. How about we do something different.
  - realusername 3y ago
    > One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. Well no, the appstore is as full of scams, malware and adware as everywhere else. They managed somehow to convince people it's a safe space though, not sure how but I consider it a bad thing since people are more likely to trust it blindly. > such as people at higher risks of being targeted by nation state actors https://apps.apple.com/us/app/absher-%D8%A3%D8%A8%D8%B4%D8%B1/id1004966456#?platform=iphone https://apps.apple.com/us/app/absher-%D8%A3%D8%A8%D8%B4%D8%B... The Saudi Arabian app to track what your wife is doing is still on the appstore, no need for a thirdparty store.
    - elashri 3y ago
      > The Saudi Arabian app to track what your wife is doing is still on the appstore, no need for a thirdparty store. While I usually don't like the saudi system but this app in particular is about making it easy to manage official government paperwork online [1]. This applies for all residents (citizens or not) and people really like it. So it is not an app to track females movements. While you can disagree or agree on the male approval requirements for a female to travel (I disagree) but it is not like it tracks movements using GPS or any invasive data. It just make it easier to manage the permits and all other interactions with the government without having to drive long distances and wait in lines. Well as a complete outsider in another country who probably never went to Saudi Arabia like yourself, I would be more careful. [1] https://en.wikipedia.org/wiki/Absher_(application) https://en.wikipedia.org/wiki/Absher_(application)
      - realusername 3y ago
        The app is doing both purpose since they follow their local laws, you can also read the wikipedia entry on the impact on women. I'm open to some kind of argument like "apple has no choice in such dictatorship" but this argument is contradictory with the argument that its protecting from nation states. And since we mentioned Saudi arabia, we can also mention China where icloud is dodgy, it's not a unique case. I'm sure they are others I don't know about.
        3y ago
  - graemep 3y ago
    No one has to use third party app stores. Android allows third party app stores and it is not a significant cause of problems. I am sure there must be some bad app stores out there, but the well known ones like F-Droid are probably better curated than Google's own. Linux has always allowed third party repositories. Again, rarely a source of problems - again, there must be some bad things out there but the percentage of users affected is tiny.
    - lupusreal 3y ago
      Exactly. Apple refuses to allow third party appstores like F-Droid because they know appstores like F-Droid would make Apple look bad and thus break the mental conditioning Apple has on their customers. Apple's appstores is filled with ripoffs and scams; F-Droid isn't.
    - janc_ 3y ago
      In fact, F-Droid is infinitely better than Google's own app store, where almost all apps contain spyware...
  - wavemode 3y ago
    Apple doesn't want third-party stores because it would cut into their profits. That they were able to convince the public that it is about personal privacy is just great marketing on their part. If you bought an iPhone because you wanted protection from the purported dangers of third-party apps, then ... just don't install any...?
    - judge2020 3y ago
      Third party app stores don’t play into the legal liability of developing for iOS without a license. Chances are Apple still has every right to charge a percentage of revenue as the licensing fee for usage of iOS APIs.
      - wavemode 3y ago
        Any regulation that requires allowing third-party stores, would be an anti-monopolistic move. So it would almost certainly include a requirement that those third-party stores be allowed to process payments themselves without paying royalties.
        zappb 3y ago
        That’s not how copyright and patent licensing works. If it did, the computing industry would look very different.
        wavemode 3y ago
        Copyright and patents aren't some kind of deep magic that binds the whole Earth. They're just laws. Legislators are free to change how those laws work...
  - 6510 3y ago
    The EU requires reviews from real customers and you have to describe how you are accomplishing this. These alternative app stores will be infinitely more trust worthy than apple, amazon, google etc If there is no payment or the trial is canceled one could use the digital id. Apple could even gather some simple statistics. Opening the app and using it for 1 minute would be a special kind of review. You wouldn't count 1 star reviews like that until manual review-review confirms the app is really that bad.
  - Andrew_nenakhov 3y ago
    If you want to resist malware, Just don't sideload apps and don't install apps from third party app stores. Refusing other users the freedom to run the apps they want without Apple's permission just because you might get mildly inconvenienced by it seems very immoral to me.
  - michaelmrose 3y ago
    Couldn't the app store support a singular store interface that draws from a singular default source and user added sources? People could pay Apple to vette sources to indicate that software therein isn't malware even if it doesn't follow other Apple standards. Anyone maximally concerned would just only use Apple sources. If Apple was less onerous about trying to get a cut most major software would be in the official store. Say a 5% cut. Remember at one time the manufacturer trying to get a cut of the action on a device was rightfully absurd. Your oven doesn't refuse to bake a pie unless Betty Crocker cut in GE nor did Magnavox require a cut from blockbuster. Both could be implimented for your protection and both would have been protection rackets. Apple's arrangement is as well it's just that the mob actually oversees permits too and charges on the way in. If you could trivially use only official apps and most apps would be available as such how would you be harmed?
  - type0 3y ago
    This is just typical FUD Apple spreads to undermine sideloading and open source apps that don't have monetary incentives
- waihtis 3y ago
  It's not in the interest of the DOJ to do so - 95% of people are technologically completely inept and it would expose them to fraud, malware and such at unprecedented scale
  - paranoidrobot 3y ago
    I don't see how this follows. Android phones can have alternate appstores, and yet we don't see widespread malware, fraud etc from that.
    - scarface_74 3y ago
      Have you heard of a little company called Epic? https://www.forbes.com/sites/ryanwhitwam/2018/08/25/epic-games-has-already-exposed-android-users-to-unacceptable-fortnite-malware-risks/amp/ https://www.forbes.com/sites/ryanwhitwam/2018/08/25/epic-gam... And then https://www.komando.com/security-privacy/ratmilad-android-malware/859519/?amp https://www.komando.com/security-privacy/ratmilad-android-ma...
    - d0gsg0w00f 3y ago
      Technically illiterate people don't use open OS's so there's no reason for attackers to target those platforms. Also, the number of users is so small that it's not worth an attacker's time.
    - sidlls 3y ago
      We don't?
- biohacker85 3y ago
  I don't disagree with the problem and lack of options. But forcing a company to add features feels like overstepping. I'm not sure how that can be legal or even be with the spirit of the law.
- usrbinbash 3y ago
  > The most essential device of the century is owned by two companies. As long as people play along, yes it is indeed. If more people were installing a free mobile OS, and thus take back ownership of their hardware and digital lives, the story would be much different. It's the same story with PCs. If you actually want to control the hardware you own, install Linux. It's not as if the alternatives to corporate control didn't exist.
  - bornfreddy 3y ago
    This. And it's not like there's no choice. The only pain point, if you want to completely get rid of A/G, is push notifications and some banking apps.
    - callalex 3y ago
      Those are the two primary things I use my phone for.
  - shopvaccer 3y ago
    I don't think it's a fair comparison because in the PC market the bootloaders are (usually) unlocked and the firmware (usually) operates via an open standard like UEFI or BIOS... whereas in the smartphone market open bootloaders and firmware are the exception.
  - hnlmorg 3y ago
    As someone who’s wanted to run their own mobile OS, I can tell you that doing so it a hell of a lot more challenging than installing Linux in a laptop. The fact is most of the stuff that makes phones what they are, is hidden behind closed hardware and firmware. Even Android, which as you know is Linux, has closed binary blobs in its kernel tree. You can get away with that somewhat for devices like the SoC on the Raspberry Pi. But things get a lot more complex when half the stuff that makes your phone usable is closed hardware and firmware blobs. What you ultimately end up with is still a device you don’t fully control but with the added inconvenience of a less mature software ecosystem too. I don’t see this problem being solved any time soon. In fact quite the opposite, I think it’s getting increasingly difficult with each passing year.
- wongarsu 3y ago
  Android removed the big technical measures that gave Google's Play Store a competitive advantage over alternatives, in no small part because of EU pressure. And while the Play Store is by far the biggest player in town, Amazon's Appstore, Huawei's AppGallery and F-Droid are all notable alternatives. Meanwhile on iOS the best we seem to get is the EU Digital Markets Act setting some rules for fairness on the big marketplaces.
  - coredog64 3y ago
    Google pressures device OEMS into joining the OHA, after which they can't create AOSP devices. Allegedly, Amazon is giving up on Android for their own hardware.
    - type0 3y ago
      > Allegedly, Amazon is giving up on Android for their own hardware. Ah, that was news to me, so Amazon Vega is predicted to be some sort of immutable OS with web apps. It seems they are thinking of starting some Chrome OS resembling thing. iOS also intended to only have Web apps and look where we are now. I don't have high hopes for OS developed for Fire devices, it will be soaked in DRM and filled with ads.
  - oniony 3y ago
    They're really not notable alternatives. I love F-Droid but its selection is very limited. Good luck finding people who use Amazon Appstore, Huawei AppGallery or any of these other stores. Let's imagine there's a company called Ticketmuster that had a monopoly on ticket sales. If they tolerate a shitty little kiosk selling a score of tickets a day, does this mean Ticketmuster does not have a monopoly share of the market?
    - gorlilla 3y ago
      They would probably somehow own the shitty little kiosk anyway.
- smegger001 3y ago
  As you mention two companies I can only assume the other is Google and android. Which I find odd as I have multiple other appstores and repositories on my phone and every other android device I have owned. My phones and tablets usually come with not just the Google Play Store, but also the manufacturers app store, and I install fdroid on all my android devices, and have in the past installed the Amazon app store on my phones back when Amazon and Google were having a spat over audible book sales and you breifly couldn't buy books on the Google hosted version of audible. So I don't see the problem. There are many third party app stores on the android half of the marker if you as a developer dont like the terms for using Google Play, then list you app on another storefront with more agreeable terms or your own webpage.
  - michaelmrose 3y ago
    It would be more competitive if it worked like software sources under Linux whereby you can use a singular interface to manage software from different sources.
    - janc_ 3y ago
      That's possible with F-Droid (& Aurora Store, I think).
- jfengel 3y ago
  But there are two, which is very different from one. I'm not sure that adding more would make all that much difference. One player would have absolute pricing power. Two keep one another at least a little in check. That assumes no collusion, and that's not entirely true, by not completely false either. Many cases of similar behavior are just them responding to the same market in similar ways. I think that completely free and open player you want isn't going to be much of a competitive advantage. It has a small niche but not enough to break into the insane levels of overhead in creating a complete ecosystem. Especially since most users just want the device to work with a minimum of grief. And especially since the use of public airwaves means a ton of regulation.
silenced_trope 3y ago
pretty clever, it reminds me of the early days of the app store when apps would be taken down for copyright strikes but if you provided proof you'd be given "immunity" from further strikes taking down your app while Apple investigates it became a strategy to copyright strike your own app, have proof ready so that no downtime was necessary, then you have the temporary immunity so that competitors couldn't submit a copyright strike, which costed them nothing to do and had no consequences if they were wrong about it
- Obscurity4340 3y ago
  I don't get how this sort of short-term thinking to the extremth degree is ever worth it or sustainable...
  - CamperBob2 3y ago
    Blame Apple for forcing developers (and encouraging bad guys) to spend more time thinking about the App Store rules than they do themselves.
  - lmm 3y ago
    It probably isn't now, but in the early days the iphone app store was a giant pinata full of money for anyone who wanted to knock up a flashlight app or whatever.
- araes 3y ago
  This is actually what I started thinking when I got to the end of the article. Maybe just immediate human snatch and grab cynicism. That the author hired somebody to dump review, does something fishy with money like those above noted, and then sues for more money. Levine over at Bloomberg had an interesting article where ransomware gangs are now filing SEC reports, as a way to pressure companies to pay, or minimize ROI.
san_dimitri 3y ago
Hmm interesting. I wonder what happen if there were a lot of fake reviews on Apple’s own apps. I am sure this policy would not apply to themselves.
KennyBlanken 3y ago
It's apparently common on Twitch for scammers to try and blackmail streamers by threatening to followbot them. Not every streamer knows that they can forward such threats to Twitch's support staff, and if they don't, their stream is at risk from automated bot detection penalizing them.
munk-a 3y ago
If Apple isn't able to police this then maybe it's unhealthy for the market to be completely controlled by them. They make billions off the AppStore and their refusal to reinvest in proper moderation (especially for an app worth hundreds of thousands in revenue) is quite telling.
- terminous 3y ago
  This isn't an Apple problem, it's a problem with every business review platform. If a shady marketing firm takes a contract to give an app fake 5 star reviews, there's no way for the review platform to know if that shady marketing firm was hired by the app's developer or their competitor. Only the marketing firm knows.
  - DelightOne 3y ago
    Except that Apple ist the gatekeeper here.
    - type0 3y ago
      Apple engages in a lot of anti-competitive practices. I think in the case of App Store it's called captive supply, it is detrimental for both users and developers but good for Apple https://en.wikipedia.org/wiki/Captive_supply https://en.wikipedia.org/wiki/Captive_supply
  - munk-a 3y ago
    There is a way for the platform to handle that scenario... Manual review. Apple chooses not to rely on manual review and we shouldn't discount this decision of theirs.
    - terminous 3y ago
      How would you be able to tell by manual review if a fake review from a SEO firm was paid for by that app's developer or by their competitor? There is no signal there. The ads are identical.
ano-ther 3y ago
That’s a very thorny problem. How can you distinguish such a bot attack from a self-promotion?
- bostik 3y ago
  The same way you detect a really good piece of satire from actual news.
sshine 3y ago
A friend of mine upvoted all of my StackOverflow posts daily for a period of time until it got flagged and the points were removed. He did it again later, and it got flagged again with a warning. I had to ask him to stop upvoting all my posts, because it was indistinguishable from me giving myself points via a proxy account.
ana_winters 3y ago
[dead]
yieldcrv 3y ago
web2isgoinggreat

echelon 3y ago

> I guess the App Store fraud prevention team hasn’t necessarily found a good solution yet. The most essential device of the century is owned by two companies. The ability for them to completely control software and business activities on top of something that is almost as essential as public transportation is appalling. The DOJ needs to remove the "app store" racket for essential computing devices. Software needs to be freely installable, sans vendor control, unfair competition, scare tactics, mandatory taxation, and adversarial ad placement by the cellphone duopoly. Not only is cell phone compute freedom essential, but we desperately need more than just two vendors.

judge2020 3y ago
One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. Requiring third party app stores disproportionately harms those that purchased the device specifically for these purposes (such as people at higher risks of being targeted by nation state actors). And this isn’t something that can be addressed with a new uber-secure product just for these people, because the EU will deem it a gatekeeper if enough people buy it - so I guess you have to create a hard cutoff for how many can purchase the product ever, or means test “do you actually deserve security?”.
- echelon 3y ago
  > Requiring third party app stores No stores. Web install. Web first class. No "only Safari/webkit engine" limitation. If Apple is so genius, they can solve malware with all of those engineering minds and dollars they have. They don't need to hind behind a store to do that. The tools and techniques are readily available and accessible for a company of their size and stature. Permission layer, app runtime heuristics, and fingerprints are a start. They can do this. They just don't want to / have to, because they're currently Gods of the Phone Universe with unfettered and completely unfair control over "their domain".
  - judge2020 3y ago
    Stores is synonymous with side loading. Pedantically your website could be considered a “store” for the single app you distribute for it. And the threat surface of the iOS sandbox is so large that it’s impossible to secure everything everywhere the first time. Every iOS jailbreak since at least iOS 10 starts with a sandbox escape exploit and executed via a sideloaded app (besides the single hardware exploit found in recent years, checkm8)
  - xienze 3y ago
    > If Apple is so genius, they can solve malware with all of those engineering minds and dollars they have. They don't need to hind behind a store to do that. The tools and techniques are readily available and accessible for a company of their size and stature. An App Store with a human review process is one tool in the toolbox. > Permission layer, app runtime heuristics, and fingerprints are a start. They can do this. I think this is Google’s approach. How’s that been going?
  - chongli 3y ago
    No stores. Web install. Web first class... Permission layer, app runtime heuristics, and fingerprints are a start. How does that work? If it's open web download and install with no notarization (because that's also gatekeeping) then we're back to the good ol' days of the 90's and early 00's. In other words, anything goes and it's up to the user to keep themselves secure, which in practice means rampant security failures and users getting scammed and hit with ransomware at every turn. I don't like Apple having so much control over everything. I really preferred the old days of the web and the anything goes, full control over my computers I had back then. But the web is absolutely way nastier today. It's jam packed with scammers and ransomware gangs and botnets. It's really quite sad and frustrating for anyone who grew up with the full potential of computing.
- Manuel_D 3y ago
  Just don't use the third party app store if you're worried about scams. Requiring that apple permit 3rd party app stores does not force users to use said 3rd part stores.
  - quitit 3y ago
    This sounds like a fair point until remembering that things like Boss-ware exist. An insurer/ health insurer, employer, government, etc will require it, and just like that the "just don't use them" crowd will hold up their hands and pretend that no one could have imagined this disaster. If the problem is truly Apple exhibiting favouritism or limiting competition through their app approval process: then the EU should have just forced them to spin it out into an independent entity for the EU stores, or even take control of it themselves - but they didn't and 2024/25 is going to be a shitshow for it. Legislating for side loading and multiple app stores is the least imaginative and most obviously flawed approach to the competition problem and the sole reason why Android's share of malware is staggering in comparison to iOS.
    - waprin 3y ago
      If you’re required to install software on your phone for work then your employer should be legally required to pay for your phone. And then if you want your own phone you pay for it yourself. And if your employers IT team lets corporate devices get malware that’s on them. This is a weird edge case to get hung up on. You’re making a very simple issue way more complicated than it needs to be. Having Apple spin out EU specific new corporate entities with unclear relationships to its parent company sounds extremely complex. Requiring Apple to allow people to install apps they want on their own device is pretty simple and should be a fundamental expectation of a free society. If normal user wants the walled garden Apple experience, that’s fine. Make it unintuitive to install third party apps. Require checking a big red disclaimer that you might brick your phone. But just have some sort of path where if party A made an app and party B wants it on the device they paid a lot of money for, they can do that without some unqualified drone in Cupertino blocking it . Countless examples of the App Store review being broken , and just on principle, Apple has what’s effectively a monopoly on mobile phones in that you can’t make a mobile app and ignore iPhone and for them to unilaterally decide all software that’s allowed is way too much power. Somehow Microsoft went to the Supreme Court for putting IE on the desktop but Apple is off the hook for a complete lockdown. At least you could download Netscape on Windows 95! What Apple is doing is like if AOL and AOL keywords became the only entry point to the web. Then you go on Hacker News and people say that’s s good thing because AOL only allows quality websites and otherwise people make malware and scam websites. It doesn’t matter, it’s too much power for one company and mobile phones are more critical to society in 2023 than the web was in the 90s. Mobile phones are not appliances. It’s still unfathomable to me this is even a conversation on this website. Apples complete lockdown of the most important computing devices is plainly bad for consumers and society.
- erikerikson 3y ago
  > Requiring third party app stores That's doing a lot of work. There's "... to be usable" but also "... to be automatically and unfilterably merged". They are very different situations. What specifically are you concerned about? I'd guess that latter but you seem to be defending the former as though it is the latter.
- deleted 3y ago
  [deleted]
- Keyframe 3y ago
  One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. Have we visited the same appstore? Just few days ago I tried to find a puzzle game for my kid and myself to play together. A whole bunch of them, from top results, resulted in games which had shady dark UI initial screens trying to get to $14.99 or similar monthly subscriptions. Eventually I caved in to arcade sub because I couldn't trust any of the results or find a normal paid one (once). Scammy at best.
  - TylerE 3y ago
    Looked at android recently? It’s far far worse. Also “has ads” isn’t a synonym for “malware”.
    - janc_ 3y ago
      That's only true for some Android application stores.
    - Keyframe 3y ago
      Yes, I have and to be honest I haven't noticed a difference at all, apart google at least pretending it cares with play protect.
- lapcat 3y ago
  > One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. The crApp Store is full of scams. https://www.washingtonpost.com/technology/2021/06/06/apple-app-store-scams-fraud/ https://www.washingtonpost.com/technology/2021/06/06/apple-a... https://www.wired.com/story/chatgpt-scams-apple-app-store-google-play/ https://www.wired.com/story/chatgpt-scams-apple-app-store-go... https://arstechnica.com/information-technology/2023/02/pig-butchering-scam-apps-sneak-into-apples-app-store-and-google-play/ https://arstechnica.com/information-technology/2023/02/pig-b... https://www.forbes.com/sites/gordonkelly/2021/05/15/apple-iphone-ipad-warning-app-store-security-new-fleeceware-scams/ https://www.forbes.com/sites/gordonkelly/2021/05/15/apple-ip... https://9to5mac.com/2022/01/11/developer-exposes-another-multimillion-dollar-scam-app-on-the-app-store/ https://9to5mac.com/2022/01/11/developer-exposes-another-mul... There's practically endless proof and documentation for this. The App Store is actually a honeypot for scammers. It's a single point of failure, because once you get past app review, which is easy, you're home free, and it's also relatively easy to manipulate App Store search, App Store ratings and reviews, and App Store Search Ads. As a non-scam App Store developer, my biggest problem is discovery, i.e., getting my app in front of the eyeballs of potential customers. It's vastly easier to do that in the App Store than it is via so-called sideloading, especially if you have no ethics. (Unfortunately, I do have ethics, which significantly limits my options for discovery.)
  - quitit 3y ago
    I hear your argument, but it's not convincing. Your logic states that because an app can occasionally slip through the review process, that we should remove -all- protections. That isn't better, that's worse. A scam is also a relatively low bar to set for such drastic change, since scams also frequently occur over chat apps and the kinds of access that side-loading and 3rd party stores can avail opens the door to significantly more sophisticated malware. If you truly think the situation right now is bad, just wait until there are no protections for users. You should also recognise that there is actual data for malware on these platforms. Every year Nokia drive home the same point for why Android has such an outsized share of malware: "...most smartphone malware is distributed as trojanized applications and since Android users can load application from just about anywhere, it’s much easier to trick them into installing applications that are infected with malware." Since all experts point to the same sources of malware - perhaps that's not the change we should be legislating. How about we do something different.
- realusername 3y ago
  > One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. Well no, the appstore is as full of scams, malware and adware as everywhere else. They managed somehow to convince people it's a safe space though, not sure how but I consider it a bad thing since people are more likely to trust it blindly. > such as people at higher risks of being targeted by nation state actors https://apps.apple.com/us/app/absher-%D8%A3%D8%A8%D8%B4%D8%B1/id1004966456#?platform=iphone https://apps.apple.com/us/app/absher-%D8%A3%D8%A8%D8%B4%D8%B... The Saudi Arabian app to track what your wife is doing is still on the appstore, no need for a thirdparty store.
  - elashri 3y ago
    > The Saudi Arabian app to track what your wife is doing is still on the appstore, no need for a thirdparty store. While I usually don't like the saudi system but this app in particular is about making it easy to manage official government paperwork online [1]. This applies for all residents (citizens or not) and people really like it. So it is not an app to track females movements. While you can disagree or agree on the male approval requirements for a female to travel (I disagree) but it is not like it tracks movements using GPS or any invasive data. It just make it easier to manage the permits and all other interactions with the government without having to drive long distances and wait in lines. Well as a complete outsider in another country who probably never went to Saudi Arabia like yourself, I would be more careful. [1] https://en.wikipedia.org/wiki/Absher_(application) https://en.wikipedia.org/wiki/Absher_(application)
    - realusername 3y ago
      The app is doing both purpose since they follow their local laws, you can also read the wikipedia entry on the impact on women. I'm open to some kind of argument like "apple has no choice in such dictatorship" but this argument is contradictory with the argument that its protecting from nation states. And since we mentioned Saudi arabia, we can also mention China where icloud is dodgy, it's not a unique case. I'm sure they are others I don't know about.
      - 3y ago
- graemep 3y ago
  No one has to use third party app stores. Android allows third party app stores and it is not a significant cause of problems. I am sure there must be some bad app stores out there, but the well known ones like F-Droid are probably better curated than Google's own. Linux has always allowed third party repositories. Again, rarely a source of problems - again, there must be some bad things out there but the percentage of users affected is tiny.
  - lupusreal 3y ago
    Exactly. Apple refuses to allow third party appstores like F-Droid because they know appstores like F-Droid would make Apple look bad and thus break the mental conditioning Apple has on their customers. Apple's appstores is filled with ripoffs and scams; F-Droid isn't.
  - janc_ 3y ago
    In fact, F-Droid is infinitely better than Google's own app store, where almost all apps contain spyware...
- wavemode 3y ago
  Apple doesn't want third-party stores because it would cut into their profits. That they were able to convince the public that it is about personal privacy is just great marketing on their part. If you bought an iPhone because you wanted protection from the purported dangers of third-party apps, then ... just don't install any...?
  - judge2020 3y ago
    Third party app stores don’t play into the legal liability of developing for iOS without a license. Chances are Apple still has every right to charge a percentage of revenue as the licensing fee for usage of iOS APIs.
    - wavemode 3y ago
      Any regulation that requires allowing third-party stores, would be an anti-monopolistic move. So it would almost certainly include a requirement that those third-party stores be allowed to process payments themselves without paying royalties.
      - zappb 3y ago
        That’s not how copyright and patent licensing works. If it did, the computing industry would look very different.
        wavemode 3y ago
        Copyright and patents aren't some kind of deep magic that binds the whole Earth. They're just laws. Legislators are free to change how those laws work...
- 6510 3y ago
  The EU requires reviews from real customers and you have to describe how you are accomplishing this. These alternative app stores will be infinitely more trust worthy than apple, amazon, google etc If there is no payment or the trial is canceled one could use the digital id. Apple could even gather some simple statistics. Opening the app and using it for 1 minute would be a special kind of review. You wouldn't count 1 star reviews like that until manual review-review confirms the app is really that bad.
- Andrew_nenakhov 3y ago
  If you want to resist malware, Just don't sideload apps and don't install apps from third party app stores. Refusing other users the freedom to run the apps they want without Apple's permission just because you might get mildly inconvenienced by it seems very immoral to me.
- michaelmrose 3y ago
  Couldn't the app store support a singular store interface that draws from a singular default source and user added sources? People could pay Apple to vette sources to indicate that software therein isn't malware even if it doesn't follow other Apple standards. Anyone maximally concerned would just only use Apple sources. If Apple was less onerous about trying to get a cut most major software would be in the official store. Say a 5% cut. Remember at one time the manufacturer trying to get a cut of the action on a device was rightfully absurd. Your oven doesn't refuse to bake a pie unless Betty Crocker cut in GE nor did Magnavox require a cut from blockbuster. Both could be implimented for your protection and both would have been protection rackets. Apple's arrangement is as well it's just that the mob actually oversees permits too and charges on the way in. If you could trivially use only official apps and most apps would be available as such how would you be harmed?
- type0 3y ago
  This is just typical FUD Apple spreads to undermine sideloading and open source apps that don't have monetary incentives
waihtis 3y ago
It's not in the interest of the DOJ to do so - 95% of people are technologically completely inept and it would expose them to fraud, malware and such at unprecedented scale
- paranoidrobot 3y ago
  I don't see how this follows. Android phones can have alternate appstores, and yet we don't see widespread malware, fraud etc from that.
  - scarface_74 3y ago
    Have you heard of a little company called Epic? https://www.forbes.com/sites/ryanwhitwam/2018/08/25/epic-games-has-already-exposed-android-users-to-unacceptable-fortnite-malware-risks/amp/ https://www.forbes.com/sites/ryanwhitwam/2018/08/25/epic-gam... And then https://www.komando.com/security-privacy/ratmilad-android-malware/859519/?amp https://www.komando.com/security-privacy/ratmilad-android-ma...
  - d0gsg0w00f 3y ago
    Technically illiterate people don't use open OS's so there's no reason for attackers to target those platforms. Also, the number of users is so small that it's not worth an attacker's time.
  - sidlls 3y ago
    We don't?
biohacker85 3y ago
I don't disagree with the problem and lack of options. But forcing a company to add features feels like overstepping. I'm not sure how that can be legal or even be with the spirit of the law.
usrbinbash 3y ago
> The most essential device of the century is owned by two companies. As long as people play along, yes it is indeed. If more people were installing a free mobile OS, and thus take back ownership of their hardware and digital lives, the story would be much different. It's the same story with PCs. If you actually want to control the hardware you own, install Linux. It's not as if the alternatives to corporate control didn't exist.
- bornfreddy 3y ago
  This. And it's not like there's no choice. The only pain point, if you want to completely get rid of A/G, is push notifications and some banking apps.
  - callalex 3y ago
    Those are the two primary things I use my phone for.
- shopvaccer 3y ago
  I don't think it's a fair comparison because in the PC market the bootloaders are (usually) unlocked and the firmware (usually) operates via an open standard like UEFI or BIOS... whereas in the smartphone market open bootloaders and firmware are the exception.
- hnlmorg 3y ago
  As someone who’s wanted to run their own mobile OS, I can tell you that doing so it a hell of a lot more challenging than installing Linux in a laptop. The fact is most of the stuff that makes phones what they are, is hidden behind closed hardware and firmware. Even Android, which as you know is Linux, has closed binary blobs in its kernel tree. You can get away with that somewhat for devices like the SoC on the Raspberry Pi. But things get a lot more complex when half the stuff that makes your phone usable is closed hardware and firmware blobs. What you ultimately end up with is still a device you don’t fully control but with the added inconvenience of a less mature software ecosystem too. I don’t see this problem being solved any time soon. In fact quite the opposite, I think it’s getting increasingly difficult with each passing year.
wongarsu 3y ago
Android removed the big technical measures that gave Google's Play Store a competitive advantage over alternatives, in no small part because of EU pressure. And while the Play Store is by far the biggest player in town, Amazon's Appstore, Huawei's AppGallery and F-Droid are all notable alternatives. Meanwhile on iOS the best we seem to get is the EU Digital Markets Act setting some rules for fairness on the big marketplaces.
- coredog64 3y ago
  Google pressures device OEMS into joining the OHA, after which they can't create AOSP devices. Allegedly, Amazon is giving up on Android for their own hardware.
  - type0 3y ago
    > Allegedly, Amazon is giving up on Android for their own hardware. Ah, that was news to me, so Amazon Vega is predicted to be some sort of immutable OS with web apps. It seems they are thinking of starting some Chrome OS resembling thing. iOS also intended to only have Web apps and look where we are now. I don't have high hopes for OS developed for Fire devices, it will be soaked in DRM and filled with ads.
- oniony 3y ago
  They're really not notable alternatives. I love F-Droid but its selection is very limited. Good luck finding people who use Amazon Appstore, Huawei AppGallery or any of these other stores. Let's imagine there's a company called Ticketmuster that had a monopoly on ticket sales. If they tolerate a shitty little kiosk selling a score of tickets a day, does this mean Ticketmuster does not have a monopoly share of the market?
  - gorlilla 3y ago
    They would probably somehow own the shitty little kiosk anyway.
smegger001 3y ago
As you mention two companies I can only assume the other is Google and android. Which I find odd as I have multiple other appstores and repositories on my phone and every other android device I have owned. My phones and tablets usually come with not just the Google Play Store, but also the manufacturers app store, and I install fdroid on all my android devices, and have in the past installed the Amazon app store on my phones back when Amazon and Google were having a spat over audible book sales and you breifly couldn't buy books on the Google hosted version of audible. So I don't see the problem. There are many third party app stores on the android half of the marker if you as a developer dont like the terms for using Google Play, then list you app on another storefront with more agreeable terms or your own webpage.
- michaelmrose 3y ago
  It would be more competitive if it worked like software sources under Linux whereby you can use a singular interface to manage software from different sources.
  - janc_ 3y ago
    That's possible with F-Droid (& Aurora Store, I think).
jfengel 3y ago
But there are two, which is very different from one. I'm not sure that adding more would make all that much difference. One player would have absolute pricing power. Two keep one another at least a little in check. That assumes no collusion, and that's not entirely true, by not completely false either. Many cases of similar behavior are just them responding to the same market in similar ways. I think that completely free and open player you want isn't going to be much of a competitive advantage. It has a small niche but not enough to break into the insane levels of overhead in creating a complete ecosystem. Especially since most users just want the device to work with a minimum of grief. And especially since the use of public airwaves means a ton of regulation.

silenced_trope 3y ago

pretty clever, it reminds me of the early days of the app store when apps would be taken down for copyright strikes but if you provided proof you'd be given "immunity" from further strikes taking down your app while Apple investigates it became a strategy to copyright strike your own app, have proof ready so that no downtime was necessary, then you have the temporary immunity so that competitors couldn't submit a copyright strike, which costed them nothing to do and had no consequences if they were wrong about it

Obscurity4340 3y ago
I don't get how this sort of short-term thinking to the extremth degree is ever worth it or sustainable...
- CamperBob2 3y ago
  Blame Apple for forcing developers (and encouraging bad guys) to spend more time thinking about the App Store rules than they do themselves.
- lmm 3y ago
  It probably isn't now, but in the early days the iphone app store was a giant pinata full of money for anyone who wanted to knock up a flashlight app or whatever.
araes 3y ago
This is actually what I started thinking when I got to the end of the article. Maybe just immediate human snatch and grab cynicism. That the author hired somebody to dump review, does something fishy with money like those above noted, and then sues for more money. Levine over at Bloomberg had an interesting article where ransomware gangs are now filing SEC reports, as a way to pressure companies to pay, or minimize ROI.

san_dimitri 3y ago

Hmm interesting. I wonder what happen if there were a lot of fake reviews on Apple’s own apps. I am sure this policy would not apply to themselves.

KennyBlanken 3y ago

It's apparently common on Twitch for scammers to try and blackmail streamers by threatening to followbot them. Not every streamer knows that they can forward such threats to Twitch's support staff, and if they don't, their stream is at risk from automated bot detection penalizing them.

munk-a 3y ago

If Apple isn't able to police this then maybe it's unhealthy for the market to be completely controlled by them. They make billions off the AppStore and their refusal to reinvest in proper moderation (especially for an app worth hundreds of thousands in revenue) is quite telling.

terminous 3y ago
This isn't an Apple problem, it's a problem with every business review platform. If a shady marketing firm takes a contract to give an app fake 5 star reviews, there's no way for the review platform to know if that shady marketing firm was hired by the app's developer or their competitor. Only the marketing firm knows.
- DelightOne 3y ago
  Except that Apple ist the gatekeeper here.
  - type0 3y ago
    Apple engages in a lot of anti-competitive practices. I think in the case of App Store it's called captive supply, it is detrimental for both users and developers but good for Apple https://en.wikipedia.org/wiki/Captive_supply https://en.wikipedia.org/wiki/Captive_supply
- munk-a 3y ago
  There is a way for the platform to handle that scenario... Manual review. Apple chooses not to rely on manual review and we shouldn't discount this decision of theirs.
  - terminous 3y ago
    How would you be able to tell by manual review if a fake review from a SEO firm was paid for by that app's developer or by their competitor? There is no signal there. The ads are identical.

ano-ther 3y ago

That’s a very thorny problem. How can you distinguish such a bot attack from a self-promotion?

bostik 3y ago
The same way you detect a really good piece of satire from actual news.

sshine 3y ago

A friend of mine upvoted all of my StackOverflow posts daily for a period of time until it got flagged and the points were removed. He did it again later, and it got flagged again with a warning. I had to ask him to stop upvoting all my posts, because it was indistinguishable from me giving myself points via a proxy account.

ana_winters 3y ago

[dead]

yieldcrv 3y ago

web2isgoinggreat