8 ms·
One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. Requiring third party app stores disproportionately harms those that
by judge2020 3y ago
One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. Requiring third party app stores disproportionately harms those that purchased the device specifically for these purposes (such as people at higher risks of being targeted by nation state actors). And this isn’t something that can be addressed with a new uber-secure product just for these people, because the EU will deem it a gatekeeper if enough people buy it - so I guess you have to create a hard cutoff for how many can purchase the product ever, or means test “do you actually deserve security?”.
- echelon 3y ago> Requiring third party app stores No stores. Web install. Web first class. No "only Safari/webkit engine" limitation. If Apple is so genius, they can solve malware with all of those engineering minds and dollars they have. They don't need to hind behind a store to do that. The tools and techniques are readily available and accessible for a company of their size and stature. Permission layer, app runtime heuristics, and fingerprints are a start. They can do this. They just don't want to / have to, because they're currently Gods of the Phone Universe with unfettered and completely unfair control over "their domain".
- judge2020 3y agoStores is synonymous with side loading. Pedantically your website could be considered a “store” for the single app you distribute for it. And the threat surface of the iOS sandbox is so large that it’s impossible to secure everything everywhere the first time. Every iOS jailbreak since at least iOS 10 starts with a sandbox escape exploit and executed via a sideloaded app (besides the single hardware exploit found in recent years, checkm8)
- xienze 3y ago> If Apple is so genius, they can solve malware with all of those engineering minds and dollars they have. They don't need to hind behind a store to do that. The tools and techniques are readily available and accessible for a company of their size and stature. An App Store with a human review process is one tool in the toolbox. > Permission layer, app runtime heuristics, and fingerprints are a start. They can do this. I think this is Google’s approach. How’s that been going?
- chongli 3y agoNo stores. Web install. Web first class... Permission layer, app runtime heuristics, and fingerprints are a start. How does that work? If it's open web download and install with no notarization (because that's also gatekeeping) then we're back to the good ol' days of the 90's and early 00's. In other words, anything goes and it's up to the user to keep themselves secure, which in practice means rampant security failures and users getting scammed and hit with ransomware at every turn. I don't like Apple having so much control over everything. I really preferred the old days of the web and the anything goes, full control over my computers I had back then. But the web is absolutely way nastier today. It's jam packed with scammers and ransomware gangs and botnets. It's really quite sad and frustrating for anyone who grew up with the full potential of computing.
- lamontcg 3y agoI still use MacOS and Linux, which is still the "old days" and its been 20+ years since the last time I had issues with getting hacked. A lot of the solution is just not to install random shit out of app stores, and to install software that has a good reputation (and use adblockers on search engines like google so you don't click on trojan ads). If you scroll down to the 10th page of the listings for 2048-clone games and install something at random you're probably going to get hacked.
- ChrisMarshallNY 3y agoI had a friend that just got pretty severely pwned on his Mac. They installed some kind of DNS redirector, so, when he thought he was contacting Apple, he was actually talking to a scammer. Their customer service was great, which I told him, should have been a red flag. In any case, he was able to extricate himself from the scammers, but not before they had grabbed a bunch of PiD, so he’s still dealing with the whole identity theft issue. Not sure how he got owned. Likely, some drive-by malware on a Web site. He basically uses Safari as his operating system.
- jkestner 3y agoApple has in fact already solved these problems satisfactorily, on a platform called macOS. That’s what a smart company does when it knows it can’t put the third-party apps back in the box, and still feels motivated to uphold its reputation for security. iOS is the aberration.
- Manuel_D 3y agoJust don't use the third party app store if you're worried about scams. Requiring that apple permit 3rd party app stores does not force users to use said 3rd part stores.
- quitit 3y agoThis sounds like a fair point until remembering that things like Boss-ware exist. An insurer/ health insurer, employer, government, etc will require it, and just like that the "just don't use them" crowd will hold up their hands and pretend that no one could have imagined this disaster. If the problem is truly Apple exhibiting favouritism or limiting competition through their app approval process: then the EU should have just forced them to spin it out into an independent entity for the EU stores, or even take control of it themselves - but they didn't and 2024/25 is going to be a shitshow for it. Legislating for side loading and multiple app stores is the least imaginative and most obviously flawed approach to the competition problem and the sole reason why Android's share of malware is staggering in comparison to iOS.
- waprin 3y agoIf you’re required to install software on your phone for work then your employer should be legally required to pay for your phone. And then if you want your own phone you pay for it yourself. And if your employers IT team lets corporate devices get malware that’s on them. This is a weird edge case to get hung up on. You’re making a very simple issue way more complicated than it needs to be. Having Apple spin out EU specific new corporate entities with unclear relationships to its parent company sounds extremely complex. Requiring Apple to allow people to install apps they want on their own device is pretty simple and should be a fundamental expectation of a free society. If normal user wants the walled garden Apple experience, that’s fine. Make it unintuitive to install third party apps. Require checking a big red disclaimer that you might brick your phone. But just have some sort of path where if party A made an app and party B wants it on the device they paid a lot of money for, they can do that without some unqualified drone in Cupertino blocking it . Countless examples of the App Store review being broken , and just on principle, Apple has what’s effectively a monopoly on mobile phones in that you can’t make a mobile app and ignore iPhone and for them to unilaterally decide all software that’s allowed is way too much power. Somehow Microsoft went to the Supreme Court for putting IE on the desktop but Apple is off the hook for a complete lockdown. At least you could download Netscape on Windows 95! What Apple is doing is like if AOL and AOL keywords became the only entry point to the web. Then you go on Hacker News and people say that’s s good thing because AOL only allows quality websites and otherwise people make malware and scam websites. It doesn’t matter, it’s too much power for one company and mobile phones are more critical to society in 2023 than the web was in the 90s. Mobile phones are not appliances. It’s still unfathomable to me this is even a conversation on this website. Apples complete lockdown of the most important computing devices is plainly bad for consumers and society.
- erikerikson 3y ago> Requiring third party app stores That's doing a lot of work. There's "... to be usable" but also "... to be automatically and unfilterably merged". They are very different situations. What specifically are you concerned about? I'd guess that latter but you seem to be defending the former as though it is the latter.
- deleted 3y ago[deleted]
- Keyframe 3y agoOne of the main draws of iOS is its resistance to malware, adware, and outright scam apps. Have we visited the same appstore? Just few days ago I tried to find a puzzle game for my kid and myself to play together. A whole bunch of them, from top results, resulted in games which had shady dark UI initial screens trying to get to $14.99 or similar monthly subscriptions. Eventually I caved in to arcade sub because I couldn't trust any of the results or find a normal paid one (once). Scammy at best.
- TylerE 3y agoLooked at android recently? It’s far far worse. Also “has ads” isn’t a synonym for “malware”.
- lapcat 3y ago> One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. The crApp Store is full of scams. https://www.washingtonpost.com/technology/2021/06/06/apple-app-store-scams-fraud/ https://www.washingtonpost.com/technology/2021/06/06/apple-a... https://www.wired.com/story/chatgpt-scams-apple-app-store-google-play/ https://www.wired.com/story/chatgpt-scams-apple-app-store-go... https://arstechnica.com/information-technology/2023/02/pig-butchering-scam-apps-sneak-into-apples-app-store-and-google-play/ https://arstechnica.com/information-technology/2023/02/pig-b... https://www.forbes.com/sites/gordonkelly/2021/05/15/apple-iphone-ipad-warning-app-store-security-new-fleeceware-scams/ https://www.forbes.com/sites/gordonkelly/2021/05/15/apple-ip... https://9to5mac.com/2022/01/11/developer-exposes-another-multimillion-dollar-scam-app-on-the-app-store/ https://9to5mac.com/2022/01/11/developer-exposes-another-mul... There's practically endless proof and documentation for this. The App Store is actually a honeypot for scammers. It's a single point of failure, because once you get past app review, which is easy, you're home free, and it's also relatively easy to manipulate App Store search, App Store ratings and reviews, and App Store Search Ads. As a non-scam App Store developer, my biggest problem is discovery, i.e., getting my app in front of the eyeballs of potential customers. It's vastly easier to do that in the App Store than it is via so-called sideloading, especially if you have no ethics. (Unfortunately, I do have ethics, which significantly limits my options for discovery.)
- quitit 3y agoI hear your argument, but it's not convincing. Your logic states that because an app can occasionally slip through the review process, that we should remove -all- protections. That isn't better, that's worse. A scam is also a relatively low bar to set for such drastic change, since scams also frequently occur over chat apps and the kinds of access that side-loading and 3rd party stores can avail opens the door to significantly more sophisticated malware. If you truly think the situation right now is bad, just wait until there are no protections for users. You should also recognise that there is actual data for malware on these platforms. Every year Nokia drive home the same point for why Android has such an outsized share of malware: "...most smartphone malware is distributed as trojanized applications and since Android users can load application from just about anywhere, it’s much easier to trick them into installing applications that are infected with malware." Since all experts point to the same sources of malware - perhaps that's not the change we should be legislating. How about we do something different.
- realusername 3y ago> One of the main draws of iOS is its resistance to malware, adware, and outright scam apps. Well no, the appstore is as full of scams, malware and adware as everywhere else. They managed somehow to convince people it's a safe space though, not sure how but I consider it a bad thing since people are more likely to trust it blindly. > such as people at higher risks of being targeted by nation state actors https://apps.apple.com/us/app/absher-%D8%A3%D8%A8%D8%B4%D8%B1/id1004966456#?platform=iphone https://apps.apple.com/us/app/absher-%D8%A3%D8%A8%D8%B4%D8%B... The Saudi Arabian app to track what your wife is doing is still on the appstore, no need for a thirdparty store.
- elashri 3y ago> The Saudi Arabian app to track what your wife is doing is still on the appstore, no need for a thirdparty store. While I usually don't like the saudi system but this app in particular is about making it easy to manage official government paperwork online [1]. This applies for all residents (citizens or not) and people really like it. So it is not an app to track females movements. While you can disagree or agree on the male approval requirements for a female to travel (I disagree) but it is not like it tracks movements using GPS or any invasive data. It just make it easier to manage the permits and all other interactions with the government without having to drive long distances and wait in lines. Well as a complete outsider in another country who probably never went to Saudi Arabia like yourself, I would be more careful. [1] https://en.wikipedia.org/wiki/Absher_(application) https://en.wikipedia.org/wiki/Absher_(application)
- realusername 3y agoThe app is doing both purpose since they follow their local laws, you can also read the wikipedia entry on the impact on women. I'm open to some kind of argument like "apple has no choice in such dictatorship" but this argument is contradictory with the argument that its protecting from nation states. And since we mentioned Saudi arabia, we can also mention China where icloud is dodgy, it's not a unique case. I'm sure they are others I don't know about.
- 3y ago
- graemep 3y agoNo one has to use third party app stores. Android allows third party app stores and it is not a significant cause of problems. I am sure there must be some bad app stores out there, but the well known ones like F-Droid are probably better curated than Google's own. Linux has always allowed third party repositories. Again, rarely a source of problems - again, there must be some bad things out there but the percentage of users affected is tiny.
- lupusreal 3y agoExactly. Apple refuses to allow third party appstores like F-Droid because they know appstores like F-Droid would make Apple look bad and thus break the mental conditioning Apple has on their customers. Apple's appstores is filled with ripoffs and scams; F-Droid isn't.
- janc_ 3y agoIn fact, F-Droid is infinitely better than Google's own app store, where almost all apps contain spyware...
- wavemode 3y agoApple doesn't want third-party stores because it would cut into their profits. That they were able to convince the public that it is about personal privacy is just great marketing on their part. If you bought an iPhone because you wanted protection from the purported dangers of third-party apps, then ... just don't install any...?
- judge2020 3y agoThird party app stores don’t play into the legal liability of developing for iOS without a license. Chances are Apple still has every right to charge a percentage of revenue as the licensing fee for usage of iOS APIs.
- wavemode 3y agoAny regulation that requires allowing third-party stores, would be an anti-monopolistic move. So it would almost certainly include a requirement that those third-party stores be allowed to process payments themselves without paying royalties.
- 6510 3y agoThe EU requires reviews from real customers and you have to describe how you are accomplishing this. These alternative app stores will be infinitely more trust worthy than apple, amazon, google etc If there is no payment or the trial is canceled one could use the digital id. Apple could even gather some simple statistics. Opening the app and using it for 1 minute would be a special kind of review. You wouldn't count 1 star reviews like that until manual review-review confirms the app is really that bad.
- Andrew_nenakhov 3y agoIf you want to resist malware, Just don't sideload apps and don't install apps from third party app stores. Refusing other users the freedom to run the apps they want without Apple's permission just because you might get mildly inconvenienced by it seems very immoral to me.
- michaelmrose 3y agoCouldn't the app store support a singular store interface that draws from a singular default source and user added sources? People could pay Apple to vette sources to indicate that software therein isn't malware even if it doesn't follow other Apple standards. Anyone maximally concerned would just only use Apple sources. If Apple was less onerous about trying to get a cut most major software would be in the official store. Say a 5% cut. Remember at one time the manufacturer trying to get a cut of the action on a device was rightfully absurd. Your oven doesn't refuse to bake a pie unless Betty Crocker cut in GE nor did Magnavox require a cut from blockbuster. Both could be implimented for your protection and both would have been protection rackets. Apple's arrangement is as well it's just that the mob actually oversees permits too and charges on the way in. If you could trivially use only official apps and most apps would be available as such how would you be harmed?
- type0 3y agoThis is just typical FUD Apple spreads to undermine sideloading and open source apps that don't have monetary incentives