4 ms·

For everyone complaining about the security issues, there is nothing that stops Apple from throwing up a ton of warnings for apps that didn't come from their Ap

For everyone complaining about the security issues, there is nothing that stops Apple from throwing up a ton of warnings for apps that didn't come from their App Store. "This app came from a third party, it can download all your private information and has not been reviewed by Apple". Pop a warning every single time it accesses contacts or location, don't allow third party apps outside the App Store to be granted ongoing permissions to anything, etc. They can still do a lot to make the third party App Store experience much less appealing to developers than the App Store path and still be within the letter of the law. And I'm sure they will. (amusing side note, every time I write App Store autocorrect keeps capitalizing it for me)

jasode 3y ago
>, there is nothing that stops Apple from throwing up a ton of warnings for apps that didn't come from their App Store. [...] Pop a warning every single time it accesses contacts or location, don't allow third party apps outside the App Store to be granted ongoing permissions to anything, etc. But then why wouldn't EU later consider those high-friction "warnings" and security firewalls to be anti-competitive because it doesn't let 3rd-party apps be on equal footing as Apple's Official App Store? Is there precedence from previous rulings analogous to this Apple situation to predict what EU would pursue depending on how Apple follows the "letter of the law" instead of the "spirit of the law"?
- bluish29 3y ago
  > This app came from a third party, it can download all your private information and has not been reviewed by Apple Why would you consider it "anticompetitive"? I think Apple has a good claim that this is a factual statement that is used as a security warning as a core OS feature. Google have something like this when you sideload (or allow sideloading option, don't remember exactly when you get these warnings) and EU did not consider it "anti-competitive" (at least yet).
  - abhibeckert 3y ago
    > I think Apple has a good claim that this is a factual statement that is used as a security warning I would hope that the technical protections protecting user data apply to all apps and not just apps that come from Apple's store. If an app from the store wants to access your contacts or your location, the user has to approve it. Should be exactly the same with side loaded apps. Vender lock in such as a core operating system feature that can only be accessed with Apple approved apps would be blatant anti-competitive behaviour. > Google have something like this when you sideload (or allow sideloading option, don't remember exactly when you get these warnings) and EU did not consider it "anti-competitive" (at least yet). The EU and the USA have both found those warnings to be anti-competitive. In the EU's case, they have the same deadline as Apple to fix it. In the USA, Google was recently fined several hundred million dollars (and will also be required to change the alerts). I'm sure there will be some warnings, but it they will have to be reasonable - such as "[Name] is an app you downloaded from the internet. Are you sure you want to open it? Safari downloaded this app today from [Website URL]" - that's the message you get right now side-loading an app on a Mac, I think it would be hard for Apple to justify anything more "scary" than that.
    - jedberg 3y ago
      > If an app from the store wants to access your contacts or your location, the user has to approve it. Should be exactly the same with side loaded apps. What I'm saying is that it already happens for apps from the App Store, where it asks you to allow access to contacts for example. But one of your choices is "always allow". I'm saying for third party store apps, they remove the "always allow" option. Make you approve it every time, to remind you that it's happening.
      - kelthuzad 3y ago
        >I'm saying for third party store apps, they remove the "always allow" option. I do not know EU's Digital Markets Act Laws in detail but I can't imagine that such discrimination would not be in breach of them. I would frankly see that as an unacceptable and unfair measure. I want to use my iPhone like my Mac without artificial annoyances.
dns_snek 3y ago
> it can download all your private information > Pop a warning every single time it accesses contacts or location, don't allow third party apps outside the App Store to be granted ongoing permissions to anything, etc. You bring up an excellent point, but that's a technological issue that should be solved with technological barriers. An app shouldn't be able to download any private data without explicit user permission, but these restrictions should apply to every app, regardless of where it comes from. To be more specific, users should have complete control over every permission and have an easy way to audit their usage. Sane security models don't rely on some app reviewer magically catching malicious behavior in an opaque review process where they don't even have access to the source code, much less the ability to review it in detail.
- huytersd 3y ago
  When you jailbreak your iPhone, all you’re doing is running external software on it. I can easily see this becoming commonplace especially with an ecosystem like Apple where people have been sheltered for so long they’re not as wary as say an android user.
  - dns_snek 3y ago
    I wouldn't compare sideloading to jailbreaking at all, they have nothing in common besides both allowing you to run apps from 3rd party sources. Sideloading should be an officially supported mechanism and safely allow any app to operate within the confines of the existing sandbox. Jailbreaking is more like taking a sledge hammer to the sandbox and other technological barriers, once you break them down, privacy and security can't be guaranteed anymore. It's why I stopped rooting my personal Android devices.
- jedberg 3y ago
  > An app shouldn't be able to download any private data without explicit user permission, but these restrictions should apply to every app, regardless of where it comes from. What I'm saying is that it already happens for apps from the App Store, where it asks you to allow access to contacts for example. But one of your choices is "always allow". I'm saying for third party store apps, they remove the "always allow" option. Make you approve it every time, to remind you that it's happening.
vlovich123 3y ago
I’m pretty sure the legislation accounts for that kind of behavior. You’re not going to be allowed to create extra warnings based on which vector the application is delivered.
- harrybr 3y ago
  Thats right. Digital Markets Act, Article 13. Anti-circumvention "The gatekeeper shall not degrade the conditions or quality of any of the core platform services provided to business users or end users who avail themselves of the rights or choices laid down in Articles 5, 6 and 7, or make the exercise of those rights or choices unduly difficult, including by offering choices to the end-user in a non-neutral manner, or by subverting end users’ or business users' autonomy, decision-making, or free choice via the structure, design, function or manner of operation of a user interface or a part thereof." https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R1925#d1e2304-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32...
huytersd 3y ago
That just ruins the whole experience. Not to mention, it’s so much easier to have malicious exploits that can jailbreak your phone just by installing it and ruin security for everything within the walled garden as well.
jrnichols 3y ago
I'm sure they could do that, but when users start getting scammed and losing data, they are not going to remember that they clicked through and allowed the app to install. Neither is the tech media, who will no doubt make a huge deal out of "Apple's broken garden" or something like that.
- smoldesu 3y ago
  The same window of scrutiny exists for Android, too. Apple has further to fall, but that's because they deliberately tied their vertical integration to anticompetitive practices. Two wrongs don't fix a broken status quo.
nemothekid 3y ago
>throwing up a ton of warnings for apps Users very quickly learn to ignore warning popups. It's why you end up with flashlight apps that can access your contacts with millions of downloads. This "fix" almost never works in practice. It didn't work in 2006 when Microsoft introduced it in Vista w/ UAC, and it's not going to work 18 years later where users are even less technical.
- beezlewax 3y ago
  There's also a certain amount of fatigue I associate with these warnings and popups now. Its getting to the point where I'm more and more likely to just ignore them and give up my data without a fight and I say that as a software engineer.
- xlii 3y ago
  I completely agree with your point but then we have an other side of the coin with endless arguments about blue/green bubble.
- hulitu 3y ago
  > It didn't work in 2006 when Microsoft introduced it in Vista w/ UAC Such things were present in Windows since Windows 95. I had some friends who only pressed cancel, without reading, which led to funny things.
throw03172019 3y ago
If they do it like macOS, it’s a few alerts and then force them to “Open anyway” inside the settings app.
chunkyguy 3y ago
Also real security issues should be tackled on the os level. If the app sandboxing is actually robust then I don't see what is the problem.
m463 3y ago
wouldn't popular apps then be "prevent apple warnings" app? I mean, some of the beauty of another app store is that apps don't have to obey apple. Or... they could popup warnings for apple telemetry, or disobey apple APIs, or "fix" the dark patterns apple has introduced. Apple phones home all. the. time. They think "anonymized telemetry" is ok. Apple lets apps have unfettered internet access. Remember how the control panel buttons for wifi/bluetooth just disable them temporarily? etc.
- jedberg 3y ago
  Third party App Store doesn't mean jailbroken. You will still have to follow the technical rules imposed by the OS. That warning is put up by the OS, not the app.
wkat4242 3y ago
> For everyone complaining about the security issues, there is nothing that stops Apple from throwing up a ton of warnings for apps that didn't come from their App Store. Also, those issues never came to pass on Android which has this feature since the beginning. In fact I would trust apps from F-Droid a whole lot more than those "reviewed" by Google on the play store.

jasode 3y ago

>, there is nothing that stops Apple from throwing up a ton of warnings for apps that didn't come from their App Store. [...] Pop a warning every single time it accesses contacts or location, don't allow third party apps outside the App Store to be granted ongoing permissions to anything, etc. But then why wouldn't EU later consider those high-friction "warnings" and security firewalls to be anti-competitive because it doesn't let 3rd-party apps be on equal footing as Apple's Official App Store? Is there precedence from previous rulings analogous to this Apple situation to predict what EU would pursue depending on how Apple follows the "letter of the law" instead of the "spirit of the law"?

bluish29 3y ago
> This app came from a third party, it can download all your private information and has not been reviewed by Apple Why would you consider it "anticompetitive"? I think Apple has a good claim that this is a factual statement that is used as a security warning as a core OS feature. Google have something like this when you sideload (or allow sideloading option, don't remember exactly when you get these warnings) and EU did not consider it "anti-competitive" (at least yet).
- abhibeckert 3y ago
  > I think Apple has a good claim that this is a factual statement that is used as a security warning I would hope that the technical protections protecting user data apply to all apps and not just apps that come from Apple's store. If an app from the store wants to access your contacts or your location, the user has to approve it. Should be exactly the same with side loaded apps. Vender lock in such as a core operating system feature that can only be accessed with Apple approved apps would be blatant anti-competitive behaviour. > Google have something like this when you sideload (or allow sideloading option, don't remember exactly when you get these warnings) and EU did not consider it "anti-competitive" (at least yet). The EU and the USA have both found those warnings to be anti-competitive. In the EU's case, they have the same deadline as Apple to fix it. In the USA, Google was recently fined several hundred million dollars (and will also be required to change the alerts). I'm sure there will be some warnings, but it they will have to be reasonable - such as "[Name] is an app you downloaded from the internet. Are you sure you want to open it? Safari downloaded this app today from [Website URL]" - that's the message you get right now side-loading an app on a Mac, I think it would be hard for Apple to justify anything more "scary" than that.
  - jedberg 3y ago
    > If an app from the store wants to access your contacts or your location, the user has to approve it. Should be exactly the same with side loaded apps. What I'm saying is that it already happens for apps from the App Store, where it asks you to allow access to contacts for example. But one of your choices is "always allow". I'm saying for third party store apps, they remove the "always allow" option. Make you approve it every time, to remind you that it's happening.
    - kelthuzad 3y ago
      >I'm saying for third party store apps, they remove the "always allow" option. I do not know EU's Digital Markets Act Laws in detail but I can't imagine that such discrimination would not be in breach of them. I would frankly see that as an unacceptable and unfair measure. I want to use my iPhone like my Mac without artificial annoyances.

dns_snek 3y ago

> it can download all your private information > Pop a warning every single time it accesses contacts or location, don't allow third party apps outside the App Store to be granted ongoing permissions to anything, etc. You bring up an excellent point, but that's a technological issue that should be solved with technological barriers. An app shouldn't be able to download any private data without explicit user permission, but these restrictions should apply to every app, regardless of where it comes from. To be more specific, users should have complete control over every permission and have an easy way to audit their usage. Sane security models don't rely on some app reviewer magically catching malicious behavior in an opaque review process where they don't even have access to the source code, much less the ability to review it in detail.

huytersd 3y ago
When you jailbreak your iPhone, all you’re doing is running external software on it. I can easily see this becoming commonplace especially with an ecosystem like Apple where people have been sheltered for so long they’re not as wary as say an android user.
- dns_snek 3y ago
  I wouldn't compare sideloading to jailbreaking at all, they have nothing in common besides both allowing you to run apps from 3rd party sources. Sideloading should be an officially supported mechanism and safely allow any app to operate within the confines of the existing sandbox. Jailbreaking is more like taking a sledge hammer to the sandbox and other technological barriers, once you break them down, privacy and security can't be guaranteed anymore. It's why I stopped rooting my personal Android devices.
jedberg 3y ago
> An app shouldn't be able to download any private data without explicit user permission, but these restrictions should apply to every app, regardless of where it comes from. What I'm saying is that it already happens for apps from the App Store, where it asks you to allow access to contacts for example. But one of your choices is "always allow". I'm saying for third party store apps, they remove the "always allow" option. Make you approve it every time, to remind you that it's happening.

vlovich123 3y ago

I’m pretty sure the legislation accounts for that kind of behavior. You’re not going to be allowed to create extra warnings based on which vector the application is delivered.

harrybr 3y ago
Thats right. Digital Markets Act, Article 13. Anti-circumvention "The gatekeeper shall not degrade the conditions or quality of any of the core platform services provided to business users or end users who avail themselves of the rights or choices laid down in Articles 5, 6 and 7, or make the exercise of those rights or choices unduly difficult, including by offering choices to the end-user in a non-neutral manner, or by subverting end users’ or business users' autonomy, decision-making, or free choice via the structure, design, function or manner of operation of a user interface or a part thereof." https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R1925#d1e2304-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32...

huytersd 3y ago

That just ruins the whole experience. Not to mention, it’s so much easier to have malicious exploits that can jailbreak your phone just by installing it and ruin security for everything within the walled garden as well.

jrnichols 3y ago

I'm sure they could do that, but when users start getting scammed and losing data, they are not going to remember that they clicked through and allowed the app to install. Neither is the tech media, who will no doubt make a huge deal out of "Apple's broken garden" or something like that.

smoldesu 3y ago
The same window of scrutiny exists for Android, too. Apple has further to fall, but that's because they deliberately tied their vertical integration to anticompetitive practices. Two wrongs don't fix a broken status quo.

nemothekid 3y ago

>throwing up a ton of warnings for apps Users very quickly learn to ignore warning popups. It's why you end up with flashlight apps that can access your contacts with millions of downloads. This "fix" almost never works in practice. It didn't work in 2006 when Microsoft introduced it in Vista w/ UAC, and it's not going to work 18 years later where users are even less technical.

beezlewax 3y ago
There's also a certain amount of fatigue I associate with these warnings and popups now. Its getting to the point where I'm more and more likely to just ignore them and give up my data without a fight and I say that as a software engineer.
xlii 3y ago
I completely agree with your point but then we have an other side of the coin with endless arguments about blue/green bubble.
hulitu 3y ago
> It didn't work in 2006 when Microsoft introduced it in Vista w/ UAC Such things were present in Windows since Windows 95. I had some friends who only pressed cancel, without reading, which led to funny things.

throw03172019 3y ago

If they do it like macOS, it’s a few alerts and then force them to “Open anyway” inside the settings app.

chunkyguy 3y ago

Also real security issues should be tackled on the os level. If the app sandboxing is actually robust then I don't see what is the problem.

m463 3y ago

wouldn't popular apps then be "prevent apple warnings" app? I mean, some of the beauty of another app store is that apps don't have to obey apple. Or... they could popup warnings for apple telemetry, or disobey apple APIs, or "fix" the dark patterns apple has introduced. Apple phones home all. the. time. They think "anonymized telemetry" is ok. Apple lets apps have unfettered internet access. Remember how the control panel buttons for wifi/bluetooth just disable them temporarily? etc.

jedberg 3y ago
Third party App Store doesn't mean jailbroken. You will still have to follow the technical rules imposed by the OS. That warning is put up by the OS, not the app.

wkat4242 3y ago

> For everyone complaining about the security issues, there is nothing that stops Apple from throwing up a ton of warnings for apps that didn't come from their App Store. Also, those issues never came to pass on Android which has this feature since the beginning. In fact I would trust apps from F-Droid a whole lot more than those "reviewed" by Google on the play store.