4 ms·

> To qualify for the [MarketplaceKit] entitlement, you must: > [...] > Provide Apple a stand-by letter of credit from an A-rated (or equivalent by S&P, Fitch,

> To qualify for the [MarketplaceKit] entitlement, you must: > [...] > Provide Apple a stand-by letter of credit from an A-rated (or equivalent by S&P, Fitch, or Moody’s) financial Institution of €1,000,000 to establish adequate financial means in order to guarantee support for your developers and users. Just let us sideload IPAs, please.

stefan_ 3y ago
I must have missed this section in the DMA! All I want is a F-Droid-esque store with sane apps. You know, open source apps, centrally built. No in-app-purchases and Chinese geotracking framework for something that is 25 lines of code to talk to some bluetooth gadget.
- jagged-chisel 3y ago
  Who’s going to curate that?
  - sureglymop 3y ago
    Take a look please: https://f-droid.org/en/about/ https://f-droid.org/en/about/
- kaba0 3y ago
  You just need a non-profit behind (or a government) and it should work just fine, they are exempted from the fees. The ruling is mostly there to prevent google and meta from creating alt stores (which is a benefit to us).
buildbot 3y ago
I have sideloaded IPAs now, on iOS 17.3. Altstore.
- winterqt 3y ago
  Sure, but your apps have to be renewed every 7 days (or 365 if you have a developer account).
  - jerbear4328 3y ago
    And, almost more restricting in my experience, you can only have two (2) sideloaded apps installed at a time (3 if you count AltStore itself). Unless you are lucky enough to have a MacDirtyCow-vulnerable device+OS, of course, but if you are going there why not just jailbreak?
summerlight 3y ago
> The gatekeeper shall not be prevented from taking, to the extent that they are strictly necessary and proportionate, measures to ensure that third-party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper, provided that such measures are duly justified by the gatekeeper. Looks like Apple tries to make a case to exploit this statement, which sounds exactly like a malicious compliance.
olliej 3y ago
Ok, so I get that you want to be able to install random binaries on your phone, but I want to understand how you think that could happen without undermining the platform security model? The inability of binaries to do malicious things on iOS is the result of the sandboxing and entitlement mechanisms of the platform. The store review and approval process is what stops applications from including entitlements that undermine the platform security. If you remove that step from the process there is nothing stopping an application shipping with the system entitlements that allow the application to read or write to other app data, or the entitlements to talk to system services without prompting permission dialogs, etc. If you want to remove the review and approval systems that the App Store has (and it sounds like are going to be required for 3rd party stores?) you have to have an answer for that. Otherwise you just end up with the android malware problem.
- lol768 3y ago
  You tell the user what entitlements or permissions are being requested at the point of the app trying to use them, stop treating the users like stupid children and let them make an educated decision about how to use the hardware that they own. There are limits on Android anyway, what your side-loaded apps can do without you using a custom ROM or rooting the device is restricted somewhat.
  - KolmogorovComp 3y ago
    Have you ever seen a random windows user? Do you think Grandma understands that? I’m all for allowing power-users to side loads apps, but average user definitely needs to be thought as a child that will use 1234 as their password, and click ‘ok’ on every pop-up without even reading it.
    - lol768 3y ago
      Require the super scary "break app sandbox" entitlements to be activated behind an adb-command-mutated flag (or whatever the iOS equivalent of adb is) after jumping through the USB debugging hoops?
- 3y ago
lol768 3y ago
Welp, that rules out anything like F-Droid. > The gatekeeper shall allow and technically enable the installation and effective use of third-party software applications or software application stores using, or interoperating with, its operating system and allow those software applications or software application stores to be accessed by means other than the relevant core platform services of that gatekeeper. > The gatekeeper shall, where applicable, not prevent the downloaded third-party software applications or software application stores from prompting end users to decide whether they want to set that downloaded software application or software application store as their default. The gatekeeper shall technically enable end users who decide to set that downloaded software application or software application store as their default to carry out that change easily. > The gatekeeper shall allow providers of services and providers of hardware, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same hardware and software features accessed or controlled via the operating system or virtual assistant listed in the designation decision pursuant to Article 3(9) as are available to services or hardware provided by the gatekeeper. Furthermore, the gatekeeper shall allow business users and alternative providers of services provided together with, or in support of, core platform services, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same operating system, hardware or software features, regardless of whether those features are part of the operating system, as are available to, or used by, that gatekeeper when providing such services How is requiring them to have access to $1M acceptable, or compliant with the legislation? > The gatekeeper shall not be prevented from taking strictly necessary and proportionate measures to ensure that interoperability does not compromise the integrity of the operating system, virtual assistant, hardware or software features provided by the gatekeeper Apple state the $1M requirement is to allow for providing support to customers. There is no allowance for doing that in the regulation, and no reasonable argument can be made that lack of customer support has an impact on the integrity of the operating system or hardware. I can understand scanning software or asking for it to be uploaded and signed, that could be justified. Not this.
- shuckles 3y ago
  Having a $100k bond to get a license to provide professional services is pretty common in other industries.
tech234a 3y ago
There are also mentions of web browser-based installs, but all apps are being notarized and encrypted. Edit: Upon looking into this further, it appears that only marketplaces can be installed from a web browser. [1] [1]: https://developer.apple.com/documentation/marketplacekit https://developer.apple.com/documentation/marketplacekit

stefan_ 3y ago

I must have missed this section in the DMA! All I want is a F-Droid-esque store with sane apps. You know, open source apps, centrally built. No in-app-purchases and Chinese geotracking framework for something that is 25 lines of code to talk to some bluetooth gadget.

jagged-chisel 3y ago
Who’s going to curate that?
- sureglymop 3y ago
  Take a look please: https://f-droid.org/en/about/ https://f-droid.org/en/about/
kaba0 3y ago
You just need a non-profit behind (or a government) and it should work just fine, they are exempted from the fees. The ruling is mostly there to prevent google and meta from creating alt stores (which is a benefit to us).

buildbot 3y ago

I have sideloaded IPAs now, on iOS 17.3. Altstore.

winterqt 3y ago
Sure, but your apps have to be renewed every 7 days (or 365 if you have a developer account).
- jerbear4328 3y ago
  And, almost more restricting in my experience, you can only have two (2) sideloaded apps installed at a time (3 if you count AltStore itself). Unless you are lucky enough to have a MacDirtyCow-vulnerable device+OS, of course, but if you are going there why not just jailbreak?

summerlight 3y ago

> The gatekeeper shall not be prevented from taking, to the extent that they are strictly necessary and proportionate, measures to ensure that third-party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper, provided that such measures are duly justified by the gatekeeper. Looks like Apple tries to make a case to exploit this statement, which sounds exactly like a malicious compliance.

olliej 3y ago

Ok, so I get that you want to be able to install random binaries on your phone, but I want to understand how you think that could happen without undermining the platform security model? The inability of binaries to do malicious things on iOS is the result of the sandboxing and entitlement mechanisms of the platform. The store review and approval process is what stops applications from including entitlements that undermine the platform security. If you remove that step from the process there is nothing stopping an application shipping with the system entitlements that allow the application to read or write to other app data, or the entitlements to talk to system services without prompting permission dialogs, etc. If you want to remove the review and approval systems that the App Store has (and it sounds like are going to be required for 3rd party stores?) you have to have an answer for that. Otherwise you just end up with the android malware problem.

lol768 3y ago
You tell the user what entitlements or permissions are being requested at the point of the app trying to use them, stop treating the users like stupid children and let them make an educated decision about how to use the hardware that they own. There are limits on Android anyway, what your side-loaded apps can do without you using a custom ROM or rooting the device is restricted somewhat.
- KolmogorovComp 3y ago
  Have you ever seen a random windows user? Do you think Grandma understands that? I’m all for allowing power-users to side loads apps, but average user definitely needs to be thought as a child that will use 1234 as their password, and click ‘ok’ on every pop-up without even reading it.
  - lol768 3y ago
    Require the super scary "break app sandbox" entitlements to be activated behind an adb-command-mutated flag (or whatever the iOS equivalent of adb is) after jumping through the USB debugging hoops?
3y ago

lol768 3y ago

Welp, that rules out anything like F-Droid. > The gatekeeper shall allow and technically enable the installation and effective use of third-party software applications or software application stores using, or interoperating with, its operating system and allow those software applications or software application stores to be accessed by means other than the relevant core platform services of that gatekeeper. > The gatekeeper shall, where applicable, not prevent the downloaded third-party software applications or software application stores from prompting end users to decide whether they want to set that downloaded software application or software application store as their default. The gatekeeper shall technically enable end users who decide to set that downloaded software application or software application store as their default to carry out that change easily. > The gatekeeper shall allow providers of services and providers of hardware, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same hardware and software features accessed or controlled via the operating system or virtual assistant listed in the designation decision pursuant to Article 3(9) as are available to services or hardware provided by the gatekeeper. Furthermore, the gatekeeper shall allow business users and alternative providers of services provided together with, or in support of, core platform services, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same operating system, hardware or software features, regardless of whether those features are part of the operating system, as are available to, or used by, that gatekeeper when providing such services How is requiring them to have access to $1M acceptable, or compliant with the legislation? > The gatekeeper shall not be prevented from taking strictly necessary and proportionate measures to ensure that interoperability does not compromise the integrity of the operating system, virtual assistant, hardware or software features provided by the gatekeeper Apple state the $1M requirement is to allow for providing support to customers. There is no allowance for doing that in the regulation, and no reasonable argument can be made that lack of customer support has an impact on the integrity of the operating system or hardware. I can understand scanning software or asking for it to be uploaded and signed, that could be justified. Not this.

shuckles 3y ago
Having a $100k bond to get a license to provide professional services is pretty common in other industries.

tech234a 3y ago

There are also mentions of web browser-based installs, but all apps are being notarized and encrypted. Edit: Upon looking into this further, it appears that only marketplaces can be installed from a web browser. [1] [1]: https://developer.apple.com/documentation/marketplacekit https://developer.apple.com/documentation/marketplacekit