4 ms·

The DMA introduces zero risk. Users are absolutely able to use the Apple App Store, Safari/Webkit, etc like this as they did before. So no, Apple isn’t factual

The DMA introduces zero risk. Users are absolutely able to use the Apple App Store, Safari/Webkit, etc like this as they did before. So no, Apple isn’t factually correct. In fact, it’s very possible that Gecko or Blink have more secure engines than WebKit. It’s very possible someone can create an App Store that is even more vetted than Apple’s and eliminates scam apps and games whose only purpose is to separate you from your money. So it’s not only not accurate, it’s probably diametrically the opposite of accuracy and is false.

riversflow 3y ago
Anyone with physical access to your device is now able to download and run arbitrary code. How is that not additional risk?
crazygringo 3y ago
> The DMA introduces zero risk. This is just not true. Maybe for experienced tech people like on HN. But the worry here is that you can be tricked into installing all sorts of dangerous malware. Especially now that casual users have been trained to believe that apps are safe. The DMA absolutely opens up all sorts of new vectors of attack. The question is ultimately a philosophical one -- whether you think the increased freedom is worth the increased risk. Not just for yourself, but for the average non-tech-expert consumer. You might think the tradeoff is absolutely worth it, but that doesn't mean that it still hasn't significantly increased security risks.
Auracle 3y ago
You assume that users always know what they're doing. Anyone that's helped an older parent/grandparent use technology knows that isn't the case.
acdha 3y ago
> The DMA introduces zero risk You need to think about this more carefully: there absolutely is an increase in risk by allowing other parties to run native code on your devices. This guarantees that people will be socially engineered into installing malware, intrusive vendors like Facebook will try to force users to add their stores to bypass privacy restrictions, and employers/schools/etc. will try to force their users to use their spyware for similar reasons. Now, a not unreasonable position is that this is acceptable but that should be an honest discussion starting with accepting the risk so you can gauge whether it’s a reasonable trade off or whether there are other mitigations. For example, notarization is a useful way for making it harder to install code on someone’s device which the OS vendor cannot see if it’s later associated with malware or which cannot be traced back to a source developer. The next time someone is breached, it’s useful to be able to tell whether the Firefox.app they have installed is an official Mozilla build or pretending to be one.

riversflow 3y ago

Anyone with physical access to your device is now able to download and run arbitrary code. How is that not additional risk?

crazygringo 3y ago

> The DMA introduces zero risk. This is just not true. Maybe for experienced tech people like on HN. But the worry here is that you can be tricked into installing all sorts of dangerous malware. Especially now that casual users have been trained to believe that apps are safe. The DMA absolutely opens up all sorts of new vectors of attack. The question is ultimately a philosophical one -- whether you think the increased freedom is worth the increased risk. Not just for yourself, but for the average non-tech-expert consumer. You might think the tradeoff is absolutely worth it, but that doesn't mean that it still hasn't significantly increased security risks.

Auracle 3y ago

You assume that users always know what they're doing. Anyone that's helped an older parent/grandparent use technology knows that isn't the case.

acdha 3y ago

> The DMA introduces zero risk You need to think about this more carefully: there absolutely is an increase in risk by allowing other parties to run native code on your devices. This guarantees that people will be socially engineered into installing malware, intrusive vendors like Facebook will try to force users to add their stores to bypass privacy restrictions, and employers/schools/etc. will try to force their users to use their spyware for similar reasons. Now, a not unreasonable position is that this is acceptable but that should be an honest discussion starting with accepting the risk so you can gauge whether it’s a reasonable trade off or whether there are other mitigations. For example, notarization is a useful way for making it harder to install code on someone’s device which the OS vendor cannot see if it’s later associated with malware or which cannot be traced back to a source developer. The next time someone is breached, it’s useful to be able to tell whether the Firefox.app they have installed is an official Mozilla build or pretending to be one.