4 ms·

Non-profits are exempted, so an fdroid alternative becomes possible, which is the only alt store I (and probably anyone) care about. This is a win.

by kaba0 3y ago

Andrew_nenakhov 3y ago
App notarisation will likely prohibit F-Droid self-building of apps, as developers would still have to provide 'notarised' binaries to third-party app-stores, which kinda kills the model of F-Droid. And Apple will charge developers directly for their installs, so F-Droid being non-profit doesn't really matter. This is just a farce at this point.
mk89 3y ago
Wow cool this is nice to know! What about the payment methods? Are these also exempted?
dns_snek 3y ago
This is absolutely not a win by any stretch of the imagination, it's a farce. Every single app will still require Apple's blessings and approval to exist in any app store on iOS. The moment any app on "f-droid for iOS" does something that Apple disapproves of, they can revoke its notarization and banish its developer from their walled garden.
- xvector 3y ago
  Notarization has been a massive win for iOS and macOS. If your app store distributes malware, it deserves to get banned.
  - ruszki 3y ago
    So should Apple’s own app store be banned?
  - dns_snek 3y ago
    Notarization has added nothing but another mandatory fee to develop for Apple's platforms. Your app can also get banned if it doesn't distribute malware. It will be abused as means of censorship (porn, drugs, gambling, etc.) https://www.macrumors.com/2020/08/31/apple-repeatedly-approved-malware-for-mac/ https://www.macrumors.com/2020/08/31/apple-repeatedly-approv... https://news.ycombinator.com/item?id=29569561 https://news.ycombinator.com/item?id=29569561
  - GlumWoodpecker 3y ago
    By that logic, the Apple-provided App Store should also [0] be [1] banned [2]. [0]: https://www.macrumors.com/2022/09/26/ios-app-store-ad-fraud/ https://www.macrumors.com/2022/09/26/ios-app-store-ad-fraud/ [1]: https://lifehacker.com/great-now-the-apple-app-store-has-malware-too-1849386738 https://lifehacker.com/great-now-the-apple-app-store-has-mal... [2]: https://www.darkreading.com/cyberattacks-data-breaches/malicious-apps-millions-downloads-apple-google-app-stores https://www.darkreading.com/cyberattacks-data-breaches/malic... You can't run any sort of marketplace in any sort of industry without bad actors slipping through every once and again.
    - mk89 3y ago
      Yeah but why are we doing "the trial" (of Kafka) already? Where is it written that they will take away their license if one app doesn't pass? I see a lot of negativity. Some of it is justified, some it's not. I see only good things: finally after this, other countries will move ASAP to do something similar. EU gave Apple a vague and open legislation. Apple's response was "okayish" and acceptable up to a certain point. Let's see what happens in the next 5 years.
- stale2002 3y ago
  > does something that Apple disapproves of, they can revoke its notarization and banish its developer from their walled garden. And the moment that that do that, they can rack up millions or billions of dollars of fines from the EU.
- mk89 3y ago
  You are confusing apple review with notarization. Notarization is literally to check malware and other small things. You can probably still use private APIs and weird things that wouldn't pass the app review.
  - DuckyC 3y ago
    "Notarization involves a combination of automated checks and human review." From the article. Human review means apple staff reviews it.
    - mk89 3y ago
      Yeah but that's not THE apple review that everyone complains about online. Notarization is a faster process. I know because I did it on my personal project without submitting it to the app store. And it's notarized and can be used on other people's computers.
- mk89 3y ago
  This is already the case with the official apple app store. Apple is very strict, so yeah, they should read carefully what to allow and what disallow.
  - Hugsun 3y ago
    They shouldn't have to be careful because apple's gatekeeping is what the legislation is trying to stop.
    - mk89 3y ago
      The legislation is not trying to stop it but it's trying to regulate it, because it got wild lately. You can read it here[0] and for the entire content here[1] (this I didn't read yet). Gatekeepers are allowed to exist, but they need to loosen up a bit. It's not an option that you are the only one able to distribute apps on a phone. Right now on Mac OSX you can still install apps from outside the App Store - if the developer didn't notarise the app, your OSX will shout at you before letting you install it, but you can still do that. On iOS you just can't (unless you root it, I think). That's where the law came in. And, arguably, I am not sure if the same can be done on Android (getting stuff from F-droid doesn't seem something that average Joe knows how to do). On the other hand, the way I imagine Apple wants to do it: - The user clicks on a link (from whatever App Store out there) - Downloads the app - Gatekeeper on iOS (behind the scenes) checks if the app was notarized The user flow seems similar to what we currently have on OSX as well, but with a mix with Apple Store: you can only install an app if it was notarised by Apple to prevent malware and tampering. This is not an app review, so you can still have private API calls (as far as I know). This is also why the responsibility falls on the external store: it's with the certificate from the external store that the notarisation will be done (on the app), as individual developers might not want anything to do with Apple Store at all. But someone has to - and this someone is the new marketplace. To be honest: I am not worried at all about the notarisation, it typically takes not too long, and it's a very basic step to prevent malware - can you still do ugly things? Probably yes, but this is really to set a minimum standard of what's allowed to have on the phone. If you question this step "why shouldn't I be allowed to have anything that I want on the phone", I even agree with you, maybe EU will tell apple to disable entirely the OS gatekeeping process (?). [0]: https://digital-markets-act.ec.europa.eu/about-dma_en https://digital-markets-act.ec.europa.eu/about-dma_en [1]: https://eur-lex.europa.eu/legal-content/EN/TXT/?toc=OJ%3AL%3A2022%3A265%3ATOC&uri=uriserv%3AOJ.L_.2022.265.01.0001.01.ENG https://eur-lex.europa.eu/legal-content/EN/TXT/?toc=OJ%3AL%3...
judge2020 3y ago
As far as I can tell The Commons Conservancy is not a 501c3 (or Netherlands equivalent), at least from their "organization" page. Not making money != a nonprofit organization.
girvo 3y ago
Yeah it’s a win for me. I do not care about other huge corporations making money via alt stores. I do care about an FDroid like alternative that will let me download emulators!
johnnyanmac 3y ago
Apps outside the app store are still subject to Apple's review. So don't hold your breath hoping for most apps you value from F-Droid making it on IOS.
alex_studer 3y ago
There is also this requirement though: > In order to establish adequate financial means to guarantee support for developers and customers, marketplace developers must provide Apple a stand-by letter of credit from an A-rated (or equivalent by S&P, Fitch, or Moody’s) financial Institution of €1,000,000 prior to receiving the entitlement. It will need to be auto-renewed on a yearly basis. Source: https://developer.apple.com/support/alternative-app-marketplace-in-the-eu/ https://developer.apple.com/support/alternative-app-marketpl... It doesn't seem like the fee waiver removes this requirement. And it seems like the cost for a standby letter of credit is roughly 1-10% of its value per year? So effectively it costs €10,000 to €100,000 per year just to have an alternate marketplace, separate from the core technology fee....
- alex_studer 3y ago
  Also!! From the full terms at https://developer.apple.com/contact/request/download/alternate_eu_terms_addendum.pdf https://developer.apple.com/contact/request/download/alterna... : > If the Core Technology Fee does not apply to Your Applications under this Section 4.4, any Alternative App Marketplace (EU) You distribute may only distribute Applications from You or another developer registered with the Apple Developer Program and not subject to the Core Technology Fee under this Section 4.4. So a hypothetical F-Droid for iOS would need all its apps to be from registered developers with fee waivers. (And individuals are not eligible for the waiver, so it could only contain apps from other non-profit organizations.)
  - rahkiin 3y ago
    Some organization that publishes gpl/etc applications under a trusted name, which could be automated with ci/cd.
xethos 3y ago
You keep posting about an F-Droid-like store for iOS is not only possible, but imminent now. I doubt that - how many devs will make something exclusively for the smaller EU market, how many will do so for free, and how many will be willing to register as a non-profit? The centre of that Venn diagram is developers for apps on iOS's F-Droid-like, and I think that's a very small subset indeed - especially considering the paperwork required to become a non-profit. Maybe the store itself will put in the work, but do you honestly believe every dev with an app on F-Droid will put up with the requirement to register as a non-profit?
- berkes 3y ago
  F Droid is operated by the EFF. They pretty much sit the brightly colored Center of your Venn diagram.
  - anticensor 3y ago
    F-Droid on Android lets users create and subcribe to other repositories though. You do not have to use the EFF's repository. Apple's terms seem to be carefully crafted to prevent users from creating such alternative F-Droid stores on iDevices.
    - berkes 3y ago
      So maybe then F-Droid on Apple doesn't have that feature?

Non-profits are exempted, so an fdroid alternative becomes possible, which is the only alt store I (and probably anyone) care about. This is a win.

by kaba0 3y ago

Non-profits are exempted, so an fdroid alternative becomes possible, which is the only alt store I (and probably anyone) care about. This is a win.

Andrew_nenakhov 3y ago

App notarisation will likely prohibit F-Droid self-building of apps, as developers would still have to provide 'notarised' binaries to third-party app-stores, which kinda kills the model of F-Droid. And Apple will charge developers directly for their installs, so F-Droid being non-profit doesn't really matter. This is just a farce at this point.

mk89 3y ago

Wow cool this is nice to know! What about the payment methods? Are these also exempted?

dns_snek 3y ago

This is absolutely not a win by any stretch of the imagination, it's a farce. Every single app will still require Apple's blessings and approval to exist in any app store on iOS. The moment any app on "f-droid for iOS" does something that Apple disapproves of, they can revoke its notarization and banish its developer from their walled garden.

xvector 3y ago
Notarization has been a massive win for iOS and macOS. If your app store distributes malware, it deserves to get banned.
- ruszki 3y ago
  So should Apple’s own app store be banned?
- dns_snek 3y ago
  Notarization has added nothing but another mandatory fee to develop for Apple's platforms. Your app can also get banned if it doesn't distribute malware. It will be abused as means of censorship (porn, drugs, gambling, etc.) https://www.macrumors.com/2020/08/31/apple-repeatedly-approved-malware-for-mac/ https://www.macrumors.com/2020/08/31/apple-repeatedly-approv... https://news.ycombinator.com/item?id=29569561 https://news.ycombinator.com/item?id=29569561
- GlumWoodpecker 3y ago
  By that logic, the Apple-provided App Store should also [0] be [1] banned [2]. [0]: https://www.macrumors.com/2022/09/26/ios-app-store-ad-fraud/ https://www.macrumors.com/2022/09/26/ios-app-store-ad-fraud/ [1]: https://lifehacker.com/great-now-the-apple-app-store-has-malware-too-1849386738 https://lifehacker.com/great-now-the-apple-app-store-has-mal... [2]: https://www.darkreading.com/cyberattacks-data-breaches/malicious-apps-millions-downloads-apple-google-app-stores https://www.darkreading.com/cyberattacks-data-breaches/malic... You can't run any sort of marketplace in any sort of industry without bad actors slipping through every once and again.
  - mk89 3y ago
    Yeah but why are we doing "the trial" (of Kafka) already? Where is it written that they will take away their license if one app doesn't pass? I see a lot of negativity. Some of it is justified, some it's not. I see only good things: finally after this, other countries will move ASAP to do something similar. EU gave Apple a vague and open legislation. Apple's response was "okayish" and acceptable up to a certain point. Let's see what happens in the next 5 years.
stale2002 3y ago
> does something that Apple disapproves of, they can revoke its notarization and banish its developer from their walled garden. And the moment that that do that, they can rack up millions or billions of dollars of fines from the EU.
mk89 3y ago
You are confusing apple review with notarization. Notarization is literally to check malware and other small things. You can probably still use private APIs and weird things that wouldn't pass the app review.
- DuckyC 3y ago
  "Notarization involves a combination of automated checks and human review." From the article. Human review means apple staff reviews it.
  - mk89 3y ago
    Yeah but that's not THE apple review that everyone complains about online. Notarization is a faster process. I know because I did it on my personal project without submitting it to the app store. And it's notarized and can be used on other people's computers.
mk89 3y ago
This is already the case with the official apple app store. Apple is very strict, so yeah, they should read carefully what to allow and what disallow.
- Hugsun 3y ago
  They shouldn't have to be careful because apple's gatekeeping is what the legislation is trying to stop.
  - mk89 3y ago
    The legislation is not trying to stop it but it's trying to regulate it, because it got wild lately. You can read it here[0] and for the entire content here[1] (this I didn't read yet). Gatekeepers are allowed to exist, but they need to loosen up a bit. It's not an option that you are the only one able to distribute apps on a phone. Right now on Mac OSX you can still install apps from outside the App Store - if the developer didn't notarise the app, your OSX will shout at you before letting you install it, but you can still do that. On iOS you just can't (unless you root it, I think). That's where the law came in. And, arguably, I am not sure if the same can be done on Android (getting stuff from F-droid doesn't seem something that average Joe knows how to do). On the other hand, the way I imagine Apple wants to do it: - The user clicks on a link (from whatever App Store out there) - Downloads the app - Gatekeeper on iOS (behind the scenes) checks if the app was notarized The user flow seems similar to what we currently have on OSX as well, but with a mix with Apple Store: you can only install an app if it was notarised by Apple to prevent malware and tampering. This is not an app review, so you can still have private API calls (as far as I know). This is also why the responsibility falls on the external store: it's with the certificate from the external store that the notarisation will be done (on the app), as individual developers might not want anything to do with Apple Store at all. But someone has to - and this someone is the new marketplace. To be honest: I am not worried at all about the notarisation, it typically takes not too long, and it's a very basic step to prevent malware - can you still do ugly things? Probably yes, but this is really to set a minimum standard of what's allowed to have on the phone. If you question this step "why shouldn't I be allowed to have anything that I want on the phone", I even agree with you, maybe EU will tell apple to disable entirely the OS gatekeeping process (?). [0]: https://digital-markets-act.ec.europa.eu/about-dma_en https://digital-markets-act.ec.europa.eu/about-dma_en [1]: https://eur-lex.europa.eu/legal-content/EN/TXT/?toc=OJ%3AL%3A2022%3A265%3ATOC&uri=uriserv%3AOJ.L_.2022.265.01.0001.01.ENG https://eur-lex.europa.eu/legal-content/EN/TXT/?toc=OJ%3AL%3...

judge2020 3y ago

As far as I can tell The Commons Conservancy is not a 501c3 (or Netherlands equivalent), at least from their "organization" page. Not making money != a nonprofit organization.

girvo 3y ago

Yeah it’s a win for me. I do not care about other huge corporations making money via alt stores. I do care about an FDroid like alternative that will let me download emulators!

johnnyanmac 3y ago

Apps outside the app store are still subject to Apple's review. So don't hold your breath hoping for most apps you value from F-Droid making it on IOS.

alex_studer 3y ago

There is also this requirement though: > In order to establish adequate financial means to guarantee support for developers and customers, marketplace developers must provide Apple a stand-by letter of credit from an A-rated (or equivalent by S&P, Fitch, or Moody’s) financial Institution of €1,000,000 prior to receiving the entitlement. It will need to be auto-renewed on a yearly basis. Source: https://developer.apple.com/support/alternative-app-marketplace-in-the-eu/ https://developer.apple.com/support/alternative-app-marketpl... It doesn't seem like the fee waiver removes this requirement. And it seems like the cost for a standby letter of credit is roughly 1-10% of its value per year? So effectively it costs €10,000 to €100,000 per year just to have an alternate marketplace, separate from the core technology fee....

alex_studer 3y ago
Also!! From the full terms at https://developer.apple.com/contact/request/download/alternate_eu_terms_addendum.pdf https://developer.apple.com/contact/request/download/alterna... : > If the Core Technology Fee does not apply to Your Applications under this Section 4.4, any Alternative App Marketplace (EU) You distribute may only distribute Applications from You or another developer registered with the Apple Developer Program and not subject to the Core Technology Fee under this Section 4.4. So a hypothetical F-Droid for iOS would need all its apps to be from registered developers with fee waivers. (And individuals are not eligible for the waiver, so it could only contain apps from other non-profit organizations.)
- rahkiin 3y ago
  Some organization that publishes gpl/etc applications under a trusted name, which could be automated with ci/cd.

xethos 3y ago

You keep posting about an F-Droid-like store for iOS is not only possible, but imminent now. I doubt that - how many devs will make something exclusively for the smaller EU market, how many will do so for free, and how many will be willing to register as a non-profit? The centre of that Venn diagram is developers for apps on iOS's F-Droid-like, and I think that's a very small subset indeed - especially considering the paperwork required to become a non-profit. Maybe the store itself will put in the work, but do you honestly believe every dev with an app on F-Droid will put up with the requirement to register as a non-profit?

berkes 3y ago
F Droid is operated by the EFF. They pretty much sit the brightly colored Center of your Venn diagram.
- anticensor 3y ago
  F-Droid on Android lets users create and subcribe to other repositories though. You do not have to use the EFF's repository. Apple's terms seem to be carefully crafted to prevent users from creating such alternative F-Droid stores on iDevices.
  - berkes 3y ago
    So maybe then F-Droid on Apple doesn't have that feature?