11 ms·
Rotten Apple
- Angostura 3y agoA lot of this article appears to be based on the belief that the security architecture of iOS and MacOS are identical. This seems ... an unlikely assumption
- rickdeckard 3y agoIf the argument is that in reality the security architecture of iOS is much much worse than MacOS, I'd be interested to hear the details of that rationale...
- Retr0id 3y agoThe security architectures of both are reasonably well documented[1] by apple, do you have any relevant distinctions to point out? [1] https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec... [PDF]
- Angostura 3y agoI suspect that there are too many differences for me to really list., but for starters MacOS supports multiple user accounts and has beeen built from its inception to allow people to install software from anywhere.
- rchaud 3y agoFor several years now, MacOS has blocked unsigned apps from running. You have to manually enable every single app installed this way inside System Preferences > Security. Android handles it the same way.
- Angostura 3y agoNope - yuo just right-click on the app and chose 'Open' from the menu. No need to go into preferences.
- bjornsing 3y agoI think a more problematic assumption is that iOS and MacOS users are equally aware and knowledgeable about potential security threats. It’s true that the sky hasn’t fallen because MacOS users are exposed to these risks. But they are not new risks on MacOS. They will be on iOS.
- pretext-1 3y agoMaybe people on this site are aware but I can assure you average Joe has no clue.
- bjornsing 3y agoExactly. And average Joe has grown accustomed to not needing a clue.
- smoldesu 3y agoIt hasn't protected Average Joe anyways. There is malware being actively distributed, today, that uses nothing other than first-party Apple services to attain persistence. Average Joe has to grow up. Scam websites and scam callers aren't going away, and even scam apps are being approved and distributed on Apple's App Store. On iOS, you have to do your due diligence to avoid being exploited (and even that might not help against some threats).
- addicted 3y agoThey don’t need to use a different browser engine. You’re talking about a user who has gone out of their way through multiple scary Apple warnings to change their browser engine. And even once they do that, they’re likely to be installing one of Firefox, Chrome, or Edge, all of which have as good if not better security histories than Safari.
- devnullbrain 3y agoThe sky hasn't fallen for the 70% of smartphone users who have an Android.
- bryanrasmussen 3y agoNo the article is under the belief that because something has not been a security problem for Mac it will not be a security problem for iOS, this does not necessarily have to be because the security architectures of both are the same.
- makeitdouble 3y agoParent's point is that Apple successfuly maintains two different security levels for mac and iOS, and claiming that it absolutely can't lower iOS at any cost is just Apple's opinion. For sure Apple doesn't like the macos security model and would want way tighter control on what's allowed to run, if it could get away with it. But it's not about what Apple wants, it's about what they're asked to do.
- everyone 3y agoGood, hopefully even less people will buy apple shit.
- 5350-uiop-1130 3y agofighting to sustain a monopoly it indicates to me a lack of ideas about the future reacting rather than preparing
- api 3y agoIt's particularly silly given their cash horde that they are not investing. Speaks to a highly conservative corporate culture almost to the level of stockpiling canned food and shotguns.
- MiscIdeaMaker99 3y agoA monopoly of what, exactly?
- 5350-uiop-1130 3y agoapp store monopoly did you read the article?
- op00to 3y agoWasn’t Apple forced to open up their App Store monopoly?
- Fischgericht 3y agoYes, and they are not complying but believe they can get away with abusing tiny loopholes. The are sabotaging the whole idea. For example them demanding that app developers have to pay APPLE if they are distributing their apps through a different App store is the exact opposite of the intention of the EU regulations, and plain evil.
- rickdeckard 3y agoI think their idea of the future is very much centered around selling the attention and purchasing power of their customers. That's not meant to be rude "Anti-Apple", that's what their business strategy is obviously based on, including implementing lots of features to prevent their users from voluntarily providing attention or sharing valuable information for free to anyone without Apple's involvement. If that's your strategy, someone forcing you to allow your customers to roam free is quite a big threat. Something you might be willing to spend one of your trillion dollars to fight against. So I believe we haven't seen the peak of this yet...
- kalyantm 3y agoNow they've stopped supporting PWAs in Europe - dark times for web indeed...
- rickdeckard 3y agoGood post, but a bit turbulent to read: "If you’ve ever built a web app, then your users will suffer. Remember, it’s a world wide web, including the European Union." "Create a PDF with the following information:" (me, reading that paragraph: '...what? why?') -- [Edit]: I concluded from the bullet-list on why that is requested, but it would help to introduce that intention before instructing me to do something
- velcrovan 3y agoIt seems obvious that they’re collecting submissions to include in an official complaint. PDF isn’t unreasonable for that use.
- bryanrasmussen 3y agoyou're creating a pdf to send a complaint to EU regulators about Apple behavior.
- everydaypanos 3y agoWhy Safari can’t just launch from a Home Screen bookmark even if the user has chosen another “default browser”? PWAs are already a separate “island” of storage and share nothing with Safari App… Microsoft does it all the time with Edge on Windows.
- endemic 3y agoThis is actually what I want tbh
- thimp 3y agoPerhaps this is just "all we could deliver by the compliance deadline without compromising platform security"? The truth is usually a lot less interesting than the hypothesis.
- actionfromafar 3y agoMaybe ... but a large company implementing compliance in the most self-serving way possible isn't exactly a shocking idea, either.
- thimp 3y agoWell exactly. The point is that both sides of the argument are somewhat more nuanced as they are disingenuously promoted.
- Fischgericht 3y agoHow would suddenly disallowing users to run a PWA that worked for years improve platform security? How would having Spotify be able to use their own subscription system compromise platform security? Being able to install software without needing an OK from the hardware manufacturer has been standard for over 40 years now. People do it on Windows PCs, on Linux PCs, on MacBooks and on Android phones, and that very clearly has not caused the extinction of the dinosaurs yet :) The document Apple has published to me reads like it's written by a 5 year old that just was served too many sweets shortly before bed time. IMHO this is about revenge, not about platform security.
- xandrius 3y agoIt's a shame, Apple is in a place to be the leader and decent, instead it decides not to be both.
- jadbox 3y agoI love apple for the hardware, but they would be a better company if they released their iron grip over the software. One day I dream I can install Linux on iOS devices.
- deleted 3y ago[deleted]
- hahamaster 3y agoBut why? What does an iPhone have, hardware-wise, that a Samsung or Xiaomi phone does not?
- xandrius 3y agoI'm an Android user (I like having freedom on my phone), but iPhone definitely have higher build quality (the materials are just better). Re-Saleability, you can sell them at decent prices. And in terms of new hardware, often Apple brings forth new features and the rest follows. And don't get me started on macbooks, I keep going back to them as basically everything is better there (except repairability and upgradeability, which I hope EU forces them to improve as well.)
- makeitdouble 3y ago> iPhone definitely have higher build quality (the materials are just better) With a glass panel on the back ? I'm perplexed on where Apple's materials are better than the Galaxy S Ultra series for instance. If anything Samsung's hardware is usually more advanced than Apple's, while their software is what kills the deal. Macbooks build quality is also IMO overrated, they are shiny and clean looking, quality control is top notch, but they're pretty fragile. The screen getting imprinted by the keyboard is a pretty frequent issue for instance (mine had clear imprinted lines after less than a year). Same for the camera right behind the opening notch, the coating gets noticeably off as the machine is open/closed. I'm comparing that to a Lenovo foldable that's still in a pretty good shape after roughly the same time, used by a teenager.
- thimp 3y agoAh yes, the poor end users suffering and the security being bullshit. I really can't wait to clean the first malicious browser out of a relative's iPhone and try and unsubscribe from Tim Sweeny's app store with his own 30% margin to spend on blackjack and hookers. The new status quo will be worse than the old one.
- pretext-1 3y agoSomehow this is not a problem on Android even though they have sideloading and alternative app stores even beyond what Apple is going to allow. (Apple still requires apps to go though a review process, even if distributed outside of the App Store, and will enforce this using digital signatures.)
- amadeuspagel 3y agoIt is somewhat of a problem for android when it comes to sideloading, and this is an additional advantages of PWAs. PWAs are the freedom of sideloading, without the security risk.
- thimp 3y agoThis is actually a big problem on Android. My ex father-in-law literally had his bank account ripped off (£18000) from rogue app installed from outside the app store. And Google's stewardship of the play store is terrible. Note I'm mostly an Android user.
- itsoktocry 3y ago>This is actually a big problem on Android. The fact that you have an anecdote does not make it a "big problem". If you're side loading apps and entering banking credentials into them, that's a human problem, not a tech problem.
- thimp 3y agoALL problems are human problems. Don't try and write this off with that one. I can go all day on these. Second one ... corp Android phone. App update ships own browser engine to display about box. Flaw in about box implementation allows user to hit Google. End user uses about box to exfiltrate data from device. Not possible on iOS. Same browser engine and controls. As mentioned I'm an Android user, just a better human than most when it comes to using the devices.
- pcdoodle 3y agoApple is so full of shit (I'm a user BTW). We're getting to the point where browsers can do really cool things and they're scared of losing their 30% mafia like tax. It's the browser wars all over again.
- algesten 3y agoCall me old fashioned, but I prefer it when web pages open in a web browser and don't pretend to be native apps.
- revscat 3y agoSometimes, sure. Sometimes not, though. I have a PWA for studying kanji that very much benefits from the increased real estate and more focused feel. I like having that choice.
- velcrovan 3y agoDon’t use PWAs then.
- asadotzler 3y agoYou aren't required to install PWAs and can generally keep using the site that created the PWA just fine. PWAs are most often a courtesy for mobile users, not a requirement. Don't need or want that courtesy, don't take it. That you spent time to post here without understanding that is some kind of indictment.
- natch 3y ago[flagged]
- hu3 3y ago> The screeds on this topic reveal thought patterns verging on mental illness. Personal attacks are, imo, uncalled for.
- anon373839 3y agoYou really should educate yourself on what PWAs are, how they’re built, and what this change actually does vis-à-vis ordinary browser tabs.
- reaperman 3y agoRe: 1) … my macbook can access / store / display nearly all the same “deeply personal” data as my iPhone. - Apple Health data - Photos/videos - Notes - etc
- agos 3y agowait is it possible to see health data on a macbook? or it's just in the backups?
- sneak 3y agoCompetition is good. This isn’t a new thing for Apple, however - even when Jobs was alive, he personally conspired with Google, Adobe, Intel, Intuit, Pixar, Lucasfilm and eBay to price-fix wages lower than a normal competitive market would allow. When the companies reached a settlement over it, the judge threw it out because it was so hilariously low compared to the three billion dollars that these companies stole from their employees. https://en.m.wikipedia.org/wiki/High-Tech_Employee_Antitrust_Litigation https://en.m.wikipedia.org/wiki/High-Tech_Employee_Antitrust... This isn’t some new development. Apple has long been without a moral compass, even when Jobs was at the helm. It continues today.
- wouldbecouldbe 3y agoWhat is really fun about working with Apple is their Appstore connect platform is buggy & slow as hell. Few times I couldn't submit an app because of it. Every time I submit a bug, there first reaction is try it on safari; most of time it was server issues so it didn't resolve it. But sometimes it actually did where I didnt expect it.
- pretext-1 3y agoThey have no reason to improve it as there is no alternative (yet).
- wouldbecouldbe 3y agoWell there is enough reasons: giving back to developers, because it's the right thing to do, saving support costs, etc. Just in their DNA not to care about developers. However even from such a monopoly position it would benefit them in the long run.
- zitterbewegung 3y agoWhy is it a bad response from Apple to disable a feature that they deem as a security risk if you allow for alternative browser engines? Browsers represent a significant attack surface since they can run code and also transmit data across the network. So when they are allowed to exist now Apple has either two options. One is to do the simple way and remove progressive web apps or extensively test and perform security analysis on all of the new browser engines. A better compromise would be to make new browser engines have extensive testing by the developer themselves. So, what's the point ? It feels similar to the GDPR where I get a popup and I click disallow all cookies except for essential ones. This seems the best way to actually implement the directive because it is not only low effort but most secure. We would have a better compromise for testing to be done by the browser engine developer or Apple but its more likely security holes would fall through.
- actionfromafar 3y agoAs said elsewhere, the PWA apps could open in Safari. But would this have legal implications? Could the browser vendors argue they are discriminated against if PWA apps do not open in their browser? I think this whole thing puts the finger on how fluid the borders have become. What is an app, what is an API, what is a service? Is Safari an Apple API for PWA apps? Or is a PWA app running by mandate on Safari when the user has selected another browser as default somehow wrong legally or ethically?
- jsnell 3y agoApple has been abusing their dominant market position for more than a decade, blocking browser competition with security being one of their excuses. They can't be trusted to be honest about what's a legitimate security issue, and what's just them using security as a smokescreen for anti-competitive behavior. And in fact, they are not being honest in this very case. Their entire spiel is based on the idea that the 3rd party browsers will be malicious, and permit data sharing between different PWAs. It's a risk they've just made up, because they're already making all kinds of other security requirements on 3rd party browsers before allowing them on the platform. They could just have made this one of those requirements.
- xbar 3y ago
- janandonly 3y agoIf I want my PWA to continue working, can I solve this by selecting "country" -> "UK" or "USA" ?
- janandonly 3y agoAlso, will all the people worldwide that changed their country setting to "France" because it prevents their iPhone from slowing down[1] now also experience broken PWA's? I guess so? [1] Untrue, apparently, but nonetheless something some people did: https://appleinsider.com/articles/21/08/25/dont-set-your-old-iphones-region-to-france----do-this-instead https://appleinsider.com/articles/21/08/25/dont-set-your-old...
- 123sereusername 3y ago[dead]
- Keyframe 3y agoI have an ipad through which I subscribed for Apple arcade. I don't use it / play at all on it and there was recently an email that price is going up. Sure, I'll just cancel subscription I said. I don't have my ipad on me, nor any other apple device (I don't use them anymore), nor windows. I have linux machines and android phone. Ok, so how do I cancel subscription? icloud login? no. subscription place of sorts? it wants me to install itunes, which I can't.. ok, no. After googling around, turns out there's actually no way except to call Apple in USA or wherever. I'll just wait a week untill I get a hold of my iPad and Apple won't be seeing my money for a long time. Disgraceful to say the least.
- disgruntledphd2 3y agoApple always assume that you use their devices as primaries. It can be very annoying. When I wanted to get my wife a replacement MB, I ended up checking out as a guest as they insisted on sending my 2FA code to my iPad (which mostly just annoyed my toddler).
- randcraw 3y agoNo. The user base for Apple Music on Windows is huge. Apple devices are secondary. Using the AM app is primary, once you've been successfully sucked into the Apple ecosystem, Borg-like.
- disgruntledphd2 3y agoSorry? Like the OP I run predominantly Linux and I noted my experience with Aple 2fa and my assumptions around why it happens. Perhaps I'm incorrect but what I said did happen to me.
- notso411 3y ago[dead]
- worksonmine 3y ago> Apple always assume that you use their devices as primaries Assumes or tries very hard to make the alternative as difficult as possible? From a company that prides itself in improving and simplifying UX the dark patterns aren't mistakes.
- sgt 3y ago> I’m going to get a lot of emails from confused users wondering why their app is broken, now opening in a regular browser window. Newsflash incoming for you.. Just about none of your users will (1) care (2) used the "PWA" in the first place. It's really not that common to add apps to the home screen. Among very technical users, it's a fair bit more common though.
- actionfromafar 3y agoFor random web pages which have a PWA mode, sure. But there are bona-fide industry specific PWA "apps". The confusion will be real. Probably minor enough for Apple to barely register, but tell that to the users.
- cageface 3y agoFrom the article: There is no native app for The Session, but you can install it on your phone nonetheless. Lots of people have done that. After a while they forget that they didn’t install it from an app store: it behaves just like any other app on their homescreen. Maybe you don't believe this but it was addressed.
- iainmerrick 3y agoI thought PWAs already didn't work well on iOS, though? Apart from opening in a browser window rather than as a full-screen app, is this going to behave significantly differently from before?
- cageface 3y agoApple has made some significant improvements in their handling of PWAs recently, most notably supporting push notifications. Which makes their recent moves even more discouraging. https://www.thisdot.co/blog/the-renaissance-of-pwas https://www.thisdot.co/blog/the-renaissance-of-pwas
- macguillicuddy 3y agoIt's a single data point but the Xbox Cloud Play (game streaming service) works on iOS through a PWA since Apple required that any service like that submit a seperate app for each game that it permitted to be streamed.
- robenkleene 3y agoThis is a terrible argument: > You can read Apple’s announcement on being forced to comply but as you do you so, I’d like you to remember one thing: every nightmare scenario they describe for the security of users in the EU is exactly what currently happens on Macs everywhere in the world. There's 1.5 billion iPhone users vs 100 million Mac users, Apple believes that at least part of the reason for that difference is the security model of iOS. E.g., arguably the largest changes Apple has made to the Mac since introducing the iPhone is implementing security measures based on iOS.
- addicted 3y ago> There's 1.5 billion iPhone users vs 100 million Mac users It’s beyond hilarious, after years of seeing Apple users fight back against the idea that the Mac’s better security relative to windows Windows has anything to do with its smaller user base, to see Apple users insist that the Mac’s smaller user base relative to the iPhone is what makes it more secure.
- stetrain 3y agoThose are probably different groups of people. I'll definitely agree that the Mac would see more security issues if it had the install base of Windows or iOS.
- addicted 3y agoThey’re a lot of the same people. John Gruber for example used to rail against the Security by Obscurity argument (correctly, IMO), but makes the same security by obscurity argument today.
- robenkleene 3y agoI don't really understand your argument, e.g., "seeing Apple users fight back against the idea that the Mac’s better security relative to windows Windows has anything to do with its smaller user base". Are you saying there was some dispute between where folks were saying Mac's tigher security someone made the platform less popular? I've never heard this. (Also for the record, I personally wouldn't make any case about Mac's security being better than Windows.) Also side point, I said this is what Apple believes, not "Apple users". I.e., I don't think anyone cares what I think, but Apple behavior on a number of fronts points to Apple believing this (e.g., sandboxing in Mac App Store, reading between the lines of the App Store restrictions, notarization).
- christkv 3y agoI don’t understands why this would be such a security issue other browsers are sandboxed. PWA would just dispatch to the chosen browser with whatever parameters are passed along and it would be up to that browser to do the right thing. How would this be a security risk worse than the current existing setup with deep links?
- apples_oranges 3y agoPerhaps we have reached peak Apple. I was a fanboy for a long time but when USB-C came to the iPhone something clicked for me. There was no good reason except money making why they didn't do it sooner. Perhaps the magic spell is broken. Yes, their computers may be good, but maybe the company that makes them, isn't.
- wavemode 3y agoI remember having this exact conversation with a girlfriend who though it was dumb that Apple was being forced to change their charger port. One day she was like "ugh! I forgot my phone charger at home" and I was like "your phone uses USB-C now. I have dozens of those lying around." She kind of tilted her head and said "huh. that's convenient." Like, she'd simply never thought about it that way before.
- will5421 3y agoDo you have to check which way round a USB-C connector is before you plug it in?
- asadotzler 3y agono
- neximo64 3y agoWhat tarnish to the brand. What a gamble.
- frizlab 3y ago> Instead of graciously acknowledging that this is what’s best for users, Apple are throwing a tantrum. I’m a user and a developer and I’m convinced this is not what’s best for users.
- t00ny 3y agoI am a developer and user, and I think it is better for me at least.
- frizlab 3y agoTo each his own. All I’m saying is his statement is presented as a fact when it is, in fact, not that simple.
- withinboredom 3y agoI'm just looking forward to have a pornhub app.
- myaccountonhn 3y agoIt's better for me, a user of an iPhone.
- frizlab 3y agoGood for you. All I’m saying is the original statement is given as a fact when it is actually highly debatable whether it actually _is_ best for the user. I don’t think it is and I’m not alone.
- dwighttk 3y agoSure this situation already exists on Mac OS but that is a much smaller user base and there are plenty of alternatives where you can go and install arbitrary software. I deal with weird stuff my parents have installed on their Macs every time I visit… so far I haven’t had to do that with their phones. If I wanted them to use a Firefox browser engine on their phone I’d get them an Android.
- Lacusch 3y agoYeah but then they just won't chage the browser enginr and nothing will change. I don't think your parents would go out of their way to change the browser engine or am I missing something?
- dwighttk 3y agoThey don’t go out of their way to install anything on their macs… every time I ask them about how their computers get this way and they do not know. I suspect my dad is just clicking anything that gets in the way of his puzzle games. Not sure what gets mom.
- devnullbrain 3y agoIt's so funny that every HN post on this topic produces more and more contrived reasons for why having less choice is better, actually. Today: my parents need to be coddled like children, so you don't get to install a new browser. It's only because Apple's legal wrangling failed that Android even exists today.
- dwighttk 3y agoYou do get to install a new browser, on a platform you’d prefer, one that is open and supports choice, go over there.
- devnullbrain 3y agoNo. Follow the law.
- bluesign 3y agoI think the main issue is attribution. Especially when a lot of stuff breaks even on web, when you change the browser. Imagine I have some PWA at home screen now, working with Safari engine. I changed my browser to Chrome, let's say it stopped working. 90% of the users will blame Apple software update instead of the Chrome choice.
- Fischgericht 3y agoWe luckily are finally living in a world where browser incompatibility is not a big issue anymore. And as a developer, you'd simply check that your PWA works with Safari, Firefox and Chrome.
- asadotzler 3y agoNah. Those kind of incompatibilities are rare and users will generally place the blame on their last change, more likely the Chrome install than a check for updates.
- monkin 3y agoI wonder how the EU will respond when high-ranking politicians fall victim to third-party app store scams or experience significant data leaks exploited through other browsers. Given that they're not particularly tech-savvy, it raises questions about their preparedness for such situations, and who they will blame for it.
- matsemann 3y agoYou don't have to wonder, as Android has had this model for years. So that should help you predict. Hint: not an issue.
- SigmundA 3y agoSeems like an issue, such that they are testing ways to disable certain side loaded apps: https://techcrunch.com/2024/02/07/google-starts-blocking-users-from-sideloading-certain-apps-in-singapore/ https://techcrunch.com/2024/02/07/google-starts-blocking-use...
- monkin 3y agoNever seen high-profile politician with an Android device.
- Hizonner 3y agoWell, admittedly that's pretty good evidence for your position that high-ranking politicians are stupid. But it also shows that high-ranking politicians won't stray outside Apple's little world even if given the opportunity, so there's no problem to begin with.
- jmull 3y ago(1) Why assume Apple's browser is more secure than the likely alternatives, Chrome and Firefox? (2) Those high-ranking politicians almost certainly already make heavy use platforms that allow "side-loading" and alternative browsers. That means the attack surface doesn't change much from where it is right now.
- 3y ago
- anon373839 3y agoThe best thing everyone can do is to keep making noise and Streisand Effect the hell out of this. Make Apple’s arrogance cost them something. Don’t just sit by quietly while they dismantle the future of computing to protect their revenue streams.
- idkdotcom 3y ago[dead]
- 123sereusername 3y ago[dead]
- idkdotcom 3y ago[dead]
- s1k3s 3y ago> risks from installing software that compromises system integrity with malware or other malicious code Sorry, what? Are they implying that iPhone's security isn't built inside the OS itself, but somehow depends on having every app pass their 30 second review on the store? That doesn't seem right. > exposure to illicit, objectionable, and harmful content due to lower content and moderation standards, and increased risks of scams, fraud, and abuse Like the deepfake video ads of politicians trying to sell me crypto that I constantly see on YouTube or Meta's apps, all coming from the official store?
- nuker 3y agoGet ready for “This website works in Chrome only. Please install Chrome on your iPhone”. This will be the day Google has won the Internet.
- manderley 3y agoNot going to happen.
- ubermonkey 3y agoAh, another article on HN complaining about Apple. Groundbreaking!
- arsh4151 3y ago[dead]
- lobito14 3y agoI've never had an Apple product and I never will. I hate their fan base, shallow virtue signaling, and business model.