6 ms·

Think Apple's argument about Epic having previously flouted the rules openly might be good enough. For a third party app store, Apple is pretty much giving the

Think Apple's argument about Epic having previously flouted the rules openly might be good enough. For a third party app store, Apple is pretty much giving the keys to your phone to the said app store. If there is a company which has demonstrated they won't play by the rules, it's not a huge stretch to say that it may harm the security of the model. While the EU wants the company/iphone to be more open, it also puts the onus of keeping it secure on the company itself. Another reason I believe they are on sure footing is that they got the rejection from the law firm, which I presume knows what they are doing, just as they did during the 2020 shenanigans from Epic.

goosedragons 3y ago
There shouldn't be rules from the manufacturer about what a third party app store can do. If so, this scheme is already a complete failure.
- ankit219 3y ago
  How do you ensure security of a device without rules from a manufacturer?
  - jocaal 3y ago
    Through security enhancing features in the operating system, like not allowing processes to access other's memory spaces. Or prompting users to allow an application to use potentially harmful api's. What do you think is the role of an operating system?
    - ben_w 3y ago
      Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". And for web browsers, which are basically an inner-OS, making sure that plug-ins can't read arbitrary content from the pages you visit. And given that "phone" is an app, that it can't wiretap all your calls. Also, one of the fights between Apple and Facebook was basically stuff which, by my reading, was stuff Facebook wanted to do which was illegal under GDPR: https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-privacy-change-will-cost-10-billion-this-year.html https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-priv... There's also stuff which is bad for the device, but I'm not sure if it really ought to be Apple's responsibility to prevent, like crypto miner libraries running on-device as an income stream for the developer.
      - dns_snek 3y ago
        > Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". And what makes you think Apple can stop these apps on their own app store before they cause harm? I sense this pervasive belief on HN that Apple's reviews are infallible, or that they magically catch malware, when in reality it's just some low ranking person installing the app and navigating through it to spot obvious flaws, usability issues, rule breaches, and ensure that the developer doesn't try to direct users to their website to purchase a subscription for cheaper, the usual anti-competitive stuff. Unless you can point out a step in the review process where a security expert sits down and reverse engineers the app, and every subsequent update, to verify that it doesn't steal user data? It's only when someone raises the suspicion that things get looked into, reported and taken off the store. At least web extensions have the benefit of being written in Javascript which is easier to inspect. At no point does Apple ask you to hand over source code.
        ben_w 3y ago
        > I sense this pervasive belief on HN that Apple's reviews are infallible Our language makes booleans easier to communicate than nuances. For example, I absolutely do not consider their reviews infallible, I just didn't think it would come across that way when I wrote the comment you're responding to.
      - jocaal 3y ago
        > Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". "This keyboard app requires access to network resources, do you want to allow this?" Or better yet, let the operating system block apps from using both network resources and keyboard api's. > And for web browsers, which are basically an inner-OS, making sure that plug-ins can't read arbitrary content from the pages you visit. My web browser allows me to choose when I want an extension to have access to a web page. > "And given that "phone" is an app, that it can't wiretap all your calls." I'm gonna guess it does this with a man-in-the-middle attack. "The operating system has detected that this phone app always calls the same number. We have disabled it for security reasons." Also if you buy a phone, it might be reasonable to let there only be one phone app. I'm kind of tired of people claiming the hand-holding argument, that apple helps people who do not understand technology. My sister uses apple devices exclusively, but at her work, her employer regularly does tests for phishing and she always fails. It is time people get educated about how to use their computing devices. These devices have been around long enough that people who fall for obvious scams should be considered incompetent.
    - ankit219 3y ago
      I combined both OS and manufacturers since in this case they are from the same company.
  - jonathanstrange 3y ago
    I doubt that Apple would accept to be responsible and liable for the security of software from other companies. Epic would ensure the security of their software in the same or similar ways as Apple does it for their software. The operating system provides the security framework, the makers of applications are responsible for the security of their software within that framework.
  - prmoustache 3y ago
    The thing you are missing is that once third party stores is allowed, the responsibility and security burden is also shared with those third party stores who have to comply the same way to EU rules or risk being fined and lose reputation the same way. It is not Apple's job to protect its customers from third party stores malware. They just have to build a secure OS with a safe apple store while allowing third parties to provide stores.
    - ankit219 3y ago
      EU mandates that gatekeepers work towards privacy and safety of the customers as a requirement in the DMA/DSA. From this link[1]: > Obligations for very large platforms that reach more than 10% of the EU’s population to prevent abuse of their systems by taking risk-based action and through independent audits of their risk management systems. They have a mandate to prevent abuse of their platforms from other apps or third party app store. This is in conjunction with opening up the same ecosystem for everyone else. [1]:https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/digital-services-act/europe-fit-digital-age-new-online-rules-platforms_en https://commission.europa.eu/strategy-and-policy/priorities-...
    - shagie 3y ago
      > It is not Apple's job to protect its customers from third party stores malware. They just have to build a secure OS with a safe apple store while allowing third parties to provide stores. Yes... it is. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R1925 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A... (section 64 paragraph 3) > In all cases, the gatekeeper and the requesting provider should ensure that interoperability does not undermine a high level of security and data protection in line with their obligations laid down in this Regulation and applicable Union law, in particular Regulation (EU) 2016/679 and Directive 2002/58/EC. The obligation related to interoperability should be without prejudice to the information and choices to be made available to end users of the number-independent interpersonal communication services of the gatekeeper and the requesting provider under this Regulation and other Union law, in particular Regulation (EU) 2016/679. "the gatekeeper and the requesting provider" Apple is still on the hook in combination with the requesting provider that doesn't intentionally deploy malware. Apple is likely claiming that Epic has in the past demonstrated clear and willful circumvention of their own security and rules. Apple would be putting itself at risk by allowing Epic to deploy applications given Epic's past history of intentionally trying to harm Apple's reputation and would compromise Apple's high level of security in data protection that it is required to follow under Union law. Apple would likely state that Epic has shown that it would intentionally break the law to harm Apple - and that's a believable concern.
  - rekoil 3y ago
    You don't, it's up to the device owner.
jsnell 3y ago
If Apple's security model really is that weak, it sure sounds like they should pull their products off the market until they fix it.
cultureswitch 3y ago
The problem with that argument is that Apple is demonstrably incapable or unwilling of securing their devices, despite the walled garden. Pegasus and a dozen other spyware exploit iOS vulnerabilities which have remained open for at least a couple of _years_ and Apple seemingly doesn't care. The only way to secure a device is to actually give control of the device to the user. But that would imply no more Apple tax, so Apple would rather die on that hill than follow the DMA. Add to that their psychopathic need for control.

goosedragons 3y ago

There shouldn't be rules from the manufacturer about what a third party app store can do. If so, this scheme is already a complete failure.

ankit219 3y ago
How do you ensure security of a device without rules from a manufacturer?
- jocaal 3y ago
  Through security enhancing features in the operating system, like not allowing processes to access other's memory spaces. Or prompting users to allow an application to use potentially harmful api's. What do you think is the role of an operating system?
  - ben_w 3y ago
    Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". And for web browsers, which are basically an inner-OS, making sure that plug-ins can't read arbitrary content from the pages you visit. And given that "phone" is an app, that it can't wiretap all your calls. Also, one of the fights between Apple and Facebook was basically stuff which, by my reading, was stuff Facebook wanted to do which was illegal under GDPR: https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-privacy-change-will-cost-10-billion-this-year.html https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-priv... There's also stuff which is bad for the device, but I'm not sure if it really ought to be Apple's responsibility to prevent, like crypto miner libraries running on-device as an income stream for the developer.
    - dns_snek 3y ago
      > Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". And what makes you think Apple can stop these apps on their own app store before they cause harm? I sense this pervasive belief on HN that Apple's reviews are infallible, or that they magically catch malware, when in reality it's just some low ranking person installing the app and navigating through it to spot obvious flaws, usability issues, rule breaches, and ensure that the developer doesn't try to direct users to their website to purchase a subscription for cheaper, the usual anti-competitive stuff. Unless you can point out a step in the review process where a security expert sits down and reverse engineers the app, and every subsequent update, to verify that it doesn't steal user data? It's only when someone raises the suspicion that things get looked into, reported and taken off the store. At least web extensions have the benefit of being written in Javascript which is easier to inspect. At no point does Apple ask you to hand over source code.
      - ben_w 3y ago
        > I sense this pervasive belief on HN that Apple's reviews are infallible Our language makes booleans easier to communicate than nuances. For example, I absolutely do not consider their reviews infallible, I just didn't think it would come across that way when I wrote the comment you're responding to.
    - jocaal 3y ago
      > Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers". "This keyboard app requires access to network resources, do you want to allow this?" Or better yet, let the operating system block apps from using both network resources and keyboard api's. > And for web browsers, which are basically an inner-OS, making sure that plug-ins can't read arbitrary content from the pages you visit. My web browser allows me to choose when I want an extension to have access to a web page. > "And given that "phone" is an app, that it can't wiretap all your calls." I'm gonna guess it does this with a man-in-the-middle attack. "The operating system has detected that this phone app always calls the same number. We have disabled it for security reasons." Also if you buy a phone, it might be reasonable to let there only be one phone app. I'm kind of tired of people claiming the hand-holding argument, that apple helps people who do not understand technology. My sister uses apple devices exclusively, but at her work, her employer regularly does tests for phishing and she always fails. It is time people get educated about how to use their computing devices. These devices have been around long enough that people who fall for obvious scams should be considered incompetent.
  - ankit219 3y ago
    I combined both OS and manufacturers since in this case they are from the same company.
- jonathanstrange 3y ago
  I doubt that Apple would accept to be responsible and liable for the security of software from other companies. Epic would ensure the security of their software in the same or similar ways as Apple does it for their software. The operating system provides the security framework, the makers of applications are responsible for the security of their software within that framework.
- prmoustache 3y ago
  The thing you are missing is that once third party stores is allowed, the responsibility and security burden is also shared with those third party stores who have to comply the same way to EU rules or risk being fined and lose reputation the same way. It is not Apple's job to protect its customers from third party stores malware. They just have to build a secure OS with a safe apple store while allowing third parties to provide stores.
  - ankit219 3y ago
    EU mandates that gatekeepers work towards privacy and safety of the customers as a requirement in the DMA/DSA. From this link[1]: > Obligations for very large platforms that reach more than 10% of the EU’s population to prevent abuse of their systems by taking risk-based action and through independent audits of their risk management systems. They have a mandate to prevent abuse of their platforms from other apps or third party app store. This is in conjunction with opening up the same ecosystem for everyone else. [1]:https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/digital-services-act/europe-fit-digital-age-new-online-rules-platforms_en https://commission.europa.eu/strategy-and-policy/priorities-...
  - shagie 3y ago
    > It is not Apple's job to protect its customers from third party stores malware. They just have to build a secure OS with a safe apple store while allowing third parties to provide stores. Yes... it is. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R1925 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A... (section 64 paragraph 3) > In all cases, the gatekeeper and the requesting provider should ensure that interoperability does not undermine a high level of security and data protection in line with their obligations laid down in this Regulation and applicable Union law, in particular Regulation (EU) 2016/679 and Directive 2002/58/EC. The obligation related to interoperability should be without prejudice to the information and choices to be made available to end users of the number-independent interpersonal communication services of the gatekeeper and the requesting provider under this Regulation and other Union law, in particular Regulation (EU) 2016/679. "the gatekeeper and the requesting provider" Apple is still on the hook in combination with the requesting provider that doesn't intentionally deploy malware. Apple is likely claiming that Epic has in the past demonstrated clear and willful circumvention of their own security and rules. Apple would be putting itself at risk by allowing Epic to deploy applications given Epic's past history of intentionally trying to harm Apple's reputation and would compromise Apple's high level of security in data protection that it is required to follow under Union law. Apple would likely state that Epic has shown that it would intentionally break the law to harm Apple - and that's a believable concern.
- rekoil 3y ago
  You don't, it's up to the device owner.

jsnell 3y ago

If Apple's security model really is that weak, it sure sounds like they should pull their products off the market until they fix it.

cultureswitch 3y ago

The problem with that argument is that Apple is demonstrably incapable or unwilling of securing their devices, despite the walled garden. Pegasus and a dozen other spyware exploit iOS vulnerabilities which have remained open for at least a couple of _years_ and Apple seemingly doesn't care. The only way to secure a device is to actually give control of the device to the user. But that would imply no more Apple tax, so Apple would rather die on that hill than follow the DMA. Add to that their psychopathic need for control.