4 ms·

Apple is still non-compliant with the requirements of the DMA, especially in regards to Article 6(7), which provides: "The gatekeeper shall allow business user

Apple is still non-compliant with the requirements of the DMA, especially in regards to Article 6(7), which provides: "The gatekeeper shall allow business users and alternative providers of services provided together with, or in support of, core platform services, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same operating system, hardware or software features, regardless of whether those features are part of the operating system, as are available to, or used by, that gatekeeper when providing such services." This means the Core Technology Fee is per-se illegal. The only exception to the provision is security, so Apple can probably demand notarization of IPA files (although maybe not really, since Android does not enforce that at all and the sky hasn't fallen over there) but the requirement that the developer already be in good standing and have 2 million app downloads is insane and non-compliant too.

alwayslikethis 3y ago
The rules aren't really strict enough it seems. The gatekeeper should not be able to have any control over app distribution at all. Notarization and other forms of code signing must be possible to turn off and should not place the gatekeeper in a privileged position (for example, it should be possible to enroll other certificates).
- EMIRELADERO 3y ago
  The DMA says this about it: > The gatekeeper shall not be prevented from taking strictly necessary and proportionate measures to ensure that interoperability does not compromise the integrity of the operating system, virtual assistant, hardware or software features provided by the gatekeeper, provided that such measures are duly justified by the gatekeeper. > The gatekeeper shall not be prevented from taking, to the extent that they are strictly necessary and proportionate, measures to ensure that third-party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper, provided that such measures are duly justified by the gatekeeper. > Furthermore, the gatekeeper shall not be prevented from applying, to the extent that they are strictly necessary and proportionate, measures and settings other than default settings, enabling end users to effectively protect security in relation to third-party software applications or software application stores, provided that such measures and settings other than default settings are duly justified by the gatekeeper.
  - arghwhat 3y ago
    That is to say, they are allowed to provide certain mandatory security services where justified for free.
    - EMIRELADERO 3y ago
      Exactly, plus the fact that Android seems to manage just fine without the notarization requirement would suggest that too could be invalidated by the Commission.
      - stirlo 3y ago
        I'm not supportive of Apple at all in this but to say that Android works "fine" without notarisation is a stretch[1]. Apple already has already implemented a perfectly functional balance between security and developers rights on the Mac, they just need to adopt that model on iPhone. [1]https://www.police.gov.sg/Media-Room/News/20230920_police_advisory_on_new_variant_of_malware_scams https://www.police.gov.sg/Media-Room/News/20230920_police_ad...
        idle_zealot 3y ago
        If they follow the Mac model of non-notarized app packages being installable with a warning (which can he disabled system-wide with a hidden setting) then that's basically equivalent to the Android model, which requires jumping through extra hoops to enable third-party app installs as well. People will be tricked into jumping through all of those hoops to install malware on their phones, but people are already tricked into harming themselves via their phones all the time on iOS and Android alike. People are ticked into using their (legit) bank apps to send money to fraudsters, into downloading (from the App Store) NFT scam apps, into downloading (from the App Store) scammy and predatory apps disguised as free colorful puzzle games. What does this proposed malware do? Surreptitiously record location data? Trick the user into parting from their money? Pop up unexpected ads and redirects? Apple's blessed apps already do all of that. What bad behavior is possible in from within an app sandbox that isn't common practice on the App Store? The only thing that comes to mind is location recording and sending of that information to the attacker, ie a spying GPS app installed by an abuser. The platform-level way to fix that would be to allow users to provide apps spoofed locations without informing the app that the location isn't real, which Apple won't do because... it would harm Netflix and Niantic's business model, I guess?
notso411 3y ago
[dead]
orra 3y ago
Wow, I can't believe how blatant their non-compliance is. That'll be some interesting legal advice they have.

alwayslikethis 3y ago

The rules aren't really strict enough it seems. The gatekeeper should not be able to have any control over app distribution at all. Notarization and other forms of code signing must be possible to turn off and should not place the gatekeeper in a privileged position (for example, it should be possible to enroll other certificates).

EMIRELADERO 3y ago
The DMA says this about it: > The gatekeeper shall not be prevented from taking strictly necessary and proportionate measures to ensure that interoperability does not compromise the integrity of the operating system, virtual assistant, hardware or software features provided by the gatekeeper, provided that such measures are duly justified by the gatekeeper. > The gatekeeper shall not be prevented from taking, to the extent that they are strictly necessary and proportionate, measures to ensure that third-party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper, provided that such measures are duly justified by the gatekeeper. > Furthermore, the gatekeeper shall not be prevented from applying, to the extent that they are strictly necessary and proportionate, measures and settings other than default settings, enabling end users to effectively protect security in relation to third-party software applications or software application stores, provided that such measures and settings other than default settings are duly justified by the gatekeeper.
- arghwhat 3y ago
  That is to say, they are allowed to provide certain mandatory security services where justified for free.
  - EMIRELADERO 3y ago
    Exactly, plus the fact that Android seems to manage just fine without the notarization requirement would suggest that too could be invalidated by the Commission.
    - stirlo 3y ago
      I'm not supportive of Apple at all in this but to say that Android works "fine" without notarisation is a stretch[1]. Apple already has already implemented a perfectly functional balance between security and developers rights on the Mac, they just need to adopt that model on iPhone. [1]https://www.police.gov.sg/Media-Room/News/20230920_police_advisory_on_new_variant_of_malware_scams https://www.police.gov.sg/Media-Room/News/20230920_police_ad...
      - idle_zealot 3y ago
        If they follow the Mac model of non-notarized app packages being installable with a warning (which can he disabled system-wide with a hidden setting) then that's basically equivalent to the Android model, which requires jumping through extra hoops to enable third-party app installs as well. People will be tricked into jumping through all of those hoops to install malware on their phones, but people are already tricked into harming themselves via their phones all the time on iOS and Android alike. People are ticked into using their (legit) bank apps to send money to fraudsters, into downloading (from the App Store) NFT scam apps, into downloading (from the App Store) scammy and predatory apps disguised as free colorful puzzle games. What does this proposed malware do? Surreptitiously record location data? Trick the user into parting from their money? Pop up unexpected ads and redirects? Apple's blessed apps already do all of that. What bad behavior is possible in from within an app sandbox that isn't common practice on the App Store? The only thing that comes to mind is location recording and sending of that information to the attacker, ie a spying GPS app installed by an abuser. The platform-level way to fix that would be to allow users to provide apps spoofed locations without informing the app that the location isn't real, which Apple won't do because... it would harm Netflix and Niantic's business model, I guess?

notso411 3y ago

[dead]

orra 3y ago

Wow, I can't believe how blatant their non-compliance is. That'll be some interesting legal advice they have.