12 ms·

The parent comment cited Web Distribution as evidence that Apple doesn't actually care about safety and security, when in fact Web Distribution is more secured

The parent comment cited Web Distribution as evidence that Apple doesn't actually care about safety and security, when in fact Web Distribution is more secured than Marketplace distribution. > The goal was to get out of Apple's clutches when your customers have their devices Whose goal? Read the DMA. It is very explicit that it expects Apple to maintain security of devices and apps.

AnthonyMouse 3y ago
> The parent comment cited Web Distribution as evidence that Apple doesn't actually care about safety and security, when in fact Web Distribution is more secured than Marketplace distribution. Which goes to the parent's point that their intent is to prevent competition. Otherwise why would the alternative need more onerous security measures, if not to act as a deterrent through friction? > Read the DMA. It is very explicit that it expects Apple to maintain security of devices and apps. It also says that the security measures have to be "strictly necessary" and "there are no less-restrictive means to safeguard the integrity of the hardware or operating system" and "[t]he gatekeeper should be prevented from implementing such measures as a default setting or as pre-installation" etc. Which implies to me that you not only have to be able to turn them off, they have to be off by default.
- willseth 3y ago
  The comment literally says "It's not about security like they've been lying about", when the opposite is actually true. They were implying that Web Distribution was a way to get around security of a Marketplace, which is not possible. Without a kill switch, gatekeepers would lose control over apps, making them "strictly necessary." Most interpretations of the DMA agree.
  - AnthonyMouse 3y ago
    > The comment literally says "It's not about security like they've been lying about" The comment literally says: "All of this just makes it crystal clear what Apple's goal is: to prevent competition. It's not about security like they've been lying about; it's all about maintaining their app store monopoly." There is no reason for the security measures to be more onerous for the competing thing if they were sufficient for Apple's thing, unless the purpose of the security measures is to prevent competition. > Without a kill switch, gatekeepers would lose control over apps, making them "strictly necessary." Gatekeepers having control over apps isn't necessary for security. The device's owner having control over apps is. They can opt into a particular gatekeeper's control if they choose to. How is it "strictly necessary" for the gatekeeper to force them to use one provider of vetting services over another? Isn't the point of the act to enable competition?
    - willseth 3y ago
      > There is no reason for the security measures to be more onerous for the competing thing if they were sufficient for Apple's thing, unless the purpose of the security measures is to prevent competition. Web Distribution means Apple is handing over responsibilities previously handled by the Marketplace directly to the developer. Allowing developers to police themselves is obviously riskier. > The device's owner having control over apps is. This is simply not true. Device owners are hopeless at maintaining the security of their devices. > How is it "strictly necessary" for the gatekeeper to force them to use one provider of vetting services over another? There are 2 tiers of "vetting services": 1. Marketplaces determine the appropriate content or type of apps allowed in their listings, 2. Apple determines if an app, developer, or marketplace is an outright threat, e.g. if an app turns out to be a scam, or if a bug in an app exposes an exploit, it is "strictly necessary" for Apple to be able to yank the app immediately.
      - AnthonyMouse 3y ago
        > Web Distribution means Apple is handing over responsibilities previously handled by the Marketplace directly to the developer. Allowing developers to police themselves is obviously riskier. Doesn't that depend on who the developer is? Certainly it isn't the case that no one exists who the user might trust at least as much as Apple. > This is simply not true. Device owners are hopeless at maintaining the security of their devices. "Device owners" includes substantially all people. Many of them are not hopeless and are entitled to make their own decisions. Some of them are even more qualified to do it than the people Apple has reviewing apps. The hopeless people may be better off sticking to trusted stores, but they can do that without prohibiting others from doing otherwise. > There are 2 tiers of "vetting services": 1. Marketplaces determine the appropriate content or type of apps allowed in their listings, 2. Apple determines if an app, developer, or marketplace is an outright threat, e.g. if an app turns out to be a scam, or if a bug in an app exposes an exploit, it is "strictly necessary" for Apple to be able to yank the app immediately. That doesn't change the question. How is it "strictly necessary" for Apple to do that, rather than whoever the owner of the device chooses to do it? It would obviously be possible for a third party like Symantec, Malwarebytes or the makers of uBlock to do the same thing.
  - toyg 3y ago
    I love how a never-used-by-courts-before regulation would supposedly already have "most interpretations" with any sort of authoritative value. I can probably walk into a pub tonight and get 27 other "interpretations", they will have the same value of yours. Technically speaking, even the Commissioner's own interpretation might well be flawed - we won't know until a court spends some time on it. I would humbly suggest, though, that when the very same lawmaker who wrote the law is publicly pulling your ears in public on related matters, your interpretations are probably not the right ones. Apple pay enough real lawyers to defend them, they really don't need pro-bono amateurs.
    - willseth 3y ago
      It's not my interpretation, self-proclaimed humble person. Educated people have been discussing this ad nauseam for months. I would not-humbly suggest you actually read up on topics before breathlessly dismissing them deep down an HN comment thread.
berkes 3y ago
> Apple doesn't actually care about safety and security, when in fact Web Distribution is more secured than Marketplace distribution. That's a contradiction in logic there. If they cared for security, they would choose the more secured option. But they didn't? Either they then have provided worse security all along: web distribution could have offered more security than an app store? Or they could have provided even better security in their app store all along: if they implemented this stricter checking there. Why not? These arguments are poor and don't stand up to scruteny. The very simple conclusion is that it's not about security, that it never has been.
- willseth 3y ago
  No, you're making assumptions about what "secured" means in this context and clearly have no understanding of how any of it actually works. None of what you wrote makes sense.
  - berkes 3y ago
    You could have stopped at "means". No need to be condescending or telling me I don't know how stuff works. I know how stuff works. My point is, and remains, purely non-technical though. And I also know how language works. If you say "we don't allow X, only Y, because we prioritize security". Then change that to "we do allow X but will perform extra security scrutiny over what we do at Y" then it does not compute. Again: it proves your first statement was a lie (intentional or not). Because a) it was possible to allow for your level of security and you could've allowed both X and Y all along, or b) you are now lowering your security, proving you don't really prioritize security, or c) you are merely frustrating X in a different way now and security was never the reason not to allow X. I'm convinced it's both a and c. I surely hope not that it's b.

AnthonyMouse 3y ago

> The parent comment cited Web Distribution as evidence that Apple doesn't actually care about safety and security, when in fact Web Distribution is more secured than Marketplace distribution. Which goes to the parent's point that their intent is to prevent competition. Otherwise why would the alternative need more onerous security measures, if not to act as a deterrent through friction? > Read the DMA. It is very explicit that it expects Apple to maintain security of devices and apps. It also says that the security measures have to be "strictly necessary" and "there are no less-restrictive means to safeguard the integrity of the hardware or operating system" and "[t]he gatekeeper should be prevented from implementing such measures as a default setting or as pre-installation" etc. Which implies to me that you not only have to be able to turn them off, they have to be off by default.

willseth 3y ago
The comment literally says "It's not about security like they've been lying about", when the opposite is actually true. They were implying that Web Distribution was a way to get around security of a Marketplace, which is not possible. Without a kill switch, gatekeepers would lose control over apps, making them "strictly necessary." Most interpretations of the DMA agree.
- AnthonyMouse 3y ago
  > The comment literally says "It's not about security like they've been lying about" The comment literally says: "All of this just makes it crystal clear what Apple's goal is: to prevent competition. It's not about security like they've been lying about; it's all about maintaining their app store monopoly." There is no reason for the security measures to be more onerous for the competing thing if they were sufficient for Apple's thing, unless the purpose of the security measures is to prevent competition. > Without a kill switch, gatekeepers would lose control over apps, making them "strictly necessary." Gatekeepers having control over apps isn't necessary for security. The device's owner having control over apps is. They can opt into a particular gatekeeper's control if they choose to. How is it "strictly necessary" for the gatekeeper to force them to use one provider of vetting services over another? Isn't the point of the act to enable competition?
  - willseth 3y ago
    > There is no reason for the security measures to be more onerous for the competing thing if they were sufficient for Apple's thing, unless the purpose of the security measures is to prevent competition. Web Distribution means Apple is handing over responsibilities previously handled by the Marketplace directly to the developer. Allowing developers to police themselves is obviously riskier. > The device's owner having control over apps is. This is simply not true. Device owners are hopeless at maintaining the security of their devices. > How is it "strictly necessary" for the gatekeeper to force them to use one provider of vetting services over another? There are 2 tiers of "vetting services": 1. Marketplaces determine the appropriate content or type of apps allowed in their listings, 2. Apple determines if an app, developer, or marketplace is an outright threat, e.g. if an app turns out to be a scam, or if a bug in an app exposes an exploit, it is "strictly necessary" for Apple to be able to yank the app immediately.
    - AnthonyMouse 3y ago
      > Web Distribution means Apple is handing over responsibilities previously handled by the Marketplace directly to the developer. Allowing developers to police themselves is obviously riskier. Doesn't that depend on who the developer is? Certainly it isn't the case that no one exists who the user might trust at least as much as Apple. > This is simply not true. Device owners are hopeless at maintaining the security of their devices. "Device owners" includes substantially all people. Many of them are not hopeless and are entitled to make their own decisions. Some of them are even more qualified to do it than the people Apple has reviewing apps. The hopeless people may be better off sticking to trusted stores, but they can do that without prohibiting others from doing otherwise. > There are 2 tiers of "vetting services": 1. Marketplaces determine the appropriate content or type of apps allowed in their listings, 2. Apple determines if an app, developer, or marketplace is an outright threat, e.g. if an app turns out to be a scam, or if a bug in an app exposes an exploit, it is "strictly necessary" for Apple to be able to yank the app immediately. That doesn't change the question. How is it "strictly necessary" for Apple to do that, rather than whoever the owner of the device chooses to do it? It would obviously be possible for a third party like Symantec, Malwarebytes or the makers of uBlock to do the same thing.
- toyg 3y ago
  I love how a never-used-by-courts-before regulation would supposedly already have "most interpretations" with any sort of authoritative value. I can probably walk into a pub tonight and get 27 other "interpretations", they will have the same value of yours. Technically speaking, even the Commissioner's own interpretation might well be flawed - we won't know until a court spends some time on it. I would humbly suggest, though, that when the very same lawmaker who wrote the law is publicly pulling your ears in public on related matters, your interpretations are probably not the right ones. Apple pay enough real lawyers to defend them, they really don't need pro-bono amateurs.
  - willseth 3y ago
    It's not my interpretation, self-proclaimed humble person. Educated people have been discussing this ad nauseam for months. I would not-humbly suggest you actually read up on topics before breathlessly dismissing them deep down an HN comment thread.

berkes 3y ago

> Apple doesn't actually care about safety and security, when in fact Web Distribution is more secured than Marketplace distribution. That's a contradiction in logic there. If they cared for security, they would choose the more secured option. But they didn't? Either they then have provided worse security all along: web distribution could have offered more security than an app store? Or they could have provided even better security in their app store all along: if they implemented this stricter checking there. Why not? These arguments are poor and don't stand up to scruteny. The very simple conclusion is that it's not about security, that it never has been.

willseth 3y ago
No, you're making assumptions about what "secured" means in this context and clearly have no understanding of how any of it actually works. None of what you wrote makes sense.
- berkes 3y ago
  You could have stopped at "means". No need to be condescending or telling me I don't know how stuff works. I know how stuff works. My point is, and remains, purely non-technical though. And I also know how language works. If you say "we don't allow X, only Y, because we prioritize security". Then change that to "we do allow X but will perform extra security scrutiny over what we do at Y" then it does not compute. Again: it proves your first statement was a lie (intentional or not). Because a) it was possible to allow for your level of security and you could've allowed both X and Y all along, or b) you are now lowering your security, proving you don't really prioritize security, or c) you are merely frustrating X in a different way now and security was never the reason not to allow X. I'm convinced it's both a and c. I surely hope not that it's b.