4 ms·

What data does the epic game store has access to if you install it? Does it show clearly which data each app collects?

pavlov 2y ago
They’re still iOS apps executed in the same sandbox and notarized by Apple. It’s not like they can suddenly read more data from your device just because you downloaded the binary from Epic’s S3 bucket instead of Apple’s S3 bucket. Of course Apple would like you to have a vague feeling of fear, uncertainty and doubt about third party distribution. The truth is that the only extra layer of defense provided by Apple’s App Store is an arbitrary review process that is always overwhelmed and easily gamed.
- ben_w 2y ago
  The ease with which Apple's rules may be circumvented is situation-specific, e.g. Facebook ran an ad campaign to protest against Apple enforcing privacy rules which (to my not legally trained eye) seem to have already been a legal requirement for app developers in several jurisdictions before Apple made it also a contractual obligation: https://news.law.fordham.edu/jcfl/2021/03/29/the-privacy-war-apple-vs-facebook/ https://news.law.fordham.edu/jcfl/2021/03/29/the-privacy-war... So, for Meta, in this specific case, the law was easier to ignore than the developer agreement.
  - Razengan 2y ago
    Facebook also uses the iOS Keychain to track you across app installs and deletions, AND even when restoring iCloud backups on a new phone! There's no way to see or delete that data without using Facebook apps, and no way to be sure that the data they show is all the data they've stored on your phone.
    - SSLy 2y ago
      If I have a meta app, where can I see this stuff?
      - nottorp 2y ago
        You can't because Facebook won't show it to you and Apple doesn't allow their users access to the phone internals :) Match made in heaven?
      - Razengan 2y ago
        It's most visible in the "Saved Logins" where it shows you all the accounts you've ever used.
    - ben_w 2y ago
      That sounds unlawful under GDPR?
  - miki123211 2y ago
    Unlike the developer agreement, the law didn't require the consent pop up to have any specific wording, and the wording that Apple requires is far scarier than it should be.
- threeseed 2y ago
  This is not true. The sandbox does not prevent iOS apps from accessing private APIs and accessing data from the OS that wouldn't be available typically. And after all these years there is still no way to curtail the power of Objective-C dynamic dispatch. It is one of the main things that the App Store process checks for.
  - dns_snek 2y ago
    > The sandbox does not prevent iOS apps from accessing private APIs and accessing data from the OS that wouldn't be available typically. That sounds like a critical failure of the iOS security model that would make me uneasy about using their OS. A security issue like this needs be addressed through technical means, not by a fallible manual review process. As things stand, it's just a fear-mongering excuse they can throw in front of clueless legislators/regulators to help them maintain a stranglehold on app distribution.
ben_w 2y ago
> Does it show clearly which data each app collects? I think it would be very funny if it turns out Epic don't understand GDPR (data collection) and DSA (dark patterns), in much the same way they've already had a settlement for COPPA: https://web.archive.org/web/20221219211645/https://www.nbcnews.com/business/consumer/fortnite-maker-epic-games-fined-520-million-accusations-exposed-child-rcna62369 https://web.archive.org/web/20221219211645/https://www.nbcne... It's possible to win every battle, and still lose.

They’re still iOS apps executed in the same sandbox and notarized by Apple. It’s not like they can suddenly read more data from your device just because you downloaded the binary from Epic’s S3 bucket instead of Apple’s S3 bucket. Of course Apple would like you to have a vague feeling of fear, uncertainty and doubt about third party distribution. The truth is that the only extra layer of defense provided by Apple’s App Store is an arbitrary review process that is always overwhelmed and easily gamed.

ben_w 2y ago
The ease with which Apple's rules may be circumvented is situation-specific, e.g. Facebook ran an ad campaign to protest against Apple enforcing privacy rules which (to my not legally trained eye) seem to have already been a legal requirement for app developers in several jurisdictions before Apple made it also a contractual obligation: https://news.law.fordham.edu/jcfl/2021/03/29/the-privacy-war-apple-vs-facebook/ https://news.law.fordham.edu/jcfl/2021/03/29/the-privacy-war... So, for Meta, in this specific case, the law was easier to ignore than the developer agreement.
- Razengan 2y ago
  Facebook also uses the iOS Keychain to track you across app installs and deletions, AND even when restoring iCloud backups on a new phone! There's no way to see or delete that data without using Facebook apps, and no way to be sure that the data they show is all the data they've stored on your phone.
  - SSLy 2y ago
    If I have a meta app, where can I see this stuff?
    - nottorp 2y ago
      You can't because Facebook won't show it to you and Apple doesn't allow their users access to the phone internals :) Match made in heaven?
    - Razengan 2y ago
      It's most visible in the "Saved Logins" where it shows you all the accounts you've ever used.
  - ben_w 2y ago
    That sounds unlawful under GDPR?
- miki123211 2y ago
  Unlike the developer agreement, the law didn't require the consent pop up to have any specific wording, and the wording that Apple requires is far scarier than it should be.
threeseed 2y ago
This is not true. The sandbox does not prevent iOS apps from accessing private APIs and accessing data from the OS that wouldn't be available typically. And after all these years there is still no way to curtail the power of Objective-C dynamic dispatch. It is one of the main things that the App Store process checks for.
- dns_snek 2y ago
  > The sandbox does not prevent iOS apps from accessing private APIs and accessing data from the OS that wouldn't be available typically. That sounds like a critical failure of the iOS security model that would make me uneasy about using their OS. A security issue like this needs be addressed through technical means, not by a fallible manual review process. As things stand, it's just a fear-mongering excuse they can throw in front of clueless legislators/regulators to help them maintain a stranglehold on app distribution.

ben_w 2y ago

> Does it show clearly which data each app collects? I think it would be very funny if it turns out Epic don't understand GDPR (data collection) and DSA (dark patterns), in much the same way they've already had a settlement for COPPA: https://web.archive.org/web/20221219211645/https://www.nbcnews.com/business/consumer/fortnite-maker-epic-games-fined-520-million-accusations-exposed-child-rcna62369 https://web.archive.org/web/20221219211645/https://www.nbcne... It's possible to win every battle, and still lose.