3 ms·

> It's not that it's public. It's that it's in use. And an API that isn't public can have its use restricted to a controlled set of environments and places, wh

> It's not that it's public. It's that it's in use. And an API that isn't public can have its use restricted to a controlled set of environments and places, which inherently makes it easier to update. > Apple can continue to update it's API's and devices at any rate it pleases. If the 3rd party devices don't updates fast enough to follow, well that's their problem. Until the EU decides that a public API that changes without warning and "arbitrarily" to suit Apple's needs is also anti-competitive. An argument that would easily be made the first time Apple shipped an update to the API that broke a bunch of third party devices even while their own devices continued to work fine because they received an update at the same time, or even early in preparation. Again, my argument is not that it is impossible to make a public API or to transition that API. My argument is that a public API by its very nature often implies a slower pace of change. Even in your examples, SSL and TLS upgrades often happen over many years, with deprecated older versions being supported along side the current version for a while. In fact, TLS is a great example of this, where TLS 1.1 had fixed the vulnerabilities that made the BEAST attacks possible, and yet in 2011, when BEAST was discovered, it was still a problem because in 5 years, TLS1.1 still hadn't had a lot of adoption. Or consider that TLS 1.3 has been out since 2018, and yet I can still connect to this very site using TLS 1.1 with weak encryption keys. In fact, if I change firefox to require TLS 1.3, I can't even connect to this site. Or consider further that initial TLS 1.3 rollout was hampered by middle layers that had implemented the spec badly (https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet/ https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet...). Again these are not insurmountable problems, but they are problems inherent with a public API or protocol that multiple vendors are implementing, and problems that Apple either does not have to deal with, or deals with on a much smaller scale with their private internal APIs and therefore can move faster when iterating on those APIs.

rstuart4133 2y ago
> Until the EU decides that a public API that changes without warning The usual solution is not to break the existing API, but to add new features and deprecate old ones. I doubt the EU will demand Apple not improve their API's. The EU may have something to say about the rate Apple drops of depreciated API's. Maintaining them does impose a burden, but it can't be that bad as Linux, Windows and Android have maintained old API's for literally decades, so I'm sure Apple would cope. Or to put it another way, the fact that Apple has to support a depreciated API for a while doesn't mean they are forced to use it. If they want to make a change, they publish their shiny new API and move to it immediately. The existence of the old one doesn't need to slow Apple down at all. > In fact, TLS is a great example of this If you're using it as an example of how a public API can't evolve then it's a lousy example. TLS did evolve, and fairly rapidly. The fact that some people elected to stay with the old version doesn't change that. Frankly for most people BEAST didn't matter, as what they were doing on the internet didn't need a lot of security. But when it did matter, like say for a bank, then you were forced to upgrade. And guess what - that new browser still worked with old sites that support the new version. So some people chose to not move didn't slow the protocol's evolution at all. I think you are confusing the rate of adoption of something new, and the rate new things can arise and change. They are at best vaguely related. And to state the obvious, the old SSL API's being public had no effect on speed of the introduction a new version, which is the opposite of what you seem to be claiming.
- tpmoney 2y ago
  > The EU may have something to say about the rate Apple drops of depreciated API's. Maintaining them does impose a burden, So you agree then that a public API would likely necessitate a slower pace of change. It’s good to finally get on the same page. > If you're using it as an example of how a public API can't evolve then it's a lousy example. I agree, so it’s a good thing I have never once claimed that a public API can’t evolve, or that would have been a terrible example of that. In fact that argument would be completely ridiculous in the face of a number of APIs that have absolutely evolved in public. What my argument is and always has been since the beginning is that a public API imposed costs on that evolution and almost certainly implies a slower pace of change. And TLS absolutely backs that up. If you want to use TLS1.3 everywhere, you can’t. If you don’t want any sites to use TLS1.1 anymore, you can’t make that happen either. And the folks that make TLS can’t do anything about that either.
  - rstuart4133 2y ago
    > So you agree then that a public API would likely necessitate a slower pace of change. It’s good to finally get on the same page. Not at all. The pace of change is determined by how fast you introduce new API's. Apple in particular can change API's the iPhone talks to their watches as fast as they want, because they control both ends. Them publishing the protocol has absolutely no effect on that. > What my argument is and always has been since the beginning is that a public API imposed costs on that evolution and almost certainly implies a slower pace of change. Despite everything you've said here, I still don't know what those costs are beyond maintaining deprecated API's and documenting the API. > If you want to use TLS1.3 everywhere, you can’t. You're not Apple. Trust me, if Apple decided their watches and phones should only connect using TLS 1.3, then that's what would happen on the next release. You apparently are claiming being forced to publish they are now using TLS 1.3 would slow them down, but haven't offered a shred of evidence or a coherent reason on why that would be so. On looking back, you haven't said anything new in this reply - you just repeated the same assertions. Sadly I have said anything new either, which means it's time to move on.

rstuart4133 2y ago

> Until the EU decides that a public API that changes without warning The usual solution is not to break the existing API, but to add new features and deprecate old ones. I doubt the EU will demand Apple not improve their API's. The EU may have something to say about the rate Apple drops of depreciated API's. Maintaining them does impose a burden, but it can't be that bad as Linux, Windows and Android have maintained old API's for literally decades, so I'm sure Apple would cope. Or to put it another way, the fact that Apple has to support a depreciated API for a while doesn't mean they are forced to use it. If they want to make a change, they publish their shiny new API and move to it immediately. The existence of the old one doesn't need to slow Apple down at all. > In fact, TLS is a great example of this If you're using it as an example of how a public API can't evolve then it's a lousy example. TLS did evolve, and fairly rapidly. The fact that some people elected to stay with the old version doesn't change that. Frankly for most people BEAST didn't matter, as what they were doing on the internet didn't need a lot of security. But when it did matter, like say for a bank, then you were forced to upgrade. And guess what - that new browser still worked with old sites that support the new version. So some people chose to not move didn't slow the protocol's evolution at all. I think you are confusing the rate of adoption of something new, and the rate new things can arise and change. They are at best vaguely related. And to state the obvious, the old SSL API's being public had no effect on speed of the introduction a new version, which is the opposite of what you seem to be claiming.

tpmoney 2y ago
> The EU may have something to say about the rate Apple drops of depreciated API's. Maintaining them does impose a burden, So you agree then that a public API would likely necessitate a slower pace of change. It’s good to finally get on the same page. > If you're using it as an example of how a public API can't evolve then it's a lousy example. I agree, so it’s a good thing I have never once claimed that a public API can’t evolve, or that would have been a terrible example of that. In fact that argument would be completely ridiculous in the face of a number of APIs that have absolutely evolved in public. What my argument is and always has been since the beginning is that a public API imposed costs on that evolution and almost certainly implies a slower pace of change. And TLS absolutely backs that up. If you want to use TLS1.3 everywhere, you can’t. If you don’t want any sites to use TLS1.1 anymore, you can’t make that happen either. And the folks that make TLS can’t do anything about that either.
- rstuart4133 2y ago
  > So you agree then that a public API would likely necessitate a slower pace of change. It’s good to finally get on the same page. Not at all. The pace of change is determined by how fast you introduce new API's. Apple in particular can change API's the iPhone talks to their watches as fast as they want, because they control both ends. Them publishing the protocol has absolutely no effect on that. > What my argument is and always has been since the beginning is that a public API imposed costs on that evolution and almost certainly implies a slower pace of change. Despite everything you've said here, I still don't know what those costs are beyond maintaining deprecated API's and documenting the API. > If you want to use TLS1.3 everywhere, you can’t. You're not Apple. Trust me, if Apple decided their watches and phones should only connect using TLS 1.3, then that's what would happen on the next release. You apparently are claiming being forced to publish they are now using TLS 1.3 would slow them down, but haven't offered a shred of evidence or a coherent reason on why that would be so. On looking back, you haven't said anything new in this reply - you just repeated the same assertions. Sadly I have said anything new either, which means it's time to move on.