4 ms·

> "...unfortunately, it's impossible to do all the complex engineering to comply with the Commission's current interpretation of the DMA..." There's nothing co

> "...unfortunately, it's impossible to do all the complex engineering to comply with the Commission's current interpretation of the DMA..." There's nothing complex and impossible about removing some "if" statements responsible for code signature enforcement.

jeroenhd 1y ago
That sounds way too hard to accomplish. Remember, Apple is a company with limited means, only bringing in the GDP of a small country. There's no way they can afford to pay programmers to check all of those if-statements! Those kinds of complex operations are only possible if a third party app manages to interact with iMessage's servers, or if someone figures out a way to replace a screen on their phone without Apple's express permission.
- thaumasiotes 1y ago
  > Apple is a company with limited means, only bringing in the GDP of a small country For reference, in 2023, Apple produced a little less than Romania or Hong Kong, and a little more than Egypt or the Czech Republic. Hong Kong is small (though not a lot smaller than the Czech Republic); Egypt is big. --- edit --- I accidentally compared Apple's revenue in 2023 to the IMF forecast of GDP for 2025. For 2023: Apple produced very slightly more than Hong Kong or Nigeria, and a little less than Malaysia or Iran. Nigeria is even bigger than Egypt. It still produced less than Hong Kong.
  - horsawlarway 1y ago
    Ah, yes - tiny numbers like "Slightly less than the total GDP produced by 91 million people in Iran" or "Slightly more than the 6th most productive metro of the most populous country on the planet". I agree - such a small player like checks notes "the 3rd most valuable company in the history of humanity" has no chance at implementing these troublesome rules.
    - thaumasiotes 1y ago
      > 91 million people in Iran Iran's GDP is artificially depressed.
nolok 1y ago
I agree that Apple's answer is of very little value and realism but I disagree on two count; One of surface, it's a lot LOT more work than that, the very obvious is "it's probably not if, but assumptions made everywhere, so it's not remove a condition but add a lot of check and rethink the whole process to ensure it's still consistent and safe"; Two, that's not what the issue is. It doesn't matter if it takes a lot of work or not. Nobody would accept something like "unfortunately, it's impossible to do all the complex engineering to comply with the YourCarCannotHaveA50PercentChanceOfExplodingWhenStarted regulation", which is an exagerated exemple on purpose; whether it's hard or not has nothing to do with anything being discussed, it's only a PR cop out.
interpol_p 1y ago
It’s extremely complex. I’m not debating whether they should comply - they should. But it’s gonna cost them years of engineering effort, and maintenance far into the future. See, for example, BrowserEngineKit https://developer.apple.com/documentation/browserenginekit https://developer.apple.com/documentation/browserenginekit They needed to engineer, maintain, document and support a whole class of APIs so that third parties can create their own competitive browser engines (that offer JIT, etc) while still maintaining iOS sandbox security. There are going to be hundreds of frameworks, thousands of APIs, that will need to come to ensure compliance with the DMA
- idle_zealot 1y ago
  Or, they could just let their pocket computers run the software users download and install, like every single other computer ever made and sold, rather than special-case engineer padded cells for every use-case, application class, or bit of interoperability.
  - bzzzt 1y ago
    You mean those users that don't even know what an application is? And you mean that software that only has the users best interests in mind and is not spying on them, trying to scam or confuse them into buying unnecessary stuff? I think Apple has done a great job of protecting non-technical people from a lot of the possible harms of malware. There's a lot of incentive for them to make sure security is handled right. I'm convinced going back to the 90s and giving every software developer full access to users phones would create a lot more problems than it would solve.
    - grishka 1y ago
      Maybe let's not optimize everything around people being tech-illiterate? We live in a society. You are expected to have some baseline knowledge to live in one. So let's instead educate people about that stuff instead of encouraging ignorance and punishing power users.
      - 1y ago
ankit219 1y ago
When a rule is vaguely defined, deliberately so that a regulator can take different interpretations depending on whether they are having any effect and who is doing it, even trivial things become complex. Eg: Meta is asked to withdraw monthly subscription for no ads offer when EU GDPR courts approved it, all EU publishers offer the same service, but the DMA interpretation of regulators for Meta keep saying No. On the surface, it's easy to do. But that is also based on the assumptions where they had to maintain some first party apis vs now having to create and maintain them so that third parties could use it. If they are committed to security which apparently DSA mandates, they have to devote many resources on it to ensure there are no threat vectors. Plus, there is no set guidelines on how much the APIs need to offer, it will be another session where competition asks for more and they will be asked to do that too.
- LelouBil 1y ago
  I didn't follow the case with Meta, but isn't it different ? Because you talk about both the GDPR and DMA, which are different regulations. I agree that a lot of websites (mostly news websites) have the "ad tracking or subscription" model, and I'm not sure if there has been a clear ruling in it yet, but maybe the DMA makes this stricter for Meta since it is a Gatekeeper
  - ankit219 1y ago
    Meta offered Pay-or-consent model (nov 23) at 10 euros or so to placate the then GDPR regulators, as the court found contractual necessity as an invalid argument. CJEU stance seems like its valid for meta and they had a long opinion on that. But DMA regulators dont agree calling it a false choice and asking meta to monetize by non personalized ads. The thing as you mentioned is how other publishers have the same model, which was never objected by any authority under GDPR either (so they clearly seem to think the model is valid). Its obviously a sticky situation where rules are different for different companies in the same jurisdiction when they are offering the same thing. A counter could be whether if Meta isn't allowed, would no one else be allowed, but you already know the answer to that question.
- saubeidl 1y ago
tomashubelbauer 1y ago
If they stand behind that statement, surely they are ready to stop doing business in the EU then? I don't see how they could continue given they are unable to follow the law here? And if it by some miracle turns out to be possible in a month or two, what consequences will Apple face for lying about this?
camillomiller 1y ago
I am generally positive towards Apple, but this is the most outrageous point to maintain. You made the iPhone, the Apple Watch, and the VisionPro. You create chipsets that smoke any other competitor. But sure, you can't fix some software processes because the engineering of that is too hard!
- grishka 1y ago
  It turns out it's very easy to not know things when your salary depends on you not knowing them.
mattlondon 1y ago
I suspect it goes a lot deeper than just a single if-statement somewhere, and hundreds of thousands of lines of code and various interfaces and all the rest are built on the core assumption of the signatures being there and the packages etc being signed. These sort of things can be tricky to refactor and more complex than they first seem. For example I recently spent the past 12 weeks or so just moving some fields around on a CRUD app (not adding or removing - just changing their order!) because there were assumptions built on assumptions built on assumptions about what order things are in and what comes first and what has already been done or not and so on. What ostensibly seemed trivial, actually required almost a complete rewrite of whole parts of the CRUD app to overcome the assumptions and implied behavior of what happens when and how.
- grishka 1y ago
  They share a lot of "AMFI" infrastructure between iOS and macOS, with macOS having a much more permissive security model (you can run self-signed code) while still retaining "private" entitlements for sensitive private APIs, only available to Apple-signed apps. Unless you disable SIP, then you can just do whatever. (Disclaimer: I may be wrong, I haven't done much of my own research, it's just things I read in various articles over the years)
snitty 1y ago
I honestly didn't expect the "it's just one line of code" argument on Hacker News.
ethan_smith 1y ago
While signature verification could be disabled with a few code changes, the real challenge is maintaining security boundaries when opening up previously controlled interfaces - it requires rebuilding permission models, API stability guarantees, and sandboxing mechanisms that were designed with closed-system assumptions.

jeroenhd 1y ago

That sounds way too hard to accomplish. Remember, Apple is a company with limited means, only bringing in the GDP of a small country. There's no way they can afford to pay programmers to check all of those if-statements! Those kinds of complex operations are only possible if a third party app manages to interact with iMessage's servers, or if someone figures out a way to replace a screen on their phone without Apple's express permission.

thaumasiotes 1y ago
> Apple is a company with limited means, only bringing in the GDP of a small country For reference, in 2023, Apple produced a little less than Romania or Hong Kong, and a little more than Egypt or the Czech Republic. Hong Kong is small (though not a lot smaller than the Czech Republic); Egypt is big. --- edit --- I accidentally compared Apple's revenue in 2023 to the IMF forecast of GDP for 2025. For 2023: Apple produced very slightly more than Hong Kong or Nigeria, and a little less than Malaysia or Iran. Nigeria is even bigger than Egypt. It still produced less than Hong Kong.
- horsawlarway 1y ago
  Ah, yes - tiny numbers like "Slightly less than the total GDP produced by 91 million people in Iran" or "Slightly more than the 6th most productive metro of the most populous country on the planet". I agree - such a small player like checks notes "the 3rd most valuable company in the history of humanity" has no chance at implementing these troublesome rules.
  - thaumasiotes 1y ago
    > 91 million people in Iran Iran's GDP is artificially depressed.

nolok 1y ago

I agree that Apple's answer is of very little value and realism but I disagree on two count; One of surface, it's a lot LOT more work than that, the very obvious is "it's probably not if, but assumptions made everywhere, so it's not remove a condition but add a lot of check and rethink the whole process to ensure it's still consistent and safe"; Two, that's not what the issue is. It doesn't matter if it takes a lot of work or not. Nobody would accept something like "unfortunately, it's impossible to do all the complex engineering to comply with the YourCarCannotHaveA50PercentChanceOfExplodingWhenStarted regulation", which is an exagerated exemple on purpose; whether it's hard or not has nothing to do with anything being discussed, it's only a PR cop out.

interpol_p 1y ago

It’s extremely complex. I’m not debating whether they should comply - they should. But it’s gonna cost them years of engineering effort, and maintenance far into the future. See, for example, BrowserEngineKit https://developer.apple.com/documentation/browserenginekit https://developer.apple.com/documentation/browserenginekit They needed to engineer, maintain, document and support a whole class of APIs so that third parties can create their own competitive browser engines (that offer JIT, etc) while still maintaining iOS sandbox security. There are going to be hundreds of frameworks, thousands of APIs, that will need to come to ensure compliance with the DMA

idle_zealot 1y ago
Or, they could just let their pocket computers run the software users download and install, like every single other computer ever made and sold, rather than special-case engineer padded cells for every use-case, application class, or bit of interoperability.
- bzzzt 1y ago
  You mean those users that don't even know what an application is? And you mean that software that only has the users best interests in mind and is not spying on them, trying to scam or confuse them into buying unnecessary stuff? I think Apple has done a great job of protecting non-technical people from a lot of the possible harms of malware. There's a lot of incentive for them to make sure security is handled right. I'm convinced going back to the 90s and giving every software developer full access to users phones would create a lot more problems than it would solve.
  - grishka 1y ago
    Maybe let's not optimize everything around people being tech-illiterate? We live in a society. You are expected to have some baseline knowledge to live in one. So let's instead educate people about that stuff instead of encouraging ignorance and punishing power users.
    - 1y ago

ankit219 1y ago

When a rule is vaguely defined, deliberately so that a regulator can take different interpretations depending on whether they are having any effect and who is doing it, even trivial things become complex. Eg: Meta is asked to withdraw monthly subscription for no ads offer when EU GDPR courts approved it, all EU publishers offer the same service, but the DMA interpretation of regulators for Meta keep saying No. On the surface, it's easy to do. But that is also based on the assumptions where they had to maintain some first party apis vs now having to create and maintain them so that third parties could use it. If they are committed to security which apparently DSA mandates, they have to devote many resources on it to ensure there are no threat vectors. Plus, there is no set guidelines on how much the APIs need to offer, it will be another session where competition asks for more and they will be asked to do that too.

LelouBil 1y ago
I didn't follow the case with Meta, but isn't it different ? Because you talk about both the GDPR and DMA, which are different regulations. I agree that a lot of websites (mostly news websites) have the "ad tracking or subscription" model, and I'm not sure if there has been a clear ruling in it yet, but maybe the DMA makes this stricter for Meta since it is a Gatekeeper
- ankit219 1y ago
  Meta offered Pay-or-consent model (nov 23) at 10 euros or so to placate the then GDPR regulators, as the court found contractual necessity as an invalid argument. CJEU stance seems like its valid for meta and they had a long opinion on that. But DMA regulators dont agree calling it a false choice and asking meta to monetize by non personalized ads. The thing as you mentioned is how other publishers have the same model, which was never objected by any authority under GDPR either (so they clearly seem to think the model is valid). Its obviously a sticky situation where rules are different for different companies in the same jurisdiction when they are offering the same thing. A counter could be whether if Meta isn't allowed, would no one else be allowed, but you already know the answer to that question.
saubeidl 1y ago

tomashubelbauer 1y ago

If they stand behind that statement, surely they are ready to stop doing business in the EU then? I don't see how they could continue given they are unable to follow the law here? And if it by some miracle turns out to be possible in a month or two, what consequences will Apple face for lying about this?

camillomiller 1y ago

I am generally positive towards Apple, but this is the most outrageous point to maintain. You made the iPhone, the Apple Watch, and the VisionPro. You create chipsets that smoke any other competitor. But sure, you can't fix some software processes because the engineering of that is too hard!

grishka 1y ago
It turns out it's very easy to not know things when your salary depends on you not knowing them.

mattlondon 1y ago

I suspect it goes a lot deeper than just a single if-statement somewhere, and hundreds of thousands of lines of code and various interfaces and all the rest are built on the core assumption of the signatures being there and the packages etc being signed. These sort of things can be tricky to refactor and more complex than they first seem. For example I recently spent the past 12 weeks or so just moving some fields around on a CRUD app (not adding or removing - just changing their order!) because there were assumptions built on assumptions built on assumptions about what order things are in and what comes first and what has already been done or not and so on. What ostensibly seemed trivial, actually required almost a complete rewrite of whole parts of the CRUD app to overcome the assumptions and implied behavior of what happens when and how.

grishka 1y ago
They share a lot of "AMFI" infrastructure between iOS and macOS, with macOS having a much more permissive security model (you can run self-signed code) while still retaining "private" entitlements for sensitive private APIs, only available to Apple-signed apps. Unless you disable SIP, then you can just do whatever. (Disclaimer: I may be wrong, I haven't done much of my own research, it's just things I read in various articles over the years)

snitty 1y ago

I honestly didn't expect the "it's just one line of code" argument on Hacker News.

ethan_smith 1y ago

While signature verification could be disabled with a few code changes, the real challenge is maintaining security boundaries when opening up previously controlled interfaces - it requires rebuilding permission models, API stability guarantees, and sandboxing mechanisms that were designed with closed-system assumptions.