13 ms·

Apple’s Dev Agreement Means No EFF Mobile App for iOS

243 points by sinak 12y ago

jewel 12y ago
Does anyone know if the Google Play Store agreement or the Amazon App Store agreement contain similar terms? I'd love to see Apple open things up a bit. My personal pet peeve is that it's nearly impossible to use LGPL libraries in iOS apps due to some of the terms.
- glitcher 12y ago
  I doubt this will actually motivate Apple to change in any way, but the EFF article also links to a petition: https://act.eff.org/action/apple-your-developer-agreement-tramples-on-free-speech-and-innovation https://act.eff.org/action/apple-your-developer-agreement-tr...
- comex 12y ago
  The Play Store agreement has a very similar clause which applies to all apps plus the store itself (haven't checked the Amazon one). The Android SDK agreement also has one, which may or may not be preempted by whatever parts of it are available under open source licenses (depending on your interpretation of "require"), but definitely applies to anything closed source (e.g. the new Java compilers, if I remember correctly). So basically the EFF is full of shit. > Security Features. You may not attempt to, nor assist, authorise or encourage others to circumvent, disable or defeat any of the security features or components, such as digital rights management software or encryption, that protect, obfuscate or otherwise restrict access to any Content or Google Play. - https://play.google.com/intl/en_us/about/play-terms.html https://play.google.com/intl/en_us/about/play-terms.html > 3.3 You may not use the SDK for any purpose not expressly permitted by this License Agreement. Except to the extent required by applicable third party licenses, you may not: (a) copy (except for backup purposes), modify, adapt, redistribute, decompile, reverse engineer, disassemble, or create derivative works of the SDK or any part of the SDK; ... - https://developer.android.com/sdk/terms.html https://developer.android.com/sdk/terms.html
  - yincrash 12y ago
    It doesn't require that you put DRM in your app. The iOS one does (which is part of the build / submission process).
    - comex 12y ago
      I don't know enough about Android technically to tell whether this is true, but the blog post is complaining specifically about restrictions on reverse engineering the SDK. Another bullet point is about restrictions on jailbreaking; while this is certainly highly onerous and I don't think Google has an equivalent clause, it's worth noting that Google's ban on reverse engineering the Play Store and apps distributed by it (as opposed to the SDK itself) includes activities that, translated to Apple terms, are fairly important to jailbreaking. (In particular, many App Store apps refuse to run on jailbroken devices, and must be reverse engineered to identify how to bypass this check. I don't know what the situation is on Android, but I would be surprised if that clause wasn't rouinely ignored.)
      - MCRed 12y ago
        TLDR: Google is doing it too. Thank you for pointing it out.
      - yincrash 12y ago
        The main SDK is open source. It's built from the same tree as Android from the AOSP, and you can build it yourself right now, which makes reverse engineering it sort of moot. Things like billing APIs or maps or google's push notifications however are in closed binaries, which I believe is what the clause is protecting.
      - yincrash 12y ago
        Additionally, I know enough of the Android build process to know that yes, it is true that the Google Play Store does not require DRM. It's also easy to pull any app that doesn't have DRM off a phone and put it on a phone using the debug tool that google themselves release (ADB). `adb pull <app location>` plug in new phone `adb install <app file you just pulled.apk>`
- on_and_off 12y ago
  I read them quite some time ago (when I signed them) but I don't remember reading anything similar in the Play Store. Several of these terms don't even apply to Android (the platform is open so you can publish where you want and you don't have to use reverse engineering on an open source project). Also, I don't see why the EFF would have published their Android app if they thought the terms were unacceptable.
  - jshevek 12y ago
    Exactly. EFF is making a well reasoned decision here that is consistent with their stated goals as an organization, and with the stances they take on other issues. Obviously, there are massive differences between Apple's policies and Google's policies, when taken as a whole. EFF might (speculation) see the Google Play store as a minor compromise of their values, while the apple app store is a MAJOR compromise. > Also, I don't see why the EFF would have published their Android app if they thought the terms were unacceptable. It seems that the dominant theory by the enraged applephiles is relates to some imaginary 'holy war' against their beloved, innocent apple.
- dingaling 12y ago
  The Amazon App Store rewraps your app with Amazon metrics and a DRM framework; even if you choose not to use DRM, the additional code is added and the app is re-signed using their keys ( with all the implications that entails ). The Amazon code is really invasive, I have been working on extricating a free app from it for some time and it is tedious work. There is an open Firefox bug about this: https://bugzilla.mozilla.org/show_bug.cgi?id=713777 https://bugzilla.mozilla.org/show_bug.cgi?id=713777 It also ensures that the app won't run on a device that doesn't have an active Amazon App Store account, even when you bought the app fair and square. If you're an open-source developer I'd suggest you stay well clear of Amazon.
deleted 12y ago
[deleted]
suyash 12y ago
Good job EFF exposing blanket agreement and requirements Apple makes developers sign. We need more of these come into lime light so developers can fight back against big corporations.
- MCRed 12y ago
  Nothing being exposed there, all those terms were well known, and when you cut thru the dishonest spin of the EFF, actually perfectly reasonable and designed to protect consumers.
  - ferrari8608 12y ago
    Could you elaborate on the "dishonest spin" part? I've always been under the impression that the EFF were the ones trying to protect consumers, so you have me curious.
    - MCRed 12y ago
      Sure thing, I'll illustrate point by point. 1. Public Statements, reason for this is that many people have tried to publish various forms of malware, and then when apple rejected the app, they cried fowl and pretended like Apple was being unreasonable in its reviews. In fact, this is the PRIMARY reason that people think that Apple is strict in what it will let in the App Store. EFF is misrepresenting what the agreement says here, putting spin on it. Revers Engineering-- The claim that this covers legal reverse engineering is created from whole cloth by the EFF, the section does not refer to types of reverse engineering, merely protects apples rights regarding such. Thus EFF is straight up lying. App Store Only: Apple provides the SDK for free, and part of the deal is that it is to be used for deploying apps for iOS on the app store only. (This is not the case with the Mac SDK) Charactersizing Lydia as a "competing app store" is straight up dishonest. IT requires jailbreaking devices, which results in greatly reduced reliability and is bad for consumers, opening them up to malware, yet the EFF is effectively endorsing exposing consumers to malware here. "No Tinkering" - Obviously, Apple doesn't want people circumventing their protections against malware and getting malware past the review process. "Apple owns security" -- A profoundly dishonest comment given that Apple has done so much to protect security that a governor is trying to get a law passed that will let the government snoop again. The EFF apparently doesn't care about his, but uses the fact that you can't use a security bug claim to circumnavigate the review process to pretend like Apple leaves people exposed. Another straight up lie. Kill your App-- yes, if malware gets in there, it can be shut down. Ignoring the reasoning for this puts a hard, dishonest spin, in fact as far as I'm concerned, makes it a lie. This is also true of google's store. So, given that the EFF is publishing on android, they obviously don't care about this too much... yet they put it in here to bash Apple, making them both hypocrites and liars. " and we certainly will not wrap our app in DRM." DRM that signs the app to prevent it from being tampered with, which keeps the users data secure. So the EFF here is rejecting keeping users data secure. They care more about grandstanding than integrity and protecting consumers.
saganus 12y ago
0 downloads. I guess I'll have to be the first. Edit: Now that I think about it, it said 1-5 installs, so most likely not the first.
- libraryatnight 12y ago
  Looks like I'm number 2 :) It seems a very simple app indeed, but useful.
pseudometa 12y ago
This comes across as though they never intended to make an app for the app store and all along just wanted to call out apple on their term sheet. It is purely a moral stance. Which is fine, but the article is slanted differently.
- serf 12y ago
  Today we launched a new app that will make it easier for people to take action on digital rights issues using their phone. The app allows folks to connect to our action center quickly and easily, using a variety of mobile devices. yeah, maybe they made the android app just so they could bitch about iOS.
  - frandroid 12y ago
    That's an expensive form of bitching... When they could just publish the same press release without having to develop an app for other platforms, for free!
    - Natsu 12y ago
      Based on the note he's replying to, I believe his statement was sarcastic.
  - MCRed 12y ago
    Its really getting to the point that no matter how many consumers rights Google violates and no matter how many consumers Apple protects, the adherents to this holy war against Apple will never admit things are not as black and white as they insist on portraying.
    - MCRed 12y ago
      And of course this is hacker news. The hordes of android fans down vote me with no comment, no argument, because it isn't about the facts of reality, it's about ideology and hatred. So, this is a site where, if you don't kowtow to the prominent ideology you get buried. That reflects more on you than those of us who are making counter arguments.
thought_alarm 12y ago
EFF have a lot of time on their hands, apparently.
- newaccountfool 12y ago
  Surely this is exactly the kind of thing the EFF should be doing?
  - notatoad 12y ago
    making apps that send notifications over proprietary push-notification channels instead of supporting open, accessible, cross-plaform communication channels like email? nah, that wasn't what i donated to the EFF for.
    - yincrash 12y ago
      They made their own push notification server with an Affero GPL license (which means even server operators have to release source that they change), and as such I would not consider proprietary. Email is not a push channel in either IMAP or POP3.
      - Nullabillity 12y ago
        SMTP is push, POP/IMAP are receiver implementation details.
        yincrash 12y ago
        The parent of my post was arguing against a "proprietary push implementation" in favor of email, but my argument is that the receiving of email is not via push.
  - MCRed 12y ago
    No, the EFF Should not be writing articles full of lies attacking the company that has consistently defended consumer rights and supporting the company that has consistently violated them.
sinak 12y ago
For any other non-profits or companies who might need a similar app to notify users, both the app (Cordova + Ionic) and the APNS/GCM push notification server are open source and available here: https://github.com/EFForg/pushserver https://github.com/EFForg/pushserver https://github.com/EFForg/actioncenter-mobile https://github.com/EFForg/actioncenter-mobile If you're an Android user, consider downloading the app. Its really, really simple - it just sends you a push notification if there's an action EFF needs your help with - but we hope to improve it over time. https://play.google.com/store/apps/details?id=org.eff.actioncenter https://play.google.com/store/apps/details?id=org.eff.action...
- dublinben 12y ago
  Can this be installed without the Play Store?
  - sinak 12y ago
    My understanding is that you need to have the Play Store on your device for apps to register and receive push notifications from GCM [1]. Since that's the main functionality of the app at the moment, an APK for sideloading won't be too useful, but perhaps we can add one once we add more functionality? [1] Would love to be wrong about this if anyone else knows differently.
    - rentnorove 12y ago
      Unfortunately that looks to be the case. I had hoped they'd rolled their own push server implementation in the linked source (https://github.com/EFForg/pushserver https://github.com/EFForg/pushserver), but it's just a wrapper around the GCM and APNS services. It's disappointing, because both Android and iOS have support for periodically retrieving data without using the proprietary push services. It's not like the EFF is going to be delivering messages that have a 'real-time' requirement and therefore require a persistent connection (as opposed to say, Gmail/Hangouts).
- jerleth 12y ago
  Honestly, the play store is not any better than the apple app store. I myself never agreed to the play store's license agreement and use my android phone without it. If you really care about privacy, consider hosting your apps apk yourself or post it to a store that really respects its users privacy, like f-droid instead of supporting the play store. If your app is opensource like you state, f-droid should host it. Take care, Martin
higherpurpose 12y ago
> Ban on Reverse Engineering: Section 2.6 prohibits any reverse engineering (including the kinds of reverse engineering for interoperability that courts have recognized as a fair use under copyright law), as well as anything that would "enable others" to reverse engineer, the software development kit (SDK) or iPhone OS. Wow. EFF should sue Apple over that alone. Private companies aren't supposed to "contract-out" your rights. This will be an easy win for EFF.
- MCRed 12y ago
  The case would be thrown out because the provision says nothing of the kind, and in fact, this statement here by the EFF is defamation and when Apple countersued they'd win. Apple doesn't respond to critics like this, so the EFF knows it can get away with these kinds of lies. It's just unfortunate that you and others believe them, and those who point them out are silenced here on HN.
  - zerocrates 12y ago
    Well, the agreement does say You may not and You agree not to, or to enable others to, copy (except as expressly permitted under this Agreement), decompile, reverse engineer, disassemble, attempt to derive the source code of, modify, decrypt, or create derivative works of the Apple Software or any services provided by the Apple Software or otherwise provided hereunder, or any part thereof (except as and only to the extent any foregoing restriction is prohibited by applicable law or to the extent as may be permitted by licensing terms governing use of open-sourced components or sample code included with the Apple Software). EFF is definitely oversimplifying and spinning a little, but that's certainly a restriction on reverse engineering "of the kind" that they describe in their post. Spin or not, it's hardly a baldfaced "lie." (That said, you're right to respond that EFF couldn't sue over that provision - people contract away their rights to do things they otherwise could all the time.)
  - Natsu 12y ago
    I do not think the EFF can (or would) sue them over the developer agreement in the manner described by the grandparent post. I found that statement hyperbolic, though I do wish that people would stop writing overly burdensome contracts full of CYA provisions. That aside, your statements about defamation are just as bogus. Opinions regarding specific, disclosed facts are protected. There's something called the Milkovich standard, which you can read more about here: http://www.rcfp.org/browse-media-law-resources/news-media-law/news-media-and-law-summer-2011/opinion-defense-remains-str http://www.rcfp.org/browse-media-law-resources/news-media-la... Given that the Apple developer agreement is public and the article I read makes that agreement the sole basis of its opinion without implying that they know more than they've told us, your statements about it being "defamation" are not accurate. They cited specific provisions in the agreement which they disagree with as the basis of their opinion and the article was explicit about this. You're entitled to that as an opinion, of course. It's an incorrect opinion that mischaracterizes the defamation laws the EFF is subject to here, but you're entitled to hold if you wish. This is why nobody should trust any legal discussion they found online (including mine) and instead hire a lawyer who can give them competent legal advice (and who has legal malpractice insurance in the event their advice is less than competent) when dealing with anything more than academic pursuits.
jasonjei 12y ago
I think it would be really effective and tongue-in-cheek if EFF released their app on Cydia.
WhitneyLand 12y ago
The EFF dev said its a Cordova app, so why not just throw up the HTML mobile site for iOS users? You could still notify via sms, email, etc.
- MCRed 12y ago
  Because they care more about making propaganda, apparently.
- windsurfer 12y ago
  You can see the site here: https://github.com/EFForg/actioncenter-mobile/tree/master/www https://github.com/EFForg/actioncenter-mobile/tree/master/ww... Since the app is basically only for notifications, it's useless as a web site. If you want sign up for email notifications, go to https://act.eff.org/ https://act.eff.org/
- driverdan 12y ago
  I understand and agree with the EFF's position and why they'd want another method of outreach but you're right, this really doesn't require an app. SMS and email are perfectly fine methods to distribute this type of alert.
shmerl 12y ago
They can use Cydia I guess. But this may be more an attempt to simply bring attention to how sickening Apple's developer agreement is. Which is a good thing to do anyway.
- jshevek 12y ago
  I'd rather see them not use Cydia. While I'm glad that Cydia exists, for those individuals who love iOS and i-things but wish to step outside of apple's total control, it seems less professional to me to release an app whose usage specifically requires 100% of the users to violate the agreements they made with the manufacturer.
  - shmerl 12y ago
    Not if that agreement is taking away their rights. Violating such agreement (or assuming users violated it) shouldn't be viewed as unprofessional. Not any more unprofessional at least than expecting Applet to violate users' rights when Apple make such agreement.
dmishe 12y ago
I don't understand the purpose of the app, the one on play store looks like a one button subscription frontend. How is it better then their website, email, twitter?
- MBCook 12y ago
  They can release a press release to complain about Apple policies and get hits/donations?
csense 12y ago
I've never understood why either users or developers put up with all of Apple's crap.
- jshevek 12y ago
  It really is worth careful and thorough study. Apple has mastered 'marketing' on such a deep level.
- k-mcgrady 12y ago
  Because it works. I have never wanted to do anything on my iPhone that I can't and as a developer I've only had one rejection that annoyed me and in hindsight I understand the rejection. I've also used Android devices a lot (I own two, and develop for the platform) and I hate it. Really hate it. Waiting for OS updates, lots of crashing, things in different places depending on the OEM. Not to mention how slow some devices are. The S3 Mini is horrible to use, I don't see how anyone could feel comfortable putting it to market. In short, the crap either doesn't effect most people, or creates a better experience. The only people who seem to really complain about it don't use the platform anyway.
gnu8 12y ago
Apple needs to remove each of these requirements. None of them serve any justifiable purpose, they only immorally and antisocially serve Apple's avarice.
parrots 12y ago
People are still complaining about section 8 - the remote kill switch? I remember only one instance of an app remotely killed, and that was malware. Even apps that enabled tethering, emulating, or are otherwise against the rules but make it through review have been simply pulled for sale, never terminated using this capability. I think Apple has proved they're using this responsibly after 6 years.
- chii 12y ago
  i dont really care that they've been using it responsibly so far - there isn't a guarantee that abuse won't happen.
eridius 12y ago
> Kill Your App Any Time I'm rather shocked to see the EFF linking to the horribly wrong old Telegraph article about Steve Jobs purportedly confirming that there was a kill-switch that would remove apps from iPhones. At least as of the time that was written, that was not true. The referenced "line of secret code" (hyperlink is broken), IIRC, was actually referring to a CoreLocation blacklist, not an application blacklist, with the intended usage being to be able to disable GPS functionality in certain regions if local governments demanded it, and that blacklist never actually ended up being used and was removed entirely in a future OS update.
- Karunamon 12y ago
  So wait, does Apple have or do they not have not the same kind of kill switch functionality (read: either remote uninstall, or cert revocation -> app no longer runs) that Google definitely has and has demonstrated on a few malware apps? Example: http://www.engadget.com/2011/03/06/google-flips-android-kill-switch-destroys-a-batch-of-malicious/ http://www.engadget.com/2011/03/06/google-flips-android-kill... This article makes direct reference to such a function: http://www.businessinsider.com/brazil-orders-apple-to-use-iphone-app-kill-switch-2014-8 http://www.businessinsider.com/brazil-orders-apple-to-use-ip...
  - eridius 12y ago
    Apple has never demonstrated such a capability, and has never confirmed it either. Pretty much everyone claiming they have it (including the linked Business Insider article) sources back to the same thing in 2008 which was the CoreLocation blacklist I referenced. To the best of my knowledge, in 2008, Apple had no way to remotely delete an app from a device. And I'm not aware of them ever gaining that ability. What Apple can do is remove an app from the store, preventing anyone from installing it. But as far as I'm aware no certificate revocation is checked after the app has been successfully installed.
    - Karunamon 12y ago
      So some further Googling. Steve Jobs himself, quoted in WSJ: (Google SB121842341491928977 to avoid the wall) Apple raised hackles in computer-privacy and security circles when an independent engineer (NB: the wrong one you were talking about) discovered code inside the iPhone that suggested iPhones routinely check an Apple Web site that could, in theory trigger the removal of the undesirable software from the devices. Mr. Jobs confirmed such a capability exists, but argued that Apple needs it in case it inadvertently allows a malicious program -- one that stole users' personal data, for example -- to be distributed to iPhones through the App Store. "Hopefully we never have to pull that lever, but we would be irresponsible not to have a lever like that to pull," he says. You don't get too much more clear than a quote from the then-CEO.
eridius 12y ago
I don't understand their position on DRM here. It makes no sense. The EFF is complaining that the DRM required by the App Store is onerous and puts restrictions on what users can do with their app, and says "we want them to be broadly available to others to use, adapt, and customize". But that's nonsense. If the EFF hands me a binary for an app, it hardly matters whether it's DRM'd or not as long as I can still run it. The extreme minority of people are capable of doing anything remotely interesting with a binary without access to source code. If the EFF wants people to be able to adapt and customize their app, all they have to do is release it under a permissive open-source license. In fact, if this really was a purely moral stance, they could have developed the application and released the source without ever publishing it to the App Store, thus allowing users to compile and use the application themselves. But they didn't do that. Instead, this seems to just be a flimsy excuse for the EFF to make a bunch of noise about Apple in order to drum up some PR.
- fpgeek 12y ago
  If the EFF didn't develop the application and release the source, what exactly is this: https://github.com/EFForg/actioncenter-mobile https://github.com/EFForg/actioncenter-mobile And quoting from the README: "Although it works on both iOS and Android, the app is only targeting Android as of today. If you need to deploy to iOS as well, please check out the Ionic docs or contact the project maintainer for help." What more do you want?
  - eridius 12y ago
    If that actually works on iOS then why didn't they talk about it in the article? It would have been much better PR for them to say that they have a functioning app and the source is available. My expectation from that README is that Ionic (which I've never heard of before) supports iOS but that the app itself has not actually been configured for or tested with iOS.
    - sinak 12y ago
      We did most of the development and testing, but didn't get it 100% production ready after we decided we wouldn't release the app. Since the main functionality of the app is the push notification service, having users compile their own apps wouldn't really be very helpful. Users need to subscribe to our push notification channel via APNS, and they can't do that if they're compiling themselves. We could have ignored that and built our own, less-than-realtime push service, but even still, having users compile their own apps means that our users have to pay the $99 and sign the developer agreements instead of us, and I don't think that's a very reasonable request. I think the best solution is for us to release on the Cydia marketplace, and I think it's pretty likely we'll do that.

243 points by sinak 12y ago

jewel 12y ago

Does anyone know if the Google Play Store agreement or the Amazon App Store agreement contain similar terms? I'd love to see Apple open things up a bit. My personal pet peeve is that it's nearly impossible to use LGPL libraries in iOS apps due to some of the terms.

glitcher 12y ago
I doubt this will actually motivate Apple to change in any way, but the EFF article also links to a petition: https://act.eff.org/action/apple-your-developer-agreement-tramples-on-free-speech-and-innovation https://act.eff.org/action/apple-your-developer-agreement-tr...
comex 12y ago
The Play Store agreement has a very similar clause which applies to all apps plus the store itself (haven't checked the Amazon one). The Android SDK agreement also has one, which may or may not be preempted by whatever parts of it are available under open source licenses (depending on your interpretation of "require"), but definitely applies to anything closed source (e.g. the new Java compilers, if I remember correctly). So basically the EFF is full of shit. > Security Features. You may not attempt to, nor assist, authorise or encourage others to circumvent, disable or defeat any of the security features or components, such as digital rights management software or encryption, that protect, obfuscate or otherwise restrict access to any Content or Google Play. - https://play.google.com/intl/en_us/about/play-terms.html https://play.google.com/intl/en_us/about/play-terms.html > 3.3 You may not use the SDK for any purpose not expressly permitted by this License Agreement. Except to the extent required by applicable third party licenses, you may not: (a) copy (except for backup purposes), modify, adapt, redistribute, decompile, reverse engineer, disassemble, or create derivative works of the SDK or any part of the SDK; ... - https://developer.android.com/sdk/terms.html https://developer.android.com/sdk/terms.html
- yincrash 12y ago
  It doesn't require that you put DRM in your app. The iOS one does (which is part of the build / submission process).
  - comex 12y ago
    I don't know enough about Android technically to tell whether this is true, but the blog post is complaining specifically about restrictions on reverse engineering the SDK. Another bullet point is about restrictions on jailbreaking; while this is certainly highly onerous and I don't think Google has an equivalent clause, it's worth noting that Google's ban on reverse engineering the Play Store and apps distributed by it (as opposed to the SDK itself) includes activities that, translated to Apple terms, are fairly important to jailbreaking. (In particular, many App Store apps refuse to run on jailbroken devices, and must be reverse engineered to identify how to bypass this check. I don't know what the situation is on Android, but I would be surprised if that clause wasn't rouinely ignored.)
    - MCRed 12y ago
      TLDR: Google is doing it too. Thank you for pointing it out.
    - yincrash 12y ago
      The main SDK is open source. It's built from the same tree as Android from the AOSP, and you can build it yourself right now, which makes reverse engineering it sort of moot. Things like billing APIs or maps or google's push notifications however are in closed binaries, which I believe is what the clause is protecting.
    - yincrash 12y ago
      Additionally, I know enough of the Android build process to know that yes, it is true that the Google Play Store does not require DRM. It's also easy to pull any app that doesn't have DRM off a phone and put it on a phone using the debug tool that google themselves release (ADB). `adb pull <app location>` plug in new phone `adb install <app file you just pulled.apk>`
on_and_off 12y ago
I read them quite some time ago (when I signed them) but I don't remember reading anything similar in the Play Store. Several of these terms don't even apply to Android (the platform is open so you can publish where you want and you don't have to use reverse engineering on an open source project). Also, I don't see why the EFF would have published their Android app if they thought the terms were unacceptable.
- jshevek 12y ago
  Exactly. EFF is making a well reasoned decision here that is consistent with their stated goals as an organization, and with the stances they take on other issues. Obviously, there are massive differences between Apple's policies and Google's policies, when taken as a whole. EFF might (speculation) see the Google Play store as a minor compromise of their values, while the apple app store is a MAJOR compromise. > Also, I don't see why the EFF would have published their Android app if they thought the terms were unacceptable. It seems that the dominant theory by the enraged applephiles is relates to some imaginary 'holy war' against their beloved, innocent apple.
dingaling 12y ago
The Amazon App Store rewraps your app with Amazon metrics and a DRM framework; even if you choose not to use DRM, the additional code is added and the app is re-signed using their keys ( with all the implications that entails ). The Amazon code is really invasive, I have been working on extricating a free app from it for some time and it is tedious work. There is an open Firefox bug about this: https://bugzilla.mozilla.org/show_bug.cgi?id=713777 https://bugzilla.mozilla.org/show_bug.cgi?id=713777 It also ensures that the app won't run on a device that doesn't have an active Amazon App Store account, even when you bought the app fair and square. If you're an open-source developer I'd suggest you stay well clear of Amazon.

deleted 12y ago

[deleted]

suyash 12y ago

Good job EFF exposing blanket agreement and requirements Apple makes developers sign. We need more of these come into lime light so developers can fight back against big corporations.

MCRed 12y ago
Nothing being exposed there, all those terms were well known, and when you cut thru the dishonest spin of the EFF, actually perfectly reasonable and designed to protect consumers.
- ferrari8608 12y ago
  Could you elaborate on the "dishonest spin" part? I've always been under the impression that the EFF were the ones trying to protect consumers, so you have me curious.
  - MCRed 12y ago
    Sure thing, I'll illustrate point by point. 1. Public Statements, reason for this is that many people have tried to publish various forms of malware, and then when apple rejected the app, they cried fowl and pretended like Apple was being unreasonable in its reviews. In fact, this is the PRIMARY reason that people think that Apple is strict in what it will let in the App Store. EFF is misrepresenting what the agreement says here, putting spin on it. Revers Engineering-- The claim that this covers legal reverse engineering is created from whole cloth by the EFF, the section does not refer to types of reverse engineering, merely protects apples rights regarding such. Thus EFF is straight up lying. App Store Only: Apple provides the SDK for free, and part of the deal is that it is to be used for deploying apps for iOS on the app store only. (This is not the case with the Mac SDK) Charactersizing Lydia as a "competing app store" is straight up dishonest. IT requires jailbreaking devices, which results in greatly reduced reliability and is bad for consumers, opening them up to malware, yet the EFF is effectively endorsing exposing consumers to malware here. "No Tinkering" - Obviously, Apple doesn't want people circumventing their protections against malware and getting malware past the review process. "Apple owns security" -- A profoundly dishonest comment given that Apple has done so much to protect security that a governor is trying to get a law passed that will let the government snoop again. The EFF apparently doesn't care about his, but uses the fact that you can't use a security bug claim to circumnavigate the review process to pretend like Apple leaves people exposed. Another straight up lie. Kill your App-- yes, if malware gets in there, it can be shut down. Ignoring the reasoning for this puts a hard, dishonest spin, in fact as far as I'm concerned, makes it a lie. This is also true of google's store. So, given that the EFF is publishing on android, they obviously don't care about this too much... yet they put it in here to bash Apple, making them both hypocrites and liars. " and we certainly will not wrap our app in DRM." DRM that signs the app to prevent it from being tampered with, which keeps the users data secure. So the EFF here is rejecting keeping users data secure. They care more about grandstanding than integrity and protecting consumers.

saganus 12y ago

0 downloads. I guess I'll have to be the first. Edit: Now that I think about it, it said 1-5 installs, so most likely not the first.

libraryatnight 12y ago
Looks like I'm number 2 :) It seems a very simple app indeed, but useful.

pseudometa 12y ago

This comes across as though they never intended to make an app for the app store and all along just wanted to call out apple on their term sheet. It is purely a moral stance. Which is fine, but the article is slanted differently.

serf 12y ago
Today we launched a new app that will make it easier for people to take action on digital rights issues using their phone. The app allows folks to connect to our action center quickly and easily, using a variety of mobile devices. yeah, maybe they made the android app just so they could bitch about iOS.
- frandroid 12y ago
  That's an expensive form of bitching... When they could just publish the same press release without having to develop an app for other platforms, for free!
  - Natsu 12y ago
    Based on the note he's replying to, I believe his statement was sarcastic.
- MCRed 12y ago
  Its really getting to the point that no matter how many consumers rights Google violates and no matter how many consumers Apple protects, the adherents to this holy war against Apple will never admit things are not as black and white as they insist on portraying.
  - MCRed 12y ago
    And of course this is hacker news. The hordes of android fans down vote me with no comment, no argument, because it isn't about the facts of reality, it's about ideology and hatred. So, this is a site where, if you don't kowtow to the prominent ideology you get buried. That reflects more on you than those of us who are making counter arguments.

thought_alarm 12y ago

EFF have a lot of time on their hands, apparently.

newaccountfool 12y ago
Surely this is exactly the kind of thing the EFF should be doing?
- notatoad 12y ago
  making apps that send notifications over proprietary push-notification channels instead of supporting open, accessible, cross-plaform communication channels like email? nah, that wasn't what i donated to the EFF for.
  - yincrash 12y ago
    They made their own push notification server with an Affero GPL license (which means even server operators have to release source that they change), and as such I would not consider proprietary. Email is not a push channel in either IMAP or POP3.
    - Nullabillity 12y ago
      SMTP is push, POP/IMAP are receiver implementation details.
      - yincrash 12y ago
        The parent of my post was arguing against a "proprietary push implementation" in favor of email, but my argument is that the receiving of email is not via push.
- MCRed 12y ago
  No, the EFF Should not be writing articles full of lies attacking the company that has consistently defended consumer rights and supporting the company that has consistently violated them.

sinak 12y ago

For any other non-profits or companies who might need a similar app to notify users, both the app (Cordova + Ionic) and the APNS/GCM push notification server are open source and available here: https://github.com/EFForg/pushserver https://github.com/EFForg/pushserver https://github.com/EFForg/actioncenter-mobile https://github.com/EFForg/actioncenter-mobile If you're an Android user, consider downloading the app. Its really, really simple - it just sends you a push notification if there's an action EFF needs your help with - but we hope to improve it over time. https://play.google.com/store/apps/details?id=org.eff.actioncenter https://play.google.com/store/apps/details?id=org.eff.action...

dublinben 12y ago
Can this be installed without the Play Store?
- sinak 12y ago
  My understanding is that you need to have the Play Store on your device for apps to register and receive push notifications from GCM [1]. Since that's the main functionality of the app at the moment, an APK for sideloading won't be too useful, but perhaps we can add one once we add more functionality? [1] Would love to be wrong about this if anyone else knows differently.
  - rentnorove 12y ago
    Unfortunately that looks to be the case. I had hoped they'd rolled their own push server implementation in the linked source (https://github.com/EFForg/pushserver https://github.com/EFForg/pushserver), but it's just a wrapper around the GCM and APNS services. It's disappointing, because both Android and iOS have support for periodically retrieving data without using the proprietary push services. It's not like the EFF is going to be delivering messages that have a 'real-time' requirement and therefore require a persistent connection (as opposed to say, Gmail/Hangouts).
jerleth 12y ago
Honestly, the play store is not any better than the apple app store. I myself never agreed to the play store's license agreement and use my android phone without it. If you really care about privacy, consider hosting your apps apk yourself or post it to a store that really respects its users privacy, like f-droid instead of supporting the play store. If your app is opensource like you state, f-droid should host it. Take care, Martin

higherpurpose 12y ago

> Ban on Reverse Engineering: Section 2.6 prohibits any reverse engineering (including the kinds of reverse engineering for interoperability that courts have recognized as a fair use under copyright law), as well as anything that would "enable others" to reverse engineer, the software development kit (SDK) or iPhone OS. Wow. EFF should sue Apple over that alone. Private companies aren't supposed to "contract-out" your rights. This will be an easy win for EFF.

MCRed 12y ago
The case would be thrown out because the provision says nothing of the kind, and in fact, this statement here by the EFF is defamation and when Apple countersued they'd win. Apple doesn't respond to critics like this, so the EFF knows it can get away with these kinds of lies. It's just unfortunate that you and others believe them, and those who point them out are silenced here on HN.
- zerocrates 12y ago
  Well, the agreement does say You may not and You agree not to, or to enable others to, copy (except as expressly permitted under this Agreement), decompile, reverse engineer, disassemble, attempt to derive the source code of, modify, decrypt, or create derivative works of the Apple Software or any services provided by the Apple Software or otherwise provided hereunder, or any part thereof (except as and only to the extent any foregoing restriction is prohibited by applicable law or to the extent as may be permitted by licensing terms governing use of open-sourced components or sample code included with the Apple Software). EFF is definitely oversimplifying and spinning a little, but that's certainly a restriction on reverse engineering "of the kind" that they describe in their post. Spin or not, it's hardly a baldfaced "lie." (That said, you're right to respond that EFF couldn't sue over that provision - people contract away their rights to do things they otherwise could all the time.)
- Natsu 12y ago
  I do not think the EFF can (or would) sue them over the developer agreement in the manner described by the grandparent post. I found that statement hyperbolic, though I do wish that people would stop writing overly burdensome contracts full of CYA provisions. That aside, your statements about defamation are just as bogus. Opinions regarding specific, disclosed facts are protected. There's something called the Milkovich standard, which you can read more about here: http://www.rcfp.org/browse-media-law-resources/news-media-law/news-media-and-law-summer-2011/opinion-defense-remains-str http://www.rcfp.org/browse-media-law-resources/news-media-la... Given that the Apple developer agreement is public and the article I read makes that agreement the sole basis of its opinion without implying that they know more than they've told us, your statements about it being "defamation" are not accurate. They cited specific provisions in the agreement which they disagree with as the basis of their opinion and the article was explicit about this. You're entitled to that as an opinion, of course. It's an incorrect opinion that mischaracterizes the defamation laws the EFF is subject to here, but you're entitled to hold if you wish. This is why nobody should trust any legal discussion they found online (including mine) and instead hire a lawyer who can give them competent legal advice (and who has legal malpractice insurance in the event their advice is less than competent) when dealing with anything more than academic pursuits.

jasonjei 12y ago

I think it would be really effective and tongue-in-cheek if EFF released their app on Cydia.

WhitneyLand 12y ago

The EFF dev said its a Cordova app, so why not just throw up the HTML mobile site for iOS users? You could still notify via sms, email, etc.

MCRed 12y ago
Because they care more about making propaganda, apparently.
windsurfer 12y ago
You can see the site here: https://github.com/EFForg/actioncenter-mobile/tree/master/www https://github.com/EFForg/actioncenter-mobile/tree/master/ww... Since the app is basically only for notifications, it's useless as a web site. If you want sign up for email notifications, go to https://act.eff.org/ https://act.eff.org/
driverdan 12y ago
I understand and agree with the EFF's position and why they'd want another method of outreach but you're right, this really doesn't require an app. SMS and email are perfectly fine methods to distribute this type of alert.

shmerl 12y ago

They can use Cydia I guess. But this may be more an attempt to simply bring attention to how sickening Apple's developer agreement is. Which is a good thing to do anyway.

jshevek 12y ago
I'd rather see them not use Cydia. While I'm glad that Cydia exists, for those individuals who love iOS and i-things but wish to step outside of apple's total control, it seems less professional to me to release an app whose usage specifically requires 100% of the users to violate the agreements they made with the manufacturer.
- shmerl 12y ago
  Not if that agreement is taking away their rights. Violating such agreement (or assuming users violated it) shouldn't be viewed as unprofessional. Not any more unprofessional at least than expecting Applet to violate users' rights when Apple make such agreement.

dmishe 12y ago

I don't understand the purpose of the app, the one on play store looks like a one button subscription frontend. How is it better then their website, email, twitter?

MBCook 12y ago
They can release a press release to complain about Apple policies and get hits/donations?

csense 12y ago

I've never understood why either users or developers put up with all of Apple's crap.

jshevek 12y ago
It really is worth careful and thorough study. Apple has mastered 'marketing' on such a deep level.
k-mcgrady 12y ago
Because it works. I have never wanted to do anything on my iPhone that I can't and as a developer I've only had one rejection that annoyed me and in hindsight I understand the rejection. I've also used Android devices a lot (I own two, and develop for the platform) and I hate it. Really hate it. Waiting for OS updates, lots of crashing, things in different places depending on the OEM. Not to mention how slow some devices are. The S3 Mini is horrible to use, I don't see how anyone could feel comfortable putting it to market. In short, the crap either doesn't effect most people, or creates a better experience. The only people who seem to really complain about it don't use the platform anyway.

gnu8 12y ago

Apple needs to remove each of these requirements. None of them serve any justifiable purpose, they only immorally and antisocially serve Apple's avarice.

parrots 12y ago

People are still complaining about section 8 - the remote kill switch? I remember only one instance of an app remotely killed, and that was malware. Even apps that enabled tethering, emulating, or are otherwise against the rules but make it through review have been simply pulled for sale, never terminated using this capability. I think Apple has proved they're using this responsibly after 6 years.

chii 12y ago
i dont really care that they've been using it responsibly so far - there isn't a guarantee that abuse won't happen.

eridius 12y ago

> Kill Your App Any Time I'm rather shocked to see the EFF linking to the horribly wrong old Telegraph article about Steve Jobs purportedly confirming that there was a kill-switch that would remove apps from iPhones. At least as of the time that was written, that was not true. The referenced "line of secret code" (hyperlink is broken), IIRC, was actually referring to a CoreLocation blacklist, not an application blacklist, with the intended usage being to be able to disable GPS functionality in certain regions if local governments demanded it, and that blacklist never actually ended up being used and was removed entirely in a future OS update.

Karunamon 12y ago
So wait, does Apple have or do they not have not the same kind of kill switch functionality (read: either remote uninstall, or cert revocation -> app no longer runs) that Google definitely has and has demonstrated on a few malware apps? Example: http://www.engadget.com/2011/03/06/google-flips-android-kill-switch-destroys-a-batch-of-malicious/ http://www.engadget.com/2011/03/06/google-flips-android-kill... This article makes direct reference to such a function: http://www.businessinsider.com/brazil-orders-apple-to-use-iphone-app-kill-switch-2014-8 http://www.businessinsider.com/brazil-orders-apple-to-use-ip...
- eridius 12y ago
  Apple has never demonstrated such a capability, and has never confirmed it either. Pretty much everyone claiming they have it (including the linked Business Insider article) sources back to the same thing in 2008 which was the CoreLocation blacklist I referenced. To the best of my knowledge, in 2008, Apple had no way to remotely delete an app from a device. And I'm not aware of them ever gaining that ability. What Apple can do is remove an app from the store, preventing anyone from installing it. But as far as I'm aware no certificate revocation is checked after the app has been successfully installed.
  - Karunamon 12y ago
    So some further Googling. Steve Jobs himself, quoted in WSJ: (Google SB121842341491928977 to avoid the wall) Apple raised hackles in computer-privacy and security circles when an independent engineer (NB: the wrong one you were talking about) discovered code inside the iPhone that suggested iPhones routinely check an Apple Web site that could, in theory trigger the removal of the undesirable software from the devices. Mr. Jobs confirmed such a capability exists, but argued that Apple needs it in case it inadvertently allows a malicious program -- one that stole users' personal data, for example -- to be distributed to iPhones through the App Store. "Hopefully we never have to pull that lever, but we would be irresponsible not to have a lever like that to pull," he says. You don't get too much more clear than a quote from the then-CEO.

eridius 12y ago

I don't understand their position on DRM here. It makes no sense. The EFF is complaining that the DRM required by the App Store is onerous and puts restrictions on what users can do with their app, and says "we want them to be broadly available to others to use, adapt, and customize". But that's nonsense. If the EFF hands me a binary for an app, it hardly matters whether it's DRM'd or not as long as I can still run it. The extreme minority of people are capable of doing anything remotely interesting with a binary without access to source code. If the EFF wants people to be able to adapt and customize their app, all they have to do is release it under a permissive open-source license. In fact, if this really was a purely moral stance, they could have developed the application and released the source without ever publishing it to the App Store, thus allowing users to compile and use the application themselves. But they didn't do that. Instead, this seems to just be a flimsy excuse for the EFF to make a bunch of noise about Apple in order to drum up some PR.

fpgeek 12y ago
If the EFF didn't develop the application and release the source, what exactly is this: https://github.com/EFForg/actioncenter-mobile https://github.com/EFForg/actioncenter-mobile And quoting from the README: "Although it works on both iOS and Android, the app is only targeting Android as of today. If you need to deploy to iOS as well, please check out the Ionic docs or contact the project maintainer for help." What more do you want?
- eridius 12y ago
  If that actually works on iOS then why didn't they talk about it in the article? It would have been much better PR for them to say that they have a functioning app and the source is available. My expectation from that README is that Ionic (which I've never heard of before) supports iOS but that the app itself has not actually been configured for or tested with iOS.
  - sinak 12y ago
    We did most of the development and testing, but didn't get it 100% production ready after we decided we wouldn't release the app. Since the main functionality of the app is the push notification service, having users compile their own apps wouldn't really be very helpful. Users need to subscribe to our push notification channel via APNS, and they can't do that if they're compiling themselves. We could have ignored that and built our own, less-than-realtime push service, but even still, having users compile their own apps means that our users have to pay the $99 and sign the developer agreements instead of us, and I don't think that's a very reasonable request. I think the best solution is for us to release on the Cydia marketplace, and I think it's pretty likely we'll do that.