> I thought they were distributing the source for you to compile yourself.

This is what they should have done. Instead, they chose to distribute a binary of their proprietary (patent pending [0]), closed source [1] product.

Not only am I not surprised that Apple shut them down the very next day, but I'm also having trouble feeling any sympathy for their cause.

[0] https://justgetflux.com/ - bottom of page

[1] https://justgetflux.com/news/pages/eula/

Developers distributed binaries before app stores. They could publish a hash for their binary, on an HTTPS web page.

True, but I can understand Apple's position.

Commercial software is unlikely to be a trojan. You have much higher value as a paying customer than as a victim.

Open source software is similarly unlikely to be a trojan, especially if compiled from source.

Closed-source freeware is the perfect attack vector. Opaque and widely disseminated. Who knows what's going on inside? Freeware is responsible for a gigantic amount of malware.

If the source of the freeware is authenticated by HTTPS, users can make their own informed decisions, e.g. to enter a risk pool with millions of other users whose health has been improved, courtesy of a known developer with no track record of shipping malware.

There are no zero-risk activities, only risk signals. Some people choose to trust a corporation with lawyers and endless pages of EULA, some people choose to trust one authenticated developer with a proven track record of service to the community. At the moment, we are still free to make our own informed choices.

I am talking about closed-source freeware only. f.lux is closed source. Nobody can verify whether it does what it says. Apple clearly does not want to set a precedent.

Open source is fine. If f.lux published the source code, then we could compile it ourselves, and Apple would be happy (they recently made the iOS Dev Program free of charge to allow sideloading in this manner.)

Millions of people have used f.lux on other platforms. Hundreds of hours of real-world testing per user, multiplied by millions of users, leads to expectations about the behavior of f.lux on iOS. This is also known as reputation, credibility and brand recognition. For those who need what f.lux offers, this empirical data means more than Apple's walled garden theories and non-liablity EULAs.

There is a gigantic amount of closed-source freeware available on the App Store. Literally hundreds of thousands of apps. Roughly zero of which have had any security scrutiny. Apple's review process only checks user-visible behavior. (Edit: and a quick check for private API use, which is not user-visible, but nor is it relevant to security.)

If iOS's app sandbox is inadequate, then those are all threats too, but Apple doesn't seem to mind them. If the sandbox is adequate, then apps like f.lux are safe even if intended to be malicious.

Apple's position is only really understandable if they don't understand their own technology. Which considering who is probably making these decisions could very well be true.

> This is what they should have done. Instead, they chose to distribute a binary of their proprietary (with patent claim [0]), closed source product.

Apple does the same with their own products.

"the same" what?

sending binaries you have to sign yourself.. I doubt that somewhat, they'll be signed by Apple.

For FOSS they use: http://www.opensource.apple.com

Well, they would sign the binaries themselves if that worked... but you need to sign it yourself to get an iOS device to let you install it.

How is that relevant?

> patent claim

Not seeing anything about patents at that link.

Wikipedia says [1]: "License: Proprietary, with free download. (with patent claim)"

[1] https://en.wikipedia.org/wiki/F.lux

O...k? The linked page doesn't mention patents, Wikipedia doesn't identify what patent, and Wikipedia isn't exactly authoritative anyway.

And also, what in the world does "Proprietary, with free download. (with patent claim)" mean??

Proprietary means not open-standard/open-source.

I remember this coming up on tech news sites a few years ago when I discovered f.lux... this article also makes mention of the patent-pending nature of the software: http://readwrite.com/2013/09/23/flux-a-hack-for-your-devices...

Go to justgetflux.com and CTRL+F for the word "patent".

That makes zero sense. Millions of people have installed f.lux binaries on more sane platforms without problems.