I spoke with a former Apple dev on this topic once. He says that you can opt out of code signing and the App Store on Mac because that's a professional OS, but for iOS the security rationale for not allowing that is that it's geared for less tech-savvy users. Paraphrasing: "If there is a way to opt out, malicious apps and sites will con users into doing it to get malware on the phone."

I can't totally disagree. To have a completely secure device you have to lock out the user since the user is often the least secure component of the system.

I am sympathetic to the Dancing Bunnies Problem [1]. However, when I weigh the societal harm of (A) preventing people who are very dedicated to shooting themselves in the foot from shooting themselves in the foot, versus (B) protesters being unable to share and access important safety information, the choice is clear.

[1] https://blog.codinghorror.com/the-dancing-bunnies-problem/

Personally I think the real problem is that the OS is fundamentally broken. All current OSes are fundamentally broken from a security point of view because they all pre-date the era when security was such a concern and are designed to run only de-facto trusted code. All the security we have including all iOS's security is a bolt-on afterthought.

A modern security and privacy conscious OS would be "principle of least privilege" from the ground up. It would be written into the DNA of the kernel and OS from the first line of code, not bolted on later via permission managers and leaky APIs and then mandatory notarization by a central authority to work around the fact that the whole mess is still insecure.

We do have something like that. It's called a web browser. A browser is a small VM that runs utterly untrusted code relatively safely. In many cases it's code from the sketchiest ad networks and other hellholes imaginable.

Imagine if your real OS were like that. Install anything even known malware with fairly strong confidence that you're safe and that it can't do anything you don't explicitly grant to it.

Modern OSes are designed to prevent users from attacking other users (or the system) with malicious code. They are not designed to protect the user from malicious code they themselves install.

> We do have something like that. It's called a web browser. A browser is a small VM that runs utterly untrusted code relatively safely. In many cases it's code from the sketchiest ad networks and other hellholes imaginable.

Given how many issues there are with ad tracking, fingerprinting, and other privacy related issues, I don't feel the web browser is particularly safer than an iOS app. What can an iOS app really do that a browser app cannot at this point?

This is what Android attempts to provide and it is hard.

This is what happens when you try to do that - you pop up so many prompts that everyone just clicks "Allow" out of frustration anyways, which defeats the purpose.

https://tyler.io/macos-10-15-vista/

https://tyler.io/broken/

The UI for it may be the toughest unsolved problem. Something must be done to simplify and group concepts. You can't just give the user a barrage of micro-permission dialogs.

That dev is completely and utterly wrong.

>He says that you can opt out of code signing and the App Store on Mac because that's a professional OS

And this is why he's wrong: it's NOT a "professional OS". My sister has a Macbook Air, running MacOS. She's not a professional (computer user). Mac computers aren't just for "professionals" (esp. software devs), they're sold to anyone who wants something with a bigger screen than a mobile phone or tablet, and wants a keyboard to type on and wants to be able to have a normal filesystem to work with. In short, anyone who still wants to be able to use a normal PC.

She uses her Mac for typing documents (she likes to write), watching movies, etc. She is absolutely NOT what I consider a "tech-savvy user". So why does she "need" to be able to opt out of code signing and the App Store?

So, no, he's completely wrong. If Apple only sold their computers to software devs, he'd have a good argument, but they don't, so he doesn't.

So where's the "professional" phone OS? It seems to me that if you want to stay in the Apple ecosystem you're stuck with iOS whether you know what you're doing or not.

Apple still provides a means for "professionals" to sign and run their own code on iOS devices, it just requires jumping through a few hoops. Pay a one-time $100 fee and you don't have to deal with re-signing your app every seven days. This is enough of a barrier to entry that I think it solves the "dancing bunnies" problem without making it impossible to run what I want. I do fully understand why some people think that this is still too extreme.

My two real beefs with this arrangement are the requirement of a Mac, and the potential use of the App Store curation to block apps for political reasons, as is happening with HKmap.live.

> Pay a one-time $100 fee and you don't have to deal with re-signing your app every seven days.

Fwiw, it’s not one-time. It’s $100 every single year.