Requiring permissions from users to access data is good, and an actually well curated app store is just as useful.

That doesn't mean that it shouldn't be possible to install through different avenues as well (still requiring the users permission).

Yes you would get a lot of shitty software if you started installing everything you stumble upon, but the apple store quality would probably increased significantly, because they could deny significantly more apps, as they'd have an alternative approach to get to users that really want it

I think you misunderstood me there. Of course permission systems are going to stay, who in their right mind would give up this crucial innovation?

But free-as-in-freedom implies that I, the owner and user, can do whatever I want, including triggering all sorts of footguns – if I get tricked into installing CriminalBankrobberApp and giving it all sorts of permissions because I believe it legitimately needs those and won't abuse them, it's game over. A non-free iOS can simply make this impossible or so inconvenient that I'll never bother – an app that actively attacks banking apps on my device wouldn't even get on the App Store I guess – but I don't think a free-as-in-freedom iOS could possibly keep that sort of tight control, not with a 30%-of-revenue economic incentive for everyone else to normalize arbitrary distribution channels.

> That doesn't mean that it shouldn't be possible to install through different avenues as well (still requiring the users permission).

How does the user know what avenues are safe and what aren't? Isn't this just a rehash of downloading software from arbitrary websites, just with lots of app stores instead?

> but the apple store quality would probably increased significantly, because they could deny significantly more apps

And lots and lots of others, big names too, would decide to forgo the App Store entirely (even assuming some loss of visibility, those are some really easily-earned (30-x)% in revenue!), so you'd end up with an Epic store and a Steam store and a EA store and a Facebook store and an app store for each media outlet (NYT Recipes now at the NYT App Store!) and possibly for each bank and national app stores and regional app stores and a CoolBeansAppStore with neat UI tweaks and skins and a SuperDuperAppStore with all sorts of small indy apps and a SuperSecureAppStore that distributes copies of other apps with added tracking and tons of Indydev Inc App Stores, and FreeXXXAppStore that has some well-known copyright-agnostic porn apps and absolutely no rules at all and all kinds of malware and scams... pretty much like the internet back then, but with much leakier sandboxes, because there are lots of things apps must be able to do if allowed to that websites pretty much never need(ed?) to do ...

And good luck with crafting a permission system that makes all of this really transparent and clear and actionable and still isn't a huge hassle that everyone just clicks through and works even for disinterested, impatient laypeople ... That's reducing the depth of security to pretty much this single thing that people hate in its current form already.

I mean, really, I am sometimes struggling to tell what's safe and what isn't on the web, and I should tell, I'm building some of the stuff that's on the web – how is someone who's busy being a lawyer, or is elderly and kinda struggling with the latest generation of gadgets, or a stressed-out parent with zero time for ITSec studies on top, or 15 years old, etc. pp. supposed to make that call that in a similarly confusing environment, on similarly bad data – possibly worse data.

The only reason this works on Android so far is probably that the UX of using other stores or sideloading is so bad; some have tried to establish their own, but churn is just too brutal for next to everyone.

I'm not saying free and open mobile platforms cannot be done, or that there's absolutely no way to open up iOS without wreaking havoc, and I'm definitely not saying that wouldn't be really worthwhile, because I think it would be absolutely fantastic to have an open and free mobile platform – but I believe that's going to be much, much more difficult than just throwing out all the restrictions and calling it a day, because we've been there in the early internet and security-wise it was an absolute nightmare.

Do you think that people are incapable of using personal computers then? Just the regular old PC.

This argument falls flat on its face, because it is blatantly obvious, that, for some reason, people are capable of using PCs, and don't explode from the confusion of doing so.

Every single argument that you are making, could apply to the PC. But people still do alright using PCs. Phones should not be any different.

> good luck with crafting a permission system

How are they doing that on the PC? PCs work fine.

> how is someone who's busy being a lawyer

Thats an interesting question. Which has an answer. How does a lawyer use a PC, right now? So thats how they'll do it.

> pretty much like the internet back then

Why do we have to talk about the internet from a long time ago? Just talk about the current internet. Which people use. On the PC. Right now.

> t there's absolutely no way to open up iOS without wreaking havoc

Just do it the same way that PCs currently work. Right now. Because PCs work, right now, and society is not falling apart.

> because we've been there in the early internet and security-wise it was an absolute nightmare.

We don't need to talk about the early internet. Just make the iPhone the same as modern day PCs. Which people are already capable of using just fine.

> Just make the iPhone the same as modern day PCs. Which people are already capable of using just fine.

Ransomware attacks are absolutely rampant, though you'll never hear about the vast majority of incidents of course, and pretty much all of those start with someone running thingycorp_salaries_full_list.xlsx.exe, enabling macros for a fishy .docx, opening an infected .pdf, downloading and running infected installers, plugging in random USB keys, and so on. Then there's lots and lots of phishing attacks going on, and that's with most companies already clamping down on attack vectors really hard — if people used private PCs as much as they use their private smartphones, for sensitive things like banking, without an IT department to shield them from the worst of it, I guess consumer Windows would get a lot more locked down really quickly.

> people are capable of using PCs, and don't explode from the confusion of doing so.

People may not explode from confusion, but if they had a better idea of how complex IT security has become, they might at least feel somewhat uneasy. Even people in IT roles screw up and get pwned, or build systems in a way that lets them get pwned easily, all the time really. Bad actors have become pretty sophisticated over the last decade as well, and Covid-19 is only making things worse as lots of unsavory individuals with money and resources find that real-world crime doesn't quite deliver the returns it used to, and everyone and their mother now conduct large parts of their lives through their smartphone and move lots of money through those devices. Personally, I've definitely noticed both attack volume and sophistication going up few notches already.

> How does a lawyer use a PC, right now? So thats how they'll do it.

The vast majoriy will depend on IT people to keep them safe, and their devices will be quite thoroughly locked down, and their email pretty aggressively filtered. Incidents definitely still happen, though. Same with medicine.

I really don't think it's a stretch to imagine people getting socially engineered en masse to install shady apps in a world where each app store and each app requires an entirely new security assessment on little to no data by end users, or apps getting compromised and not get pulled, or whatever. It's possible to solve that quandary, but it's not going to be as easy as just throwing out all restrictions without devising some other mechanism to take their place in protecting users.

> Because PCs work, right now, and society is not falling apart.

Society isn't falling apart from lots and lots of issues I'd consider quite severe. I'd rather not let anything get to that point if it can be prevented.

They use PCs right now. As of this moment. They are using PCs, just fine.

It is the existing status quo that everyone is using PCs already.

> I'd rather not let anything get to that point if it can be prevented.

There is not "getting" anywhere. We are already here. We are already living in a world where lots and lots of people use the PC.

Thats what you don't understand. This is the status quo. There are no changes. People already use PCs, right now.

> as easy as just throwing out all restrictions

There is no throwing anything out, because people already are using PCs, right now. Lots of people use them.

You keep phasing this as a "change" when it is not. People using PCs is the status quo.

They're not. They're doing this for maximizing the companie's profit. Which they absolutely don't need to (it's not like if apple was struggling financially, or trying to find an subtle business model that works).

I thought I'd made a pretty strong case to not trust Apple's PR in my first paragraph. To clarify, no, I don't think that is the case, and people should be very miserly with their trust towards orgs like Apple in general.

The thing is, no matter their rationale, their product decisions have far-reaching real-world consequences. This particular decision has obvious real-world consequences to protesters in Belarus, and it is a disgusting decision, and definitely makes for a strong argument against leaving them with that much control.

On the other hand, however, their security stance works really, really well, as far as I can tell, and it keeps their users quite safe from lots of harm, and that's something I keep giving them money for, because I value security highly.

Forcing their walled garden free-as-in-freedom wide open will amend #1, but what about #2? Literally hundreds of millions of iPhone users around the world depend on the ecosystem being safe – my mom has an iPhone mostly because they keep their walled garden clean, so she doesn't have to get a CS degree to do that herself, and also because it's a very nice product that she enjoys a lot, but I'd advise her very strongly to get something else if Apple's security was shoddy. As I've argued, I have very strong doubts that this could be done without breaking much of what makes iPhones so secure.

I'm definitely not arguing that this makes Apple's ability and growing propensity to abuse their power a great thing – I think it's absolutely creepy in a deeply dystopian way – but right now the only way to build such a safe environment that I know of relies on strict centralized control, and having such an environment is one of the prime things that make this technology manageable for everyone and their mother.

If someone comes up with a free-as-in-freedom smartphone that's secure, easy to use, has the necessary polish and all the important apps and isn't laser-focused on people who live inside emacs, I'll be happy to part with a bunch of money for that.

How? And why? Most people won't care. I think disallowing Telegram to operate freely will wipe out Apple's iOS products in countries where real freedom of speech matters.