10%? I think FOSS developers would be extremely happy if even 1% clicked on that kind of button. I reckon the actual stat is closer to 0.01%...
This is absolute scroogerism from our mobile overlords. We badly need a really-open alternative to the Google/Apple world of feudal taxes.
F-Droid is a thing
When they change that optional setting they introduced recently which blocks sideloading applications outside of the official store and make it non-optional, what are we going to do? Use special Chinese Android builds with Ali store (or whatever it's called)?
Boiling the frog slowly and all.
What setting was introduced recently? I remember such settings all the way back to the Nexus One.
In fact, things were more closed back then as Android phones bought from AT&T had it hard coded to disable third party apps. I'm not aware of a US carrier doing that any more.
And then, of course, applications like your banking won't work, because they require Google SafetyNet attestation for your security.
All my phones are rooted and it has never been an issue with any banking app I use. It's all about priorities. For some people, that's going to be the roman numeral name suffix dropdown in the registration form. For me it's the bank not telling me what I can do with my devices.
Because it is pushed centrally, banks do not have a choice. Hence, you as a customer, won't have a choice either, unless you consider not using the bank online at all as a choice.
Banks are forcing you to run proprietary software on proprietary operating systems with draconian "security measures" that would make the latest DRM-enforcing-rootkit look like a children toy. They check whether your device is rooted, whether it has any non-Google-approved programs installed, whether Google Play notifications work, etc. And if you fail any of these checks, good luck using your credit card!
Open-source operating systems are basically dead in the water at this point, since failing to run these proprietary programs is not going to be a minor "I can't play this game" level- nuisance, but rather a life critical issue. And so far more and more banks keep enforcing these measures.
And for some reason there is no big outcry about this.
Even Korea's "all banks require ActiveX" situation was very mild compared to where we're going...
Encrypted push notifications are much better.
PSD2 lets you do basically whatever you want. Fingerprint is enough, or confirm in phone app if making a transfer from a desktop banking UI.
U2F would be nice but with banks being banks that's not going to happen this decade.
Why? Because even with "Google" phones, installing pure AOSP cripples the phone (and by that mean SMS breaks with LTE, you lose voLTE, Wi-Fi calling, etc.) A lot of Android ROMS have to scrape official images to get the binary bits (and it is nor a fun needle in a haystack excerise) to get basically phone functionality in Android.
This kind of response completely ignores the fact that the vast majority of the drivers required to just run on modern hardware are closed source and that the vast majority of phones these days have their bootloaders locked.
I don't know if that is actually still true. Back in the day nearly every phone in the US was bootloader and carrier locked. Now basically every phone is carrier unlocked and anything besides Samsung can have the bootloader unlocked very easily. I guess Samsung phones are the most common but there are certainly many other options that are more open.
Many manufactures make it easy to unlock and root your device (shout-out oneplus), but many others do try to make you brick it if you try doing anything out of the ordinary. Like the HMD rebrands Nokia, Sharp, etc.
Here in europe, you go to developer mode, check the OEM unlock button, reboot and hold some weird button combination while booting, phone asks you again if you want to unlock the bootloader, does a factory reset for security reasons, another reboot, and it's unlocked.
Regular Android works great in GrapheneOS/CalyxOS/other AOSP variants.
Otherwise: send complaints to [email protected] (jk, there's no actual support)
The rejection is wrong, because the App Store review guidelines clearly spell out that apps may request donations through Safari. On the other hand, apps cannot use in-app purchases to request donations, unless they are published by an approved nonprofit.
3.2.2 Unacceptable
(iv) Unless you are an approved nonprofit or otherwise permitted under Section 3.2.1 (vi) above, collecting funds within the app for charities and fundraisers. Apps that seek to raise money for such causes must be free on the App Store and may only collect funds outside of the app, such as via Safari or SMS.
Collecting funds "within the app" means that the payment flow is completed without leaving the app. They explicitly list two ways for any app to accept donations, by redirecting the user to an external web service opened in Safari, or by collecting payments using a text message.
You obviously have to somehow communicate to the user that donations can be made, and that is allowed to happen by showing an external link.
Which e.g. "[email protected]" is not, clearly.
The words you are missing are important.
One of the reasons why I do not gift money to WireGuard developer(s) is that they have taken the steps to obscure where and to whom the money is going, which is in and of itself fishy. Just labelling something as 'donation' does not make it so.
[Edit: line breaks]
If Jason is recommending a way to donate to the project, who cares where it goes? If he puts it straight in his pocket and uses it to buy pizza or a computer game, it's still serving its purpose as far as I'm concerned. I have donated, and will do so again, and I'm perfectly happy with the money being used that way.
In a sense, for me, it's a thank you for the work thus far, not an payment for more work.
I imagine many see this differently, so I'm interested to hear some other opinions.
> One of the reasons why I do not gift money to WireGuard developer(s) is that they have taken the steps to obscure where and to whom the money is going, which is in and of itself fishy. Just labelling something as 'donation' does not make it so.
Your remark about WireGuard developers being fishy and obscuring where the money goes is ridiculous, and the way you framed it, just... wow.
3.2 Other Business Model Issues [list is not exhaustive] 3.2.1 Acceptable (vi) Approved nonprofits may fundraise directly within their own apps or third-party apps, provided those fundraising campaigns adhere to all App Review Guidelines and offer Apple Pay support. These apps must disclose how the funds will be used, abide by all required local and federal laws, and ensure appropriate tax receipts are available to donors. Additional information shall be provided to App Review upon request. Nonprofit platforms that connect donors to other nonprofits must ensure that every nonprofit listed in the app has also gone through the nonprofit approval process. Learn more about becoming an approved nonprofit.
3.2.2 Unacceptable (iv) Unless you are an approved nonprofit or otherwise permitted under Section 3.2.1 (vi) above, collecting funds within the app for charities and fundraisers. Apps that seek to raise money for such causes must be free on the App Store and may only collect funds outside of the app, such as via Safari or SMS.
It would appear that the current understanding is that if you are not a nonprofit, you don't fundraise within the app nor do you provide a link where you can transfer funds. If you are a nonprofit, you can register through the nonprofit program to use Apple Pay (which comes with actual checks of the status). This matches the intent every other point regarding payments, where soliticing money from within the app, even by way of link, is generally prohibited unless specifically allowed under one of the small list of exceptions. Remember when "reader" apps also had to remove links to purchase individual items and replaced it with, at best, "visit our website"? Same intent, same result.
As for fishiness, compare these examples: * Signal Technology Foundation is a registered nonprofit foundation, I can check if the money is going to development of Signal (it is). They even do it right by providing the EIN so it is trivial to check. * Mozilla Foundation is a registered nonprofit foundation, I can check if the money is going to the development of the browser (it is not). * WireGuard developers decided it is important for them to keep the information where their business is located private (this is what I am referring to as fishy: I would challenge you to find where that particular "Edge Security" firm is actually operating, as a company, or what zx2c4.com is beside a name that Jason used to tag some files and host a domain, and both are used as "this project is from") and to keep the profits.
See the difference? Two are genuine nonprofits entitled to donations, one is a business disguised as one (how much money that business makes is immaterial, it could be $1, it could be millions - I sincerely wish them the latter). Every developer has to make a living somehow - or at least recoup some costs, for FOSS projects - but this is not the way to go about it if you want to claim moral high ground over Apple.
The argument for the ruling being bad is: the app links to the wireguard webpage (not within the app) which contains information on how to donate. That's like if in my app, I linked to my twitter profile, and my twitter profile contained a link to donate to me. It shouldn't be a problem.
If you are an actual nonprofit, you get to ask for donations both via app and your website and have Apple not take the cut.
Don't like it - don't deploy on the platfrom, but if you persist you will soon run out of platforms. Note that particular point has also caused WireGuard to be delisted from Google's Play Store before so it should not come as a suprise to anyone (https://news.ycombinator.com/item?id=21268389).
Note that some of those distinctions are legal - where I am, I need to know if I am gifting you money or donating to a nonprofit to report it on the tax record (and I certainly need to know if I were to get my own limited company to "donate"), as going above certain limits makes _me_ liable for tax on gifts as well, including reporting who the recipient is. "I sent that money to a random functional email [email protected] I can't say much about" does not cut it. Yes, Jason might be at the other end of it - but as is, it fails the smell test compared to other FOSS projects. Simple as that.
Can we go back to discussing why Apple is bad due to their ever changing APIs, general disregard for backwards compatibility and for that matter general compatibility with anything else and not one of the few things in the whole process that make sense? Or, for that matter, why Google effectively making GMS and locked bootloader a requirement for corporate and/or finance apps is ensuring that in many areas the existence of unlocked devices/alternative AOSP distributions is and will remain a fig leaf purely there to avoid being considered the one true dominant player?
I mean, maybe in a technical sense? But the ones who publish these apps are usually just "non-profits run by single individuals who can't afford all the bureaucracy required to run a non-profit."
Keep in mind that FOSS apps like WireGuard are 1. entirely free, 2. with no ads, restrictions, or nags to donate. There's nothing you get from the app, or from the developer, by sending them a "monetary gift." Other than the fact that you can't claim it on your taxes, they're effectively working for a non-profit that produces this software.
If you consider someone offering a link to send them "monetary gifts" to pay their own salary to allow them to continue to work on an app they don't charge for, "a business" — I'd hate to see what you call a church, or a library, or PBS.
Churches are "complicated" - and less said about the funding the better, especially in context of the US. Suffice to say I very much prefer the German model - which happens to come with quite stringent accountability requirements.
I have no problem sending money in appreciation for the work with no expectation of any return on it (not even a tax deduction). I do not have a problem with someone making a profit on those "gifts" - I wish them all the best, in fact. I do, however, firmly believe that you can't have your cake and eat it too: you receive the ability to accept donations in a way where you enjoy various exemptions (in this context, from Apple/Google delisting you or taking their cut) in exchange for actually going through that bureaucratic rigmarole to get registered. It's not a $DEITY-given FOSS right.
Side note - as I wrote before, my local tax office would like to know who the money is going to, to either try to get their pound of flesh (cynical and realistic view) or to identify the money going to 'bad actors' (take your usual terrorists/criminals/think of the children BS excuse the politicians always make up to pass the relevant law), doubly so when the money is sent internationally - if I wanted to actually send an one-off gift to Jason/zx2c4, I can only assume he is not in my country.
[0] https://www.pbs.org/about/producing-pbs/funding-standards/
You seem to be assuming, though, that "not being a registered nonprofit" automatically implies that there's some non-trivial probability that you'll be profitable.
Every FOSS developer I've met who is accepting "tips" for their work, is not anywhere close to "breaking even" from those tips (insofar as you'd treat the FOSS project as its own business with its own balance sheet, rather than as a marque of the owner's hypothetical individual-proprietorship IT consultancy.)
Sure, some of these are side-projects they do in addition to a full-time job, and therefore the self-employment-wages they get paid out for this effort are "pure profit" in the sense that they already make a living wage. But that would be just as true if they worked full-time for a business, and then worked as a part-time paid employee of a nonprofit.
Profitability of a FOSS-project-as-corporation, is what's left over after you pay yourself (the sole employee) out at a working wage for all the labor you put in. As such, in legal terms, these side-projects almost always would qualify as non-profits.
FOSS developers aren't YouTubers with a fanbase of millions and a platform where they can directly, incessantly plug their Patreon to that captive audience with embedded advertising. They're just people publishing apps, where the app almost never event hints at the "personal brand" of the developer.
And so, I think a critical difficulty in the communication here, is that you might be imagining this thing on the wrong scale. We're talking about maybe 200 people per year, sending the developer maybe $5 apiece. Not about individual transfers of hundreds/thousands of dollars; nor about enough transfers to pay a living wage. That's why it makes sense to call these monetary transfers "tips", rather than "funding."
And that's also, partly, why people are so confused/appalled — Apple and Google do not serve their own bottom lines by getting in the way of people "donating" to these FOSS projects. The labor-cost required to enforce this directive probably costs more than they'd ever make by taking a cut of these tips!
> in exchange for actually going through that bureaucratic rigmarole to get registered
It's not the "rigmarole" (labor), it's the cost. A nonprofit corporation is still a corporation — and most FOSS developers, as individual proprietors, don't receive enough in tips to actually be able to afford the fees involved in incorporating and registering a nonprofit.
(I mean, they can probably afford it themselves. But the hypothetical nonprofit that is the FOSS project can't afford to pay for it out of its own treasury. I.e., incorporation would just put the FOSS project further "in the hole" in being revenue-negative, and therefore in being worth the developer's time to contribute to.)
There's a reason that governments allow individual proprietors to just "do business" without incorporating: it's a fiscal stumbling-block that trips up the people governments most want to encourage to start businesses.
The same thing should be true for nonprofits/charities, intuitively. Even if there is no legal recognition for "individual proprietorship nonprofits", everyone acts like those are a thing. (They don't expect their donations to be tax-deductible, but most people in the middle class don't donate to formal nonprofits enough to realize "donations" are their own, tax-deductible, class of thing, separate from regular monetary gifts.)
And most of all, people expects corporations to go along with it — and most corporations do go along with it. Microsoft with Github Sponsors, etc. That's why everyone is so up-in-arms that Apple and Google aren't going along with it.
Of course, Apple and Google are technically, legally in the right — these are not donations. The problem is that common sense disagrees with the law: by common sense, these should be donations, tax-deductibility and all. If push came to shove, the law — not common sense — would be what bends. But nobody's pushed that far yet.
> Side note - as I wrote before, my local tax office would like to know who the money is going to
Is there some problem I'm not seeing, tax-wise, with sending small monetary gifts to people you believe to be individuals who are online acquaintances of yours (e.g. people you talked to on a forum once)?
If I want to send money to a FOSS developer, it's because I view them as, effectively, an acquaintance. Someone I'd buy a beer at a conference. By "donating" to them, I'm just buying this acquaintance of mine a beer asynchronously.
Most people make small monetary transfers to individuals they aren't sure of the identity of all the time. For example, buying hand-made jewelry at a pop-up street bazaar. There's no "business" name — it's just an individual proprietor — and you might never learn the proprietor's name, either!
Because there are so many situations like this that can arise in every-day life, it's never the job of private citizens to prevent money from being unknowingly laundered into the hands of trade-embargoed states or entities. It's not your legal civic responsibility to avoid shopping at a store just because you haven't ruled it out as being a money-laundering operation.
Instead, it's the legal duty of banks and payment processors — with their fancy KYC/AML databases — to do that: to identify the transfer recipient through network-analysis at point of fan-in. Money launderers aren't fought by starving them of demand; they're fought by deplatforming them from the financial system they depend on.
(That being said, if you were acting as your own payment processor, ala https://en.wikipedia.org/wiki/Hawala, you might be on the hook at tax time.)
https://apps.apple.com/us/app/united-way-of-chester-county/i...
They have a donate button (last image on right). Does Apple take 30% of all that is donated? If so, I find that to be repulsive.
[0] I picked Unite Way because they're a large org, not because of any other reason.
Update: Apple Pay appears to have similar policies [0].
I can imagine that Apple may want to define 'FOSS' to some extent (donations need to go to a non-profit with a board, software needs to be licensed under one of the following licenses, etc), but there should be some room for supporting FOSS that is included in an App Store.
"The stuff we won't pay for, but will make other people pay for, even tho we did nothing for it"
Heck, if both Apple and Google offered a solution by which you provide the source code to build, any necessary secret variables for the build and then it gives you those extra privileges, it would be nice. But that costs money the open source apps don't have.
This could be normalizing effort; no end runs around allowed in software from our repo?
It’s rather our fault though, yeah? For popularizing their kit and agreeing to pay for “package management as a service” as devs in the first place.
Nothing is preventing these apps from simply saying 'if you want to learn more or support our project go to <some top-level URL>' instead of directly linking the URL to a donation. Do that and there is no problem.
1. App links to developer's blog. At one point the top post is about their patreon. Apple removes app until post is amended.
2. Also apparently the bandcamp app has no links to their website, for the same reason.
https://news.ycombinator.com/item?id=19378914
Amazon Kindle app could not link to amazon.com as users could purchase books there without giving apple their cut
Last year Google started to ban donation links in FOSS apps, WireGuard was one of the first victims [0], completely removed from the store. I didn't know that Apple also started doing the same and hit WireGuard again. Extending the definition of an "in-app payment" to a link to the project homepage in the "About" window that doesn't buy any good or service related to the app is an overzealous restriction. Especially so when that button is clicked by, perhaps, only 10% of the users. This is just evil.
[0] Open-source apps removed from Google Play Store due to donation links
https://news.ycombinator.com/item?id=21268389