It's weird that a clueless person was able to download and install a malware apk when by default Android forces you to go to your settings and allow apps to install other apps (the behaviour has changed over the years, but you always need to do something). Not to mention that Google Play Protect scans your apps and warns you if it finds something sketchy.

In any case and as much as I like my own clueless grandma, I don't think my Android phone should only allow me to use the play store or that windows/macos/linux should stop me from installing Steam just because she's clueless about tech.

Why is that weird? Facebook has to put warnings in the browser console to prevent people from pasting malicious code that some viral post said would give them super powers on Facebook. Obviously these warnings aren’t for people who understand developer tools and internet security. They’re there because malicious people trick other people into running malicious code.

It's not weird because it didn't happen.

It's actually happened more than once. Perhaps the person you were replying to was lying; doesn't make their point valid, because it has actually happened.

People can follow the most complicated step by step instructions if they're explained clearly enough, by someone they feel they don't need to trust, and there's an incentive to follow them.

If grandma ignores my advice and installs the unsafe app despite the steadily more large and screaming warnings doesn’t that become individual responsibility at some point?

But what do you want to ensure: that grandma only installs malware on her phone via mistakes she is individually responsible for, or that she doesn't install malware on her phone? Maybe for the abstract 'grandma' you would take the first option. But for someone you personally care about, you're not going to choose the option that predictably ends with her being harmed, even if it will be her own fault when it happens.

You may notice we don’t cover all power outlets because kids (or grandma) may stick their fingers in them either.

I trust them not to do that.

Then again, if iOS has a setting that ‘enables’ the unsafe app store I’m confident grandma won’t reach it since it’s hidden behind the actual passcode, not a fingerprint.

Power outlets in the UK have a mechanism to cover the live holes with a rubber plug unless the Earth pin is connected, so yes, we do.

And when grandma gives all of her retirement money to scammers by hitting the wrong button, she will get her rightful comeuppance dying on the street instead of taking up your guest bedroom.

In the real world, avoiding mistakes is more important than people suffering the consequences of mistakes.

You’re free to argue that, but my guess is that Apple actually cares about customer satisfaction regardless of who you or anyone else decides to blame for any particular instance of dissatisfaction.

Current behavior on downloading an apk makes it pretty easy, IIRC it says you need to set a setting, has a (working) deeplink to the setting, and when you set the setting it prompts you to finish installing.

It's really not that hard anymore. Google Play Protect then yells at you about the app you just installed (but maybe that was because I was installing rooting apps). The best solution to someone installing garbage apps would be a system with an app whitelist managed by a trusted person off the phone. And no browser or incoming phone calls.

What’s your argument here, that the GP is lying or that their grandmother wanted the malware or something else?

I find it very easy to believe that some malware vendor managed to trick someone into enabling things in settings. I would also believe that malware was just sitting in the play store[1] and available to install the normal way.

[1] same goes for the App Store.

His grandmother already has an iPhone, so it's unlikely that she was using Android 10 or 11 (which made it fairly easy to install an apk file). Until Android 9 you had to go through some menus and allow sideloading, something that "clueless" people usually don't do. It's more likely that the "malware" came from an app installed via the Play Store.

Three or so years ago I was asked by someone to see if there was a virus on their phone. The "virus" was in fact a religious app, installed via the official store, which was opening a popup with ads every few hours.

Now, I could be wrong and it's possible that his grandma actually sideloaded an apk. If she did, I still think that you should be able to install an app that isn't allowed by Apple on their store, after all they block more than just malware: apps with free licenses, some VPN apps in some countries, torrent apps without any illegal content in it, etc.

If Apple wants to continue on this path, hopefully they'll go a step further and also remove the web browser and the ability to receive calls. Scam calls are a problem after all and we don't want people to send all their savings to "Microsoft" or "Amazon".

Not only that but I don't see how this problem isn't just trivially solved by putting an optional "parental" control on the setting. God forbid someone has to take 5 seconds to set a phone up for their mum.

It's not exactly difficult to walk users through the process - Epic Games already makes you bypass all the warnings if you want to install fortnite.

https://www.businessinsider.com/how-to-get-fortnite-on-andro...

Once it becomes normalized for users to click through the warnings, they become meaningless and powerless, just like any warning.

Never underestimate a malware makers ability to instruct a user to do something. Out for that matter a users ability to get themselves into trouble.

True, but we probably don't want to remove the ability to receive calls just because users might receive a scam call or the browser just because it can be used to trick someone to give their information. It's the same with apps, especially when Apple bans more than just apps with malware.

Actually I definitely do want to A) make it more difficult for spam callers to exist and B) make it more difficult for people to be fooled by them.

The problem with an App Store-like approach to that problem is that Apple would control who could call you and not give you the option to receive calls from someone they don't like.

I'm not against security or privacy. My problem is not having a way to bypass the App Store and what they allow (they ban more than just malware) when I want to install something.

I use Android for this reason. As soon macOS becomes like iOS, I'm out too.

> My problem is not having a way to bypass the App Store

The ability to bypass the App Store for yourself exists and has for a long time. The process might not be to your liking, but let’s stop pretending that you have no choice if you want to use iOS but not go through the App Store.

When I say "bypass the App Store", I mean installing an app like you can do on Android, Windows, macOS or Linux.

Jailbreak isn't supported by Apple and it's not something most people can or would do.

> I mean installing an app

I meant exactly that and didn’t mean Jailbreaking. Apple officially supports allowing you to sign apps for your own device with a free developer account, it’s just the signing expires after 7 days (unlike the paid developer accounts which expire after a year). It’s a hassle to need to reinstall weekly (hence my point about it likely not being to one’s liking), but there are apps[0] available to automate the process. So my point stands, nothing is stopping you from using iOS and installing apps from outside the App Store but yourself.

[0] https://altstore.io/

It's an interesting solution which I wasn't aware of (thanks for sharing), but requiring a weekly reinstall and a free developer account (and a computer to automate the process) doesn't seem to be something most people would use. It's also not comparable to what all other mainstream OS allow you to do.

When I install an apk on Android, it works until something breaks. Same on Windows, macOS or Linux. I also don't have to ask Google, Microsoft or Canonical for a free key so I can sign an app created by someone else.

I'm sure this is enough and acceptable for some users, just not for me.

> My problem is not having a way to bypass the App Store

As I’ve shown, there is a way, just not to your liking.

> I'm sure this is enough and acceptable for some users, just not for me.

I agree, I wouldn’t endure it either, but I also have a regular developer and an enterprise developer account so I’m not limited by the short duration.

IMO the right question to ask here is how do we, as a society, make people not be this trustful?

It’s not really weird at all. When a dialog pops up while a user is trying to do something like install an app 90% of users will blindly click “ok” in order to get on with it.

Neither the user or a website/app can install an apk file on Android by just clicking "OK".

This extends to any number of dialogs standing between the user and their goal. If a user wants to install an application they will not be deterred by warnings because they fundamentally don't care - they've already decided they want this app.

So the solution is to force majority of the population to use Apple store, to protect minority of the population who aren't tech savvy?

If Apple allowed other stores, before a user can install an app from non-Apple store, iOS can show a message saying the app is not from Apple's holy store and that it is users responsibility to make sure the app is trustworthy? This won't be pretty, but at least it is a compromise.

They want their 30% cut and they want to tightly control everything. That is the only true, logical reason. Everything else is a flimsy excuse

But then Epic will have detailed instructions on how to sideload apps, and if enough apps do this it will be common practice for users to do so. If users are trained to do this by safe apps, they won't be on the lookout for the malware that does the same thing.

Maybe a wacky idea, but what if Apple required you to go to an Apple store to sideload a new app or app store. That way the person at the store can stop really stupid mistakes.

They already basically do; they require you to go to the digital equivalent and ask Apple pretty please for a signature.

Pretty hard to know who the minority is in this case. Based on other HN opinions about Apple products, there seems to be a consensus that Apple customers are mostly not tech savvy. If they were, they wouldn’t buy Apple stuff.

Even though this is a stereotype not grounded in reality and there are plenty of techie people who buy Apple products.

Lots of tech folks buy apple and at the same time vast majority of Apple customers should not be trusted to do valid security assessment or maintain good operational security.

I am not particularly a fan of Apple. Still, I think Apple is better than Google. That is how sad the situation is. There is simply no choice other than iOS and Android. I really wish Microsoft hadn't given up so soon on windows phone. Microsoft isn't great either, but at least there would be three choices instead of two.

I hope projects like Librem 5 succeed, but they are a long way :(

Why is it hard to know? Apple has at most like a 20% market share globally, and around 50% in the United States. The overwhelming majority of smartphone owners have a non-Apple smartphone.

What is hard to know is whether Apple (iPhone) users are sophisticated enough to not be exploited by non-Apple App stores.

One possible solution is to start giving our money to companies that are not Apple or Google. Otherwise we'll be forever stuck with this duopoly and various alternative OS will keep being niche at best.

Show me a viable 3rd party OS phone that doesn't require me to jump through 1000 hoops and accept subpar reception/user experience and I'll hop right on it. Until then I'll choose iPhone for it's superior user privacy policy (compared to Android/Google)

I hope projects like librem 5 will catch on, at least amongst the tech savvy, might take a while though.

> So the solution is to force majority of the population to use Apple store, to protect minority of the population who aren't tech savvy?

You could always get an android.

I realise that this can come off as silly, but what, id not the walled garden differentiate the two systems? If you tear those walls down, you’re basically using a really expensive android device with all the tracking and malware that includes.

I do think the courts should force Apple to open up. Closed systems are evil, even though they are very nice to use. I just hope they do it in such a way that it’s optional and has no effect on the rest of us.

Why, exactly, are they evil? It's not as if people who buy Apple (like me, and I develop for iPhone/iPad too) don't know what they're getting. I like the walled garden Apple has because:

* It makes my life as a developer much easier. I only have one App Store to aim at, and with a few hiccups here and there from inexperienced or overzealous reviewers the guidelines are pretty clear. If I had to design for half a dozen or more apps I'd have that many more versions of guidelines to worry about.

* I don't need to worry nearly as much about scam or knock-off apps siphoning off users, since Apple is proactive about that. Not perfect, but very proactive.

Those are just two off the top of my head. There are more, but I'm getting hungry.

Because they are limiting. I’m personally in the iOS boat, and it’s great until you try programming on your iPad instead of your non-closed MacBook.

Phones, consoles, tablets are closed because the companies that build them didn’t have competition from open platforms. Computers are still open because they still have competition, if they didn’t they’d likely all be chrome books.

I know it’s sort of hypocritical, but the walled-garden is only nice until it’s curators considers your needs to be weeds.

You might not have seen this: https://developer.apple.com/swift-playgrounds/

It's pretty nice to be able to build entire Swift playgrounds on your iPad, then share them with your Mac/MacBook. The IDE is simple and very straightforward, and it's useful for prototyping things on your iPad or iPad Pro.

Could the guest mode on android or enterprise/fleet thingy be used to achieve that (preventing user from installing malware) ?

Fuck, Time said that 2 years old are using iOS so , "Great news, the lowest common denominator will be lowered from grandma to toddlers"

And Apple protecting her from that is the only solution? I don't think so...

With just a tiny bit of imagination I'm sure we can come up with something which will work. Here's an idea: Let Apple sell Apple-locked and unlocked iPhones. It can work just like carrier locking. Buy one unlocked, maybe pay a little extra, and you can have 3rd party app stores.

That took me a minute to come up with. I am absolutely positive that there are many other degrees of options between full-control by Apple and full-control by End-user.

I get it though... people who like Apple aren't very appreciative of having options.

> Let Apple sell Apple-locked and unlocked iPhones. It can work just like carrier locking. Buy one unlocked, maybe pay a little extra

But that won't work for Epic, or for any competitor. Epic wants access to every iPhone customer, not just the ones who paid extra to add third party app stores. Heck, you don't even have to pay extra to sideload apps on Android, but they still lost a ton of people when Google kicked them out of the Play Store.

There's a thing called "choice paralysis" that Apple minimizes as a value-add.

My technically-savvy associates, I suggest an Android to (especially if they want to dabble in mobile development themselves). For my family that just wants a phone that works, I suggest iPhone. The ecosystem tends to have a single right way to do any given task, which is a boon when they just want it to work without having to think about details.

I just want a commodity pocket computer. I don't need to be able to install linux on it or Uncle Jack's latest new app idea. I just want to see my calendar, answer emails, and take calls, I dgaf about "oh I can put git on my phone and download the latest rustc and compile my web backend and test it on my phone!"

Ok, thats fine. But you don't need to force everyone else to make the same decisions.

If other people want to have unlocked iPhones, due to Apple's behavior being illegally anti-competitive, then thats OK.

If that was the law then sure, Apple could just sell a Samsung Android phone on their store so they don’t get fined. This approach obviously doesn’t actually change anything for smartphone users or developers.

I know you mean well. But it’s ironic that with the first iPhones, Apple was combating the tight gripe of carriers, especially in the US on consumer control.

Apple's corporate charter is pretty simple: keep the girl with the hammer from getting too close to the screen.

Yes, they won important victories against the cellular carriers -- victories that we all continue to benefit from -- but let's not kid ourselves regarding why they fought those battles in the first place. They didn't just set out to defeat the incumbent gatekeepers, they set out to become them.

So your Grandma installed apks? I find that hard to believe. The google store has a slightly worse history for malware than the Apple Store but not that much worse, especially relative to PC malware. Also anecdotes generally don't prove much in the greater scheme of "Android is a malware platform and your grandmother is going to get a virus"

why is that hard to believe? literal children do it to get fortnite. any site that is trying to get you to sideload will have convenient instructions for how to do it.

https://www.businessinsider.com/how-to-get-fortnite-on-andro...