Why is that weird? Facebook has to put warnings in the browser console to prevent people from pasting malicious code that some viral post said would give them super powers on Facebook. Obviously these warnings aren’t for people who understand developer tools and internet security. They’re there because malicious people trick other people into running malicious code.

It's not weird because it didn't happen.

It's actually happened more than once. Perhaps the person you were replying to was lying; doesn't make their point valid, because it has actually happened.

People can follow the most complicated step by step instructions if they're explained clearly enough, by someone they feel they don't need to trust, and there's an incentive to follow them.

If grandma ignores my advice and installs the unsafe app despite the steadily more large and screaming warnings doesn’t that become individual responsibility at some point?

But what do you want to ensure: that grandma only installs malware on her phone via mistakes she is individually responsible for, or that she doesn't install malware on her phone? Maybe for the abstract 'grandma' you would take the first option. But for someone you personally care about, you're not going to choose the option that predictably ends with her being harmed, even if it will be her own fault when it happens.

You may notice we don’t cover all power outlets because kids (or grandma) may stick their fingers in them either.

I trust them not to do that.

Then again, if iOS has a setting that ‘enables’ the unsafe app store I’m confident grandma won’t reach it since it’s hidden behind the actual passcode, not a fingerprint.

Power outlets in the UK have a mechanism to cover the live holes with a rubber plug unless the Earth pin is connected, so yes, we do.

And when grandma gives all of her retirement money to scammers by hitting the wrong button, she will get her rightful comeuppance dying on the street instead of taking up your guest bedroom.

In the real world, avoiding mistakes is more important than people suffering the consequences of mistakes.

You’re free to argue that, but my guess is that Apple actually cares about customer satisfaction regardless of who you or anyone else decides to blame for any particular instance of dissatisfaction.

Current behavior on downloading an apk makes it pretty easy, IIRC it says you need to set a setting, has a (working) deeplink to the setting, and when you set the setting it prompts you to finish installing.

It's really not that hard anymore. Google Play Protect then yells at you about the app you just installed (but maybe that was because I was installing rooting apps). The best solution to someone installing garbage apps would be a system with an app whitelist managed by a trusted person off the phone. And no browser or incoming phone calls.

What’s your argument here, that the GP is lying or that their grandmother wanted the malware or something else?

I find it very easy to believe that some malware vendor managed to trick someone into enabling things in settings. I would also believe that malware was just sitting in the play store[1] and available to install the normal way.

[1] same goes for the App Store.

His grandmother already has an iPhone, so it's unlikely that she was using Android 10 or 11 (which made it fairly easy to install an apk file). Until Android 9 you had to go through some menus and allow sideloading, something that "clueless" people usually don't do. It's more likely that the "malware" came from an app installed via the Play Store.

Three or so years ago I was asked by someone to see if there was a virus on their phone. The "virus" was in fact a religious app, installed via the official store, which was opening a popup with ads every few hours.

Now, I could be wrong and it's possible that his grandma actually sideloaded an apk. If she did, I still think that you should be able to install an app that isn't allowed by Apple on their store, after all they block more than just malware: apps with free licenses, some VPN apps in some countries, torrent apps without any illegal content in it, etc.

If Apple wants to continue on this path, hopefully they'll go a step further and also remove the web browser and the ability to receive calls. Scam calls are a problem after all and we don't want people to send all their savings to "Microsoft" or "Amazon".

Not only that but I don't see how this problem isn't just trivially solved by putting an optional "parental" control on the setting. God forbid someone has to take 5 seconds to set a phone up for their mum.

It's not exactly difficult to walk users through the process - Epic Games already makes you bypass all the warnings if you want to install fortnite.

https://www.businessinsider.com/how-to-get-fortnite-on-andro...

Once it becomes normalized for users to click through the warnings, they become meaningless and powerless, just like any warning.

Never underestimate a malware makers ability to instruct a user to do something. Out for that matter a users ability to get themselves into trouble.

True, but we probably don't want to remove the ability to receive calls just because users might receive a scam call or the browser just because it can be used to trick someone to give their information. It's the same with apps, especially when Apple bans more than just apps with malware.

Actually I definitely do want to A) make it more difficult for spam callers to exist and B) make it more difficult for people to be fooled by them.

The problem with an App Store-like approach to that problem is that Apple would control who could call you and not give you the option to receive calls from someone they don't like.

I'm not against security or privacy. My problem is not having a way to bypass the App Store and what they allow (they ban more than just malware) when I want to install something.

I use Android for this reason. As soon macOS becomes like iOS, I'm out too.

> My problem is not having a way to bypass the App Store

The ability to bypass the App Store for yourself exists and has for a long time. The process might not be to your liking, but let’s stop pretending that you have no choice if you want to use iOS but not go through the App Store.

When I say "bypass the App Store", I mean installing an app like you can do on Android, Windows, macOS or Linux.

Jailbreak isn't supported by Apple and it's not something most people can or would do.

> I mean installing an app

I meant exactly that and didn’t mean Jailbreaking. Apple officially supports allowing you to sign apps for your own device with a free developer account, it’s just the signing expires after 7 days (unlike the paid developer accounts which expire after a year). It’s a hassle to need to reinstall weekly (hence my point about it likely not being to one’s liking), but there are apps[0] available to automate the process. So my point stands, nothing is stopping you from using iOS and installing apps from outside the App Store but yourself.

[0] https://altstore.io/

It's an interesting solution which I wasn't aware of (thanks for sharing), but requiring a weekly reinstall and a free developer account (and a computer to automate the process) doesn't seem to be something most people would use. It's also not comparable to what all other mainstream OS allow you to do.

When I install an apk on Android, it works until something breaks. Same on Windows, macOS or Linux. I also don't have to ask Google, Microsoft or Canonical for a free key so I can sign an app created by someone else.

I'm sure this is enough and acceptable for some users, just not for me.

> My problem is not having a way to bypass the App Store

As I’ve shown, there is a way, just not to your liking.

> I'm sure this is enough and acceptable for some users, just not for me.

I agree, I wouldn’t endure it either, but I also have a regular developer and an enterprise developer account so I’m not limited by the short duration.

IMO the right question to ask here is how do we, as a society, make people not be this trustful?

It’s not really weird at all. When a dialog pops up while a user is trying to do something like install an app 90% of users will blindly click “ok” in order to get on with it.

Neither the user or a website/app can install an apk file on Android by just clicking "OK".

This extends to any number of dialogs standing between the user and their goal. If a user wants to install an application they will not be deterred by warnings because they fundamentally don't care - they've already decided they want this app.