> I also think it would open a whole can of worms

Absolutely. Apple should be afraid of holding the gatekeeper position. Anyone should.

When people can install and use whatever they want, safety becomes their responsibility. They should open up their platform and let people do their own due dilligence. If they assume that responsibility and then neglect it, they absolutely can and should be blamed for any problems.

If Apple gave up the gatekeeping position, I would be afraid to use my phone for the things I do today.

The point is, you should be afraid today too (or better word, more careful). What you have right now is a false sense of security.

Why aren't you afraid today? Their gatekeeping is clearly useless.

Something does not have to be perfect to be useful; a filter that throws out 50% or 90% of malicious trash is very useful even if a lot of malicious trash gets through.

The appropriate metric for safety of an app store is not whether you can get attacked, but rather how many users - proportional to all users - get attacked every year.

This filter is useless and misleading. Compare to F-Droid or GNU/Linux repositories.

So why would someone release malware in f-droid, when the user base is not your average joe and would likely know how to counter or detect any attacks?

This is the second person in this thread to think using an open source repo as an example carries weight. There are less users, therefore less malware is released here in the first place and then there’s less load for the malware filters for that that does get through.

Your argument does not hold for GNU/Linux repositories. There are plenty of good targets there.

Oh sure, that’s why I didn’t include it. But we have historically seen issues with those repos haven’t we?

My comment stands, why target f-droid?

Because it's technically the same as GNU/Linux repositories (i.e. relies on community and FLOSS). Therefore, one can expect that when it grows, and average Joe starts using it, there will be no huge inflow of malware in it.

> But we have historically seen issues with those repos haven’t we?

Care to elaborate?

The two being open source is an apples to oranges comparison.

Here’s one issue we’ve had with these repos:

https://lwn.net/Articles/295406/

Then there’s things like NPM that’s broken quite a few production deployments in spectacularly public ways.

I've been using Linux for at least 10 years and I have never received malicious software from distribution repositories. For some reason, malware just doesn't make it into the repositories.

Apple's filters are clearly garbage.

This is called market penetration. Look around, how many linux “desktop” users do you see? Who would you rather own, a few hundred million devices or a few 10 thousand?

Using linux as an example here doesn’t work.

> Why aren't you afraid today? Their gatekeeping is clearly useless.

You're not perfect at anything you do. Does that make you useless? Of course not.

That's why I don't gatekeep anyone.

So if we followed this logic, and reversed everything that wasn’t 100% perfect, so you realize how far back in human history we’d be propelling ourselves? There is not a single gov program, law, corp, anything on this planet that is perfect, except maybe the planet itself.

> You're not perfect at anything you do. Does that make you useless?

As a gatekeeper? Yes, yes it does; hence why there shouldn't be any gatekeepers.

You should already be afraid now.

Yes and likewise, car manufacturers should remove seatbelts and airbags. They simply encourage reckless driving, and by giving the false sense of security / assuming the gatekeeper role, they should be liable for any accident.

The big difference between "Apple's app review process" and "seatbelts and airbags" is that car companies acknowledge the latter are fallible.

It's not about adding layers of protection or not; it's about being transparent with your customers about how effective those layers actually are.

I don’t think any one of my less technical friends has any belief that the App Store is infallible or even mostly secure. Apple doesn’t advertise it much, and if they did I’d be happy to call that a mistake.

Just read their copy for the App Store: https://www.apple.com/app-store/

> Because we offer nearly two million apps — and we want you to feel good about using every single one of them.

> Apps must adhere to our guidelines.

> You should never have to worry about inappropriate content.

> Every day, moderators review worldwide App Store charts for quality and accuracy.

All of these are far stronger claims than I would be comfortable making about the current state of the store.

Disagree, they seem very reasonable. But also no one is reading those terms really, they aren’t being pushed in ads or shown at the store.

Do you have any ties to Apple?

That is the most ridiculous implication.

'We did not expect anyone to read the terms of the product, so we shouldn't have to deliver on what we promised.'

That is not resonable.

Apple is using weezle-words like "should" which gives them wiggle room, but I guess it will be up to a court to decide.

I have no ties, other than owning a few of their devices. I think you should up your prior that there exist people who generally think this is ok.

I think about 0 out of the first 100 people I know that I think of have heard any version of those claims (maybe 5 now since a few read HN). It’s probably not even a top 10,000 trafficked page on their site.

Do you have any ties against apple or for a competitor?

Car manufacturers are going to face the liability issues when they try to sell "self driving" cars. Volvo has for example ack'ed this in public years ago.

https://www.theverge.com/2015/10/7/9470551/volvo-self-drivin...

Weird, I can flash whatever code I want to on my car's ECU. There's even an entire subculture dedicated to modding ECU firmware.

You absolutely cannot, unless you have an open ECU to begin with. Typically this is only sporty type cheap cars (evo, wrx). But even if you were to take on such and endeavor the difficulty of such a task and the knowledge requirement will scare off the unexperienced

Flashing your car's ECU is illegal. Or more specifically, federal and state laws make it illegal to operate an automobile on the open road or highway after you've altered a vehicle's emission control devices (which includes the ECU).

In contrast, it's legal to jailbreak an iPhone.

The Apple review process is not in any way equivalent or even similar to seat belts and airbags. Not even the government can be fully blamed for bad drivers since people don't actually need a driver's license in order to drive.

Punishing companies for adding protections to their products is an insanely backwards incentive. May as well turn off sandboxing, and lock screens. If they ever break, it’d be a liability!

Nah. If you're gonna set yourself up as the ultimate arbiter of what I can run on my device, you are absolutely to blame for any harm that comes as a result.

Protections? Encryption is protection. Address space randomization is protection. This Apple review process? This is just humans failing to do what's expected of them. Also known as negligence.

there’s a lot of faulting apple here, when you point out it’s a “humans failing”. Does this mean you understand the process completely and you can do better?

Probably not,

which is why he hasn't placed himself in the position of "arbiter of what's right and wrong on phones", the way Apple has with their App Store.

so then what’s the argument here, if not perfect, remove?

I think what Apple _could_ do is insure that there is a real person that can be held accountable by law enforcement in the users jurisdiction. That way a user has some legal recourse in the event they are wronged.

Nobody wants Apple to be judge and jury, we have judges and juries for that, but it would be nice if they could tell us who to go after when we have to.

If they can't do that, I don't think its unreasonable for us to ask Apple to be responsible any losses, then let Apple seek compensation for their losses from the app publisher.

> they are already doing quite a bit.

They must be focusing on the wrong things then. Certain categories are filled with scam apps at the top ranks, including scam subscriptions.

Censorship is also easier when you have an AI to blame the "mistake" on.