Something does not have to be perfect to be useful; a filter that throws out 50% or 90% of malicious trash is very useful even if a lot of malicious trash gets through.

The appropriate metric for safety of an app store is not whether you can get attacked, but rather how many users - proportional to all users - get attacked every year.

This filter is useless and misleading. Compare to F-Droid or GNU/Linux repositories.

So why would someone release malware in f-droid, when the user base is not your average joe and would likely know how to counter or detect any attacks?

This is the second person in this thread to think using an open source repo as an example carries weight. There are less users, therefore less malware is released here in the first place and then there’s less load for the malware filters for that that does get through.

Your argument does not hold for GNU/Linux repositories. There are plenty of good targets there.

Oh sure, that’s why I didn’t include it. But we have historically seen issues with those repos haven’t we?

My comment stands, why target f-droid?

Because it's technically the same as GNU/Linux repositories (i.e. relies on community and FLOSS). Therefore, one can expect that when it grows, and average Joe starts using it, there will be no huge inflow of malware in it.

> But we have historically seen issues with those repos haven’t we?

Care to elaborate?

The two being open source is an apples to oranges comparison.

Here’s one issue we’ve had with these repos:

https://lwn.net/Articles/295406/

Then there’s things like NPM that’s broken quite a few production deployments in spectacularly public ways.

I've been using Linux for at least 10 years and I have never received malicious software from distribution repositories. For some reason, malware just doesn't make it into the repositories.

Apple's filters are clearly garbage.

This is called market penetration. Look around, how many linux “desktop” users do you see? Who would you rather own, a few hundred million devices or a few 10 thousand?

Using linux as an example here doesn’t work.

> Why aren't you afraid today? Their gatekeeping is clearly useless.

You're not perfect at anything you do. Does that make you useless? Of course not.

That's why I don't gatekeep anyone.

So if we followed this logic, and reversed everything that wasn’t 100% perfect, so you realize how far back in human history we’d be propelling ourselves? There is not a single gov program, law, corp, anything on this planet that is perfect, except maybe the planet itself.

> You're not perfect at anything you do. Does that make you useless?

As a gatekeeper? Yes, yes it does; hence why there shouldn't be any gatekeepers.