It's funny, because I actually agree with both of you.

We should generally trust our primary OS vendor, because otherwise we're all going to need therapy.

But we shouldn't have to trust them. That is, the system should be designed such that we have some amount of "defense in depth" where a mistake by Apple during the review of one of the 3.5 million apps doesn't result in an exploit.

I think this is why Apple and the others are trending towards the design that they are, because a deep capability approach that's integrated into the UI helps offload some of the complexity and overhead of managing that liability at scale.

> I think this is why Apple and the others are trending towards the design that they are, because a deep capability approach that's integrated into the UI helps offload some of the complexity and overhead of managing that liability at scale.

I don't think this is an accurate description of what Apple is doing at all. If anything, they're moving more towards the direction where they are implicitly trusted and if you don't trust them you don't get any security.

Apple does have pretty great security story. On ios, it’s like state of the art, and it’s ok on macos as well. And no, walled garden is not the security of apple, but proper sandboxing is.

So even without extensive app review (which is frankly, not extensive at all) a rouge application should not be able to do much damage.

Apple is responsible for distributing 500 million copies of Xcodeghost[1] to its users, and Google's Play Store is the #1 vector for malware on Android[2].

[1] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...

[2] https://www.zdnet.com/article/play-store-identified-as-main-...

I think it's very misleading to put it like that. Xcodeghost came with an infected version of Xcode that was not distributed by Apple.

From Wikipedia: "Security firm Palo Alto Networks surmised that because network speeds were slower in China, developers in the country looked for local copies of the Apple Xcode development environment, and encountered altered versions that had been posted on domestic web sites."

https://en.wikipedia.org/wiki/XcodeGhost

Right, and despite Apple assuring us that it vets each app and developer via its App Store, 500 million copies of the malware were distributed via the App Store to users' devices.

This is the next sentence after your quote[1]:

> This opened the door for the malware to be inserted into high profile apps used on iOS devices.

> Even two months after the initial reports, security firm FireEye reported that hundreds of enterprises were still using infected apps and that XcodeGhost remained "a persistent security risk". The firm also identified a new variant of the malware and dubbed it XcodeGhost S; among the apps that were infected were the popular messaging app WeChat and a Netease app Music 163.

From the same article:

> Removing malicious apps from the App Store

> On September 18, 2015 Apple admitted the existence of the malware and began asking all developers with compromised apps to compile their apps with a clean version of Xcode before submitting them for review again.

[1] https://en.wikipedia.org/wiki/XcodeGhost

Sure, a wikipedia reading can give that impression. What actually happened is that sytems with infected Xcode installations created infected executables. Those infected executables were then uploaded to the App Store. There were known to be thousands of infected executable images.

This is a false dichotomy. Just because I trust OS vendor to not be shipping malware or backdoors in their code doesn't mean I must let them decide what I can or cannot run on the OS for me.