I agree in principle, but I worry that we end up in the situation where if you need to use a particular app, you can only get it from a third-party store that you don't trust. (Something gross like Facebook starting an app store.)

Or course, this is mostly a result of Apple being greedy. If they had acted like a good steward of the platform rather than trying to extract a lot of money from developers, we probably wouldn't be here.

In practice I doubt many apps will use a third-party appstore. Apple has a lot of leeway in how they will implement the regulation - they can make it painful enough to use a third-party store that most popular apps will want to keep using the primary app store to get maximum reach. Just like how almost every android app is on the google play store - despite sideloading being a thing since forever.

As soon as those devs can avoid Apple's restrictions and deliver their apps directly to users with the "intended" experience, they will.

Personally, I like neutered-evil-genie apps, and will be sad to lose them (i.e. have them turn into unfettered-evil-genie apps, which I won't use.)

Or does the EU law prevent them from having private APIs/system components period? It seems like many people are making the assumption that this means that every single sideloaded app will be able to bypass all of the privacy/security features on the device, and I don't see why that would be. My understanding is that this is for "fairness", which would mean that apps that are sideloaded would have the same level of access as those on the App Store, meaning they use the same APIs that trigger the same prompts.

These are the sorts of prohibited behaviors that can be heuristically recognized by technical means (e.g. static analysis), but where any such recognition would necessarily result result in tons of false positives; and so those issues, when raised, must be passed to a team of human auditors for determination.

This is, by-and-large, why App Store submissions — even for updates — still require that human-auditor step. They're always watching for those seemingly-minor "this app got sold to someone evil" updates that slip in spyware — the kind you see often with Chrome Extensions.

The second example has already been fixed with the microphone indicator from 1-2 versions back, where a light shows up in the corner whenever the microphone has been activated (and swiping down tells you what app activated it). A notification could be added if an app tried to activate the microphone when it wasn't in the foreground (but I don't think the OS lets you do that anyway?)

You'd think that maybe restricting connections to e.g. domains that are rooted in a zone the developer has proven ownership of, would be fine... but there are third-party advertising, analytics, and fingerprinting services that allow you to CNAME them as subdomains of your domain to evade ad-blocker signature recognition.

And, of course, no user could ever be expected to figure any of this out if asked in a prompt. "Example App is asking me to allow it to connect to abcdefg.example.com? Well, they own that, don't they? Why wouldn't I allow that?"

ANY "solution" that puts more burden on the user isn't.

The problem with consent prompts on websites is that they are rarely in compliance with the GDPR.

Take, for example, this: https://www.reddit.com/r/ios/comments/w27x6j/uber_does_not_r...

This also ignores that it's conceivable that Apple can harden iOS's existing permissions system.

Not at all. App Store review is not perfect and no one expects it to be. That doesn't mean it has no value or that we should get rid of it entirely. Otherwise you could make the same argument about any system involving unscrupulous actors: "people still kill despite there being laws against murder, doesn't that mean the law is pointless?"

> This also ignores that it's conceivable that Apple can harden iOS's existing permissions system.

Curious how you think this would actually solve the issue I linked above.

But Apple is clearly presenting it as such.

> That doesn't mean it has no value or that we should get rid of it entirely.

That is correct, but right now it is the only game in town. There's no secondary stores that present it with competition. Already we read about top-10 grossing apps that are actually scammy. Perhaps Apple will strengthen its App Store when presented with alternatives.

> Curious how you think this would actually solve the issue I linked above.

It really depends on what mechanism that Uber is using to bypass the notifications systems. But off the bat, iOS could force even more granular alerts to the user when sensitive permissions are required.

Curious too, how you think that App Store review currently solves this issue. Uber is already too significant to the platform for Apple to do much more than give them a slap on the wrist, as seen historically.

https://www.cnet.com/news/privacy/apple-tim-cook-threatened-...

How does having more granular alerts actually solve this issue?

> Curious too, how you think that App Store review currently solves this issue.

Well, obviously it doesn't, currently. App Store review needs to update their rules to address this type of abuse. Uber is big but they've taken hard line stances against bigger apps before (e.g. Facebook).

> https://www.cnet.com/news/privacy/apple-tim-cook-threatened-...

Sounds like a success story, imagine the alternative scenario where there was no review process and Uber could get away with this unimpeded.

> Sounds like a success story, imagine the alternative scenario where there was no review process and Uber could get away with this entirely.

It'd say 60-40. The 40% downside is that Apple deigned to go through with actually pulling Uber from the store, even just for a few days. Do you think they'd do anything even remotely similar over the notifications permission leak you cited?

> How does having more granular alerts actually solve this issue?

More restrictive and more transparent handling of permissions. Maybe this mechanism was caused by Uber bundling some sort of library that led to permissions leak. Perhaps the OS could expose that permission being triggered.

I don't think you've thought this all the way through. Once a user grants me permission to send them push notifications because they want to know when their ride shows up, you can't really stop me from pushing them ads through the same channel.

> Once a user grants me permission to send them push notifications because they want to know when their ride shows up, you can't really stop me from pushing them ads through the same channel.

Wait, can't an improvement upon the OS be to make it more granular so that Uber is forced to establish separate permissions channels for rides (vital) vs. ads (not-so-vital), and that every time a notification of a certain type appears, the user is given the option to mute that channel entirely?

My underlying point, of course, is just because the operating system provides certain APIs, does not mean they are going to be used in good faith.

Perhaps they could team up with Facebook and create a rival app store of those who don’t want to pay the 30% tax. Of which they can all hemorrhage users together- it should be noted that FB is also having issues maintaining and growing DAU.

Permissions represent one of two pillars of their strategy against legal malware developers. The second one is the rulebook associated with the AppStore, preventing publishing non-compliant apps and banning developers for breaking said rules. A classic example is Facebook misusing enterprise certificates to install "Facebook research" which allowed them almost unrestricted access to the data of the users. Apple revoked their enterprise certificate, which also affected internal applications that Facebook employees were using. Facebook relented.

If Facebook launches their own app store, the second pillar is completely circumvented. Additionally they will find ways around the technical limitations, be it through use of private APIs, tricking users into clicking confirmations or bribing them. Technical limitations are not enough when dealing with malicious actors.

Meta be forced to offer their adware/spyware Facebook app through the Apple app store as well, as many people will not agree or won't have the technical knowledge to install more than one alternative app store. Apple will probably be forced to provide a list of alphabetically ordered app stores to choose from in the initial iPhone setup. It's quite convenient that their own app store starts with an A.

And let's say the user says No. Today the app will be forced to work without it. By Apple Store rules. Tomorrow the app will say "this permission is required for app to work".

The government offers a democratic way to determine these requirements

Some apps are unavoidable for most people, like whatsapp or facebook.

Future is Matrix.

Are you aware of man in the middle attacks? Do you think encrypted channels are safe from state actors?

Also most phones don’t even use SMS anymore, and instead go through an encrypted server to make it so you can hide your traffic from your neighbors.

Get with reality, not everybody wants or needs what your selling here.

Of course I am aware of this.

Spend $16 and sit in a coffee shop for an hour, guarantee you'll intercept plenty of SMS: https://arstechnica.com/information-technology/2021/03/16-at...

Not selling anything here considering every reasonable solution to this problem is something offered for free, or can be mitigated by a user with FOSS.

Furthermore, the lawyer isn't just de-risking one evil genie wish, they're de-risking millions of them. Apple does not just have Facebook on the App Store. They have millions of apps. And as you can imagine, many of them are barely reviewed garbage or outright scams. If these apps tried to get distributed outside of the App Store, nobody would trust them. But them being on the App Store gives users a false sense of security. Apple switched from being highly selective in the early days of iOS to doing bare-minimum checks because the latter made them more money.

"just don't install the app" won't work in many, many cases.

Yeah, but I can't I can use only Safari engine, and I would like to use Firefox one.

Such compulsions are the real problem. In a free society, nobody should be compelled to have a phone at all, let alone install software on one. Government services in particular should never be gated in this way. If no compulsion exists, then there is no problem with people having the choice to use any appstore they wish.

If by 'have to' you mean something along the lines of "My brother keeps badgering me to install WhatsApp" then the answer is to simply say "No." Real example. He texts me instead.

I believe a rooted Android used to allow something like that, not sure if that still works nowadays.

This can lead to an arms race where the OS creates increasingly advanced/realistic fake data, and apps get increasingly sophisticated logic.

So I'm not a fan of solving this the technical way. A policy is way better, but you need to be able to enforce it.

Sure, it'll lead to arms race like you describe on one side, but let's say 99% of the apps won't even engage in that arms race if the fake data is generic enough to cause a high number of false positives (blocking someone who's not actually faking the data).

Then, we can focus on the remaining 1% of worst offenders to actually enforce the policy.

Realistically this just drives people into a different walled garden. One that is device-vendor agnostic, but a walled garden nonetheless - in that your purchases are tied to Epic. This law could have been so much better, but now it just trades one problem for a bunch of new ones (some even worse than what it's trying to solve).

One thing that might have been nice - making allowances in the law for centralised certification authorities with fixed tariffs, so that Apple still checks the builds as it does now for the App Store, but then the builds can be released elsewhere (as the signatures will match). For this they could charge a fee, which could be capped in the law at a percentage of the sale price (and obviously much lower than 30%). This way iOS/Android could still have guaranteed protection, for which Apple/Google's costs are covered, but the user would have freedom to get their software from wherever.

The problem is that hardline free software advocates would still complain about this, insisting that the certification authority be scrapped. iOS and Android are now Windows, and it's going to be a mess.

Now that I have an iPhone, I miss NewPipe greatly. But with this law, I might be able to get something like it in a few months without jailbreaking.

And when your employer / school / insurance provider / other requires it, what then?

Other wise you can end up like the streaming situation where people are just giving up with all the subscriptions and just pirating everything.

This will be a problem but the solution is not to transfer your freedom to choose to Apple and just let them decide which third party apps you are allowed to use.

In some cases that will mean making a hard choice between accepting the risk of using the third party app store, or accepting that you won't be able to use certain apps. The benefits are significant though - your device will actually be under your control. You will be able to do all the things Apple prevent now.

Very good point. It's almost like people believing it to be better for a "benevolent" dictator to make all decisions, so that they won't be bothered with having to make choices.

Not every user wants to give over their freedom of choice to Apple (or any seemingly "kind" dictator), and many would prefer they can make decisions about what is best for their particular situation and based on their own preferences.

Will the solution involve a method to negotiate degrees-of-freedom? Or perhaps a freedom grant method with revocation protocol? Do I get a little widget to see how free I am at the moment?

I'd love to see a laundry list of changes to industry practice, too. But the language employed for these compatibility fights is just getting goofy.

The F150 cup holder is enslaving me, somebody pass a law quick!

You already have that choice today: I can buy into the walled-garden, or go to Android and side-load to my heart's content.

Clearly the market has chosen the preferred route. (I personally am also in the camp of preferring the simple, locked-down approach for my family that Apple has created.)

So if Google decided to force this policy onto Android phones, you would support the EU introducing this legislation to bring back the option of side-loading?

Or would you want the legislation to only apply to Android phones, and not Apple devices?

Indeed - iOS trails Android in Europe. With this law in effect, perhaps more Europeans will choose to buy iPhones

As apposed to today where you can’t get it at all if apple and the app disagree about anything?

I know you are thinking of another large enough player you don’t trust as much forcing their store as the only avenue for an app, but it’s hard to imagine how that wouldn’t provide large incentives for a smaller party to make a competitor on the official store.

Since there is only one app store for iPhones, almost every app vendor is willing to conform to Apple's guidelines (which are often pro-privacy and protect the user). Otherwise they lose out on a significant market share with a lot of spending power.

smaller party to make a competitor on the official store

Sure, they will pop up. But Facebook, Microsoft, and Google will start iOS app stores and app developers will go to their app stores because of network effects.

You've just described why these changes are good. I feel like the word "willing" in your statement is carrying a lot of weight.

Apple forces developers to publish from Apple devices, spend $100 a year for a developer account, give up 15-30% of any revenue generated from that app, use WebKit, etc.

That is not at all what I describe as restrictions that lead to "willing" app vendors.

They might try, but it would be a lot harder than you imagine.

You have Android as a real world experiment, go ask an Android users to search the Facebook Messenger app on Google Play store and you will see it is there, FB did not forced Android users to install the app by side loading it and FB did not created their own app store for their apps.

What could happen though is you would get fair prices, say an app/Game would be 30% cheaper if you buy it directly from the developer and not from an intermediary, though I did not see this happening on PC (getting a better deal if I buy directly, I am wondering what causes this)

I often hear this argument but Android has had third-party app-stores and 'side-loadable apps' since day one and I can't think of a single major app that needs its own app-store.

There are also app stores on Android that basically push lots of scamware targeted at kids.

We aren't the target audience so we aren't going to see much of these going ons.

My bet is on Microsoft Solitaire. :-)

Though Minecraft is supposedly still at 170 million monthly active players vs. 80M or less for Fortnite.

Not necessarily up to date but interesting: https://en.wikipedia.org/wiki/List_of_most-played_video_game...

This works both ways. Some people want to use iOS exclusive apps but can't justify buying an iPhone because of how restrictive it is. This act alleviates that.

- The app in question does not exist because the only existing app store run by Apple rejects it. Tough luck, no choice, but you still can stay safe.

Don't you agree that the latter situation is a strict subset of the former?

Also, if I were Apple, I would implement a one-click return to "safe defaults", and a prominent badge to tell Apple's software and setting from third-party.

I use MacBooks and iPhone, and I love their current form, but they are victim of their own success at one point, like how Intel just dragged its feet to just keep the performance gap enough to keep the lead. Maybe this can help us to see a better, more exciting Apple and tech ecosystem, no?

The last battery lawsuit brought us "Battery health" menu, and this is immensely useful, even if it only reads a couple flags and shows us what the iOS is doing.

This sounds like iPhone user argument. In Android world you can have multiple app stores, but if you want your app to be used you must be on Google one, because it has the most eyes. Facebook didn't create their own app store.

Custom App stores are fringe apps, with exceptions of f-droid which is source of open source apps and many prefer it to google play (and apps are frequently on both stores) and maybe samsung/amazon ones because they are preinstalled on some devices.

I don't think so. Another comment was mentioning how some desktop apps are built to install ONLY from a certain marketplace (eg Steam) so you can't install them from anywhere else. It could easily happen on iOS.

Competition

Direct downloads from websites isn't far off - I wouldn't be surprised if we very rapidly get to a place of each-app-is-it's-own-store for the purposes of complying with the law so you can freely download apps from websites.

It'll be Windows all over again, with all that implies.

That’s actually not possible though. For instance, Microsoft is likely to create its own app store, as is Adobe, Google, and obviously Epic, among the many others. So now I will have to install a bunch of app stores just to install different softwares.

I already have this problem on my gaming PC where I not only have a bunch of different app stores, but a bunch of different update tools, payment providers, logins (not just for the games, but for the app stores). It’s a freaking pain in the butt. I just want to play a game on my PC and I have to deal with crap like that. I don’t want it on my phone!

I guess most of "the rest of the world" will still be hindered by the price tag.

This isn't going to end well.