Apple has turned popular opinion against startups and the little guy so much that we're saying these things out loud to one another. Seriously?

Apple has too much power. Just like Google on the web.

Dealing with a little more pain and friction from marketing, in exchange for freedom for our devices and distribution of power, would be worth it.

I don’t want a direct relationship with developers. I don’t want to go to their website to subscribe or to cancel my subscription and I don’t want to give them my credit card information.

I want to be able to use “Sign in with Apple” and not give them my real email address.

Surely there's a compromise solution here? I don't see why Apple couldn't grant trusted certificates to good actors and revoke certificates from bad actors in regards to pasteboard access?

You already have a compromise: you can, if you insist and if your user consents--not Apple through some "trusted certificate" granting process but the user themselves--choose to not follow standard system flows. Or you can follow standard system flows and receive implicit consent by the user when they click 'Copy' in the share sheet.

Why is seeking consent so terrifying a prospect? And why should anyone privilege "your flows" over that consent?

My issue is with Apple acting as the arbiters of what consent looks like. You have to consent with the flow to go through with it, right? Nobody's forcing our users to continue.

And like I have already said, it's not like we can't do what you're suggesting. In fact, we have, but that it equates to more churn in our flows because users get confused or are fatigued by the amount of hoops they have to jump through to make the product work, which was my original point to this whole thread.

Apple does not have a trusted relationship with you, the software developer. And Apple doesn't know about a trust relationship between the user and the software developer until the OS sees confirmation from the user.

It then follows that consent must be given at or inside the security boundary to be provable; the web page you refer to is outside of it. You are asking to move from a less trusted environment (a web browser, generally watched like a hawk) to a more trusted environment (an application, with additional implicit permissions and the explicit ability to ask for others). That isn't a decision you are allowed to make and it isn't something that, for all Apple knows, you confused-deputy'd your way around a user's affirmatively consenting to.

It's turtles all the way down. You have to acquire consent at a trustable level. That means the OS or, if the OS isn't sure, the user themselves, through an OS-verifiable method. Sorry that your third-party vendor doesn't count, but it shouldn't. "Just trust me" isn't security.

"But nobody cares" might be next up, so let's settle that now: nobody cares because they pay Apple to care for them.

Yeah, they do, because they have to trust the certificates and entitlements that my app is signed with. All I'm asking for is an extension of that same idea to other parts of the app experience.

I just don't think we're going to agree on this, and that's fine. Care to call it a day and we can respectfully both walk away?

That's a 401 vs 403 distinction. They know who you are, they don't know that you're authorized to do this.

Are you willing to provide signed proof that the user consented to this action? The same way you provide signed code to prove you're the one uploading the code. Presumably this would have to be via a key that you don't have access to (only the user would be able to consent to this).

Because that seems like the parallel here.

Technically, apple should be auditing your flows at that point too, to make sure there aren't any dark patterns.

But, yeah, at that point, I think you could make that argument stick.

They do not have the capability to exhaustively check all uses thereof in a way that obviates the need for a user to consent to having you monitor their pasteboard.

They could develop it, expending significant resources on an edge-case for a tiny fraction of app developers, or they could ask the user for permission because the user has the context to expect this request (or to not).

What I'm suggesting is a predicate like only allow NSPasteboard access without prompting iff the predicate passes something like let predicate = NSPredicate(format: "SELF MATCHES %@", "^/.\\?var=.$")

I don't think you know what you're talking about.

It's important to note that this is not an issue for apps that are already installed: we get those links and their data; this is just a first-ever launch issue.

The flow is click link, copy data or finger print, redirect to the App Store, install, user opens app for the first time, route to experience from finger print.

Diligently creating a business which turns a healthy profit for a fair exchange with the customer is less profitable than developing a large customer base that could be sold to someone.

Say what you will about the big players... there is no exit strategy. They are in the endgame.

Unless this is a reference to the fact we are having the conversation on the Y Combinator website specifically, it's is a fallacious argument to suppose that the only way any of our current technology could happen through the historical accidents that have occurred.

The nature of complex systems mean that larger systems process more information relevant to their continuance are more successful.

I do agree with the point underlying your rhetorical question. I am just not so certain we should be grateful for naked self interest.

If you don't trust me, just look at the web. How it lost the cache for static asset; visited link css; popup window, etc

As to the rest of your post: the app developer in this thread is saying Apple should give him and his friendos special permissions ("trusted certificates") to not ask the user whether the user trusts them, and you're saying it's Apple's decision to require a user to affirmatively consent to having their pasteboard read by an app that is thuggish?

One of these is actually on my side as a user, and it's not the marketer and it's not you.

But trying to deter such app developer to gather as much PI as possible is even better as it is preventive.

This is like chrome saying you can’t go to anything other than the root path of a site the first time you go there.

totally different things.

Why is the open and clear obtaining of consent so clearly anathema throughout this thread?

We're not afraid of marketers at all. We simply despise them.

The more roadblocks Apple puts between us and the marketers, the better it is. You have no right for our eyeballs.

People were spoiled on the old Internet, like pre-2010, where a simple adblocker meant you could just see all content, ad-free, with virtually no paywalls. It seems like because that’s changed now, they feel they have been robbed of their birthright.

By “start up” and “little guy” you of course are referring to complete strangers with close to zero reputational risk at stake who are handling my private data? Those people?

Apple had nothing to do with my distrust. Plenty of bad actors just like them have done that all on their own.