> But now, thanks to emails published as part of Apple's trial against Epic Games, we finally know how many iPhone users were impacted: 128 million in total, of which 18 million were in the US.
> "In total, 128M customers have downloaded the 2500+ apps that were affected LTD. Those customers drove 203M downloads of the 2500+ affected apps LTD," Dale Bagwell, who was Apple's manager of iTunes customer experience at the time, wrote in one of the emails.
> Apple also disclosed the apps that included the malicious code, some incredibly popular such as WeChat and the Chinese version of Angry Birds 2.
Still a huge deal, particularly in China, but considering all the virus really did was collect some device info (less information than most ad networks) (and maybe it was able to open URLs and popups on command)[1] and it was the biggest virus on the App Store ever (that I can find), maybe not as awful as you suggest.
The scams on the App Store, yeah that's pretty bad. Though, can you point me at a marketplace as big as the App Store without loads of scams?
[1]: https://www.lookout.com/blog/xcodeghost#what-does-it-do
You are shown that this is by no means as secure as they want you to believe.
Then you argue that "of course, with a market that big!"
So basically you are proving that Apple uses the excuse of security to hold a monopoly.
Suppose there were multiple app marketplaces for iOS. Then some of them could be extremely selective by finding a niche, and thereby be more trustworthy than any unified store that has to carry a million general purpose apps with only cursory evaluation from various publishers of little or unknown reputation.
Not the person you're replying to but isn't that the point?
Nah, that would mean that what really protects iOS users from malwares is just a good sandboxing mechanism and not the "human" control of the App Store. That would also mean that bypassing the App Store shouldn’t be a real security issue.
The question is whether there’s more malware on stores like f-droid, and the answer is yes, there is of course significantly more malware.
This even pollutes the official Play Store to some extent because of course google can’t put the foot down too hard when Facebook et al can simply “start their own app stores” to bypass review if they really want to. Malware rates are much higher on android in general.
https://arstechnica.com/information-technology/2020/09/joker...
GNU/Linux repositories.
https://nitter.net/npm_malware has twenty postings in the last 19 hours, quite far from "without".
Probably OP was thinking about the deb and rpm repositories of the main distributions but yes, NPM and the likes are other examples of large repositories.
I agree there are linux-only repos that are ~1% of that size and contain little or no malware or abuse. That's true whether you measure size in updates per day or total count of packages, so 1% seems reachable without considerable malware problems.
Another plausible explanation is that pure FLOSS repos are free fron malware.
No, it's not even a Linux package repository. Think repositories for Debian, Fedora, Arch, etc.
I don't think either Debian, Fedora or Arch are anywhere close to a million packages or a thousand updates per day. Well below 10%, so they're GNUish and 100% linux, but really bad on the size axis.
The app store has at least two classes of problems that those three don't have, and have to handle the problems at much higher scale. "Those guys manage to handle a simpler problem at much smaller scale, so it's possible for the app store too" is hardly an argument.
As long as a FLOSS repo is small and has few uploaders, it'll be safe. Hardly a model for a big and busy repo like the app store, of couse.
The distinguishing feature of Linux distributions is the existence of maintainers. Human beings who put in effort into maintaining the quality and integrity of the packages and keeping them up to date. We Linux users generally trust those people, and they stand between us and all the software developers out there. To get to us, you gotta go through them. And they generally aren't in the habit of allowing obvious malware into the software repositories. That's why we trust them in the first place.
Contrast that to repositories like npm, pypi, rubygems, cargo which are all designed so that any random person can make an account and push up any package they want. There's no checking. Accounts might be compromised by or outright bought by malicious actors. Just like popular browser extensions which get bought and converted into malware.
Maybe the issue is being so big then. Which is exactly why the EU did this in the first place. So Apple has yet another lever to comply: reduce their size.
so, is it "safer"? what's "safer" about it? or is it really just a meme apple has successfully perpetuated about it's limitations?
A year ago, I also saw a fake advertisement for a squid game. These fake advertisements have already become a meme, but they also offer to download from Google Play a slightly similar game, where after quickly clicking on the screen, the smartphone will suddenly prompt you to buy an expensive subscription and then you will not be able to cancel it, because Google does not provide for them refund. This idea comes from SMS scams since j2me platform, and judging by the comments on this game, people are still losing money, especially if they leave their phones to children.
I don't use ios and won't say whether manual moderation there helps prevent the same crap, but let's not ignore that if you're not tech-savvy, this Android security alternative is pretty easy to get around.
funnily enough, some bits of it might be worse because ios and app store are promoted as 'being secure' period, almost unequivocally - so it ends up being a thing like 'well, ios is secure and this app is on the store, so it's all good, right?", which doesn't always happen to be the case.
AFAIK, This cannot happen on Apple.
I think that this is faith, not objectivity - which is misplaced in this specific scenario.
The challenge isn’t market dynamics, but rule breaking and predation on victims.
Non tech inclined people are targets/marks for bad actors.
Malicious websites, innocuous messages, hard to avoid buttons - are all designed to circumvent good intentions.
This is resolved with rule enforcement, retributive and governance powers.
If we are adamant about competition, then apple being locked down while Android remains open is about the best you will see.
these questions are silly if you pivot them to be about other things rather than the fruit company, just like the arguments that "[company] needs to run open-infrastructure so other companies can build commercial products on [company] servers".
It's rather obvious they're being asked in bad faith with the intention of dragging down the discussion. You know perfectly well what SELinux and application sandboxing are for, and that they're net benefits.
Tech journalists have literally warned Android users that they need to be wary of apps from inside Google's walled garden.
> With malicious apps infiltrating Play on a regular, often weekly, basis, there’s currently little indication the malicious Android app scourge will be abated. That means it’s up to individual end users to steer clear of apps like Joker. The best advice is to be extremely conservative in the apps that get installed in the first place. A good guiding principle is to choose apps that serve a true purpose and, when possible, choose developers who are known entities. Installed apps that haven’t been used in the past month should be removed unless there’s a good reason to keep them around.
https://arstechnica.com/information-technology/2020/09/joker...
Also, most of my apps come from fdroid anyway.
Many, many people game the system in terms of in-app payments, e.g. showing a link to subscribe on their website but hiding the link for the review.
If they can't catch that, why do you they can catch anything?
Apple is well aware of this and plays into it hard.
That's because people are idiots. There's nothing that iMessage does that whatsapp, telegram, kakao, line can't do. In fact, US/Canada are the only ones that actually use SMS or iMessage, as far as I know, and the rest of the world use other messaging apps. I have been living in Canada for 5 years already, and in no instance I had any issue whatsoever. I now use iPhone, but nobody talks to me via iMessage, it's all either Messenger or Whatsapp, or Instagram
If Apple is able to hold such a stronghold over Americans because of something so easily bypassed, then you deserve to be controlled, really.
Apple has been repeatedly requested to change the colour to a less ugly shade, or to give users the choice to disable the feature or to give Android apps an API of some sort so they can comply with whatever Apple's requirements and get the blue text boxes.
Apple hasn't taken action because they like the current state of affairs, they want the social ostracism of non-Apple users.
That part of the market not being separate from the other part of the market is the issue. There could be a dozen different reasons that someone might want an iPhone over some competitor, and if they buy one for that reason, they're stuck with Apple's store even if they would have chosen something else given the option.
Not only that, the markets are tied together in both directions.
Suppose that you do want to go into competition with Apple and Google and make your own competing phone platform. The biggest problem you're going to have is that people expect you to have a lot of apps available for your phone before they'll buy one, but you have to have a lot of customers before anyone will make apps for your platform.
The traditional way to solve this is by creating a cross-platform framework and then giving developers an incentive to use it, generally by making it easy to distribute apps to existing platforms. For example, Valve wants game developers to develop for SteamOS, so they provide cross-platform frameworks and a distribution system that also works on popular incumbent platforms like Windows. Then developers make games that run on Windows and incidentally also on Linux/SteamOS, and now there are more games available for SteamOS than ever before and it's the most promising competitor to Windows for PC gaming in a long time.
Conversely, Microsoft is prevented from making an app store for iOS, so they can't do that and their ambition to create a viable competitor to Apple and Android faltered. Likewise Ubuntu Touch and Firefox OS and every other attempt to create a viable alternate phone platform. And then you say "just buy a different phone platform" -- as if that wasn't the problem.
I take care of Android devices used by elderly people, and they have just zero issues. Not anymore than they would have with iOS.
All this is nonsense talk trying to help the indefensible position of Apple. Most people also use Windows computers with no monopolistic app store and even though sometimes they are problems they almost always come from user errors. Most of the time it's poor choices, generally from greedy behavior (trying to get stuff for free without knowing much).
If a user doesn't know what it's doing, it can ask someone for help or stick with Apple's App Store if that suits him. Allowing other possibilities for more competent people doesn't change this fact one bit.
Her phones become really slow because of this.
In fact, their notification system makes it complicated to just allow specific behavior and not something else. It's not better than the notification settings in typical web apps. As a day one user of iOS, I find it funny that you complain about notification out of all things, because if there is one place where iOS is just as fucked as every other platform it's notifications...
Nowadays I have resorted to basically denying notification for everything but the few stuff where they are actually relevant...
Also, you should correctly set things up for your mother and refuse notification prompt for every website and just whitelist the few that might be usefull..
Sorry but the actual statistics from mobile security companies that track this stuff show otherwise. From Nokia's Threat Intelligence Report 2020 (https://pages.nokia.com/T005JU-Threat-Intelligence-Report-20...):
Among smartphones, Android devices are the most commonly targeted by malware. Android devices were responsible for 26.64% of all infections, Windows/PCs for 38.92%, IoT devices for 32.72% and only 1.72% for iPhones.
Android malware infections are an order of magnitude higher compared to iPhones.
(I tried to look for data from more recent years but iPhones don't show up in the reports after 2020.)
Which is ironic, considering that the App Store is likely one of the largest malware distribution vectors on the planet.
Looking at one virus alone, the App Store distributed half of a billion copies of it to iPhones and iPads[1]. Similarly, there are multimillion dollar scams on the App Store, as well[2].
[1] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...
[2] https://www.theverge.com/2021/2/8/22272849/apple-app-store-s...