If the bad actors were all shady fly-by-night looking companies it’d be one thing. But once the gates are opened, if it’s easy enough, you’ll see people being pressured to open the gates by all sorts of companies that they will have no choice but to comply with. Imagine, for example, if your insurance company, in order to pay your bill, starts making you install the app through some alternate pathway that brings a side-dish of keylogging to adjust your rates based on your browser behavior.
> my bank didn't have an app
Exactly my reasoning last week when I read about one more dependency attack on GitHub.
Do you have a mac? What's your setup? I need CoreML so VMs are not an option, and I'm a freelancer so I use my own MacBook for work. I have a different session for each client, but at this point I don't even know if it's useful at all. Of course I also have a personal session with banking stuff... which is what made me realise I was probably doing something dumb.
Yes, two.
(Well, three, but the third is in a box waiting to go to recycling or someone who wants it "for parts", as that's from 2013…)
> What's your setup?
It's literally an entire second mac. I bought an MBAir/M1 second hand, then was given an MBPro/M1 Pro; the Pro became my main machine, the Air became my "mess around" box.
This isn't because of Apple, or at least it isn't in my case.
Even as an iPhone app developer with the means to do so whenever I want, and even though I find Apple's content restrictions derisory and "big brother"-y, I actively don't want a system that can install "whatever".
This is due to all the malware everywhere on the internet, and owing to this unfortunate reality, also means I think it is unwise even to have 3rd party libraries as project dependencies. I have an entire spare computer dedicated to learning scientific python because I don't feel I can rely on the absence of vulnerabilities in the stuff.
This makes me sad. I miss the old days of 2002 where I didn't feel any reason to worry about random apps from random websites. But part of my carefree youth was that I had a Performa 5200 running OS 8, which wasn't a popular targets for malware authors, and another big part was that my bank didn't have an app.
But before someone replies to point out that malware gets past the App Store tests: yes, of course it does, I see all this as a "defence in depth" strategy, not a silver bullet.