And we know for a fact that Apple despite all their claims to the contrary cannot do that.
Apple's (flawed!) review process still catches a lot of bad actors. Not all, and it has false-positives. That doesn't mean it's useless.
The (legit) question is: is Apple also using security as an excuse to make more money at the expense of customer choice? Because Apple absolutely doesn't need to be the only entity performing this task — I don't trust Epic, I think their business model is predatory on gambling addiction, that doesn't mean they would be incapable of performing the same kinds of security review — and while Apple's smooshing of all the different expenses from API development to review and hosting and processing fees into a fixed sales percentage is convenient, it does make it harder for competitors to emerge for each of those separate tasks.
I think it goes both ways. Perfection is letting me control the hardware I bought and tweak the software to my liking. them throwing their hands up because of their motte argument of "security" doesn't resonate with me. Especially when the bailey argument is simply "we want to control everything you do". Here, it's "don't even try to achieve good, avoid bad at all costs".
In my mind it's like closing a store down due to excessive theft in an area. That doesnt fix theft, it just takes away service from the honest customers.
Yes, I lose the power to do things; in exchange, I genuinely gain the security of some measure of defence against other people doing things at my expense. I remember when we could actually read all the code on our computers — that time has passed even when the source code is fully published simply because the volume is too great, and we must either trust someone to do it for us (or at least that someone has liability if it goes wrong), or have some manner of insurance because doing so is impractical.
Of course, corporations are not democracies, so the fight between Apple and Epic is to me as the fight between King John and his barons in 1215 A.D. — and my relative power compared to either corporation is as the power of a, I dunno, franklin or free peasants or something, as to the King and his barons.
If I need security, I buy anti-virus. But I can't opt out of Apples "security". I don't see that as a good thing. If apple wanted to offer that at checkout, I wouldn't mind at all.
Worst case scenario, I backup all my stuff. My phone exploding should not ruin any more of my livliehood than losing a few days of phone calls would. I can protect myself without some non-consentual agreement from a vendor whose relationship should end after the device ships to my address. that time has passed even when the source code is fully published simply because the volume is too great, and we must either trust someone to do it for us (or at least that someone has liability if it goes wrong), or have some manner of insurance because doing so is impractical.
>that time has passed even when the source code is fully published simply because the volume is too great, and we must either trust someone to do it for us (or at least that someone has liability if it goes wrong), or have some manner of insurance because doing so is impractical.
I'm not going to pretend I consult the AOSP everytime I hit an odd quirk on my android. But I like the ease of mind knowing I can take my ball and go home if Google goes rogue (and I can argue thst it has already done so, years ago).
I ultimate trust people mush smarter than me for that, but I like having more than one biased source to rely on. And heck, I might help contribute if angry enough. That's the power of open source. The best possible insurance when I go in loops under "official channels".
I can't opt out of the police.
I can opt out of Apple's security by using literally any other brand of phone.
> Worst case scenario, I backup all my stuff.
No, the worse-case scenario is that malware knows everything you look at and everything you type (like bank details), everything you're listening to in real life, your location, your health data, etc.… and can also be used to spy on you through all the phones of the people around you in much the same way even if you don't download any malware yourself.
(And how many of those things would Facebook like to do in the name of "improved advertisement targeting"? If they had full access to photo libraries rather than just what's uploaded to their servers, I'd expect them to try to analyse all my friend's photos that happen to include me for this exact reason, and I'd expect that data to be mis-used by malicious parties just like other ad data has reportedly been).
There's a lot of reason someone should be enforcing rules on this; not so much that it should be Apple doing it.
> whose relationship should end after the device ships to my address
So, not a fan of security patches? :P
> But I like the ease of mind knowing I can take my ball and go home if Google goes rogue (and I can argue thst it has already done so, years ago).
Given that Google has (arguably) already gone rogue, can you actually take your ball and go home? There's a whole subreddit for that, yet every time I've heard other people try, it turns out much harder than anticipated.
> That's the power of open source. The best possible insurance when I go in loops under "official channels".
I have no more reason to trust open source than closed source: underhanded-C contest; at least one example of a Linux distro doing exactly what I'd expect if they were under a secret government order; Reflections on Trusting Trust; the foot-gun nature of C++ combined with its popularity; the number of times someone else has told me to fix something in a PR or QA report where I never spotted the issue while writing the code myself; and the obvious motivations of intelligence agencies worldwide to insert backdoors.
macOS has implemented code signing and only allowing apps from the App Store or trusted developers as default for quite a while now but people still find a way to turn it off or bypass it and then get infected by malware/spyware/adware. Because it's expected that you can run any app on a desktop/laptop platform though, they can't just fully restrict it, and it shows.
To me, this is one of the main reasons to fight for an open iOS: if people get accustomed to corporations revoking access to their software for arbitrary reasons, and if the technology exists allowing them to easily do so, then the gradual introduction of these measures to PC platforms will be met with a collective shrug.
Without any intervention, it's a matter of when instead of if.
Or they leave it on, and install malware/spyware/adware anyways: https://www.pcmag.com/news/beware-theres-a-fake-lastpass-app...
So suffice to say, their whole security scheme leaves a bit to be desired.
Indeed, but always was it so, and always will it be.
Also, that story is exactly what I mean when I say that what Apple does is, despite the flaws, still better than nothing: you can't pull a fake app hosted on its own website — you might not even be able to go after the host or the domain registry without a court order, and even then the country in which they are based may not be on good terms with your own and may not care about that order.
The analogy here would be using a headline of the police arresting a criminal to say "this shows that the idea of using a police force to prevent crime leaves a bit to be desired". Yes, and?
You can stop signing it, or register the hash of the program as malware. There, that's two easy ways to stop end-users from consuming harmful software.
> The analogy here would be [...]
It's more like if the police was trying to rationalize some ridiculous security system (say, drones) that didn't help catch criminals in the first place.
The first requires them to be signed in the first place. That violates the prerequisite of your point because your words were "they leave it on, and install malware/spyware/adware anyways" — so that's not a way to actually stop end-users from consuming harmful software, by your own words.
The issues with the App Store are "Apple is a gatekeeper that gets to say no and we don't like the set of reasons they've given themselves to be allowed to do that" and "Apple is a gatekeeper that charges money and we don't like that charge".
The right to stop signing some app, the right to register a hash as malware, both have the exact same capacity for mis-use if you regard Apple themselves (or any other gatekeeper) as being a threat to your freedom. Unless you turn off "run only trusted apps", but again that violates the prerequisite of your point, because then "stop signing it" has no effect.
And come on, hashes? Self-modifying code was a thing when my compiler only output for 68k/System 7.
> It's more like if the police was trying to rationalize some ridiculous security system (say, drones) that didn't help catch criminals in the first place.
It's specifically an example of them catching a bad actor and stopping them. "Pulls" is right in the headline.
Given my cultural history, I sure do wish I could.
Regardless, police have people holding them accountable some 20% of the time. No one's holding Apple accountable in the US, apparently.
>No, the worse-case scenario is
Okay... I'm a regular Joe. That sucks but let's not pretend I'm leaking government secrets even if all that happens. I see bad malware on phone (with my data backed up), I reset my phone. It's software, not a serial killer.
You can argue identity theft and all that, but that's not a unique feature to IOS/Android/Windows/Linux. So I don't count that as a bonus/demerit to any given platform.
>I have no more reason to trust open source than closed source
I already gave a reason. The ball is in my court and I can take it home. There are bad actors but also good actors when bad actors arise. Thars a better check and balance than some conglomerate who never had my best interests in mind.
Back in the desktop days, Regular Joe had malware that they have no idea was on their system.
> (with my data backed up), I reset my phone. It's software, not a serial killer.
What it is, however, is a thief. Lots of people have juicy secrets, that's why privacy is important in the first place.
Malware is very good at keeping hidden these days, running unspotted for a long time.
Someone cleans out your bank account, or gets blackmail material on you, backup won't do jack. This is also why certain apps, including banking, include tests to make sure they're not on a rooted device.
> So I don't count that as a bonus/demerit to any given platform.
Sounds like you only accept silver bullet "solutions".
Scare quotes because nothing ever is.
The questions are "how often" and "where can be done about it", the answers are not "yes" and "turn it off and on again".
> I already gave a reason
And I showed why it wasn't sufficient.
If you think open source will keep you safe, you are treating it as the exact silver bullet you're criticising Apple for not being.
> Thars a better check and balance than some conglomerate who never had my best interests in mind.
There's no real balance, and the checks are insufficient — there are definitely bugs that only get spotted a decade later, there are definitely state-sponsored flaws in OSS code, definitely some cases of normal criminals buying off some projects, and definitely cases where we don't find out about these things until much later.
And of course, quite a lot of OSS projects are in fact directly funded and managed by a corporation — the cathedral and the bazaar have both blended into a metaphorical Amazon marketplace, complete with fake reviews for fake products.
Most of the security you gain is due to mechanisms built in the OS like sandboxing. Third-party appstores gain the same security by default.
I might agree that Epic should be prevented from publishing their apps, but by a Democratically elected government, not by a private warlord. If Epic is doing something wrong, that should be a matter of public law, not a matter for a king to decide.
The thing I'm referencing is Magna Carta, specifically where the conflict was over "can the King force me to use his own courts when I sue him?" — this didn't much affect the normal folk who never had to personally sue the king in his own personal courts.
Similarly, I:
(1) already had the ability to publish an app, and have done so on many occasions
(2) still don't have the means to start an entire app store because the obligations vastly exceed my competencies (and I don't have access to one million USD): https://developer.apple.com/support/alternative-app-marketpl...
> I might agree that Epic should be prevented from publishing their apps, but by a Democratically elected government, not by a private warlord. If Epic is doing something wrong, that should be a matter of public law, not a matter for a king to decide.
Sure, but this is the kind of thing we could — and others have and will anyway even if we don't — spend lifetimes arguing over every single nuance and subtlely of, including the extent to which a corporation is allowed to have the freedom to decide its own rules for who it does business with e.g. all the things Apple is doing (and all that Apple wants to refuse to do), or if the owner of a cake shop can refuse to do business with customers whose morals it disagrees with, and so on.
The only thing I'm sure of, is that I can't see the consequences of applying my first principles as if they were universal truths.
Your point is misdirection.
> and need to protected from harm
Yet Apple has no issue working for authoritarian regimes like Russia and China to protect those regimes and fuck over their users. Is that what you’re talking about? People are to dumb and stupid for democracy and therefore corporations like Apple need to prop up dictators to protect them?
I’m not even being facetious, looking at the actual facts and Apple’s behavior I don’t see how anyone can come to a different conclusion?
Not even the most brilliant hacker can say so. In other words: I don't agree. Users are dumb, and need to protected from harm. I don't want the Windows virus disaster all over again, especially because this time the stakes are considerably higher.
You can disagree with the fees, but for the rest my opinion is: live with the pain.