I can't opt out of the police.
I can opt out of Apple's security by using literally any other brand of phone.
> Worst case scenario, I backup all my stuff.
No, the worse-case scenario is that malware knows everything you look at and everything you type (like bank details), everything you're listening to in real life, your location, your health data, etc.… and can also be used to spy on you through all the phones of the people around you in much the same way even if you don't download any malware yourself.
(And how many of those things would Facebook like to do in the name of "improved advertisement targeting"? If they had full access to photo libraries rather than just what's uploaded to their servers, I'd expect them to try to analyse all my friend's photos that happen to include me for this exact reason, and I'd expect that data to be mis-used by malicious parties just like other ad data has reportedly been).
There's a lot of reason someone should be enforcing rules on this; not so much that it should be Apple doing it.
> whose relationship should end after the device ships to my address
So, not a fan of security patches? :P
> But I like the ease of mind knowing I can take my ball and go home if Google goes rogue (and I can argue thst it has already done so, years ago).
Given that Google has (arguably) already gone rogue, can you actually take your ball and go home? There's a whole subreddit for that, yet every time I've heard other people try, it turns out much harder than anticipated.
> That's the power of open source. The best possible insurance when I go in loops under "official channels".
I have no more reason to trust open source than closed source: underhanded-C contest; at least one example of a Linux distro doing exactly what I'd expect if they were under a secret government order; Reflections on Trusting Trust; the foot-gun nature of C++ combined with its popularity; the number of times someone else has told me to fix something in a PR or QA report where I never spotted the issue while writing the code myself; and the obvious motivations of intelligence agencies worldwide to insert backdoors.
macOS has implemented code signing and only allowing apps from the App Store or trusted developers as default for quite a while now but people still find a way to turn it off or bypass it and then get infected by malware/spyware/adware. Because it's expected that you can run any app on a desktop/laptop platform though, they can't just fully restrict it, and it shows.
To me, this is one of the main reasons to fight for an open iOS: if people get accustomed to corporations revoking access to their software for arbitrary reasons, and if the technology exists allowing them to easily do so, then the gradual introduction of these measures to PC platforms will be met with a collective shrug.
Without any intervention, it's a matter of when instead of if.
Or they leave it on, and install malware/spyware/adware anyways: https://www.pcmag.com/news/beware-theres-a-fake-lastpass-app...
So suffice to say, their whole security scheme leaves a bit to be desired.
Indeed, but always was it so, and always will it be.
Also, that story is exactly what I mean when I say that what Apple does is, despite the flaws, still better than nothing: you can't pull a fake app hosted on its own website — you might not even be able to go after the host or the domain registry without a court order, and even then the country in which they are based may not be on good terms with your own and may not care about that order.
The analogy here would be using a headline of the police arresting a criminal to say "this shows that the idea of using a police force to prevent crime leaves a bit to be desired". Yes, and?
You can stop signing it, or register the hash of the program as malware. There, that's two easy ways to stop end-users from consuming harmful software.
> The analogy here would be [...]
It's more like if the police was trying to rationalize some ridiculous security system (say, drones) that didn't help catch criminals in the first place.
The first requires them to be signed in the first place. That violates the prerequisite of your point because your words were "they leave it on, and install malware/spyware/adware anyways" — so that's not a way to actually stop end-users from consuming harmful software, by your own words.
The issues with the App Store are "Apple is a gatekeeper that gets to say no and we don't like the set of reasons they've given themselves to be allowed to do that" and "Apple is a gatekeeper that charges money and we don't like that charge".
The right to stop signing some app, the right to register a hash as malware, both have the exact same capacity for mis-use if you regard Apple themselves (or any other gatekeeper) as being a threat to your freedom. Unless you turn off "run only trusted apps", but again that violates the prerequisite of your point, because then "stop signing it" has no effect.
And come on, hashes? Self-modifying code was a thing when my compiler only output for 68k/System 7.
> It's more like if the police was trying to rationalize some ridiculous security system (say, drones) that didn't help catch criminals in the first place.
It's specifically an example of them catching a bad actor and stopping them. "Pulls" is right in the headline.
Given my cultural history, I sure do wish I could.
Regardless, police have people holding them accountable some 20% of the time. No one's holding Apple accountable in the US, apparently.
>No, the worse-case scenario is
Okay... I'm a regular Joe. That sucks but let's not pretend I'm leaking government secrets even if all that happens. I see bad malware on phone (with my data backed up), I reset my phone. It's software, not a serial killer.
You can argue identity theft and all that, but that's not a unique feature to IOS/Android/Windows/Linux. So I don't count that as a bonus/demerit to any given platform.
>I have no more reason to trust open source than closed source
I already gave a reason. The ball is in my court and I can take it home. There are bad actors but also good actors when bad actors arise. Thars a better check and balance than some conglomerate who never had my best interests in mind.
Back in the desktop days, Regular Joe had malware that they have no idea was on their system.
> (with my data backed up), I reset my phone. It's software, not a serial killer.
What it is, however, is a thief. Lots of people have juicy secrets, that's why privacy is important in the first place.
Malware is very good at keeping hidden these days, running unspotted for a long time.
Someone cleans out your bank account, or gets blackmail material on you, backup won't do jack. This is also why certain apps, including banking, include tests to make sure they're not on a rooted device.
> So I don't count that as a bonus/demerit to any given platform.
Sounds like you only accept silver bullet "solutions".
Scare quotes because nothing ever is.
The questions are "how often" and "where can be done about it", the answers are not "yes" and "turn it off and on again".
> I already gave a reason
And I showed why it wasn't sufficient.
If you think open source will keep you safe, you are treating it as the exact silver bullet you're criticising Apple for not being.
> Thars a better check and balance than some conglomerate who never had my best interests in mind.
There's no real balance, and the checks are insufficient — there are definitely bugs that only get spotted a decade later, there are definitely state-sponsored flaws in OSS code, definitely some cases of normal criminals buying off some projects, and definitely cases where we don't find out about these things until much later.
And of course, quite a lot of OSS projects are in fact directly funded and managed by a corporation — the cathedral and the bazaar have both blended into a metaphorical Amazon marketplace, complete with fake reviews for fake products.
If I need security, I buy anti-virus. But I can't opt out of Apples "security". I don't see that as a good thing. If apple wanted to offer that at checkout, I wouldn't mind at all.
Worst case scenario, I backup all my stuff. My phone exploding should not ruin any more of my livliehood than losing a few days of phone calls would. I can protect myself without some non-consentual agreement from a vendor whose relationship should end after the device ships to my address. that time has passed even when the source code is fully published simply because the volume is too great, and we must either trust someone to do it for us (or at least that someone has liability if it goes wrong), or have some manner of insurance because doing so is impractical.
>that time has passed even when the source code is fully published simply because the volume is too great, and we must either trust someone to do it for us (or at least that someone has liability if it goes wrong), or have some manner of insurance because doing so is impractical.
I'm not going to pretend I consult the AOSP everytime I hit an odd quirk on my android. But I like the ease of mind knowing I can take my ball and go home if Google goes rogue (and I can argue thst it has already done so, years ago).
I ultimate trust people mush smarter than me for that, but I like having more than one biased source to rely on. And heck, I might help contribute if angry enough. That's the power of open source. The best possible insurance when I go in loops under "official channels".