I like that more developers just reject software certification processes. There is zero benefit aside from lock in.
The argument that they could be better therefore they are worth nothing, is a clear fallacy.
I’m claiming that the App Store solution as it stands is better for most users than just freely installing apps from the web.
It’s not at all clear that the safety of just installing software without vendor lock in is getting better for most users.
In fact it seems to be getting worse.
You could still have trust mechanisms while downloading from sites where the author, not the walled garden, has the control.
Wouldn’t it be better to have the user have the control?
The walled garden does have problems, but I generally don’t see anyone adding any value to our understanding of how to replace it with something better.
It would, but the user has no control of the walled garden either. It's a situation where both the user and the author have little to no control, as well as poor feedback.
I'm not sure walled gardens, with their arbitrary rules, and opaque audit and review processes (which include not knowing how detailed their reviews are), are really a trusty safeguard against malicious authors. Whether you believe walled gardens protect you from malware depends on your definition of "malware".
It's not true that without the App Store there's a world of dangers out there. Author reputation goes a long way.
History certainly proves otherwise, as do the number of attempts at putting malware into app stores.
I’d go as far as to say that you are certainly wrong about this and you can trivially verify this by even the most cursory examination of software threat models.
Author reputation goes almost nowhere these days. It’s quite obvious why. There are a huge number of authors producing software.
It’s impossible for more than a few authors to develop a reputation, and even those that do face impersonation.
As to you not being sure how much protection ‘walled gardens’ give. They aren’t perfect, but they clearly work, and you can trivially verify that.
If you think the author or the user can solve these problems without an intermediary, it bears some explanation as to how exactly this could work.
Can you explain?
You haven't explained how the user has more control with walled gardens, a bold and unsupported assertion (I believe we both agree the author has less control with walled garden, at least).
> It’s impossible for more than a few authors to develop a reputation, and even those that do face impersonation.
The first part is a matter of opinion (and I disagree with you). As for the latter: do you really believe the only technical solution to author impersonation is a walled garden? No other form of establishing trust is possible to you? Interesting.
> I’d go as far as to say that you are certainly wrong about this and you can trivially verify this by even the most cursory examination of software threat models.
That isn't an argument. That's just you saying "I'm right and you're wrong".
In fact I have consistently agreed about the problems levied against the walled garden model.
I haven’t asserted that the user has more control with a walled garden, although I think they do in practice have more control with an App Store than with nothing.
I’d be curious how you came to the impression that I did - can you explain where I made that claim?
My claim is that walled gardens do introduce problems, but that they currently solve much greater problems for both users and developers than the ones they introduce.
The claim that it’s just safe for people to install software because it’s not dangerous out there is obviously false.
You can say this is just me saying ‘I’m right and you are wrong’, or you can do the most basic research on the amount of cybercrime and plain old scams and how much of it involves malware or impersonation of one kind or another.
If you think this problem doen’t exist, it would make sense that you don’t see the benefit of App stores, however to deny that it exists in this way is quite surprising, to say the very least.
The issue of reputation isn’t a matter of opinion. It’s a fact. How can I say that? All industries with a significant number of creators and a significant number of consumers have intermediaries. Only the most famous independent producers are independent.
If you can find a counterexample, I would be interested to know about it.
As for believing that the only solution to the issue of impersonation is a walled garden - I don’t know the answer to that.
Maybe some kind of distributed reputation and trust system that doesn’t involve a powerful intermediary is possible.
Perhaps some kind of blockchain or web of trust can be developed.
I’m not at all sure that this is possible - Apple’s attestation mechanism uses hardware keys to to create signatures that join a device, a particular user and an app binary.
Without the ability to link all three of these it’s hard to see how a software only solution would work.
But even if an alternative is technically possible, it quite obviously doesn’t exist today. If it did, you’d have just linked to it, and I’d have probably ordered whatever device would allow me to participate.
If you want to continue claim that App stores solve no real problems or that the problems are trivial, there are no dangers out there etc, then be my guest. I can’t change that belief in you.
If on the other hand, we have good solutions to those problems that don’t require an App Store, then I would love to know about them and if it’s true, I’ll happily concede that I’m wrong.
There are severe disadvantages though:
https://medium.com/vchaincodenotary/developers-unite-against...
Additionally, the most predatory kind of app milks your wallet and these come in signed and unsigned forms.
Also, quite a few companies with long time certs have leaked them pretty quickly. Primarily, it is a lock in mechanism with questionable security benefits. Predatory apps can be signed which would have been classified as malware 15 years ago.
Maybe those benefits don’t outweigh the downsides, but to say there is no user or developer benefit is objectively false in both cases IMO.
And of course there are benefits beyond lock-in.
Do you know about the attestation service Apple has introduced?
How would you build such a thing on your own?
Outrage based on the facts is definitely something Apple should face.
However outrage based on lies is simply another evil.
People who are engaging in it are not doing any kind of public service - they are just adding more harm.
1. A standard format and tools for code signing.
1b. Actively validating or rejecting code on the end user machine.
2. Purchasing and delivery of software.
3. Trust of code blobs.
They just don't need to be all handled by your OS vendor.
Additionally this is a Mac app and you can sideload apps on Macs
Now we can skip the part where somebody says that you can't have a monopoly on your own product and then I point out that monopolies always look like that because their product is the only one in the market, and the reason that android app stores and iOS app stores are different markets is that you can't install Android apps on iOS devices or vice versa.
Walmart doesn't have a monopoly on SAE 5w30 motor oil. You can't make it look like a monopoly when it isn't one, because when it isn't you can identify competitors who sell substitute products to the same customers.
> In the end both mobile platforms have practically the same popular apps.
The market they have a monopoly on is iOS app stores, not individual apps.
It's very straight forward. For Google Play to be in the same market you would have to be able to use it to install apps on your Apple iPhone. Since you can't, it isn't, and since there is only one app store that can, it's a monopoly.
Notice that it has nothing to do with the fact that Apple also makes the phones, outside of control over the phone being used to enforce the app store monopoly by locking out competitors. If Amazon for some reason had the only app store for Apple iOS devices, they would be the one with a monopoly in that market.
A phone is a natural monopoly.
This would be more akin to buying a Ford and then discovering you could only buy parts, motor oil, etc. by visiting your Ford dealer.
> Now we can skip the part where somebody says that you
> can't have a monopoly on your own product
> monopolies always look like that because their product is the only one in the market, and the reason that android app stores and iOS app stores are different markets is that you can't install Android apps on iOS devices or vice versa.
You being tired of it doesn't change anything. ¯\_(ツ)_/¯
As a developer I want a store where someone is investing in the safety and security of the ecosystem.
If I want Apple to be able to be able to remove malware from the store, I obviously have to accept that if I make malware, then they may remove it.
The arguments about what they are somehow holding back are completely without merit.
It’s not expensive to buy an Android phone.
Android phone allow both sideloaded apps and alternate stores.
Where are the amazing Android apps that are only possible through side-loading?
Most people here are from Silicon Valley and Apple is the biggest employer over there.
Try to badmouth Samsung in a Korean sub and you get the same treatment.