Hacker News Reader

Comment by moksly | Hacker News Reader

I don’t think anyone who uses an iOS device wants epic to win. Most of us are specifically in the walled garden because we just want our tech to work.

Would I rather have an open source system, including for my phone, that works as well as Apple things? Sure, but there is no such thing.

View on HN

I have been an iOS developer for more than a decade and I will never buy another brand of phone unless Apple manages to ruin the ecosystem.

I want Epic to win. Devs should be able to distribute their apps to consumers without Apple dictating style guidelines or which features are/aren't allowed on a general purpose computer. The iPhone and iPad are general purpose computers and Apple wants to pretend they are not.

I've shipped a ton of (legit, non-spam, useful, popular) apps over the years, but there are 2 I was never allowed to ship simply because they didn't fit in to Apple's rules... which were not even explicit, it tooks several rounds of review feedback to land at the final rejection.

Once that happened it made me wonder just how many products out there simply aren't allowed to exist or are intentionally handicapped because Apple said so. We should work to end it.

As someone who has jailbroken almost every iPhone I've owned I am very familiar with whole categories of apps that can't be distributed through the App Store. That said, how do you handle the FB's of the world or other bad actors who will (ab)use private API's if they no longer have to follow Apple's rules?

I could see Apple offering a new entitlement for payment processing, maybe with defined endpoints for canceling/managing subscriptions but 3rd party app stores open a whole can of worms. Can Apple lock down their private API's? Maybe, but I feel that will lead to a cat and mouse game where apps have lots of code testing to see what they can reach out and access on the OS version they are installed on. Sure, the FB through the official App Store won't be doing that but the FB distributed through Facebook's own App Store will. We've already seen what FB will do when given unchecked ability to distribute apps (see Onavo, FB's VPN to spy on users). Do you really think that end users will care that they installed an app through a seedy 3rd party app store? No, they will blame Apple if their data is stolen/privacy invaded.

I can already see the "promos" apps like FB or scummy games will run to get you to install them via some app store which isn't vetting the apps. "300 free coins if you install via AppStorez".

>That said, how do you handle the FB's of the world or other bad actors who will (ab)use private API's if they no longer have to follow Apple's rules?

how does Google or Windows handle it? This idea isn't novel, and there are billions already spent on antivirus initiatives, regardless of how open or closed the platform is.

I wouldn't be surprised if people blamed Google for a variety of things they downloaded on Chrome or an android device, but I haven't heard much traction being gained on how responsible google is for what users download from the internet.

> they will blame Apple if their data is stolen/privacy invaded

This is something that happens currently because Apple has decided they are the sole distributor of apps, with their explicit approval implying that the app is good and wholesome.

I think you only need to look to Windows and macOS users to understand that people don't hold the platform fully responsible, and rightfully so.

> Do you really think that end users will care that they installed an app through a seedy 3rd party app store?

Apple certainly will care, and they can and have rejected signing certs on Mac. For better or worse (Apple still having final say on what constitutes malware), I think this is fine (for now).

> Can Apple lock down their private API's? Maybe, but I feel that will lead to a cat and mouse game where apps have lots of code testing to see what they can reach out and access on the OS version they are installed on.

Yeah, sounds great. Look at where Windows security is compared to 10 years ago. Things get better over time and that only comes through testing the limits.

Apple has a lot of money and they can certainly hire the experts to work on these hard problems.

I want Epic to win. It's fine if you want to have Apple as an option. It's not fine to have Apple as the only option. Apple should either allow 3rd party IAPs or 3rd party app stores. Having neither is Apple abusing it's power and forcing it on consumers.

You've made some statements there but provided no context. Why is it a bad thing? I've been on the platform since 2007 - the App Store has been around since 2008. To date, I have had exactly 0 issues. Annecdata for sure, but I'm clearly not the only one to have this experience.

I feel I could flip the question around, why is it a bad thing that users can use other sources to retrieve and download apps? This is already the default line of thinking with a PC.

Most people will not be taking advantage of this option; many won't download outside the IOS store, and many companies won't make a new storefront to get around 30%. because hosting a storefront is expensive. Fortnite took themselves off Google play and they likely lost a lot of sales. But that's on them to decide.

Why is it a bad thing to give a dev a choice of hosting powers? If you don't, they find loopholes that inconvenience the user regardless. e.g. you cannot sign up for Spotify or Netflix through your IOS device.

But you can just buy an android. What you can’t do, is break Apple and then still have an Apple option for those of us who really don’t want an android phone.

This is a false dichotomy - you don't have to choose between a locked-down walled garden and a chaotic free-for-all. There is a lot of space in-between.

The whole point of more choice is that you can choose. Why would this affect you?

Imagine what Facebook's app would do if they didn't have to play within App Store rules.

It would be WeChat, which is an entire ecosystem and OS within itself. Apple seems to regret letting that one through and is determined to not let it happen again.

You can choose not to install their app unless it’s provided through the App Store.

It would be a significant barrier to entry for them to completely remove it, and I imagine they would lose many users if they did so.

Who is responsible for issues caused by Epic's store? What are the ramifications from an API point of view? Will having another store change the limitiations imposed on what can or can't be done? If so, people already have a choice - Android.

The OS limitations are separate from the storefront.

The Epic launcher on Windows can’t provide more underlying functionality than Steam, but it can compete on pricing and features.

So what value does an alternative store provide? (No snark intended, genuine question)

The option to install applications that are censored by the the Default App Store for whatever reason.

Plus, this case probably has pretty far reaching implications on the future of computing. If Apple is allowed to lock down their phones & tables, can they do so with Mac OSX? If Apple can do so with OSX, can Microsoft do the same and lock down Windows to prevent apps from being installed outside of their App Store?

If Microsoft can lock down Windows like iOS/OSX, can Dell lock down their servers to prevent other operating systems from being installed?

Apps and in-game purchases could be cheaper. In theory, Epic could pass all that 30% apple cut in savings you.

Another reply said "censor" which implies speech, but Apple's rejections can be more fundamental.

Have an app you want to ship? Apple gets to decide whether you meet "minimum functionality requirements". You cannot distribute your app to paying consumers without their approval.

Doing something truly unique, perhaps with some hardware in the phone? Apple may decide they simply do not want this feature in an app on the App Store. Which means you cannot distribute your app to consumers.

I'm less concerned about having other "stores," I just want a way to buy apps from legit developers that don't involve Apple dictating look and feel and entire feature sets.

You know, the same way I can purchase and run software on a Mac without Apple being involved in the transaction.

Apple's rules are completely arbituary, so many apps simply don't exist due to vague guidelines. There are zero 4chan apps on the app store, but a dozen reddit apps (which is ironic given recent news over there). There are dozens of these odd edge cases based on Apple's whimsy that just means there are zero IOS options for what Android has dozens of, even before getting into "obviously" banned content like adult apps and piracy.

So while a few (like, literally 5-10) blockbuster game companies may take the PC launcher route if this wins, there are several smaller time apps that can benefit form this if the app store wasn't the only source of downloading here.

Being able to have Microsoft XCloud (and other cloud gaming) as a native app instead of forced to only have the Apple games/arcade.

This is one example of a completely legitimate scenario in a very popular entertainment category and yet it's blocked because of Apple's arbitrary rules of what you can do on your own device.

It still has to run on the IPhone and ask for location, ad ID, etc. from iOS. Where the app comes from doesn't change that it must make the same system calls as everything else.

Except if they weren't subject to App Store rules they would likely bypass the advertising ID and do their own fingerprinting instead.

You're logged into the app. They don't need to fingerprint anything.

Maybe in the Facebook app, but not necessarily in the Facebook SDK which is integrated by other apps for ads/auth/analytics.

SDK abilities don’t depend on the storefront, that’s up to the OS. Apple store is just informational.

Either way users should be able to choose what they install and from where.

All apps on iOS need to pass App Store review, which means all apps that integrate third-party SDKs need to ensure those SDKs don't violate App Store policies, including policies on fingerprinting. Apple has already started to deny approval of apps using third-party SDKs that violate user tracking policies on iOS 14.

You can do your own without dealing with SDKs.

This isn't a problem if Apple ups their game and actually competes to keep people on the App store despite having real choice.

Of course you can. You're entirely missing the point, which is that without a review process that sets explicit limits for how data can be used, developers will abuse system APIs to violate user privacy.

So be more strict with system APIs?

We can go back and forth forever with what-ifs. It's nothing we cant overcome in the future.

Restricting APIs doesn't solve the problem because there are plenty of APIs that apps need for legitimate purposes but can be abused by bad actors. Many of the APIs used for device fingerprinting would fall under this category.

Apps on the app store already do this.

There's a difference between sneaking through App Store review and not enforcing anything at all. People still shoplift even though theft is a crime, that's not an argument against having laws.

No. Apple provides a door (advertising ID) but there's also a window (fingerprinting). Right now both things exist. Apps already have the ability to fingerprint users with data they collect and that's not sneaky.

That's a strange argument though. Apple forks over an advertising ID so that any app can fingerprint you with a single system call yet you complain that more apps might in the future fingerprint you themselves.

The difference is the advertising ID can be disabled or reset by the user, and Apple has started blocking apps that use fingerprinting SDKs during app review. (https://9to5mac.com/2021/04/01/app-store-now-rejecting-apps-...)

Without app review there would be no practical way for end users to avoid fingerprinting.

> That's a strange argument though.

Only if you don't consider consent. A user opting-in and enabling the advertising ID is very different from a bunch of apps using third-party SDKs to fingerprint their device without asking.

What does it do on Google's app store? If they are still playing by google's rules, why would they take themselves off Apple's store? is Apple's data more valuable than Google's?

These kinds of theoreticals have likely already been addressed with Apple's biggest competitor. Androids aren't known to be virus ridden privacy compromising devices. At least, no more than any device with communication antennas installed.

> Androids aren't known to be virus ridden privacy compromising devices.

I mean, statistically, they kind of are. From Nokia's Threat Intelligence Report for 2020 (https://www.nokia.com/networks/portfolio/cyber-security/thre...):

Figure 3 provides a breakdown of infections by device type in 2020. Among smartphones, Android devices are the most commonly targeted by malware. Android devices were responsible for 26.64% of all infections, Windows/PCs for 38.92%, IoT devices for 32.72% and only 1.72% for iPhones.

statistically, maybe. But it's more about mindshare in cases like these. IoT devices based on your report is even more prone to compromises, but there's not much fear for a person's fridge being compromised.

And as always, these cases come down to how many people really concern themselves with that risk. Windows has had that reputation, but it hasn't helped Apple that much in terms of Mac adoption, let alone Linux.

I'm not sure why mindshare is relevant? You might not worry much about your fridge being compromised, but these days smartphones contain a lot of personal data which could be very problematic if compromised. There is even Android malware out there that steals 2FA codes.

>I'm not sure why mindshare is relevant?

because many people commenting on security and privacy aren't necessarily experts on such topics. Their interpretations of what is secure or not comes from marketing and word of mouth.

If you look at the stats in an extremely stark interpretation; no device is perfectly secure (0%), but no device is so malware ridden that you are more likely than not to be compromised (50%). most users will be safe as long as they don't go out of their way to disable default security settings, and few need to. In that way, privacy won't be the main factor determining why a user purchases a device or chooses an OS.

In that respect, What a user feels (or what their immediate bubble feels) has more weight than any statistical reality. Or in other words, "mindshare".

Reply on news.ycombinator.com