Hacker News Reader

Comment by sjnu | Hacker News Reader

Imagine what Facebook's app would do if they didn't have to play within App Store rules.

You can choose not to install their app unless it’s provided through the App Store.

It would be a significant barrier to entry for them to completely remove it, and I imagine they would lose many users if they did so.

Who is responsible for issues caused by Epic's store? What are the ramifications from an API point of view? Will having another store change the limitiations imposed on what can or can't be done? If so, people already have a choice - Android.

The OS limitations are separate from the storefront.

The Epic launcher on Windows can’t provide more underlying functionality than Steam, but it can compete on pricing and features.

So what value does an alternative store provide? (No snark intended, genuine question)

The option to install applications that are censored by the the Default App Store for whatever reason.

Plus, this case probably has pretty far reaching implications on the future of computing. If Apple is allowed to lock down their phones & tables, can they do so with Mac OSX? If Apple can do so with OSX, can Microsoft do the same and lock down Windows to prevent apps from being installed outside of their App Store?

If Microsoft can lock down Windows like iOS/OSX, can Dell lock down their servers to prevent other operating systems from being installed?

Apps and in-game purchases could be cheaper. In theory, Epic could pass all that 30% apple cut in savings you.

Another reply said "censor" which implies speech, but Apple's rejections can be more fundamental.

Have an app you want to ship? Apple gets to decide whether you meet "minimum functionality requirements". You cannot distribute your app to paying consumers without their approval.

Doing something truly unique, perhaps with some hardware in the phone? Apple may decide they simply do not want this feature in an app on the App Store. Which means you cannot distribute your app to consumers.

I'm less concerned about having other "stores," I just want a way to buy apps from legit developers that don't involve Apple dictating look and feel and entire feature sets.

You know, the same way I can purchase and run software on a Mac without Apple being involved in the transaction.

Apple's rules are completely arbituary, so many apps simply don't exist due to vague guidelines. There are zero 4chan apps on the app store, but a dozen reddit apps (which is ironic given recent news over there). There are dozens of these odd edge cases based on Apple's whimsy that just means there are zero IOS options for what Android has dozens of, even before getting into "obviously" banned content like adult apps and piracy.

So while a few (like, literally 5-10) blockbuster game companies may take the PC launcher route if this wins, there are several smaller time apps that can benefit form this if the app store wasn't the only source of downloading here.

Being able to have Microsoft XCloud (and other cloud gaming) as a native app instead of forced to only have the Apple games/arcade.

This is one example of a completely legitimate scenario in a very popular entertainment category and yet it's blocked because of Apple's arbitrary rules of what you can do on your own device.

It still has to run on the IPhone and ask for location, ad ID, etc. from iOS. Where the app comes from doesn't change that it must make the same system calls as everything else.

Except if they weren't subject to App Store rules they would likely bypass the advertising ID and do their own fingerprinting instead.

You're logged into the app. They don't need to fingerprint anything.

Maybe in the Facebook app, but not necessarily in the Facebook SDK which is integrated by other apps for ads/auth/analytics.

SDK abilities don’t depend on the storefront, that’s up to the OS. Apple store is just informational.

Either way users should be able to choose what they install and from where.

All apps on iOS need to pass App Store review, which means all apps that integrate third-party SDKs need to ensure those SDKs don't violate App Store policies, including policies on fingerprinting. Apple has already started to deny approval of apps using third-party SDKs that violate user tracking policies on iOS 14.

You can do your own without dealing with SDKs.

This isn't a problem if Apple ups their game and actually competes to keep people on the App store despite having real choice.

Of course you can. You're entirely missing the point, which is that without a review process that sets explicit limits for how data can be used, developers will abuse system APIs to violate user privacy.

So be more strict with system APIs?

We can go back and forth forever with what-ifs. It's nothing we cant overcome in the future.

Restricting APIs doesn't solve the problem because there are plenty of APIs that apps need for legitimate purposes but can be abused by bad actors. Many of the APIs used for device fingerprinting would fall under this category.

Apps on the app store already do this.

There's a difference between sneaking through App Store review and not enforcing anything at all. People still shoplift even though theft is a crime, that's not an argument against having laws.

No. Apple provides a door (advertising ID) but there's also a window (fingerprinting). Right now both things exist. Apps already have the ability to fingerprint users with data they collect and that's not sneaky.

That's a strange argument though. Apple forks over an advertising ID so that any app can fingerprint you with a single system call yet you complain that more apps might in the future fingerprint you themselves.

The difference is the advertising ID can be disabled or reset by the user, and Apple has started blocking apps that use fingerprinting SDKs during app review. (https://9to5mac.com/2021/04/01/app-store-now-rejecting-apps-...)

Without app review there would be no practical way for end users to avoid fingerprinting.

> That's a strange argument though.

Only if you don't consider consent. A user opting-in and enabling the advertising ID is very different from a bunch of apps using third-party SDKs to fingerprint their device without asking.

What does it do on Google's app store? If they are still playing by google's rules, why would they take themselves off Apple's store? is Apple's data more valuable than Google's?

These kinds of theoreticals have likely already been addressed with Apple's biggest competitor. Androids aren't known to be virus ridden privacy compromising devices. At least, no more than any device with communication antennas installed.

> Androids aren't known to be virus ridden privacy compromising devices.

I mean, statistically, they kind of are. From Nokia's Threat Intelligence Report for 2020 (https://www.nokia.com/networks/portfolio/cyber-security/thre...):

Figure 3 provides a breakdown of infections by device type in 2020. Among smartphones, Android devices are the most commonly targeted by malware. Android devices were responsible for 26.64% of all infections, Windows/PCs for 38.92%, IoT devices for 32.72% and only 1.72% for iPhones.

statistically, maybe. But it's more about mindshare in cases like these. IoT devices based on your report is even more prone to compromises, but there's not much fear for a person's fridge being compromised.

And as always, these cases come down to how many people really concern themselves with that risk. Windows has had that reputation, but it hasn't helped Apple that much in terms of Mac adoption, let alone Linux.

I'm not sure why mindshare is relevant? You might not worry much about your fridge being compromised, but these days smartphones contain a lot of personal data which could be very problematic if compromised. There is even Android malware out there that steals 2FA codes.

>I'm not sure why mindshare is relevant?

because many people commenting on security and privacy aren't necessarily experts on such topics. Their interpretations of what is secure or not comes from marketing and word of mouth.

If you look at the stats in an extremely stark interpretation; no device is perfectly secure (0%), but no device is so malware ridden that you are more likely than not to be compromised (50%). most users will be safe as long as they don't go out of their way to disable default security settings, and few need to. In that way, privacy won't be the main factor determining why a user purchases a device or chooses an OS.

In that respect, What a user feels (or what their immediate bubble feels) has more weight than any statistical reality. Or in other words, "mindshare".

It would be WeChat, which is an entire ecosystem and OS within itself. Apple seems to regret letting that one through and is determined to not let it happen again.

Reply on news.ycombinator.com