Hacker News Reader

> Sideloading is a threat to privacy because it allows apps to ignore the consent requirements the App Store enforces. As it stands, if any app wants access to your contacts, your camera, your microphone, your photos, etc, it must ask first. Allowing sideloading removes this protection, and apps installed that way could simply siphon all your data silently.

There's no reason that the OS can't implement sandboxes and enforce protections for such data. There's literally decades of research on operating system security.

Besides, when we forgo system safety in favor of corporate gatekeeping, that isn't security. In fact, such a scheme is responsible for mass distribution of malware. Apple's App Store is responsible for distributing over half a billion copies of Xcodeghost to iPhone and iPad users[1], and that's just one piece of malware.

[1] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...

People always cite sandboxing as some kind of panacea but the problem is sandboxing is entirely incapable of preventing bad actors from abusing permissions that were originally granted for legitimate purposes.

For example: I might be okay with granting a messaging app access to my contacts to make it easier for me to send messages to people, but that doesn't mean I'm okay with that app exfiltrating my contacts to build a shadow graph of my social network to sell to advertisers.

Putting a permissions dialog in front of my contacts only solves the problem of whether an app is allowed to access my contacts in the first place, there are zero restrictions on what can be done with that data once access is granted.

> For example: I might be okay with granting a messaging app access to my contacts to make it easier for me to send messages to people, but that doesn't mean I'm okay with that app exfiltrating my contacts to build a shadow graph of my social network to sell to advertisers.

> Putting a permissions dialog in front of my contacts only solves the problem of whether an app is allowed to access my contacts in the first place, there are zero restrictions on what can be done with that data once access is granted.

There's no reason that sandboxes have to be so lenient that this is possible. Permissions can be fine grained, and network connections can be filtered, restricted and denied. Contact access doesn't have to be black or white, either. On systems that work for the user, you can even feed dummy data to apps if you want to.

I'm sorry but I don't see how any of that actually solves the underlying problem of granting a third-party access to data you don't want to see abused.

> Allowing sideloading removes this protection, and apps installed that way could simply siphon all your data silently.

I don't have any iDevices, but are you suggesting that any iOS app has access to all of your files if the code makes it through the app store review? Because that would be a major issue in Apple's sandboxing in my opinion. I don't think you're right about how the OS security policies work, at least I hope so.

You are right. Every app lives in its Sandbox, so it is really not an issue.

I would imagine that the OS's APIs should be the ones to enforce that, rather than the app store

One of App Store review's uses is to block misuses of valid API

Some good examples are:

* Exorbitant subscription pricing (3-day free trial, then $20 per week)

* Misusing in-app purchase dialogues. There are some apps that dim the screen down to zero brightness when the in-app payment prompt pops up, and tells the user to rest their finger on the home button

* Ensuring data collection practices match the claimed data collection practices in the privacy policy / "nutrition label"

I don't know whether Apple is any good at enforcing those. We can only see the ones that slip through the cracks, and there are many. But not enforcing them hurts trust in the App Store and decreases revenue for all legitimate developers. I know two people who refuse to accept any free trials due to being burnt by subscription scams on iOS. And I personally have an app in the App Store with a free trial (no subscription, just a once-off lifetime purchase!) and constantly get one-star reviews claiming I run a subscription scam

Lack of enforcement of the above is directly hurting my revenue. So I worry that allowing side-loading opens up the above channels to all sorts of scammy behaviour, and that then reflects poorly on the official App Store (many users won't know the difference, doesn't matter how many dire warnings / official dialogs you pop up)

I think that sideloading represents a greater security threat in terms of what the sideloaded app can do, but it's counterbalanced by the number of users sideloading - especially if sideloading is designed to be a highly technical process, the number of users doing it is going to be quite small. Even now very few Android users sideload.

By contrast, third party app stores could open an entire one-click universe of privacy abuse. Even if individual apps can't do as much damage, the overall footprint is much larger as the information that's accessible is scattered across a far wider spread of companies/developers by giving them access to users who don't possess the technical aptitude to get themselves in trouble with sideloading.

> By contrast, third party app stores could open an entire one-click universe of privacy abuse.

This is similar to the argument made for censorship - we should also censor newspapers, books, television, movies and the internet to ensure that people get the right information and values, and are not influenced by "harmful" content.

At some point, you have to start treating adults like adults, rather than mollycoddle everyone as some immature and / or innocent being.

I think the key difference is that in the case of media, people aren't unknowingly signing up for anything – those partaking decide they like what they see and continue to partake. Media also has no element of lock-in… if one media source becomes untrustworthy in one's eyes, it's pretty easy to switch to some other outlet.

With third-party app stores and even apps themselves, it's very easy for users to get more than they bargained for at mass scale. As I noted in my original comment, it's very likely that an app store run by the likes of Facebook would operate in such a way, and the worst part is that many users wouldn't have any choice but to go along with it — they're forced to install the Facebook Store and accept all that it and the apps on it (WhatsApp, Messenger, etc) entail in order to continue to connect with their friends and family. Malicious app stores can effectively hold parts of users' lives hostage to force access to data.

Which is why I'm not against third party app stores, but rather third party app stores without regulation that makes foul play a costly mistake on the part of the developer.

Sideloaded apps on Android have needed to ask the user for permissions since day one. This is not (necessarily) a feature of the store.

sideloading also disallows stores like f-droid.

The same argument could have been used by microsoft a long tjme ago to lock machines to windows and kill linux. It would not have worked then, it should not now.

What apple does is basically avoiding competition. That's not fine when you have 50+% market share

Huh? Locking a machine to Windows is the manufacturer's choice, not Microsoft's.

A better comparison is if MS banned installing apps not distributed by MS.

> Huh? Locking a machine to Windows is the manufacturer's choice, not Microsoft's.

Microsoft used to tax OEMs on all pcs with x86 sold as having windows pre-installed on them (otherwise OEMs wouldn't be allowed to sell windows at all). This got them into anti-trust issues. By the same mechanism they could have asked OEMs to lock machines to windows.

Anti-trust lawsuit could have lead to Microsoft being broken up into separate companies.

It would be funny if Microsoft avoided that only for Apple to be broken down into separate companies. (one for app store, one for iphone, etc)

> A better comparison is if MS banned installing apps not distributed by MS.

If they did this what would be the consequences?, are potential anti-trust lawsuits going to appear again?

Also see what happened with bundling internet explorer in europe.

> Locking a machine to Windows is the manufacturer's choice, not Microsoft's.

Microsoft has hardware certification requirements for machines that ship with Windows, and these certification requirements mandate whether or not a machine will be locked to Windows. On traditional x86, these requirements mandate that it must be possible to both disable SecureBoot and enroll the owner's keys; on ARM, Microsoft changed these requirements to forbid both options (https://softwarefreedom.org/blog/2012/jan/12/microsoft-confi...), so that these machines would be locked to operating systems signed by Microsoft.

If manufacturers want to be able to ship machines with Windows, they have no choice but to follow these hardware certification requirements; and it's not hard to argue that Windows is a monopoly, such that manufacturers have no choice but to ship machines with Windows.

> A better comparison is if MS banned installing apps not distributed by MS.

Isn't that what "S mode" does?

What about an EFF store that only allows strongly vetted open source apps? Wouldn't that allow users to have more security and more privacy?