Hacker News Reader

Comment by thehappypm | Hacker News Reader

I hate that you cant sideload today but its gonna lead to tons of malware

Alternatively we may end up with better app stores with far less malware and trash. As much as apple enthusiasts like to claim the app store is as good as it can get, there's a ton of room for improvement IMO. Just getting rid of the games that prey on children and addiction would be a good start.

It's about 100% more likely that it's going lead to every company that chafes under Apple's current "you have to ask permission before you can do that" rules to begin to only offer their apps outside the App Store.

Remember the original Android permission model of "an app gets every permission it wants or you can't install it"? That's where this is heading.

I would think a permissions model is something that Apple would still be able to design and enforce through their control of the operating system?

The same way that Google prevents malware from existing outside of the Google Play Store?

Apple can’t stop malware on macOS

Google can’t stop malware on android

Microsoft can’t stop malware on android

What makes you think Apple will be able to stop malware on iOS?

Malware is definitely possible in various ways, but my understanding is the permission system is still robust. Unless you have given an app a particular permission, with a UI controlled by the operating system, it is unable to use operating system capabilities that are protected by that permission.

For example, the OS can enforce that an app can't use the camera without the user clicking "allow" on an OS-managed pop-up.

The permission and security systems will be circumvented by malware authors and unscrupulous developers, just like they are on macOS. Given the enormous amount of personal information on our mobile devices, this represents a particularly concerning potential regression in end user privacy and security.

Like on Windows, macOS and Android it’ll be crucial for users to avoid installing executables from the web. and like Android, users also have to be trained to only install apps from ethical software repositories that respect user privacy and security. This is the best case scenario for privacy/security, and essentially the status quo for Android.

For better or for worse, the days of iOS users installing any and all available applications without worrying about malware is over. Users will get more freedom, but they’ll have to take more responsibility when vetting and running third party apps. I don’t know how a notoriously novice user base will react to that, but we shall see.

Mac OS, like all traditional desktop operating systems, gives almost all permissions to every process running as the user. This is a very difficult environment to defend!

It's also very different from how iOS and Android heavily restrict what each app can do, hiding most things you might want to do behind permissions. Installing an app is not quite as safe as visiting a web page, but it's very nearly so if you don't agree to any permissions requests.

The most common way for malware to abuse the permissions system is to ask for permissions to do something plausible, or even implausible, and then abuse those permissions to do other things that the user wasn't expecting. For example, a speed dialer might ask for permission to read your contacts, which is quite reasonable for a speed dialer, but then exfiltrate and sell them.

Android also lets you individually enable/disable permissions for apps you install. Yet companies haven't started moving to 3rd party app stores to circumvent this, like you are describing

It sounds like you envision a world of many different walled gardens, instead of the single Apple-policed walled garden.

I can see how that would be attractive in some ways. On the other hand, parent's aren't necessarily smarter than anyone else.

"Install this rando app store and get 12¢ off your next gas fill-up!"

Remember Facebook offering people a few bucks to MITM their entire phone? Oh wait, that was on the official App store! And they didn't even ban them!

>Remember Facebook offering people a few bucks to MITM their entire phone? Oh wait, that was on the official App store! And they didn't even ban them!

No, companies can apply for their own app signing key that allows them to create apps for their own in-house-only uses that completely bypass the App Store.

Facebook used that enterprise signing key to install spyware on user's devices. This had nothing to do with the App Store, and Apple did revoke their signing key as a warning shot.

>“We designed our Enterprise Developer Program solely for the internal distribution of apps within an organization,” the spokesperson said. “Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple. Any developer using their enterprise certificates to distribute apps to consumers will have their certificates revoked, which is what we did in this case to protect our users and their data.”

https://www.cnbc.com/2019/01/30/apple-says-facebook-violated...

Please read carefully what you wrote.

> that completely bypass the App Store [..] Apple did revoke their signing key

Do you see it yet? There is no "bypassing the App Store". At the end of the day, the root of trust comes back to Apple.

And, of course, they "revoked" it meaning they waited for a week or so and then Facebook had all their enterprise apps back. This isn't the treatment in store for you if you attempted this.

Sorry, but bypassing the App Store and it's associated review process is exactly what Enterprise signing certificates do allow.

Those apps are not distributed through the App Store.

>Oh wait, that was on the official App store!

Do you see it yet? :oP

Children and addiction are your two problems with the App Store? How exactly do think a third-party free-for-all set of app stores is going to do better?

I think niche app stores will be able to engage is much stricter moderation. For example, a kids only store could focus on knowing their developers and forbidding in app purchases.

Alternatively, Apple will loosen restrictions on what App Store (tm) apps can do to prevent profitable apps (for Apple) from moving to alternate app stores.

But, you know, I can just not install those app stores so it totally won't affect me, right? Thanks guys! /s

Does Android have a malware problem with sideloading? The majority of users don't know how to sideload and don't do it. Technical users hopefully know what they're doing. In any event, if you google "android malware" most of the results are apps that slipped into the app store:

https://www.tomsguide.com/news/malware-hits-10-million-andro...

Reply on news.ycombinator.com