Hacker News Reader

Comment by QAPereo | Hacker News Reader

When people bitch about “walled gardens” I like to remind them just why people build walls. This... is why. Sure, a world without walls and locks would be ideal, but only if it’s also a world without thieves, saboteurs, and jerks.

View on HN

The irony is strong here. You need walled gardena because walled gardena protect people from dangerous software. Posted as a comment in a news about dangerous software found in a walled garden.

The argument would be that this suggests that Google's garden should have higher and better-guarded walls to prevent such things, while many seem to argue that our gardens' walls are too high. Apple gets criticized for having slower and more arbitrary manual reviews of all app updates, but they don't seem to get malicious apps like this in their app store nearly as much.

They also don't have decent free mail clients with OpenPGP support.

Not really. This is only news because it's surprising and uncommon. In contrast, consider the fake Microsoft tech support scams. Those are so common that Microsoft gets 10,000 complaints/month [1], so nobody would think to mention a single example here.

[1] https://blogs.microsoft.com/on-the-issues/2017/05/18/fight-t...

It’s not uncommon at all, and it’s been documented here and other places many many times. The difference between this and your poor analogy is that here Google could actually prevent this if they chose to.

It's hardly a walled garden. More like a picket fence.

While physical analogies have their limitations, a meatspace store where any supplier could drop their product without vetting would not be a safe place to shop.

There has to be some sort of curation. Algorithms and automation can help with the curation, but there has to be something.

Scams in the Google Play store are an old problem. It genuinely perplexes me that Google hasn't solved this problem. Surely they realize this drives people away from the platform. My parents don't follow @swiftonsecurity but they do read the news and they don't want their retirement accounts pilfered. Thus they overreact to any negative security news in the mainstream news. So they own iPhones. The volume of bad news about Android security outweighs iOS.

Google has an obsession with automating everything and employing at best no humans at all.

Same thing with Chrome extensions. Mozilla has solved this same problem in near perfection by just having a few actual human beings look over the code of newly submitted or updated extensions.

Google has magnitudes more money than Mozilla, so they could easily afford to just copy that, too.

Google Play is a walled garden. Maybe a wall is a little lower then some, but still.

Is F-Droid a walled garden?

Yeah, its walls are higher than most. What's the point?

They build walls and fences because of economic inequality. I have been in places with huge 3m walls and in places with no fences around the house and owner name plates over the doors. In former places there are jobless people asking for job in the streets, lets call them thieves.

Walled gardens just keep small developers out of the marketplace by rising the bar. Now you need to pay money or have a name, so WhatsApp, Viber and similar shit can retain monopolies and keep their users despite being filled with ads and offer less security than competitors. Jabber clients and independent media never get a "verified" badge.

If you want to download "genuine" WhatsApp, go to their website, check their TLS certificate (you can never be sure, they don't even bother to get a EV cert, even for WhatsApp web; https://app.wire.com/ has an EV, for example) and follow the link to Google Play. Software repos are not here to do the job of CAs.

And of course you go to their website by googling them. Maybe clicking one of the 5 adword links at the top of the page that look like search results. Works out nicely for someone.

"Good fences make good neighbors."

Um.... it didn’t seem to do much good here. Not sure what your point is.

I think his point is that Apple's app store is commonly criticized for being a walked garden. While the Android app store may be as well, some complaints seem specific to the Apple side. For instance, releasing a new or updated app requires manual review from someone at Apple. I've only seen complaints about an app release taking an arbitrary amount of time with the Apple app store.

There's a list of guidelines your app must conform to, and Apple is generally more aggressive about catching violations before app release compared to Google. There are consequences to this, like Safari-WebKit being the only permitted browser engine on iOS. Any other browser must wrap this engine.

The grandparent post is likely pointing out the dissatisfaction that devs express regarding the Apple app store review process. It seems like it comes down to an engineering trade-off. At some point you have to choose between developer experience and end user security.

If you prefer being unfree in the name of security, that is your prerogative. But please don't drag the rest of us with you into your golden cage.

I prefer solutions that offer both, freedom and security. Such as proper application isolation, user review systems (a tough nut, yes) and generally having better reputation/quality signals than just a company name.

Reply on news.ycombinator.com