Comment by united893 | Hacker News Reader

Comment by united893 | Hacker News Reader

Is Apple now also going to ban Square, Sonos, Amazon, DoorDash, Instacart, Postmates, Uber, DBS Bank, Handy, Vseen, Shiphero etc for also misusing their certificates?

If you're going to rule with an iron fist on your walled garden, then you better do it fairly. If they don't then they stand to be ridiculed and lose face.

[0] Square https://squareup.com/help/us/en/article/5492-customer-displa...

[1] Amazon https://www.azflexinfo.com/how-to-download-and-install-the-a...

[1.5] Casino 2020 https://www.igt.com/promotions/casino2020

[2] Doordash https://dasherhelp.doordash.com/download-app/

[3] Sonos https://twitter.com/archer_mcgee/status/1091176871734108161

[4] Instacart https://shoppers.instacart.com/apps

[5] Postmates https://fleet-help.postmates.com/hc/en-us/articles/225239347...

[6] Uber https://help.uber.com/partners/article/updating-the-driver-a...

[8] DBS https://www.dbs.com.sg/ibanking/mbanking/demo/index.html?pid...

[9] Handy https://prohelp.handy.com/hc/en-us/articles/217292127-Downlo...

[10] https://viseven.com/ar-app

[11] ShipHero https://help.shiphero.com/article/246-trusting-ios-apps-on-d...

Worth noting the relationship between these services and the "paid contractors" that use the app is expressly not Employer-Employee. Facebook and Google paid third party personnel, so is Instacart and Uber.

Apple has historically looked the other way at a lot of uses of enterprise certs outside the fuzzy definition of who exactly is in the enterprise. The difference with the Apple and Google cases is that they were using the enterprise cert to distribute apps that were specifically banned from the app store, and they were distributing it to people that clearly did not have any kind of close relationship with the company. In many of your examples, the apps are for gig workers that are arguably part of the "enterprise.", even if they're not technically employees. I think Facebook tried to argue that because they were paying people $20 a month to keep the app on their phone that they were their contractors, but that is a very thin argument.

Come on, let's be real, the difference is that the media blasted Facebook and Google about privacy issues and Apple capitalized on that to play to their privacy marketing play.

Why this, instead of the much simpler explanation above?

"Negative media attention about a thing, better ban it" seems like a fairly simple explanation to me.

Which i guess is _fine_ if the result from that is an increase in privacy for the end user. I get your point - there is something to be said about handling every "breach" of their rules differently. But in the case of Google and Facebook there is a clear distinction between evil and not evil if you factor in your list above, which we all can agree on.

Unless Apple found it sufficient to make an example of Facebook and Google. The statement would be pretty clear: if you think we won't do it to you because you're a big company and a valued partner, just look at the size of the company who tried it on and think again.

I am surprised that you are being downvoted. What you wrote makes a lot of sense.

Sibling comments says your comment was downvoted? I imagine you’re spot on. I caught my credit union doing this (to deploy a beta version to this customers), and I emailed them asking about their mental health given that Apple takes a dim view on such practices. And that’s just the one I’ve caught. So I could see Apple using this circumstance to fire a warning shot across multiple bows.

I think those apps have a much better chance of falling under "internal apps for employees", but they are somewhat close to the line.

They're not employees but 1099 workers sure sound like they're part of your 'Enterprise'. They could even be 'in house'.

Lots of 1099s actually work in the same building as employees. What makes you think they wouldn't be covered?

Sure, fair point. But Facebook paid as well. If Facebook starts paying them via 1099, would that be fair?

Assuming Apple doesn't explicitly ban analytics collection (and how would that play with fancy mdm solutions?), it sure sounds like it should!

Generally if someone earned less than $600 as an independent contractor, the payer does not have to send the contractor a 1099-MISC. Given that Facebook pays $20 per month, it's well below the limit for issuing 1099s.

everyone in the US who is not employed directly (where the employer pays income tax for you) are by default 10-99s if they are paid more than $600 per year...

how the people are paid has nothing to do with why Apple took the action they did.

Uber, DoorDash, and all the others actually issue 1099's to their drivers. I'd be surprised if users of the research apps were issued tax forms that show a similar relationship.

What's the line however? It's a bit blurry. If Google and Facebook starts paying their panelists using a 1099 that would be fine?

My interpretation is that this should be fine; just as I'm pretty sure it's OK to design MDM software for your employees that all but spies on them.

The enterprise agreement itself does not require any showing of an employee-employer relationship as defined by the local jurisdiction.

But if you read the rest of the agreement, you will find more requirements about who these apps may be distributed to, and they make this case pretty much a slam dunk in Apple's favor. For example, Facebook cannot possibly agree that they would be liable for what users of these research apps do, nor can they claim the ability to retrieve these devices if the relationship ends.

So, no - simply issuing a tax form won't solve this for Facebook.

That's fair, but Doordash, Square and Instacart don't have that ability either. They're distributing their apps via the same sideloading mechanism.

At least the way I'm reading Apple's terms, those cases fall more cleanly into the Employee category (which includes 1099 contractors, as defined in the terms).

The requirement to issue 1099s kicks in at $600/year. The panelists were well below that and weren’t paid in cash. The not-paid-in-cash thing doesn’t matter for reporting requirements, but I would guess it probably gives an extra layer of legal protection if the panelists decided to claim they are in fact employees.

It's blurry but the fact that the payment is solely for them to install the app and give away their privacy is a pretty strong indication. That's quite different from a delivery service where the relationship is that they're delivering food, and the app is just one tool they use to do the job.

I looked at the first two, they both appear to be aimed at people making deliveries for Amazon and Door Dash. It doesn't sound like the apps do anything unrelated to delivery work, much less analyze all web traffic from the mobile device 24/7.

If the only point you're making is about employees vs. contractors, the 24/7 interception of non-work internet traffic seems to be far more important than employment classification.

Google's App did similar ban evasion technique as what Facebook Research put out so its weird that Facebook is still revoked (edit: apparently not they got unbanned) and Google and Amazon are still free to play. TOS has to be enforced less randomly, as that erodes trust.

I do respect Apple's play here on privacy, but they are quite literally trying to police sideloaded apps and that's a hard thing to really do, which is why these apps went on undetected for a long time raising no flags until the recent media spotlight.

Apple’s App Store policies have not been known for being fair to all participants. That’s for public apps.

I’m not sure why they would change that stance - much less for enterprise apps - now. So long as the abuse is not egregious (see FB & G) they probably don’t care.

Apple hasn’t claimed it is banning Facebook or Google from their enterprise program. They are simply revoking the certificate that was spread to consumers. Those certificates can be re-generated.

Any idea how companies like Nielsen get their stats?

You get a black tracking box installed at your house.

TV-tracking is done by sound signatures and web-tracking is done with a router which has custom firmware installed.

Last I checked it was way more low tech than you’d expect for a company people put a lot of stock in. Basically, they put scanners on some people’s TV’s (with their permission, which is good but introduces a lot of selection bias) and try to correlate what gets watched with the ages of the people in the house (while not knowing whos watching what and hoping the TV doesn’t just get left on for hours with no one watching).

They give you a remote with toggle buttons labeled with people's names so you can tell it who is watching or if multiple people are watching. They also have software for media pcs but you can hook up an intermediary box if you want. They also pay you per hooked up tv, and have stats on whether a tv is a bedroom / kitchen / family room tv.

I once participated in data gathering for Arbitron, which gathers radio stats.

It was very simple. For some period of time (I think it was a week...this was a long time ago so details are fuzzy) I was supposed to write down the time and identity of every radio station I heard (or maybe every station I heard for more than a few minutes?). At the end of the survey period, I mailed that to them.

I forget how much they paid, but I think it was on the order of a few dollars.

This would have been quite a while ago--probably at least 20 years ago.

They still do that kind of survey, I believe, a few times a year in each of several hundred metropolitan areas.

In 2007, they added another data gathering method that they use in a smaller number of major markets where participants wear a small device that can pick up subaudible identification messages embedded in radio broadcasts to tell what radio stations are being played in an area. These devices record that information and periodically send the data back to the company.

In 2012 they were bought by Neilsen and are now called Neilsen Audio, but the data gathering is still as described above.

At least at one point, Nielsen were getting their stats by paying people to install their iOS monitoring app using an enterprise developer certificate: http://www.arbitron.com/research/installhelp/install_ios9_en... Including minors as young as 13 with parental consent: http://www.arbitron.com/research/faq/iBoard_faq_en.pdf

Reply on news.ycombinator.com