Apple reveals App Store takedown demands by governments | Hacker News Reader

Apple reveals App Store takedown demands by governments

techcrunch.com

343 pointsmindgam3203 comments

This is the №1 reason I choose Android - nobody can dictate what apps I can install.

I always knew you can only install apps from the store on Apple devices and strongly disliked this (I already use some apps which even Google won't approve, e.g. an open-source YouTube downloader only available on GitHub) but once I've found out you can't get some apps (and books) in particular countries (e.g. a book I wanted was only available in the US store) and a government can ban something from the store I facepalmed.

An interesting contrast is the story on the front page about Chinese border patrol installing spyware [1]. There, the fact that every app needs to be signed by Apple meant that the surveillance app could only be installed on Android phones. So I guess, yes, nobody can dictate what apps you can install, but also nobody can dictate what apps others can install.

[1] https://news.ycombinator.com/item?id=20342063

> also nobody can dictate what apps others can install

That's one of the main reason why I don't use smartphones: I wouldn't be in control of my own device. With iOS, Apple is in control. With Android, apparently nobody is in control.

But on my Linux machines, I'm arguably in control. If I can find stuff somewhere, I can install it. And nobody else can, unless they root them. It happens, I know. But with LUKS FDE, even booting is arguably hard unless they could read the key from RAM.

So how come we got this smartphone crap, instead of actual portable computers that could, among other things, work as cellphones?

>With iOS, Apple is in control. With Android, apparently nobody is in control...

A thousand times this.

The state of the mobile universe right now is such that you have to either effectively trust Apple, or you have to effectively trust everyone. That's why HN User qwerty456127's choice to go to Android was fine, if he wants to be able to install his own apps, but it seriously compromised his privacy and security.

What if you do not want to trust anyone?

Nope. Sorry. No easy to use options for you out there.

>What if you do not want to trust anyone?

>Nope. Sorry. No easy to use options for you out there.

Sure but to an extent that's true about almost everything in modern society. If you don't want to have to trust those supplying you with food or water, there's really no easy options to completely supply yourself with either of those. And even with all the oversight and regulation there's still often good reasons not to fully trust (we all know about Flint at this point even if it was a bit overblown by the media)

It's hard to imagine a situation where someone would supply you with something without you needing to trust them on some level.

Sure, you're at the mercy of your food and water suppliers. But you have choice. There are numerous food sources. And many choices about water. Bottled water. Your own well, or rain water collection. And home-scale treatment systems, for metals and organics.

That's very different from trusting only Apple. I mean, if you want to use Apple's equipment, you must also use their software. And perhaps we can trust their software. They also curate apps in their store, but sometimes they miss stuff.

Given Apple's position vs the FBI, it seems pretty clear that they won't intentionally pwn their customers. But it's clear from TFA that they do remove apps when governments demand.

Maybe that doesn't directly pwn users, but some of the apps that they've pulled could have protected users better than remaining alternatives. For example, I gather that it's impossible to build custom email or VPN apps in iOS. You can just build wrappers for Apple's stuff. For email, that apparently limits ability to securely encrypt messages.

I can't see a way to "trust nobody" beyond abstaining entirely from phones, computers, etc.

Imagine a Free Software utopia with open hardware running an open source OSes and apps. Someone is writing that code. Someone is manufacturing that device. Someone is compiling and packaging that distribution for you. Someone is running the network.

Having access to the (alleged) source code for everything, and being able to compile it all yourself, would surely be worth something. But it'd be way too much code for you to audit alone. So you're going to have to trust Someone (security researchers, open source contributors) to be doing this for you...

For some people, I think it's actually exciting for them to think about how independent they are and how nobody can spy on them or trick them out of money because they consider themselves to be so worldly and knowledgeable about such things. And maybe they are compared to their families or the people they deal with during their day-to-day. I've known plenty of people (myself included at times) who get some of their feelings of self-worth from this sort of thing. But because it's more of a fun or emotional or ego-boosting thing than a rational thing, they'll often make big bold binary blanket statements about all the products they refuse to buy or web sites they refuse to go to or companies they refuse to patronize. And that's all great, actually, as long as it's rational and based on facts rather than some narrative in their head. We need more skeptical people, we always do.

But it's not always rational, and sometimes it is more like they're LARPing through some exciting narrative about the world, and in that narrative they're the heroes who know stuff that the normies don't. They're more like survivalists living an adventure in their head than rational people making rational choices. And that's where people can also get into trouble, both for having a false sense of confidence about their ability to avoid risk, and for giving others bad advice based on excessive confidence or rose-colored glasses about the same things.

I'm all for better security practices based on ever more openness, but I agree 100% with your example: people are kidding themselves if they think just because they run binaries built by other people from open source, it's almost as good as if they had personally inspected every line of code themselves. And when people are making those sorts of utopian statements, it's generally coming from the LARPing survivalist narrative part of the mind rather than the skeptical rational part of the mind and should be viewed with that much more skepticism. Not rejected, but just considered with an extra dollop of skepticism, because they hopefully at least mean well.

That's me, for sure.

But here's the thing: It's always just a game. So sure, call it LARPing. However, consider that the US came out of LARPing.

Sure, you must always trust someone.

However, you can distribute trust. With open-source software, you distribute trust across many developers, researchers and other users. It doesn't always work. But you're not stuck trusting just one entity.

Another example is Tor. You can't trust any one relay operator. But Tor does onion routing through three relays (guard, middle and exit) and so it's the design that you're trusting. Basically, the difficulty is identifying what relays you're using, and getting data from them. Plus the fact that the routing changes frequently (10 minutes by default) so adversaries would need data from many relays.

Even so, Tor's design can't resist traffic analysis by adversaries with access to global network data, and global attack networks. That was an explicit choice. Because resisting such adversaries would require stuff (random mixing and latency, padding to provide ~constant throughput, etc) that makes the network far less usable, and not scale well.

> So how come we got this smartphone crap, instead of actual portable computers

Because we are not the average smartphone user. The market for people that cares about this is tiny.

The only smartphone that will approach a sane philosophy seems to be the Librem 5.

>But on my Linux machines, I'm arguably in control.

How so?

If you show up at the border and the agent demands you install the software or your machine will be confiscated and you will be denied entry, then they are just as much in control as they are with android. At current all systems seem vulnerable to this attack that shares something in spirit with rubber hose cryptography.

Even Apple could be, but I suspect it is a case of it not being worth the effort since androids are the majority of phones.

I wasn't talking about border crossing.

Anyone paying attention knows that it's foolish to take sensitive devices and data across borders.

I was talking about what stuff I can install on my gear.

"So how come we got this smartphone crap, instead of actual portable computers that could, among other things, work as cellphones"

I think because they care about milking users, not about them being creative. I myself is very disappointed about what smartphone could've been for people and what it actually is.

> But with LUKS FDE, even booting is arguably hard unless they could read the key from RAM.

You can also use FDE on Android devices. That won't stop the border police from forcing you to unlock your device or deny entry, though.

>is arguably hard unless they could read the key from RAM...

That's the fine print that kind of makes FDE a bad fit for mobile. (At least FDE as it's typically implemented.) I don't think it's any secret that Trust Zone has a larger attack surface than Secure Enclave, but cold boot attacks to extract data from RAM are stupidly pedestrian. At least make it hard for them.

Apple's self destruct is extremely poor UX for any user cursed with the misfortune of forgetfulness, but it's a lot more secure than Android's Trust Zone.

True, using dm-crypt. And iOS also has FDE.

So my comment about iOS vs Android only applies once the phone is unlocked. And I wouldn't be comfortable with just the root passphrase protecting me.

My main complaint is Apple -- and so anyone who can pressure Apple -- controlling what I can install on the device.

You can sideload apps on iOS. You can use cydia impactor, use enterprise certificates, or sign them yourself.

Huh. Didn't know about cydia impactor.

But Apple can revoke certificates, and then your stuff is gone. Right?

Unfortunately, yes. If you don't distribute the signed binary, they'll never do it. But, they can, which is unfortunate.

> So how come we got this smartphone , instead of actual portable computers that could, among other things, work as cellphones?

I have been looking for such a thing for a long time. Sadly, there is no good solution. If you want a not-horrible one, get a samsung tablet with cellular capabilities and run linux on dex on it.

The Librem 5 (only dev kit is out so far) is similar to this. You can run some Gnome software unmodified, they have been doing a Youtube series showing various apps running on it. My understanding is the phone will be able to connect to a large monitor as well.

Yes, when / if it is available. I really really really hope they deliver at least hw platform and drivers... Fingers crossed.

Not out yet but maybe the PINEPHONE [1].

[1] https://www.pine64.org/pinephone/

That seems very nice.

It uses the radio "Quectel EG-25G with worldwide bands". I wonder how well isolated that is from the OS.

Better or worse than the Librem 5 radio?

From the article:

"The iPhones are plugged into a reader that scans them, while Android phones have the app installed to do the same job."

Yes, they cannot install an app, but that doesn't make your data secure from being taken.

It's unclear how successful hardware hacking on a modern, updated iPhone can be at this point, isn't it?

That's a pretty big difference given that it's a point-in-time event versus needing to get a new phone to be certain it's not compromised.

Also it seems like they juyt havent figured out they can use a developer license to sign the app and install it on peoples iphones.

They would need to register each iPhone as a developer device as well, right?

If Chinese guards abused such a developer license (which Apple could quickly revoke) could Apple also remotely invalidate/delete apps from affected customers? Could Google do this?

On iOS this could also be done because they are forced to release the physical device and password/PIN.

At that point they could jailbraik or install MDM.

Or just dump all your browsing history, apps and email.

Makes me wonder if I can enable some ‘enterprise policy’ on Android that would require apps signed or otherwise validated by an ‘enterprise’ and the phone locked down for stranger apps.

I see what you're trying to do, and I understand the security concerns leading you to do it. I think it's probably a good feature to have on phones like Android. At the same time though, what you're really doing is just sneaking closer and closer to an Apple style mobile-verse.

>Apple style mobile-verse.

I think the OP is looking to be the Apple in his Apple-style mobile-verse.

But what if the "Enterprise" was a server in your house?

I am sure the chinese government can twist Apple's arm to sign their malware. So it is not any better.

It's not any better (stated as fact) because you hold an unsubstantiated opinion which so far is contradicted by actual reality.

Today Android phones have this malware on them and iOS phones do not, so the actual facts in the real world are that iOS is free of this intrusion.

That might change, but the situation now is what it is. This is why you are getting downvoted.

No offense, but the idea that "iOS is free of this intrusion" is your unsubstantiated opinion just as much. You don't know that for sure, do you?

So far only Android phones are reported as having the software installed on them by border guards. There are no reports of this being done to iPhones. Those are the facts.

The company building the software also provides equivalents for other operating systems: https://mobile.twitter.com/0xdude/status/1146113174212661249...

We just don't have a sample to reverse-engineer yet.

The reports that I have seen have stated that iPhones are searched by connecting a cable to them.

Cables are probably connected to make sure the screen doesn't lock to save battery.

Those are the reports, not the facts.

Well, they're facts about news reports. Always good to remember that what we know about what's going on in some other part of the world is what people tell us.

I understand that and I think the people downvoting do too. It doesn’t justify knowingly and explicitly stating something as a fact based only on speculation.

What exactly was stated explicitly as a fact?

I think if news of that got out, the US government would not be happy with one of their companies being complicit in signing Chinese malware. China gets away with a lot of stuff because companies can write it off to spies or other infiltration. Outright approval of it wouldn't go so well, especially after the Huawai affair.

The US government failed to twist their arms. Very unlikely that China has a lot of power over them. Given how many people they employ in China, they might have actually power over China.

Conversely, they depend heavily on Chinese manufacturing -- for something like 70% of their production and also rely on Chinese markets for a significant portion of their profits. When Xi comes to Tim Cook with the options: "lose 70% of your manufacturing and 50% of your sales or let us install this app" it's not really an easy choice.

Oh there is, but its not one the proletariat on social media want to accept.

OK, I'll bite: How sure are you?

Lol, fanboys downvoting my comment, even though it is totally possible. Even my last comment 28 days ago, which was incidentally against Apple but factually true, was also downvoted. Looks like hacker news is being plagued with fanboys who can't take any valid criticism of their dear Apple Inc.

Edit: when I wrote this comment, my original comment was at -4 points.

It’s not the same. These are border guards easily putting spyware on Android phones, since it’s a feature of Android (to load programs). With iOS, you’d have to jailbreak it first, which isn’t a trivial thing to do “while you wait” at the border.

That’s all.

You don't need to jailbreak if you have an Apple signed App, which the Chinese Govt. can theoretically force Apple to provide.

Will you not see it on the launch screen?

I mean, if you wanted a hidden, non-standard launchd type app, you'd have to modify the filesystem, install it, they'd need to create special tooling to do so, and modify the updaters to preserve it across an iOS update, etc. All without anyone at Apple speaking out.

Apple refused to create an unlock tool for the US government that was a one-off, to create spyware for China seems like they last thing they'd do. Could they? I guess. Once detected - and it definitely would be (as this was), or leaked by employees - Apple would get bowled over by buyers and the stock market. It's just not in their interests. Their current business model is selling privacy.

Then we need a story like this article confirming that do this too. So far the evidence points to “no”, but that isn’t enough. The transparency report from Apple needs to report this as well.

Apple is just gonna remotely ship it to you. You can't do business in China without bending over to government. If they want malware there then there will be one.

Would you please read the site guidelines? They ask you not to post like this.

https://news.ycombinator.com/newsguidelines.html

These biases are in the eye of the beholder. People with opposite feelings about Apple (or whatever the corp of the moment is) see exactly the opposite bias.

I used Android for this reason for many years and I still think Apple's model poses an extremely serious threat to the freedom of the internet.

But as Google's data mining practices have become increasingly invasive I've also become a lot less enthusiastic about using Android phones. I suppose I should probably run one of the stripped down Android variants that removes all that tracking but I also need a reliable phone that doesn't require hours of fiddling.

It probably easiest to look for a phone that supports lineageos and install its fork, lineageos for microg on your phone. That way you can continue to use apps like WhatsApp that require Google Play.

Lineage for MicroG also provides "F-Droid Privileged Extension", which allows F-Droid to install and update apps without the need of user interaction or the unsafe "Unknown sources" option.

https://lineage.microg.org/#faq

As of either Android 8 or 9, you can set F-Droid to be able to install apps - i.e. the "unknown sources" option is scoped.

It still requires user confirmation before install, autonomous updates are still not possible.

Because F-Droid is a paradigm of how to run a good app store.

I can't tell - is this sarcasm? If yes, what is wrong with it?

Last I checked WhatsApp worked fine without Google Play Services.

Indeed I use an open-source stripped down Android variant. It only required an hour of fiddling one time (to learn how to, flash it and set everything up the way you do on a new phone), works as breeze since then.

On which phone if you don’t mind me asking. My experience has been on several phones that doing this is rather buggy and just a big headache.

I use Lineage OS with microG on my OnePlus 3. It works just as well as Oxygen OS (which shipped with the phone).

Minor and major upgrades both happen in place so no need to ever reinstall. However, major version upgrades do require you to flash an image from the Lineage website.

Your number one reason is also my number one reason, for the exact opposite reason. I don’t want anyone to be able to get their innocent looking code into my phone without some extra effort

I agree with you, which is why there are many more viruses/malware in Android vs iOS.

However my issue with iOS is, that people don't have the freedom to choose whether or not they want to be protected by this "walled garden".

Currently, you cannot opt-out, and the side effect is that Apple limits our freedom to choose to, for example, set Firefox as the default browser. Or set startpage.com as the default search engine in Safari. etc. etc.

I don't understand how a single company is allowed to have so much power to decide/enforce upon us what we may and may not do with our devices. And since it's an oligopoly (Apple or Google), we don't have any other alternatives.

I’ve been both inside and outside that walled garden. I increasingly prefer life inside the wall.

But that’s just me. What concerns me is the tribalism of people. “OMG! You use THAT phone/computer/OS?!?! I would NEVER use that!” Then go on to explain why their buying choices are better than yours. Look at the replies here, they’re rife with it.

> I increasingly prefer life inside the wall.

We can have both: live inside the wall and have the freedom to do with our devices what we want;

For example, in macOS i can disable 'System Integrity Protection' (SIP), make whatever modifications i want to make, and then re-enable SIP. The same thing could be done with iOS.

The real issue is that Apple wants to have control over our devices for economic/financial reasons.

True story: I worked for a mobile app developer that earned a reputation for destroying Android phones.

Logging bugs would trash the flash storage in months or weeks. Other bugs and “features” would drain the battery so aggressively that several phones caught on fire, some injuring customers. We found ways to hide our actual power usage and circumvent protections that would have prevented rapid battery discharge.

In a meeting, it was said, “Stupid Apple won’t let us run background processes.” To which I thought, “Thank God.”

It was Apple’s approval checks and policies that prevented this app maker from potentially physically damaging their customers’ phones with this terrible software. Physical injuries weren’t enough to fix the bugs or stop messing with low level settings. Nope.

There are some “choices” that shouldn’t be put upon consumers. There are some profoundly bad developers out there. Shouldn’t there be protections from app makers that intentionally hide their shady tweaks that disable power protection safety?

Apple’s approval process does indeed root out many of the worst offenders, like my former employer.

> Other bugs and “features” would drain the battery so aggressively that several phones caught on fire, some injuring customers. We found ways to hide our actual power usage and circumvent protections that would have prevented rapid battery discharge.

Was it FIX Health? Their flagship app, The Outbreak[1] is literally the worst app I've ever installed on my phone.

I had to install it as a part of a company health incentive so I could get my HSA bonus, but that app is seriously so bad. If I opened it on my Nexus 5X with 30% battery remaining, the OS would immediately start shutting down. Sometimes it froze my phone at full battery such that I couldn't use it or even reach the lock screen again until I did a hard reset.

[1] https://play.google.com/store/apps/details?id=com.FIX.TheOut...

> The real issue is that Apple wants to have control over our devices for economic/financial reasons.

Maybe, maybe not. But I for one like this walled garden because it prevents a lot of stupid people from doing really stupid things. From a computer, infosec security angle.

That's understandable. And those willing to break out will have a price to pay. Like the "your phone is insecure" message on boot after you went to a bunch of complicated steps to unlock your bootloader. That's acceptable. Removing this option entirely is not.

Or, you know, having multiple trust sources installed on your phone. I'd like to download apps by microsoft without having to beg google for permission. Manually adding new stores/etc should come with drawbacks / be unacceptable complicated for average users, of cause.

> But that’s just me. What concerns me is the tribalism of people. “OMG! You use THAT phone/computer/OS?!?! I would NEVER use that!” Then go on to explain why their buying choices are better than yours. Look at the replies here, they’re rife with it.

The thing about being able to install code without permission from a third party is that it's like herd immunity in vaccination - individuals or small groups doing it is not actually very useful in order to ward off harmful effects, it needs to be a widespread, mainstream possibility.

Repressive governments are perfectly fine with draconian restrictions and attacks on minorities using computing platforms if they can succeed in 80% of cases. That means they have a much smaller base to attack with targeted "enforcement". Only mass civil disobedience through installation of prohibit code actually works.

Many of the fundamental freedoms we cherish only exist because of mass permissionless code installation of the 90s to mid-2000.

I wish I could sit there and say you can use whatever you want, I really do. But I think your choices negatively impact me and the rest of society.

Ah, and another one, but with the added BS of “OMG! You’re hurting society!”

Mkay...

We do have the freedom to choose, we pick Google or Apple if it’s an issue we care about. If we don’t care about it, it doesn’t matter which we pick.

It’s like complaining that Toyota gives you the option of reliability but Nissan doesn’t. You pick from the options available.

Like i said, it's an oligopoly. There's only 2 choices which is not enough.

Imagine you could only buy 2 type of cars...

There are Blackberry phones. There are feature phones. It’s your choice to feel you must own a phone from one of the two main ecosystems because “everyone” else does. I know a number of people who either don’t own smartphones or only carry one provided by their company (and use only for work purposes).

Two is not enough? So what are you doing about it? It's not Apple's fault that Google now has pretty much all the rest of the market for smartphone ecosystems.

I totally support the idea that Apple/Google/whatever should check apps published in their stores thoroughly yet a user should be able to install an app manually or via a 3rd-party store if they know what are they doing.

> anyone

This "anyone" is you as only you are responsible for the applications you install in your own devices.

People need to learn personal responsibility for the stuff they install instead of enabling OS vendors to control what everyone can do with their devices in the name of protecting them by themselves.

> People need to learn personal responsibility

Yeah they do but from what I've seen in my life, we're centuries or millennia away from the average person being like that.

So the mobile OS vendors adapt to the average human. It's only natural.

A few stories down today sis Chinese boarder guards installing presumably surveillance apps on android phones but not on Apple

The trade offs are far from simplistic

You can always go to China without a phone or with a throwaway phone (if you really must). You cannot install applications on your locked down iOS device regardless if you go to China or not and the people who go to China are a much smaller number than the people who own a smartphone.

The bigger picture is more than a government installing apps on your phone. The issue is someone other than you can install apps with unlimited access on your android phone. Foreign government, your government, your employer, a work colleague, a competitor, your spouse ... the list goes on

The security and privacy on an iPhone is greater and comes at a flexibility factor.

These apps are not installed by themselves, someone with physical access to the phone is installing them (if we include remote installs then anything that autoupdates - including iPhone - can also install software).

And it isn't a matter of flexibility, it is a matter of utility: others not being able to take your phone from you and install apps also means you not being able to do it either.

Although I have nothing illegal there, I would rather travel without a phone than handle my real phone to anybody.

Anarchy vs. BDFL

In terms of books that is very much a non Apple issue. Every country can (and does?) ban some books from publication. Whether it’s political or „save the children“, it’s a normal government process and your chosen platform, digital or paper, is irrelevant. Picking out Apple for book censorship is wrong.

Apps on the other hand you are totally right about. This censorship exists with app stores only. But in practical terms, is there really a difference between side loading iOS apps or installing android apps from binary? If anything I would prefer the open source nature of side loading

> Every country can ban some books from publication. (...) it’s a normal government process

Being common does not make it acceptable, and it is alright to criticize "neutral" actors like Apple that partake in this censoring, even if they are only following orders.

Using that logic, we should also protest book stores who don't sell banned publications.

Most certainly!

And also celebrate those who do, even if it is prohibited.

Note that Apple's Books app works with books that were not purchased from Apple. You can simply send an epub file to Books app via the standard sharing functionality, from any other app.

I assume it is allowed because it does not pose a security threat to the device, nor user, as opposed to allowing apps from outside the Apple Store.

Edit: You can try it with Peter Watts' Blindsight ;). EPub download link is in the header:

https://rifters.com/real/Blindsight.htm

> Every country can (and does?) ban some books from publication... Picking out Apple for book censorship is wrong.

That's Apple who has made this possible. If it was doing no distinction between countries (e.g. Google seemingly has just one Play store globally) then it would be not a party to blame.

By the way the book I wanted was free and not on any sensitive subject. Some kind of science fiction. I've just stumbled upon a Twitter post saying there is a curious new scifi book available for free in Apple store, so I've taken my wife's iPad and tried to get it but it said it was only available in the US store (we live in Europe).

Fwiw, Google Play does have regional stores. For example, https://play.google.com/store/apps/details?id=com.hutchison3... is only available in the UK store.

...and since parent was specifically referring to ebooks:

- Harry Potter and the Philosopher's Stone is not available for purchase in the US: https://play.google.com/store/books/details/J_K_Rowling_Harr...

- Harry Potter and the Sorcerer's Stone is not available for purchase in the UK: https://play.google.com/store/books/details/J_K_Rowling_Harr...

I'm currently in the UK, with a US-based Google account. If I'm logged in, I only see a "buy" button the second link. If I'm not, I only see a "buy" button on the first link... but Google doesn't allow me to complete the purchase, as it forces me to log in and then recognizes that it doesn't sell that ebook to Americans.

Yes, local taxi company apps are another example: they are only available in the UK store. Which sort of makes sense, you wouldn't want someone to try to call a UK taxi overseas, although I did have to spend some time figuring out how to switch store countries when I moved here.

I disagree it ever makes sense. People travel. I've found myself many times abroad not being able to download: parking payment apps, local taxi apps, sim card providers' apps, local banking apps, etc. for no reason apart from someone thinking it would be useful to region-lock them.

Perhaps there should be 2 regions: your "home" region where you initially signed up, and your "roaming" region, i.e. the country you're currently in. And perhaps instead of preventing you from installing the app it should still be available and just tell you why it cannot be currently installed, with a way to override it.

It doesn't really matter what you choose - you won't get the choice you really want in our world (at least not that fast and it won't be as shiny and exciting as the advertised stuff we can buy already).

One should consider smartphones unsafe devices and not trust important data to them.

Even most computers aren't really safe devices. With a lot of effort you can minimize risks (e.g. using core/libreboot, full disc encryption, live OSes etc.) but you'll never find a way to absolute security and privacy.

The discussion if Android or iOS is safer doesn't really matter that much in my opinion. I choose iOS because of their constraints. The pseudo-freedom Android gave me wasn't enough or that useful that I'd consider using that system again so soon. Also I like the fact that I can use an iDevice for a longer period including new OS- and security- updates. (just my personal opinion without any recommendation)

I agree. Android is not without it's problems but at least I can run my own code on it without jumping through hoops.

Android is not safe from the same problems. Google also shows all gov's demands for information.

In practice I just haven't found this to be an issue. It seems to be only obscure, possibly illegal? apps like the youtube app you mentioned.

I would actually love to hear what apps you guys love but can't get on iOS

And leak all your available data in the instant you open the app.

> I always knew you can only install apps from the store on Apple devices

This couldn't be further from the truth. At least take the time to understand how the various platforms function before spewing inaccurate statements about them.

You've been able to side load apps on iOS since the App Store existed. The App Store has never been the "only" way to install apps.

Oh? Outside of a developer certificate or jailbreaking, how does one sideload apps on iOS?

Remember that most users woudl gladly exchange their freedom to do so for a safer, more controlled environment.

And that some of them want a phone that can run some application ( where android is a PDA that can make some phone call )

It's not an exclusive choice, in an ideal world we'd have apples app store lockdown AND the ability to throw caution to the wind and run whatever we want.

You can simply get a dev account and install what you want.

Or someone can get an enterprise account and allow you to install their apps.

Also... what exactly do you even want to run what is not possible on iOS?

> You can simply get a dev account and install what you want.

For simply €99 a year for the privilege to run your own code on your own device.

Yeah I value my privacy and security a lot more than that.

Plus the price of the machine for running xcode

"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."

- Benjamin Franklin

This is silly argument to make here. The vast majority of users aren't using their phones to whistleblow on some government scheme or a plot by the new world order. They are running their businesses and lives on these things. And for those people the ability to run some .apk from a sketchy website is worth less than nothing to them, but the safety of being protected from attack is. Realise that you are not the kind of user these phones are designed for. You are a power user who wants power user features. That is fine, but don't condemn people who are just using their phones as tools.

> The vast majority of users aren't using their phones to whistleblow on some government scheme

But some of them are, and it is essential for a healthy society that this is always possible for them and for anybody who needs to.

It is possible: Buy an Android if that's what you need from your phone.

Unless an app essential to their business gets taken down from an app store, with no way around that.

Not being able to install 0.1% of the apps I like is not giving up essential liberty. Getting a completely controlled sandboxed environment with vetted applications is not little temporary safety.

Not being able to sell your application, because another company doesn't like it, is giving up an essential liberty.

> Not being able to install 0.1% of the apps I like is not giving up essential liberty.

Apple literally dictates acceptable expressions of sexuality to people.

How the hell is that not giving up an essential liberty?

Controversial opinion: I like Apple's security lockdown- and the whole Internet is still available, so I'm not quite that worried about not being able to install [app] because there's likely to be a web version, too. Keep in mind that using an Apple phone means that you are using a tool / machine / device that's much less likely to reveal its secrets. Isn't that worth something, too?

What Ben Franklin Really Said: https://www.lawfareblog.com/what-ben-franklin-really-said#.U...

FWIW, the original quote in context means something different than most people realize:

https://www.npr.org/2015/03/02/390245038/ben-franklins-famou...

Yes, but it is an apt quote which has been re-appropriated long before the 21st century to mean what it does today. Just because Ben Frank didn't mean it in that context doesn't mean it loses its power.

Can someone point to which OS youtube downloader OP is referring to?

Not the OP, after some quick searching found this: https://github.com/HaarigerHarald/android-youtubeExtractor

Not open source, but "YouTube Downloader" (thread on XDA [1]) has worked well for me.

1: https://forum.xda-developers.com/showthread.php?t=2137743

Note that on iOS you can download videos from YouTube using youtube-dl (installed in Pythonista). With Pythonista's share sheet extension, it's quite convenient.

Google Play Store also complies with government requests.

The actual report[1] is very interesting to read.

I was surprised that there were zero App Store takedown requests from governments in North America, South America, and Australia.

All of the takedown requests came from China, Vietnam, and Europe; including Norway and Switzerland.

[1] https://www.apple.com/legal/transparency/pdf/requests-2018-H...

Also, a National Security Letter may require that the takedown not be publicized in any way. This is in part what led to the concept of warrant/NSL canaries: a statement in a legal doc such as terms, etc. that says there have been no warrants or takedowns orders received. If the canary is removed from the doc then it is not publicizing the NSL, but the canary's absence is supposedly required by law (IANAL) because keeping it in there would be a falsehood in a legal document, and so the absence indicates the NSL/takedown occurred.

Just to add to this, Apple did have a warrant canary. It disappeared in 2014 [1], suggesting that they have been receiving warrants and possibly takedowns for the last 5 years.

[1] https://gigaom.com/2014/09/18/apples-warrant-canary-disappea...

An NSL can only be used to subpoena metadata from a provider without the provider being allowed to inform anyone. It can’t be used to compel a company or person to do much else.

To my knowledge, the US government (or at least the FBI) “negotiates” a takedown of a problematic app with the developer directly.

Source?

Personal knowledge/professional experience. While it certainly isn’t my area of expertise I have no reason to believe law enforcement handled this particular situation differently than they would any other. I will say that I didn’t think the government had much of a leg to stand on from a legal perspective (so perhaps that could have necessitated their “negotiation” approach) but the stress of the ordeal provided quite a lot of leverage to get the developer to take it down.

All the EU countries (Norway, Switzerland and Netherlands) include the footnote "All or vast majority of requests relate to illegal gambling investigations."

Switzerland is not part of the EU.

Sometimes people type "EU" when they mean "Europe." Like people type "America" when they mean "The United States of America."

Though they are part of Schengen which abolishes border control with the EU and makes things confusing for visitors.

And neither is Norway.

True, but they are part of the single market.

Well, thank you (sarcasm at play here obviously) Germany for pushing Europe towards the top with 67% of all the requests based upon the total given for Europe, Middle East, India, Africa Total. Why they bundle those into one total is equally odd, though maybe some telco regional grouping legacy aspect at play perhaps - thinking https://en.wikipedia.org/wiki/Eurasia

I'd work out the Europe total, but that would only depress me further.

Why does Germany stick out compared to other countries in Europe - some Stazi hangover mentality! Who knows, but some serious questions need to be asked as clearly some major disparity amongst EU countries at play here. But I'm sure they will get their shrills to bury that question, hmmmm.

Germany 12,343 requests Europe, Middle East, India,Africa Total 18,205

They mention why Germany had an unusually large amount in the article.

They do, but that is a large amount of stolen devices in a 6 month period compared to other countries.

The inner cynic in me asks - Maybe that was the template they used for such requests.

> Germany issued the most legal demands for the six-month period ending December 2018 with 12,343 requests for 19,380 devices. Apple said the large number of requests were primarily due to police investigating stolen devices.

In scenarios like this, is "... primarily due to ..." good enough? I'm inclined to say no: They need to all be accounted for.

I don't think I understand what's going on here. How does removing an app from the app store help them track down a stolen phone?

My understanding is that there's two things they did: take down apps, and grant access to devices (presumably access to personal data). I'm specifically talking about the latter. Context:

> Apple said it received 29,183 demands from governments — down almost 10 percent on the last reporting period — to access 213,737 devices in the second half of last year.

Presumably investigation of stolen devices has the owner's consent, should it be really counted as information demanded by the government? Or can the police demand information about my phone that I myself wouldn't have access to?

To make it easy, the owner should only have to go to the police, with them taking care of everything else. I wouldn't want some old lady coordinate the data exchange between Apple and police. But this makes it hard for Apple to verify the owners consent. Thus I'm fine with them only knowing "... primarily due to ...".

On a second thought, how much detail should Apple get in the first place. If police suspects me of some wrongdoing, I probably wouldn't want any third party like Apple to get details about the cases as well.

Apple can grant access to its devices? I thought they can only grant access to a subset of things saved on iCloud, what is stored on devices should be off-limits.

Apple's report covers all government requests regardless of the reason for the request. Only 80 of the nearly 30,000 requests were related to app takedowns.

How does removing an app from the app store help them track down a stolen phone?

It doesn't. The Apple report is broad, and lists all government requests.

The headline writer chose to focus on App Store takedowns only.

There are lots of stats in the report, not just app takedowns. The German govt. requested a lot of device information, about as much as the US.

For number of affected devices - yes, but for actual requests - they are 3x higher than the USA

United States of America 4,680 requests Germany 12,343 requests

imagine living some place where cops actually investigate stolen phones.

> Apple said it received 29,183 demands from governments — down almost 10 percent on the last reporting period — to access 213,737 devices in the second half of last year.

> Apple also received 4,875 requests for account data, such as information stored in iCloud — up by 16 percent on the previous reporting period — affecting 22,503 accounts.

I wish they were more specific. What does "access" mean? Location? All local data? Even encrypted data?

What data from iCloud? Email addresses, or the full contents of Notes and Drive?

Maybe I'm being naive, but I assumed that when something says "Apple can't read X data" it means under all circumstances. But if they have a backdoor, client-side encryption probably doesn't matter.

The common thread here seems to be

"there are bad governments in the world, and mobile phones should allow people who want to oppose their own bad governments to install apps that will help them in their opposition?"

Honestly if our goal is to rid the world of truly bad governments then phone apps are in not in anyway the first or most effective method.

> rid the world of truly bad governments

and who makes the judgement on what a "truly" bad gov't is?

I say if you own the hardware, you should be allowed to install any app you wish on it.

Apple can claim that this voids your warranty, but they (or any other actor (including the gov't)) cannot be allowed to _prevent_ you from doing it. .

Surely there has to be a way for you to install apps on your own device while developing new applications. So if the source code is available for an application can you compile and install it?

It is. You also could make it possible to install for testers. But: - either 100 devices per developer account per year - or use TestFlight open beta test (as much devices as you want, users have to register in Testlight, app have to pass 'beta review') (I knew at least one app that uses TestFlight open beta as method of distribution: they just show 'enter login/password' on startup and change icon and name from time to time. Their android app is just apk+updater. Registration and payment is via website Reason for such measures? App does nothing bad for it's users but there are people who will say it's existence violates their right and costs them trillions of dollars)

3rd option is abuse of enterprise development certificate (which is intended for $BIGCOMPANY's own employees only)

> and who makes the judgement on what a "truly" bad gov't is?

Maybe common sense, human freedom index, etc.

Are you really arguing that as Westerners we cannot tell a bad government from a good one?

> as Westerners

What distinction are you trying to make here? Many Western governments ( namely, the US and its closest allies) engage in warrantless wiretapping, unlawful search and seizure, imprisonment without due process, warfare without democratic authorization and even taxation and regulation without representation. None of these matters register on the radar of public concern. So can we, as Westerners tell the difference? Apparently not, but we sure are smug about our geographic orientation.

Yup, the US are absolutely awful. That's why everyone wants to move there.

Unless you're a college kid or just came out of college and you've just been brainwashed by your Marxist professors, I have no idea how you can have a vision that is so far from reality.

There are lots of people who think the USA has a good governmental model despite the fact that we never re-implement it when we're helping another nation rebuild. I think that's telling.

Maybe it's too good, and you wouldn't want those nations to become superpowers ;-)

I disagree, I think social media and its associated viral communication is one of the best way to fight against an oppressive government.

If it doesn’t work, why the ban? (ed: rephrased ambiguity)

Also interesting, but not mentioned in the article, is that Apple provides data on how often they comply with such requests in addition to how many they get.

Yes, see https://news.ycombinator.com/item?id=20341997

Reports available at https://www.apple.com/legal/transparency/report-pdf.html.

I was curious about which apps where taken down in Switzerland (Table 13, page 16), and the report says:

> All or vast majority of requests relate to illegal gambling investigations.

Those will only increase with this year's new gambling law, which bans and requires blocking of unlicensed/foreign online gambling providers: https://www.admin.ch/opc/de/classified-compilation/20172704/...

As far as I know all gambling sites are still accessible, with only some having decided to suspend their activities in Switzerland (Betfair comes to mind).

The blacklist is currently empty, the first set of blocks will go online in Autumn 2019: https://steigerlegal.ch/2019/07/01/schweiz-netzsperren-gelds...

> gambling investigations

I hope they mean court orders than just some investigation.

I think the american investigation term is more broad than in other places where investigation just refers to police investigation.

5 NSLs: https://www.apple.com/legal/transparency/us.html

Way more than 5. Every instance of "0-N" instead of just "0" implies at least one more NSL.

Scroll down, there are five which FBI permitted Apple to publish which Apple lightly redacted.

Shouldn't the report about first half of 2019 be published already?

There were apps which tracked US bombings and violations in war zones which were removed. I hope they’re on this list.

That wasn’t a government takedown request, so it wouldn’t be on this list.

Not paying your Youtube Premium subscription is enough to take down the entire App Store on your phone.

Imagine if Windows wouldn’t let you install software until you updated your Paypal with a valid credit card.

It used to be possible to register for an Apple Id that you could use to install apps without providing your credit card details. It it not entirely obvious how, but I managed to do it in the past by registering from the device itself and skipping the part where it asked for card info. I no longer own an Apple device, so can't verify whether that is still possible.

Apple Id signup without credit/debit card is still possible. I don't have any card linked at the moment, and I help friends/family signup.

It's possible. I don't care a CC attached to my Apple ID.

You used to be able to sign up merely with a iTunes Gift Card (which can be bought with cash).

They may have removed that restriction entirely now.

How is this categorically different from other goverments demanding social media credentials?

https://thehill.com/opinion/immigration/445766-government-su...

Pretty ridiculous the FBI refers to Apple Inc as Apple Computer in 2017, it seems, which would be many years after legal renaming.

I wonder -- Could that render these requests invalid? They're not properly addressed to the entity after all.

Not that I'd recommend trying that luck :)

I doubt that you would be able to register a new company called "Apple Computer" that is different from "Apple Inc". When you look up "Apple Computer" you get redirect to "Apple Inc": https://www.sec.gov/cgi-bin/browse-edgar?company=Apple+Compu...

Do companies own their past names indefinitely?

The RMS defense. Like when he’s asked about Linux and he says he doesn’t know what that is unless you specially say “GNU/Linux”

And by "he says he doesn't know" you mean he meticulously, in paragraphs, explains the difference between GNU and linux, and how he basically started the GNU operating system out of a desire for freedom, but that he technically or philosophically has nothing to do with the linux kernel, which is correct, technically and otherwise?

I guess he doesn't know a lot then.

He doesn’t do that in interviews. And he’s just being pedantic prick about it.

I think this fails the “would a reasonable judge see through it” test.

I'm glad this article puts a spotlight on this, but my gosh! Could it be more vague? What are the subjects of the NSLs? Was this article written too soon after the documents' release to give a summary of the juicy bits?

To me this basically reads like "a company released some government documents". Is this typical of TechCrunch?

If only Apple reported it's own takedowns - a.k.a. censorship of the competition on the app store. Anyone remember how they retroactively changed their policies to "takedown" Steam?

I wonder what the violation of privacy law was for the apps taken down by Kuwait (and Saudi Arabia)...

only took them 5 years.

The reports go back to 2013: https://www.apple.com/legal/transparency/report-pdf.html

Reply on news.ycombinator.com