While the US doesn’t force companies to install apps, it does force companies to support E911 and the system used for Amber alerts and other mandated alerts.
There's a huge difference between "implement this standard on your phones" and "execute this binary blob".
A key tool Apple uses to mitigate the risk is the ability to remove those binary blobs from distribution and to prevent them from running.
The iPhone has the same mechanism.
The references demonstrate that they would use it if they needed to.
Saying ‘it’s Apple’s responsibility to make the sandbox secure, is magical thinking’, which is why they need these tools.
As to the Zoom fiasco - who should have clicked on that option?
Their defense in depth strategy involves inspecting apps before they get onto the App Store for completely rational reasons. If they are not allowed to do this then it’s probably in Apples interest to abandon the Russian market.
It could go through the same app review process.
On the other hand, this should be an excellent test of Apple’s security and review process....
>On the other hand, this should be an excellent test of Apple’s security and review process....
In between your two contrasting comments, lies the rub of how much further Apple is willing to capitulate to the demands of nation states ─ who demand nothing less.
https://www.nytimes.com/2019/11/28/world/europe/crimea-apple...
Heck, Apple could theoretically make the sandbox more restrictive.
On top of that, changing the name of a country is a server side change and changes data. That’s no different technically if France mandates that all movies had to have French subtitles.
Only by breaking other apps.
Yes. https://www.bleepingcomputer.com/news/security/chinese-censo...
Imagine a state requested application tracks location and sends that up (yeah, need is little as devices can be tracked over cell towers relatively good) when installing they'd certainly require permissions to be set accordingly.
Also from Apple's perspective it's about the brand. They don't want to have preloaded crap on a fresh device, where the user can't distinguish whether it comes from Apple or the state.
If Apple does find that the app breaches its security process during a review, they should treat it as any other security vulnerability and fix the problem.
The US doesn't need to. Most companies dominating the field are US based. If they weren't, the US would turn protectionist and require specific favors from them to let them operate in the USA pronto...
A lot of the grandstanding "we would never do that" stems from this dominance...
This is already the case. They're not called favors, they're called federal laws.
However, there are no federal laws requiring the installation of software on almost anything (maybe military applications?) There is no need. The government can just go through ISPs & carriers & companies for surveillance purposes. Russia's government can do the same thing.
This move is an attempt to energize the Russian software market and not much else.
Although I am against this law because probably it is there to allow spying for Russian citizens and prevent them from using secure messengers like Telegram or Tox.
And, by coincidence, companies that sell equipment with non-US firmware, are not very welcome in the country.
This maybe the case for military equipment. In terms of infrastructure, I think currently its just Huawei equipment that is banned. An other countries are considering that ban too. But we use plenty of equipment from South Korea, Taiwan, EU. I bet the BIOS of most PCs are developed overseas.
And just like if a regular app can cause security issues, it’s the fault of the operating system and should be fixed, if your data on the cloud can be read by an adversary, instead of only having the private keys on the device, that’s a flaw in the implementation that Apple needs to fix. Yes si realize that everything stored on iCloud is not E2E encrypted. That’s the real issue, not that the data is in China.
I don’t trust the US government anymore than I trust the Chinese government.
In the US, data requests have to be for individual accounts and go through a judge and sent to the company, who might file an appeal. This is not the case in China. The government can simply get the data it wants without any company appeal.
> It wasn’t stated that Russia was mandating device management
Nor was it stated that it isn't. My point was that the sandbox doesn't automatically imply that these apps are safe, as you had claimed.
I would much rather that Apple designer a system where it couldn’t give out the information because it didn’t have an unencrypted version of the data in the first place.
"Google first provided location data, but no identifying information, for 19 devices in a 150-meter radius around the bank for a one-hour period that included the robbery. Police then picked out nine of those devices for more information, and Google gave location data on those devices covering two hours. Finally, police asked for — and received — subscriber information for three devices, including one that was in the bank during the robbery, left immediately after it, and followed a path matched by witness sightings."
https://www.nbcnews.com/news/us-news/police-used-google-loca...
In China, the police would simply access the location history of all iPhone users in the area, complete with identifying information, without Apple's involvement.
There was a series in a British magazine, many years ago, where a journalist would ring up a restaurant asking for special treatment for a celebrity. So they'd ring up The Ivy or whatever and say "Look, Madonna is coming in, is it possible you can serve her kid some chips?". The gag was that when it was an A-lister, the restaurant would always bend over backwards for them, but when they rang up as Kerry Katona or something, the restaurant would give a stiffly worded response along the lines of "The Ivy only serves the highest in culinary quality, and Ms Katona should leave her kids at home".
Anyway, China is a gigantic, buoyant market with a huge and growing middle class who will be Apple consumers for a long time, and also a crucial part of Apple's manufacturing strategy. CCP ain't going anywhere fast.
Russia is a failing state, and anyone who aides and abets the regime is likely to be considered an enemy of the people in a few years time, let alone the reputational damage in other Western countries of supporting Putin's regime.
Also emergency alerts in the US are now fairly well secured with a PKI (iirc). Doesn’t stop a dumb or rogue operator, but it does provide some authenticity regarding if the alert came from a legitimate authority or not.