Hacker News Reader

Comment by fermienrico | Hacker News Reader

I am fine with this for most things except my phone.

I trust Apple more than any party in the world. Even the government. Fortnight devs, Epic, whatever are not even on the same radar. They'll sell your privacy in milliseconds if they can get 2.5 cents for it.

I would never ever own an open source phone. Not because the operating system is open source (probably good that it has eyes on it) but there is no way to control third-party apps. Even the os builds can get hacked and I cannot trust it. I have so much personal stuff on my phone on it that I cannot afford to entertain Richard Stallman and his righteousness.

View on HN

>I trust Apple more than any party in the world.

That opinion is likely to be a bit of an outlier, heh.

I honestly do. Who would you trust more?

Myself.

If not for IME, I could have a computer under my control, running software guaranteed to be free from the Trusting Trust attack, right now.

I respectfully disagree in my case. I don't consider myself a security expert at anything, especially at computers. This is probably 99.999% of the Apple customers.

People like yourself can probably manage their own security, have a secure NAS, multiple firewalls, etc.

Do you see it from the perspective of average Joe (or me)?

I trust Debian to supply and maintain the software on my machine. But, at any moment, I can choose to add other trusted parties, or remove the Debian repositories, or add my own patched version of some app.

I usually choose to trust them, because it's convenient and because they probably know better than I do. But my trust in Debian is completely voluntary, non-exclusive and revocable.

That's fine, but you're telling everyone else that, because you personally are not willing to take responsibility for the security of your devices, it's ok for a corporation to dictate that no one is.

This doesn't need to be an either/or situation. You can outsource your security and privacy decisions to Apple while simultaneously allowing others to take full control of their devices.

No, that's not a fair take. I am saying that everyone is probably more akin to not knowing a darn thing about security (outside of HN caccoon) than people who are commenting here to setup their own security infrastructure.

Given the conditions of how ignorant large percentage (~ 99.999%) of the Apple customers are, I would trust Apple more than any other party to keep them and myself safe.

Can you imagine third parties siphoning off data, metrics, photos, etc. without Apple safe guarding user's interest?

I would pay a lot of premium for security if I don't have to do it myself.

A lot of HN users are hackers. That doesn't mean that there are no hackers outside of HN, nor that only hackers can keep a phone secure.

I think maybe you're missing the point? I don't even disagree with what you're saying, but we can have it both ways: the alleged 99.999% (I suspect you're exaggerating) can have by-default strict security with no apps allowed unless installed through Apple's App Store, and the rest could do whatever they want.

Android has that, but you can also side-load apps if you think you are knowledgeable enough to want to. That's the main contention with how Apple runs things, there is no proper escape hatch.

Do note that trusting other people is not incompatible with trusting yourself. Often you can trust yourself to the point where you know you will be over your head, and then hand off that trust to someone else.

And what about giving people choice? Androids often come with locked bootloader and users can unlock it. Unlocking permanently deletes all user data. Apple is not giving any such choice!

Now that you know that Apple will abuse the security mechanism for their own self-interest do you still trust them more?

Free and open source software.

Even if Apple allows people to install apps on their phone bypassing the official app store, noone is forcing you to do it on your phone.

Your phone's security will not be compromised by adding an extra optional feature.

You're right, but that fundamentally changes how I look at apps on my iPhone and my device or the ecosystem as a whole. Right now, any app icon I see on my phone, or any Apple device, I implicitly trust, because I have outsourced my trust to a corporation. This does not mean there are not scummy/weaselly apps out there (tiktok/Facebook/etc. for example).

Like root certificates, you have to trust someone, at some point. I am choosing to trust Apple.

By allowing side-loading apps, that is eroded, even if the tiniest bit.

How is it eroded at all if you don't install or use those apps? What changes?

More than... yourself?

Yes, when it comes to keeping things secure, I honestly trust Apple more than myself (I've forgotten to lock my car upteen number of times) and my family.

I am not saying that Apple is not prone to hacks, gov influence, but based on their past record, their stance on privacy - who else could be more trust worthy?

Can you provide examples of whom you would trust more if you owned an iPhone to manage your phone?

It's not comparable to locking your car, unless you're in the habit of re-writing your phone's operating system every few days.

Right now, if I was running some open source OS on an open source hardware, with random 3rd party unverified apps, etc. - I would have no confidence in myself to keep that thing secure.

I agree that things like openssh can be more secure because there is a huge number of individuals and corporations using it, there are a lot of eyes on it. It is open source and secure.

That's not the same as something as big as an iPhone. iPhone is an ecosystem of apps, cloud data, biometrics, hardware encryption (secure enclave), etc. and finally the physical device.

For some reason a lot dev's cannot seem to comprehend that a lot of people(Including myself) are not capable/wish to maintain/keep up with security.

I rather use my brain cycles for something else. This is compounded for people who have no interest in tech but rather just want to use them to perform certain tasks.

Are some of practices unfair sometimes to a small subset of companies/developers. Definitely yes, But what are the other options that have this level of privacy or trust worthiness with a similar ease of use/setup. I don't know of any.

It's more or less choosing the lesser evil.

If we want something objective, how about sampling HN commenters Android and iPhones for security exploits?

It would be interesting to see if these users views stack up in practice or these are just beliefs that are not practically demonstrable.

My guess is just beliefs. It's pretty similar to what happens in code at-least where i work at.

Dev tries to make it super flexible, tries to make it fancy, implement DRY like one's life is dependent on it ultimately resulting in a hard to read/maintain messed up spaghetti code.

Also i don't see how can a person know all of the security stuff with a beast like Android unless they spent/are willing to spend an insane amount of time on keeping up latest exploits, architecture etc.

Sometimes choices are not a good thing.

But there could be a switch to allow installing apps from untrusted sources" default off. It's sad that people are so ignorant and gave apple so much power. :(

Never underestimate the ingenuity of users trying to install malware onto their computers.

I think you're over-generalizing. Most people with an iPhone do not care about side-loading apps. They may be ignorant, but they also do not care. The same reason I am ignorant about the rules of NBA, or Cricket - I simply do not care.

The power you're talking about (and the risk you're not talking about) are of no value to me.

I do not want that option. Especially non-tech users really do not care for side loading.

Fortnite tried pushing people to side-load on Android is a perfect example.

Even though that step failed, still a lot of people did side-load without knowing what they were doing and that's a problem.

For what it's worth, I agree with you. I work in software and the number of times I have inspected the source of something I'm running could be counted on one hand. I trust Apple, I trust the open-source community to look for me, etc.

Reply on news.ycombinator.com