Comment by graeme | Hacker News Reader

Comment by graeme | Hacker News Reader

Parent Full thread

> compete against each other for developers.

They wouldn’t be competing on underlying frameworks though. Epic’s letter asked Apple to extend its app install frameworks and related frameworks to competing app stores.

So the only point of competition would be price, or marketing savvy. This seems to resolve to my point above: reducing Apple’s cut would benefit all developers.

Not clear how the rest does, except perhaps indirectly by forcing Apple and Google to surrender their businesses. And big developers would have a relative advantage. It’s not that small developers would have to run an app store: it’s that the ability to run an app store provides relatively more advantage to large companies who can.

Whether small developers had an absolute improvement might depend on whether prices dropped to match the lower cost structure.

Epic also wants anyone to be able to install apps on ios outside app stores. See point #2, app stores and apps available via direct install. This would lower trust in apps. The trust of the app store has led to an explosion of developer revenue. Not obvious that dismantling this system will help small developers.

There are small developers that make free stuff and when someone asks for an Android port this devs can export an apk but for and .iOS person they can't give them a package.

Other example a kind makes a small mobile game and shares it with his friends , except his cousin is using iOS so he can't install and play it.

All this things you can't do on iOS is not because Apple is incapable of allowing this scenarios, is because this is not in Apple financial interest.

I assume someone would say something about security, the kid would maybe put code to steal your pictures, then my answer is the sandbox is garbage if you can trick it or trick the user to give full access for a small game and a competent developer would have placed code to fake data if needed.

Apple is getting greedy and pretending it acts for the user is getting harder and harder and eventually they will reach the limit, starting a fight with Epic will cost them more on the long run IMO because it makes more mainstream Apple practices that we on HN already knew but regular people did not know.

I still don’t get “apps available via direct install”

Epic had (/has?) this with Android and gave up because... reasons?

Epic has claimed that Google put so many restrictions that it effectively wasn’t an option for them. Google has measures to persuade people not to turn on sideloading, for security reasons.

So Epic wants both Google and Apple to abandon their security models and allow direct installs of apps.

Phones have been an enormously popular computing platform in significant part because of the security model. Non-technical users can use them easily and reasonably trust the apps they install. Epic is asking for a rather radical shift.

>Phones have been an enormously popular computing platform in significant part because of the security model.

>and reasonably trust the apps they install.

That seems like an illusion though to me.

https://www.cvedetails.com/top-50-products.php

Android comes in at #2 for number of distinct vulnerabilities and iOs at #8 both in the top ten and both above windows of all things. Which rings in at #10 for 7 and #13 for 10. OsX sits at #4.

https://www.gnu.org/proprietary/malware-mobiles.en.html

This kind of misses the point, which is that the user is the weak link in most personal computing security models. You don't need a CVE on Windows to get malware on the machine; you just need to trick the user into installing your nasty piece of software--perhaps by making it look like something the user wants.

The point of the single-source App Store is that the app review creates a line of defense against such trickery, on behalf of the user.

This chart is a bit misleading - MacOS is the equivalent of windows 7, 8.1, and windows 10 combined, which places Microsoft at the top where they belong. iOS has overall fewer code execution and privilege escalation vulnerabilities as well.

Android has always been a shitshow,so the gnu link is unsurprising - however I did not find an example of iOS malware.

Fair point. The ease of use is just as important to the ubiquity, and Android especially has a lot of vulnerabilities. But, vulnerabilities also come with popularity: people try harder to find them.

1. How much less secure would Android be without even the play store’s security measures?

2. How much harder would people work to find vulnerabilities on such a ubiquitous platform used by non-technical users if any app could be installed?

You would likely get more malware and more app hesitancy.

>You would likely get more malware and more app hesitancy.

More malware, possibly, though android has plenty of that even with the play store. But, app hesitancy, maybe from a small subset of people, but i feel like those same people already show app hesitancy.

Only from my own experience, but i treat apps from the app stores about the same as i do random apps from the internet and do the same thing to verify in both situations, look at reviews and information about the app and make my judgement based on those. It's the same either way. All app stores do in my mind is aggregate reviews to one place, whether it's the play store, the apple store or the steam store, etc. I trust each of them about as much as something such as apk mirror, in all cases, i'm relying on the opinions and information provided by others that have used the app, if no such information is available, i consider it suspect and avoid.

The method acquire an app isn't what invokes trust, it's other user verification, no matter whether that app came from a store, a repo, a random website or any other method software can be delivered and it always has been, since the days of floppies.

I’m less familiar with android, but on the ios side there are very real limits to what an app can do, even if it has malicious intent. And app review greatly limits apps with malicious intent. ‘

You still need to exercise caution with permissions, but an individual app itself has pretty strict limits. Most of the security flaws are tied to the OS itself.

>Most of the security flaws are tied to the OS itself.

Which was the point of my original comment, that phone OS's provide the illusion of being more secure, while being about as secure as any other platform.

From what I can tell, computers are about as secure as they've ever been, whatever the kind, which is, alright depending on the user. It's always been like that and still is.

App stores and sandboxes haven't changed that.

Eh. Unless iOS exploits are uniquely tuned to be unnoticeable... I go home to help my parents with their Macs and am always removing crap, usually from their browsers. I haven’t yet had to remove crap from their iPhones/iPad.

Is it 100% secure? No. Is the user experience that I desire available due to app stores and sandboxes? Yes.

Epic couldn't convince people to sign up outside Google Play and sideload, so they gave up and came back. Turns out Google was delivering value for their 30% after all.

Google's position on Android is way too strong to say that they deliver their 30% worth of value.

Aside from what user graeme said, there are plausible reports that epic tried to contract with samsung or huawei or some fairly sizable android hardware maker to put their app store, or at least fortnight, on the phone directly, and google then informed the hardware maker that they'd block the google play store from those devices if they did that.

But it does highlight the problem here.

Let's say I take epic at their word, that this is not okay (and I'm tempted, this whole judge jury and executioner thing is ridiculous. Apple has now said that they regret that they can no longer spend time with Epic on making sure the Unreal engine runs well on mac hardware. That is so close to 'nice house you got there. Would be a real shame if something happened to it' it makes the hairs on my neck crawl).

What then? Sideloading with security measures is something google has but that's according to epic not good enough (and I'm again tempted to agree).

But clearly some free for all fiesta is no good for the users. And I don't think governments, certainly no the US government and probably not the EU either, are capable of defining the playing field, this stuff is too complicated.

So... what then?

I would hope that Apple (and Google) realize that this fight has only users, and the name of the game is to walk the line so that nobody is pissed enough that you end up with exactly what just happened. And it looks like apple has decided they like the hole they are in, as it sure looks like they are frantically digging.

They still offer it, and since they're also banned from the Play Store, probably dependent on it again for Android users.

They probably listed in the Play Store in order to get standing to sue Google.

Reply on news.ycombinator.com