Hacker News Reader

Comment by dwighttk | Hacker News Reader

I still don’t get “apps available via direct install”

Epic had (/has?) this with Android and gave up because... reasons?

Epic has claimed that Google put so many restrictions that it effectively wasn’t an option for them. Google has measures to persuade people not to turn on sideloading, for security reasons.

So Epic wants both Google and Apple to abandon their security models and allow direct installs of apps.

Phones have been an enormously popular computing platform in significant part because of the security model. Non-technical users can use them easily and reasonably trust the apps they install. Epic is asking for a rather radical shift.

>Phones have been an enormously popular computing platform in significant part because of the security model.

>and reasonably trust the apps they install.

That seems like an illusion though to me.

https://www.cvedetails.com/top-50-products.php

Android comes in at #2 for number of distinct vulnerabilities and iOs at #8 both in the top ten and both above windows of all things. Which rings in at #10 for 7 and #13 for 10. OsX sits at #4.

https://www.gnu.org/proprietary/malware-mobiles.en.html

Fair point. The ease of use is just as important to the ubiquity, and Android especially has a lot of vulnerabilities. But, vulnerabilities also come with popularity: people try harder to find them.

1. How much less secure would Android be without even the play store’s security measures?

2. How much harder would people work to find vulnerabilities on such a ubiquitous platform used by non-technical users if any app could be installed?

You would likely get more malware and more app hesitancy.

>You would likely get more malware and more app hesitancy.

More malware, possibly, though android has plenty of that even with the play store. But, app hesitancy, maybe from a small subset of people, but i feel like those same people already show app hesitancy.

Only from my own experience, but i treat apps from the app stores about the same as i do random apps from the internet and do the same thing to verify in both situations, look at reviews and information about the app and make my judgement based on those. It's the same either way. All app stores do in my mind is aggregate reviews to one place, whether it's the play store, the apple store or the steam store, etc. I trust each of them about as much as something such as apk mirror, in all cases, i'm relying on the opinions and information provided by others that have used the app, if no such information is available, i consider it suspect and avoid.

The method acquire an app isn't what invokes trust, it's other user verification, no matter whether that app came from a store, a repo, a random website or any other method software can be delivered and it always has been, since the days of floppies.

I’m less familiar with android, but on the ios side there are very real limits to what an app can do, even if it has malicious intent. And app review greatly limits apps with malicious intent. ‘

You still need to exercise caution with permissions, but an individual app itself has pretty strict limits. Most of the security flaws are tied to the OS itself.

>Most of the security flaws are tied to the OS itself.

Which was the point of my original comment, that phone OS's provide the illusion of being more secure, while being about as secure as any other platform.

From what I can tell, computers are about as secure as they've ever been, whatever the kind, which is, alright depending on the user. It's always been like that and still is.

App stores and sandboxes haven't changed that.

Eh. Unless iOS exploits are uniquely tuned to be unnoticeable... I go home to help my parents with their Macs and am always removing crap, usually from their browsers. I haven’t yet had to remove crap from their iPhones/iPad.

Is it 100% secure? No. Is the user experience that I desire available due to app stores and sandboxes? Yes.

This kind of misses the point, which is that the user is the weak link in most personal computing security models. You don't need a CVE on Windows to get malware on the machine; you just need to trick the user into installing your nasty piece of software--perhaps by making it look like something the user wants.

The point of the single-source App Store is that the app review creates a line of defense against such trickery, on behalf of the user.

This chart is a bit misleading - MacOS is the equivalent of windows 7, 8.1, and windows 10 combined, which places Microsoft at the top where they belong. iOS has overall fewer code execution and privilege escalation vulnerabilities as well.

Android has always been a shitshow,so the gnu link is unsurprising - however I did not find an example of iOS malware.

Epic couldn't convince people to sign up outside Google Play and sideload, so they gave up and came back. Turns out Google was delivering value for their 30% after all.

Google's position on Android is way too strong to say that they deliver their 30% worth of value.

Aside from what user graeme said, there are plausible reports that epic tried to contract with samsung or huawei or some fairly sizable android hardware maker to put their app store, or at least fortnight, on the phone directly, and google then informed the hardware maker that they'd block the google play store from those devices if they did that.

But it does highlight the problem here.

Let's say I take epic at their word, that this is not okay (and I'm tempted, this whole judge jury and executioner thing is ridiculous. Apple has now said that they regret that they can no longer spend time with Epic on making sure the Unreal engine runs well on mac hardware. That is so close to 'nice house you got there. Would be a real shame if something happened to it' it makes the hairs on my neck crawl).

What then? Sideloading with security measures is something google has but that's according to epic not good enough (and I'm again tempted to agree).

But clearly some free for all fiesta is no good for the users. And I don't think governments, certainly no the US government and probably not the EU either, are capable of defining the playing field, this stuff is too complicated.

So... what then?

I would hope that Apple (and Google) realize that this fight has only users, and the name of the game is to walk the line so that nobody is pissed enough that you end up with exactly what just happened. And it looks like apple has decided they like the hole they are in, as it sure looks like they are frantically digging.

They still offer it, and since they're also banned from the Play Store, probably dependent on it again for Android users.

They probably listed in the Play Store in order to get standing to sue Google.

Reply on news.ycombinator.com