Hacker News Reader

Comment by echelon | Hacker News Reader

> Go use another phone if you don't like it.

Half of my audience is on your favorite device. I didn't have to pay for them before Apple sunk their claws in.

Even if there wasn't a tax, the lack of freedom is what really gets me. Apple built itself atop open source. They leveraged it to gain control over 40% of the CPUs used by consumers. Now we can't run code for these people.

I applaud their privacy stance. But freedom to run software is a separate issue.

View on HN

My experience with freedom to run software resulted in me spending an inordinate amount of time dealing with malware.

If anyone wants to come up with a freedom to run software alternative that doesn’t result in me dealing with malware, I’m open to it.

Until then, I have to pay Apple, because I don’t have time to deal with the alternatives currently available.

Edit:

>Half of my audience is on your favorite device. I didn't have to pay for them before Apple sunk their claws in.

I might be part of that audience, but when I was purchasing tablets for my business, I chose Apple, because I didn’t want to deal with malware or google support. I knew I could rely on Apple to not have malware and to provide in person support in reasonable time. I’m also willing to pay 30% extra for a subscription via the App Store since I know it’s dead easy to cancel it.

I am aware of Apple’s injustices with their arbitrary rules and enforcement and how they are able to screw over developers. But I need to move on with life, and I need something that just works.

Is the macOS ecosystem filled with malware?

I don't know what you mean by filled, but I know malware exists for macOS. I am not aware of malware for iOS.

Having an alternative to the App Store doesn't mean you have to stop using the App Store, or suffer any reduction in quality in the apps available on the App Store. Nothing changes for you in exchange for more freedom for others.

I assume a device's security is improved by being hampering the ability to install software. Can I rely on an Android device to not be tampered with or have malware just as much as I can an iOS device?

I don't mean secure as in the NSA can't break into it. I mean secure as in normal people can't mess it up clicking bullshit links in WhatsApp messages.

I'm guessing you don't use Android at all, but it is very difficult to accidentally install something outside of the play store. I would even say it is tricky to purposely install something outside of the play store.

I did from 2010 to 2015 and while I didn't have a problem, my dad was able to get malware on his. He actually was iOS from 2010 to 2014 then android 2015 to 2018, and then he kept messing his device up so I told him I'm not helping him unless he goes to iOS.

All I know is I needed a 100% guarantee the device won't be tampered with by random people for my business and that other than turning it off and on, there was no tech support needed. To me, this meant going with Apple.

Do you know the specific method he got malware on his device? Because people assume that Android malware are from secondary illicit app stores, and not just malware that was not caught on Google's inferior official Play Store, or from exploits at the OS level.

No, I didn't bother researching that. My dad very well might have gone in the options settings and disabled some stuff if the WhatsApp message instructions told him to to get something he wanted. He has, for some unknown reason, the desire to trust all the things he shouldn't, and for him I need a device that simply can't be touched.

Especially since nowadays your financial accounts and everything is secured via SMS 2FA.

Fair enough, but again the whole anti-alternate app stores narrative hinges on the supposition that these app stores will be a significant source of malware. I'm wondering if there are any Android security studies that proves or disproves that point.

Yes, Google publishes a security report that indicates that devices that side-load apps have an 8x higher malware incidence compared to devices that only use the Play Store. (https://source.android.com/security/reports/Google_Android_S...)

As an example, HummingBad infected 85 million devices primarily via direct-download on malicious adult websites. (https://www.zdnet.com/article/this-android-malware-has-infec...)

So it looks like allowing users to easily sideload apps, let alone direct download and install binaries from mobile web, is problematic. Their stats on third-party app stores seems more scanty.

> In 2018, hostile downloaders made up 22.0% of all sideloaded PHAs, making this the third most prevalent category, as in 2017. While this category accounted for 0.39% of all sideloaded apps in 2017, it is down to 0.20% in 2018, a sharp decline. Last year, Trojans were particularly targeting devices in India, Indonesia, Russia, Brazil, and Mexico.

> The prevalence of hostile downloaders is due to a combination of legitimate third-party stores with poor security setups that distribute PHAs, fake stores that are built specifically for spreading PHAs, pre-installed apps that slipped through the security scans of OEMs, and plain apps that pretend to (or actually do) offer user-wanted features while downloading PHAs in the background.

Android has an "allow software from unknown sources" option buried in the settings menu. As long as you don't specifically go looking for that option and THEN approve the source of the .apk file and THEN click install on the system dialog, you can't accidentally install non-play-store software.

Yeah until Facebook moves all their apps to their own App Store so they don’t have to deal with all of Apple’s pesky privacy rules.

What privacy rules would those be? Why would iOS privacy settings be affected by the install method? What would be different from the Facebook SDK that's already installed in millions of apps on the App Store today?

Abusing private APIs would be a major issues. Binaries uploaded to the App Store are inspected to ensure that they aren't abusing any private APIs. Facebook controlling their own store would allow them to circumvent this check. In the past, private APIs have been used to track users, amongst other malicious behaviour.

What kind of inspection? The App Store review is not that in-depth and has frequently let through many apps that were leaking private details.

And again, how does this affect iOS system level privacy settings and protections? App permissions and warnings don't change.

They'd suffer massive public blowback for that, atop all of their PR woes that's been mounting each year since the 2016 U.S. elections.

I use Android, and the Google and Amazon Android devices combined have had less malware infections than iOS despite having vastly more users. I get to run my own apps on my device without telling anybody, so there is also more privacy. You've been hoodwinked into supporting a restrictive platform that benefits only Apple.

> Half of my audience is on your favorite device. I didn't have to pay for them before Apple sunk their claws in.

A big part of the reason why I bought an iPhone is the App Store. That’s because the App Store imposes rules on software developers, such as Facebook, which have consistently proven that they don’t particularly care about privacy, security or other user-centric concerns. If I felt like I could trust these developers, maybe I wouldn’t be on an iPhone. But they haven’t earned my trust.

> But freedom to run software is a separate issue.

It isn't, because it's tied to security.

I don't understand why a company, like Apple, shouldn't be allowed to create locked-down devices.

This practice isn't new either. Locked down game consoles have existed since the dawn of computing. What makes this situation special? Don't like it, then don't buy it.

Speaking of the situation at hand, Epic did in fact distribute Fortnite outside of Google Play. Until they eventually caved, because distribution via Google Play is more lucrative.

This isn't about your freedom, they couldn't care less. This is about them making Apple succumb to their demands, while still using the App Store as a distribution channel.

And yes, it matters what "champions" are fighting for your "freedoms". When the likes of Epic are your champion, maybe you're on the wrong side of it.

Can you explain what blocking services like XCloud and Stadia has to do with security or privacy? Many of the policies are about a pure money grab.

One reason might be related to xCloud bypassing Apple's parental controls for both screen time and in-app purchasing that Apple requires for games distributed via the App Store. I expect Microsoft will work with Apple to resolve these issues and xCloud will be eventually be released in the App Store once they are resolved.

Reply on news.ycombinator.com