Comment by lotsofpulp | Hacker News Reader

Comment by lotsofpulp | Hacker News Reader

Parent Full thread

My experience with freedom to run software resulted in me spending an inordinate amount of time dealing with malware.

If anyone wants to come up with a freedom to run software alternative that doesn’t result in me dealing with malware, I’m open to it.

Until then, I have to pay Apple, because I don’t have time to deal with the alternatives currently available.

Edit:

>Half of my audience is on your favorite device. I didn't have to pay for them before Apple sunk their claws in.

I might be part of that audience, but when I was purchasing tablets for my business, I chose Apple, because I didn’t want to deal with malware or google support. I knew I could rely on Apple to not have malware and to provide in person support in reasonable time. I’m also willing to pay 30% extra for a subscription via the App Store since I know it’s dead easy to cancel it.

I am aware of Apple’s injustices with their arbitrary rules and enforcement and how they are able to screw over developers. But I need to move on with life, and I need something that just works.

Having an alternative to the App Store doesn't mean you have to stop using the App Store, or suffer any reduction in quality in the apps available on the App Store. Nothing changes for you in exchange for more freedom for others.

I assume a device's security is improved by being hampering the ability to install software. Can I rely on an Android device to not be tampered with or have malware just as much as I can an iOS device?

I don't mean secure as in the NSA can't break into it. I mean secure as in normal people can't mess it up clicking bullshit links in WhatsApp messages.

I'm guessing you don't use Android at all, but it is very difficult to accidentally install something outside of the play store. I would even say it is tricky to purposely install something outside of the play store.

I did from 2010 to 2015 and while I didn't have a problem, my dad was able to get malware on his. He actually was iOS from 2010 to 2014 then android 2015 to 2018, and then he kept messing his device up so I told him I'm not helping him unless he goes to iOS.

All I know is I needed a 100% guarantee the device won't be tampered with by random people for my business and that other than turning it off and on, there was no tech support needed. To me, this meant going with Apple.

Do you know the specific method he got malware on his device? Because people assume that Android malware are from secondary illicit app stores, and not just malware that was not caught on Google's inferior official Play Store, or from exploits at the OS level.

No, I didn't bother researching that. My dad very well might have gone in the options settings and disabled some stuff if the WhatsApp message instructions told him to to get something he wanted. He has, for some unknown reason, the desire to trust all the things he shouldn't, and for him I need a device that simply can't be touched.

Especially since nowadays your financial accounts and everything is secured via SMS 2FA.

Fair enough, but again the whole anti-alternate app stores narrative hinges on the supposition that these app stores will be a significant source of malware. I'm wondering if there are any Android security studies that proves or disproves that point.

Yes, Google publishes a security report that indicates that devices that side-load apps have an 8x higher malware incidence compared to devices that only use the Play Store. (https://source.android.com/security/reports/Google_Android_S...)

As an example, HummingBad infected 85 million devices primarily via direct-download on malicious adult websites. (https://www.zdnet.com/article/this-android-malware-has-infec...)

So it looks like allowing users to easily sideload apps, let alone direct download and install binaries from mobile web, is problematic. Their stats on third-party app stores seems more scanty.

> In 2018, hostile downloaders made up 22.0% of all sideloaded PHAs, making this the third most prevalent category, as in 2017. While this category accounted for 0.39% of all sideloaded apps in 2017, it is down to 0.20% in 2018, a sharp decline. Last year, Trojans were particularly targeting devices in India, Indonesia, Russia, Brazil, and Mexico.

> The prevalence of hostile downloaders is due to a combination of legitimate third-party stores with poor security setups that distribute PHAs, fake stores that are built specifically for spreading PHAs, pre-installed apps that slipped through the security scans of OEMs, and plain apps that pretend to (or actually do) offer user-wanted features while downloading PHAs in the background.

Android has an "allow software from unknown sources" option buried in the settings menu. As long as you don't specifically go looking for that option and THEN approve the source of the .apk file and THEN click install on the system dialog, you can't accidentally install non-play-store software.

Yeah until Facebook moves all their apps to their own App Store so they don’t have to deal with all of Apple’s pesky privacy rules.

What privacy rules would those be? Why would iOS privacy settings be affected by the install method? What would be different from the Facebook SDK that's already installed in millions of apps on the App Store today?

Abusing private APIs would be a major issues. Binaries uploaded to the App Store are inspected to ensure that they aren't abusing any private APIs. Facebook controlling their own store would allow them to circumvent this check. In the past, private APIs have been used to track users, amongst other malicious behaviour.

What kind of inspection? The App Store review is not that in-depth and has frequently let through many apps that were leaking private details.

And again, how does this affect iOS system level privacy settings and protections? App permissions and warnings don't change.

They'd suffer massive public blowback for that, atop all of their PR woes that's been mounting each year since the 2016 U.S. elections.

Is the macOS ecosystem filled with malware?

I don't know what you mean by filled, but I know malware exists for macOS. I am not aware of malware for iOS.

I use Android, and the Google and Amazon Android devices combined have had less malware infections than iOS despite having vastly more users. I get to run my own apps on my device without telling anybody, so there is also more privacy. You've been hoodwinked into supporting a restrictive platform that benefits only Apple.

Reply on news.ycombinator.com