Apple claims 'sideloading' apps is 'serious' security risk | Hacker News Reader

Apple claims 'sideloading' apps is 'serious' security risk

bbc.com

16 pointsfrumper24 comments

Sideloading has worked well for Android. Users are not idiots and there are enough warnings so they know that they should not sideload an application unless they really know what they're doing.

Apples argument serves Apple's 30% interest in iTunes revenue and removes the choice from the user.

That's how they get you. First you sideload one app, you think you can stop with just one, then next thing you know you've got F-Droid on your phone, your sideloading left and right. Then before you know it, all your money now belongs to a Nigerian Prince and hackers are ransomwaring your grandma.

Yeah kids sideloading might seem fun, but it's a gateway to disaster. Just say No to sideloading.

It sounds like we need to get the hackers to ransomware the Nigerian Prince's grandma.

Nah, better to just stick to the walled garden and let Almighty arbiters of all that is safe to install guide us.

hey man, sideloading is just the start, next thing you know theyll be saving progressive webapps and never leaving their browsers!

Something troublesome to people who worry about privacy would be FB asking people to side-load, which in a sense they did when they bought a VPN and asked kids to grant all access to network traffic [1]. Kids will ignore warnings, and they are thought to be savvier than their folks. Kids are the ones who will download games that basically train you to love ads.

And Apple doesn't collect revenue from FB, but FB is probably the heaviest in its weight class. If FB asks, parents will say yes. If Fortnite asks, children will say yes.

[1]: https://techcrunch.com/2019/01/29/facebook-project-atlas/

it's amazing to me how much imagination & concern people put in to 0.000001% of side loading cases.

if a computer is a bicycle for the mind, these people insist we go out fully padded, with front & back training wheels, walk our bikes up & down hills. never exceed 10mph or your eyeballs might pop out.

building a smarter culture able to avoid dangerous & bad forms of computing seems much more like the end I think we should spend time promoting. give people choice, visibility, and an ambient social network that can help provide background & discussion around the tech you've started dabbling in, that can warn you.

So, how much do you know about pharmaceuticals, building safety and cows?

We tightly regulate all those industries precisely so that people can rely on vendors and not get hurt, even if it might be more profitable to substitute a few components in a vaccine, skip the earthquake retrofit and ignore whatever animal disease popped up.

And this is without getting into the issues of oligopolies, network effects, vendor lock in and user manipulation/deception by vendors. The companies dedicate entire specialist teams worth of effort to this. The average person doesn't stand a chance without help.

IT in general is really not so special that it should be exempt from governmental consumer protection efforts. Especially since it is one of the most profitable sectors by far, so you really can't argue that there isn't room for tighter controls.

Apple and Facebook specifically are two of the most profitable companies in the world. They can afford it. And if they drop to "merely" being in the fortune 500, that is still completely fine with me. And if some exploitative business models become unprofitable, that's fine as well. That's kinda the point.

And before you argue that it would kill innovation: there is ample precedent for regulations that depend on the size of the company or the customer base.

I still see a computer more as a tool for freedom & exploration & less as a consumeable commodity or domicile. we use our will every second of our interactions with the computer, we pilot the tool through the information.

the premise that this experience must be built into a completely failsafe environment where the user has no possibility to ever do any harm to themselves is foolish. a pen if wielded improperly can hurt someone. but we don't regulate pens to make them utterly safe. and pens don't regulate what they will write.

the consumer does need protection, though, for sure. I don't see it as desirable that apple be the sole arbitrator of how their computers may be used though, as reasonable determiners of what parts of the internet we might connect to.

Parents would say yes to Facebook because it has a reputation. If Shadybook wants you to side load then you're not doing it because you don't know what it is, you don't already have an account outside of iOS garden, and likely will never hear about this company to even install it. It only works for Facebook because they are big enough to establish the relationship outside of Apple's walled garden.

I'm not sure what security concerns Fortnite might have either. It's a billion dollar game with a solid reputation. They're not going to start ringing up your credit card with fraudulent charges, and if they did then it would make the news and tarnish that reputation.

People interact with many companies outside of the iOS ecosystem just fine.

it serves their entire ecosystem, what next, users loading PWA and bypassing their entire ecosystem? heave fordbid!

apple is like the malevocence of hardware software walled garden, they make it easy to do what makes them tied to the platform and e erything else a struggle.

Something has to give. Apple controls what apps are allowed, how those apps behave, how those apps operate and then point to the web as the alternative, which they also control the only browser they allowed on the system. Then stories like https://www.theverge.com/2021/6/11/22528701/apple-rank-own-a... show why all that power concentrated has already lead to anti-competitive behavior. While I don't think there is a single perfect solution, I do think that if they don't flex in some of these areas that the governments of the world will break them.

This would be evidence that the last 50 years of OS research is for naught.

If we can't run two apps at the same time, and have some confidence that the interaction between those apps is constrained, why in the world did so many computer scientists and engineers spend all this time on permissions schemes and information flow control?

Simply allowing sideloading is the best solution because it disrupts users the least while maximizing their freedom. Web apps are not the answer because they will never cut it for every use case (even if that use case is just the installation of a non-Apple browser engine).

Why is it not a risk on MacOS?

Answer: the MacOS customer base expects a computer they can run stuff on, and would not tolerate it without defecting.

They are slowly moving in the direction of only letting you run apps from their app store. Look at all the warnings and prompts you get if you try to run a program you downloaded outside of it.

This is definitely my fear for the future of MacOS, though it will likely cause me to just get an iPad and a windows computer instead.

They're not pushing you in the direction of running apps from their store, but they are pushing in the direction of having apps be notarized: https://developer.apple.com/documentation/security/notarizin...

For many years the secret incantation to run an unsigned app is right click open twice in a row and confirming at the warning. “Run this… yes, and I really mean it!” Once you do this once it remembers and opens normally. This is still the case in Big Sur and on the M1.

This idiom is fine with me. It’s easy to remember but kind of hidden from the non-technical. It also forces you to think a little which protects from accidentally launching an unsigned app.

An alternative idiom that would work would be a red warning and requiring the user to type “YES.” This is also common in non-reversible delete dialogs.

MacOS is arguably much more unsafe than iOS, which is a concern of mine as I imagine Apple will eventually answer the question of integrating your health and finance data on MacOS.

I think this is just an excuse to keep users locked to the App Store. Yeah, it could be more secure to some extent but Apple’s walled garden isn’t unbreachable. There were cases that scum and fraud entered the stores.

I’d say that Apple’s approach makes the users more ignorant of security issues. Because they assume that their device 100% which isn’t possible.

I don’t understand why they are limiting the advanced users so much ? If I bought iPad Pro that means I am an advanced enough user to know what kind of apps I need and I can avoid problematic apps. The iPad Pro has Mac level CPU - M1 Chip. Why shouldn’t users be able to leverage it fully ?

Programming isn’t really possible on a iPad just because of this BS

Also, a lot of the features iOS got are inspired by the jailbreak community. And even on macs there are apps that really offer big improvements to usability like bettersnap or bettertouchtool.

At the very least they should let you self sign and run applications you built yourself. I feel that is enough barrier to entry to keep Grandma from sideloading a virus.

I just wanna build and run RetroArch dammit.

I remember going on vacation away from my computer and discovering my own app failing to launch after a few days. I guess I had tended to rebuild and reinstall it so often that I never saw their signing expire before.

It is pure crap that Apple has any ability to prevent you from running software you created and installed yourself.

https://news.ycombinator.com/item?id=27565002

https://news.ycombinator.com/item?id=27603849

Reply on news.ycombinator.com