Comment by politelemon | Hacker News Reader

Comment by politelemon | Hacker News Reader

The headline is editorialized, which isn't surprising considering the biased news source. You can see in the body of the article, Apple is _stifling_ competition, which is what the antitrust is about. The headline reduces it to "stave off" to make it appear harmless.

I'm glad this is being pointed out, as Apple has long subverted (and done damage to, IMO) the privacy conversation by telling users that privacy can be obtained by giving up their privacy. The main aim has not been privacy, it has always been to lock users into their ecosystem with carefully controlled images, misleading advertising campaigns, PR spins, and their analogues/equivalents to "think of the children".

Realistically, I do not have any hope of anything being done as there is far too much support for, and normalization of, the current jail. This isn't the same landscape that punished MS many years ago - who have been relatively harmless when compared to FB, Apple and Google - these three companies have been playing a slightly more clever game with their EU ties and I fully expect them to get away with little more than a slap on the wrist, while relaxing in their tax haven.

> …Apple has long subverted (and done damage to, IMO) the privacy conversation by telling users that privacy can be obtained by giving up their privacy.

If you listen to the interview, the actual message from Cook is "privacy and security go hand-in-hand", which is plainly obvious and supported by history and data.

Maybe I'm missing something from a different source. Where has Apple said, "privacy can be obtained by giving up privacy"?

Of course Apple doesn't say that explicitly. That stance in implicit in Apples refusal to users to install without Apple's knowledge (i.e. use other app storea) and their many measure to force apple product users to pay for amy software features or services outside Apple's ecosystem.

They pretend to care about consumer privacy by only encrypting on device and at the same time hand data over to governments through unencrypted iCloud backups.

That's a user choice.

iCloud supports storage if encrypted data and disabling unencrypted backups.

It's fine that you reject the legitimacy of government, but unreasonable to expect huge organizations to do the same while serving hundreds of millions of users.

I don’t understand why you’re being downvoted. It seems to me that either you keep the key that’s used to encrypt the data or Apple does. If Apple keeps the key then they have to comply with subpoenas. If you keep the key then you’re on the hook to not lose it which is a big ask for non-technical users (I’ve seen lots of technical users lose important keys too). Am I missing something?

Apple doesn’t let you keep the key but give them your encrypted data.

So they let you choose how much privacy you have with all you backed up data,but if the choice of privacy might also let someone compete with Apple it's not a choice the user can make

Well, I want decentralized peer-to-peer networks and the ability to pay for things using currencies like Monero and Zcash; only, to build the tools that make that world happen, I can't only build apps and platforms that only work for half the potential users: the network effects simply don't work like that :/. And yet, Apple insists that, for their own good, all push notifications for users must go through their servers--requiring apps to always have centralized backends, which they currently often outsource to Google or Amazon, further centralizing all data collection--and all payments for all products everywhere by anyone must be made with centralized credit cards through Apple's payment processor. I mean, this is the same company that implemented a feature that causes your computer to phone home to Apple every time you run a program, which they also claim is for your own good? Even the entire setup of their centralized App Store makes them a tool of oppressive governments to do further surveillance on their population, providing centralized chokepoints--ones that only exist because of Apple: Android phones that are marketed to these same regions do not have these issues, proving Apple's excuses are lies--to ban applications such a scam VPNs. The whole situation is ridiculous: centralized systems are inherently anti-private, if not in the short term then in the long term as their incentives wear out.

https://www.youtube.com/watch?v=vsazo-Gs7ms

Privacy is not the same as anonymity. Confidentiality is a technique for offering a degree of privacy without anonymity.

Offering services to fully anonymous counterparties is fraught with challenges.

Android is extremely vulnerable to third party attackers via apps.

> I can't only build apps and platforms that only work for half the potential users.

Are you sure even close to half of your potential users use (exclusively) iOS? I severely doubt that.

Exactly for the reasons you mention, people who want self-managed security don't use iOS.

If you're a mobile developer, the market numbers are pretty well known. About %50 in the USA is iOS & %15-%20 is iOS internationally. And even in the international case, that %15-20 is around +%50 of the REVENUE. iOS users pay way more and these facts have been fairly stable for years.

And what apple is doing is not giving their customers and users a choice other than an extremely radical one of abandoning the platform completely.

In addition to the absolutely "well known" market share and revenue numbers listed in the sister comment, because many of my users care deeply about both security and privacy--which this absolutely is: Monero and Zcash are both called "privacy coins" and not "anonymity coins" for a reason... being able to avoid any third-party (including Apple or banks or governments) from knowing who you transacted with is different from building systems where the person you are transacting with doesn't know who you are (even if they are related)--I would expect more than the usual share of users for such a product to be using iOS, a decision that even I tell people is a smart decision... due to the better permissions and capabilities/entitlement systems and due to the longer support and seemingly better care towards security in general, and not at all due to the App Store's centralized BS.

FWIW, though: 1) even if you expected the vast majority of people to be using one system instead of the other, you can't build a communications platform or payment system or ecosystem generally at all that simply cuts them out as it causes problems for the people and companies trying to adopt it... if you build a platform for decentralized apps that doesn't support iOS or a chat system that doesn't support iOS or a payment system that doesn't support iOS, well, you now have to convince everyone else in the world not to support iOS: your hands are frankly tied here.

With all due respect, this is not about your open source decentralized peer-to-peer crypto utopia. This is about third-party app stores. This is about Google- and Facebook-type companies gaining unfettered access to the most lucrative user segment (rich iPhone users) and data-mining the crap out of them. This is about billions of dollars of juicy advertising revenue.

Curious why the video is unlisted?

OMG that would explain why it is always so difficult for me to find the link every time I want to paste it!! Thanks!!

I hate leaving such a useless comment but this autocorrect-assisted typo is so horribly confusing: "a scam VPNs" -> "as VPNs". (I guess I will just take this forced opportunity to then point out that this is all viscerally concrete for me, as the developer of both Cydia and now Orchid: I recently sued Apple over these issues.)

> only, to build the tools that make that world happen, I can't only build apps and platforms that only work for half the potential users: the network effects simply don't work like that

I call complete bullshit on this. I want the same thing, and so so many other people. The only reason we don’t have it is that it’s a lot of work and nobody has done it yet.

Blaming Apple for their business standing in the way of network effects is just an excuse.

If the software was built, we’d find a way to run it.

Well, claim what you will, but the Ethereum community has been making great strides in these areas, but Apple has forced all of the wallets to remove their dApp browsers and has caused companies such as mine to have to spend immense amounts of time trying to figure out how to build fiat payment gateways for cryptocurrencies over Apple in-app-purchases rather than working on our actual decentralized product as we got rejected from the App Store due to failing to give Apple their cut.

Again, just false.

Nobody has built anything like the whole stack needed for a secure distributed App Store with private payments.

It’s obvious you can’t build such a thing on top of Apple’s store, it’s just not credible to claim to be trying and being stopped by Apple.

You could build one for Linux or Android. If you actually made it work, then it would be existence proof that a centralized model is not needed for a private and secure store.

That hasn’t been proven and the way to prove it is clearly to build it where it can be built, not to make arguments about Apple’s bad faith.

What OP meant was that Apple has access to, and does datamine our personal information on every Apple devices.

They sell the idea that Apple is the only "trustworthy" entity capable of handling and protecting your data, so you can trust them with your data and you should ignore how they are datamining it (because they are "trustworthy").

What personal data does Apple data mine?

The do data mine user information, if given permission, but they anonymise it first.

According to their privacy policy, virtually anything you send them. The only promise they make is that they don't link it in an identifiable way with third party data.

Location traffic data. How do you think Apple Maps shows traffic flow on the most minor side streets?

Location data used by Maps is aggressively anonymized prior to being collated.[1] By the time Apple has a "mine" of data to collate for Maps, it has no practical privacy implications and is no longer usefully described as "user data". At most you could describe it as user-derived.

[1] https://www.idownloadblog.com/2019/03/13/apple-maps-navigati...

That traffic data is opt-in. You're asked if you want to participate when setting up a new iPhone.

> "privacy and security go hand-in-hand", which is plainly obvious and supported by history and data.

This doesn't seem to be true. Privacy here means "user privacy" whereas security means the security of the systems holding the user data.

Almost any system that hold large amounts of user data is a counter example. Such systems are typically highly secured but are antagonistic to user privacy.

You are correct that privacy is not necessary for security. But here, Apple is arguing that security is necessary for privacy. This seems to me obviously true. If a system isn't secure, it cannot safely store private data.

Think about this in the extreme: imagine your computation platform is a virtual machine on a hypervisor controlled by your adversary. There would be no way to use this platform to safely interact with your private data.

It is definitely true.

A good example, since we are talking about Apple is "the fappening". A massive leak of celebrity photos, including nudes, coming from compromised personal iCloud accounts. It is an obvious attack on privacy, made possible by poor security.

Now, you can tell me that the best way to respect privacy is not to store user data, and it certainly helps, but if your software is insecure, it may be used to harvest passwords or do all sorts of nasty stuff. In other words, maybe you don't store anything but hackers will.

You can't guarantee privacy without security. And even for companies with poor privacy practices, with security, only authorized people can spy on you, without it, anyone can do it.

That’s a pretty poor example considering we’re talking about a spearphishing campaign.

MS is (slowly) reading off of the same script when it comes to security on Windows, as well.

Apple sells you privacy from everyone but Apple.

When are they going to allow us to opt out of the baseline telemetry that we cannot opt out of as per their EULAs?

When are they going to make their own ad targeting network opt-in instead of opt-out?

When are they going to give us the option of full E2EE for our iCloud data?

> Apple sells you privacy from everyone but Apple.

What you have just described sounds like a really good product to me since Apple themselves are not a vector in my privacy threat model.

> Apple themselves are not a vector in my privacy threat model

Mostly the same here.

But, when their ad-targeting goes fully online?

When they hand over your data due to a lawsuit you didn't expect?

There's no limit to the scenarios you could posit as a hypothetical. What if the US Government had a backdoor in every Wi-Fi chip (which works even if you don't load drivers for it) and a brutal exploit for SHA-256? Hey, it's possible. And there goes your façade of security.

Reply on news.ycombinator.com