Hacker News Reader

Comment by keehun | Hacker News Reader

One of the salient points Apple makes in the document is that by the mere ability for sideloading to be possible, it would be forced upon users by schools and jobs. It also opens an entirely new attack vector by spoofing and other means of deceiving the user into either sideloading an app they didn't mean to.

View on HN

Except all of those things exist in the wild today - using the enterprise management tools that Apple already provides.

Apple is happy as can be to let enterprise (and schools/gov/etc) force users to install apps.

They just fight tooth and fucking nail to hang onto their rent-seeking in the app store.

As a customer, you're getting fucked twice.

> Apple is happy as can be to let enterprise (and schools/gov/etc) force users to install apps.

The enterprises are "forcing" the installation of apps on the hardware they themselves own. Corp A cannot force the installation of apps on Corp B's devices, or even on the personal devices of Corp A's employees.

I have an iPhone for work and my personal iPhone, and my work has no access to the latter.

I don't think there's any technical reason why you couldn't set up a MDM system for your own personal phones and have the same capabilities as an 'enterprise'.

There's nothing to stop enterprises from asking users to install their provisioning profiles on personal devices (technically the employee could say "no" but employment is "at will" in almost all of the US, so....)

And yes - I can set up an MDM system, but that doesn't provide the same utility as a store.

Nor does it work around the profile limitations built into iOS (again, I'm out of date, but previously you could only have a single provisioning profile installed on the device - this was actually the recommended way to prevent this type of attack: pre-install your own profile).

> The enterprises are "forcing" the installation of apps on the hardware they themselves own.

Okay, then why can't I do the same thing with devices that I own?

You can. Set up an MDM system and attach your device.

* https://simplemdm.com/

* https://jumpcloud.com/mdm-mobile-device-management

That's not enough. You also need to buy a enterprise developer certificate from Apple (a few hundred dollars?).

App Store apps can be deployed via MDM for free, but not ones you write.

Wow, that's unbelievable.

Those mandated apps still go through App Store review. Apple’s point is those entities would bypass review if they could.

I don't believe this is true (disclosure: I'm about 2 years out of date).

Last I checked - you can distribute private & proprietary apps using an enterprise deployment provisioning profile.

It requires that the signing entity (usually an enterprise) is registered with Apple (and pays a $300 fee), but it does not require store review.

> Those mandated apps still go through App Store review.

Not true - the company can push whatever they like to their managed devices making that whole line of argument moot

This is definitely not true. I publish enterprise apps for my org and there is no review

I guess it's telling in a way of the PR push if users believe that Apple is constantly and always protecting them, even when they do absolutely nothing.

Are there any cases where this has happened with Android? I use side-loading extensively and consider it essential, but have never had it imposed.

Epic already tried it once by not offering Fortnite in the Play Store, instead making directions on how to sideload APKs on Android.

I guess it didn't work that well since they went on the Play Store anyways and then sued Google for making their life so hard.

The document is actually worth a read. I don’t think the parent poster is accurately representing Apple’s position.

Page 26, paragraph 3 seems to make exactly the claim GP made. But you're correct, I haven't read all of the 28 pages of Apple's argument here. From what I have read, they don't seem to be discussing potential benefits that come from sideloading, only costs.

> Even users who decide they don’t want to sideload, and prefer to download apps only from the App Store, would end up being harmed. They could be forced to sideload an app they need for work, for school, or for social inclusion if it is not made available on the App Store. Furthermore, cybercriminals and hackers may trick users into unknowingly sideloading an app by mimicking the appearance of the App Store, or by touting free or expanded access to services or exclusive features.

Reply on news.ycombinator.com