Just allow people to put their devices in a mode that allows side loading or let people load their own signing keys. The fact Apple keeps such a tight grip on hardware they don't even own needs to be cracked down on.
Perhaps you're just scoping it to the mobile tables and phones, those are indeed locked down but I don't mind it, they are appliances to me and I want the manufacturer to be 100% responsible for it, 100% of the time.
The right I am talking about is primarily the right of exclusion and its not just an American concept plenty of other countries have similar concepts or even the same name, but of course the exact details will vary from one legal system to an other.
Effectively apple retains the right of exclusion via extralegal means by using cryptography. Apple can unilaterally decide to exclude software from devices they don't own by not signing it. If you wrote some software yourself for instance you would also still have to ask apple to sign it which they only will do under certain conditions. Essentially if you have to keep having to ask a 3rd party to do something with something you “own” you don’t fully own it.
Why it’s extralegal is that normally a seller would require a buyer to agree to a contract to retain some rights over real or tangible property. Instead apple is using cryptography to effectively retain some property rights despite the buyer never signing a contract agree-ing to this arrangement.
You agree to the terms when you first use the device.
And if you don’t agree to the terms you can get a refund and buy another phone.
The problem still persists that apple is selling hardware that you don’t have full control over. What if I wanted to run linux instead or even bare metal code that I wrote myself? Apple does not permit this nor will sign such software so that boot-rom will load it to RAM. Just because your average user may not do those things does not mean their rights are not being effectively diminished compared to other tangible property they buy.
Apple is under no obligation however to compromise the security of their device in order to help you.
This technically is ridiculous and completely untrue.
Web applications, by design, have a tiny fraction of the capabilities of a fully fledged mobile app.
[0] https://jonbottarini.com/2021/12/09/dont-reply-a-clever-phis...
[1] https://www.theverge.com/2022/1/16/22886809/safari-15-bug-le...
[2] https://nvd.nist.gov/vuln/detail/CVE-2021-30858
[3] https://www.ryanpickren.com/safari-uxss
Also your not free to install any software on the device unless your lucky enough to find an exploit.
Is that a fact? I think not. (don't misunderstand me, I would love mobile hardware to be 'the same' as fixed PCs, but as far as the world is concerned, it is not.)
If you think: phone has CPU, memory and storage, thus it is a computer and I need to have the same "access" as a 1990's PC, then yes, the whole world might as well be burning right now. But if you take it for the appliance that it is, are you really surprised it works the way it does?
If you are so worried about 'rights', where do you draw the line? (pun incoming) your modem, CMTS/CPE/ODN are all closed, crypto-sealed and inseparable hardware+software as well, as is the core router your packets flow through, the TCON board in your flat screen monitor and the microcontroller in your USB charger. Get a CPU from Intel, AMD, Qualcomm, TI, Nvidia, MediaTek, Rockchip etc., get a sealed boot loader that is cryptographically tied to the chip and the chip manufacturer. Heck, to get that sealed stuff as an ODM you sign so many NDAs it might as well be an appliance in itself.
The days that you bought some end-user high-level hardware and had control over the stack are gone. Not because it can't be done differently, but because it's not viable. Even framework is having a hard time (as are Purism and System76) getting any true 'open' system. Not even a libreboot/coreboot system is actually unencumbered if you use any hardware from the last 5 years. People want a whole bunch of things, but the scale simply isn't there to carry the cost.
Ironically, all of this stems from lawyering from the corporate side.
You cannot install a working Wireguard on macOS outside of the App Store.
They don't want you to think of them as (general-purpose) computers.
Also just take the name AMD it stands for advance micro devices.
What's the one and only thing that a smart phone or tablet is meant to do? If it's make phone calls, most people don't anymore and doesn't apply to tablets.
This is an absurd argument.
I have an app that I wrote myself and run just on “my own” iDevices that I have to re-install every week because the installation certificate expires. I'd have to pay the annual $99 tax just for the privilege of running my own frigging software on “my” iDevices without hassle.
And all of the connotations that people associate with PCs eg. unreliability, viruses, malware, constant updates and complexity are not something that people are in a hurry to bring across to the mobile world.
Then again we can look to the market for guidance which is that side loading has in no way impacted the success of iOS devices.
Problems from the early 2000s that don't exist in the same capacity anymore. In fact, I would say getting scammed by an app from the apple app store is more likely than downloading a virus in 2022.
> constant updates
That's a mobile problem.
And you would be wrong.
With viruses, at least the OS vendors are getting rid of them.
Nonsense. I've cleaned malware off of employee laptops within the last 2 years. And off family members' computers within the last 3 months.
So this malware that you had to clean off of those laptops would still not be possible, even for sideloaded apps.
This Christmas I had to uninstall adware from my Grandmothers phone that was filling the notification bar with ads.
Last time I visited my other grandparents I had to warn my grandmother not to click on an offer to install device drivers, that had somehow shown up as an add in a Microsoft Game.
And language such as "side loading" helps that too.
The issue is starting from the boot-rom and up apple is effectively using cryptography to retain the property right of exclusion when it comes to what code can run on that ARM cpu. Effectively you have to ask apple for approval of any code that will run on your own hardware. If they sign the code they allow it run if they don’t its excluded from running. If you have to keep asking a 3rd party to do something with something you bought you don't fully own it.
The thing is normally a seller wishing to retain some rights to real or tangible property would normally require a legal contract between the buyer. Here however apple is using cryptography to bypass traditional legal means. You can buy an iPhone, iPad without signing any contract. Yet this effectively retained control of the hardware still exists. You can’t just buy the hardware and throw linux or android on it short of finding a weakness in how code is loaded.
> right of exclusion when it comes to what code can run on that ARM cpu
Yes I like it for the phone. The walled garden has very little malware and has high quality apps. I am never pestered to install crapware or malware and I don't have to be paranoid about it. You can still run your own development software on these machines, and software distributed in controlled channels outside of the store. The controls are reasonably convenient and necessary to keep unwanted software out.
Compare it to Android Play Store or much worse the Galaxy store situation. The grass is much greener in the walled garden.
For the Mac, it's a different story, you can and should be able to run whatever you want on it. But iPhone as a product is a well tended garden (controlled but quite wide and powerful) and I can appreciate that.
Secondly, if apple just allowed loading your own signing key it’s not like malware writers can sign their crap with their own key, and expect it to run.
We’re not talking about going back to the old Windows security model where you were always one wrong click away from damaging other apps or the OS, or having your data stolen.
b) You need to stop using the term extralegal. You agree to the terms when you first use the phone. Apple is not doing anything without your explicit permission.
Extralegal just means outside of the scope of law or a legal framework. Here apple using cryptography starting from the boot loader to effectively retain the right of exclusion regarding what code may or may not run on the ARM CPU. The sale of the tangible property should include the right of exclusion to the buyer short of a legal agreement at the time of sale allowing the seller to retain some rights. Thats why its extralegal there is no contract just apple using public key cryptography in rather hostile manner that diminishes the property rights of buyers.
Here is a simple test if you have to ask 3rd party to do something with something you “own” you don’t fully own it or your rights are diminished in some manner.
- Apple giving a shit about app curation versus Google Play being a trash heap
- Android having the ability to install third-party-signed apps
Nothing about having the ability to install software outside of Google Play necessitates Google Play itself being a tire fire. Same with Apple: if they tomorrow decided to open up iOS to non-App-Store apps, it wouldn't impact the quality of curation on the iOS App Store.
For the record, I daily drive both an Android phone and an iPad, and don't really worry about malware on either of them. My main gripe is not having any good virtualization options to really stretch the iPad's legs on more developer-centric workflows. That's a particular category of app where App Review has ranged from somewhat hostile to extremely hostile. The end result is that not a lot of people actually bother working on such tools because the chances of actually getting into the App Store and being useful to a wide swath of people is marginal.
Yes, it would. Developers who are today forced to go through the app store would self publish rather than use the app store. Whether or not they use this power well is a different question but there is no question that opening up other distribution channels would directly impact the app store, (which is a huge part of the value add for an iOS device to me)
You still wouldn’t need to be paranoid if sideloading became possible. Sideloading doesn’t imply that app isolation (sandboxing) is also going away, nor does it imply that any app would ever be able to trick the user into running it with escalated privileges (sudo/root) as is the case on most computers.
We’re not talking about going back to the old Windows security model where you were always one wrong click away from damaging other apps or the OS, or having your data stolen.
If I didn’t, I wouldn’t buy an iPhone. What’s the problem?
If side loading is allowed the amount of tech support I'll have to provide my family will skyrocket.
> If side loading is allowed the amount of tech support I'll have to provide my family will skyrocket.
I mean, if apple ever allow sideloading I suspect it will be behind a 10 feet wall warning and obscure multiple clicks on settings, similar to how google does it.
I also suspect that my family will be divided into two camps: oblivious to the existence of sideloading or technical enough that won't need my tech support.
i don't even want to think about the level of intelligence you're suggesting your family has that they will go above and beyond the average person in deliberately breaking their own phones.
We’re not talking about going back to the old Windows security model where you were always one wrong click away from damaging other apps or the OS, or having your data stolen.
The other side did not, until COVID started. Then they had to get one so their kid could attend online schooling. It is used just for that.
We’re not talking about going back to the old Windows security model where you were always one wrong click away from damaging other apps or the OS, or having your data stolen.
No, it affects everyone, even the people who don’t want it.
Consider the time when Facebook got caught spying on minors by abusing their iOS enterprise certificate, and expand that to everybody.
If Apple allowed sideloading, Facebook could just remove their application from Apple’s App Store. They would still have roughly the same amount of users, because even if a person doesn’t want to sideload, most of them will do it anyway if it’s the only way to get Facebook. And now all of those people, who didn’t want to sideload, will be subject to whatever Facebook wants to do that Apple’s rules stopped them from doing.
This isn’t really about individual choice, it’s about the effect on the ecosystem. As soon as you give giants like Facebook a way to opt-out from Apple’s rules, it affects the whole ecosystem, not just the people who choose to sideload.
Sideloading would probably be quite convenient for me personally. But I would rather not have sideloading because of its effect on the ecosystem.
Although, I am of the opinion letting people just load their own personal signing keys. Its not like facebook can sign their app with their own key and expect to work on other peoples devices in that situation. Unless its signed by apple’s private key that all devices would have stored. However, if you had your own signing key you could sign the linux kernel ect or whatever you want, but its definitely not a click/tap and install situation with your own signing key.
Further, its not just doom and gloom on other systems where being able to install software from any source as you please is the default.
You’re missing the original point I was making though.
In this scenario, Facebook removes their application from Apple’s App Store and almost everybody sideloads it. Ultimately, what happens to the people who do that is their own responsibility. Yeah, I get that.
Where does this leave the people who want to use Facebook under Apple’s rules but refuse to sideload it? They have had something taken away from them. Sideloading affects them even if they choose not to sideload. It affects the entire ecosystem, not just the people who sideload. “Just don’t sideload” advice doesn’t work.
You can use Safari
If Facebook pulled their app from the Apple App Store right now, would you be forced to use Android? You'd say they can't, because they'd lose the entire iOS marketshare, which is exactly the problem: Apple are forcing people to use their Apple App Store using their iOS monopoly power marketshare. Which is anti-competitive.
They are both well-tended gardens of different types for different uses. Much higher walls on the phone is a great feature IMO.
You can, legally. You have that right. You can legally jailbreak a supported iPhone in 10 minutes and sideload all day or lldb attach to whatever you want. Nobody will stop you.
But Apple doesn't want to support an open platform. That's their right. They don't want it to part of their ecosystem, their brand, or provide the avalanche of non-negligible support costs.
The distinction here is important and rarely addressed in these discussion.
I mean, Apple blocked countless jailbreaks as of today. It's AFAIK also against their ToS, therefore means they legally try to make it so you don't jailbreak. Can you _really_? Sounds more like a gray area they simply cannot control, but they're definitely trying their hardest to do so...
https://www.macworld.com/article/206764/jailbreak_exemption....
I would understand (though personally disagree) if you wanted the walled garden everywhere, but it seems contradictory to only want it on phones and not computers.
https://www.androidpolice.com/microsoft-teams-911-break-emer...
https://www.reddit.com/r/GooglePixel/comments/r4xz1f/pixel_p...
Interesting quote: Cause let's be real, as someone without a landline, I sure as hell don't want a phone that freaks out when I try to call 911 in the middle of a life threatening emergency. I'm supposed to trust that a phone will do the main thing is built for, and place the call, and let me speak to the human on the other end.
If you're worried about low-quality software being side-loaded onto the phone, you can just not side-load anything. That's probably how most Android users use their devices. But it's nice that the walled garden has a gate.
But that’s an interesting question anyway. Apple and google can remove apps distributed through their stores. If a side loaded malicious app exploited this bug, would you have been in favor of google being able to disable those apps? Or should users wait a month until it is sort of fixed on some phones, and be unable to dial emergency services during the month where this was unpatched?
> Apple can also issue a revocation ticket for apps known to be malicious—even if they’ve been previously notarized.
https://support.apple.com/guide/security/protecting-against-...
https://developer.apple.com/documentation/security/notarizin...
And iPads?
This was simply the question I was trying to answer. No more.
My personal feeling, however, is that, if there is a suitable alternative, people should be allowed to buy a device knowing the limitations (artificial or not).
Nobody is surprised that there isn't an alternative App Store an iPhone or iPad. If that's important to folks, they have plenty of Android or Microsoft alternatives.
It feels a lot to me like people buy a blue car, then complain that it's not a red car. I honestly don't understand why people don't just buy the red car in the first place.
That's not at all obvious. What is the distinguishing characteristic that makes it reasonable for a giant corporation to have total control over how you use one but not the other?
See how ridiculous that sounds?
I see many people blaming Apple's stance (surely Apple has LOTS to blame, but not this one) on App Store/walled garden policy, but without it the whole ecosystem would turn to a mess. Not for the geeky audience of HN Here, but for the rest 99.99% of the world which probably matters more from a brand awareness perspective.
We’re not talking about going back to the old Windows security model where you were always one wrong click away from damaging other apps or the OS, or having your data stolen.
There is a whole class of Apps that doesn't or shouldn't need Apple's approval. And are mostly reader apps or web page with some interactivity. From Ordering in a restaurant to Reading comics, or as simply as watching Netflix.
Keep the Gaming and "Software" on the App Store if they want it that way.
I can't even send a notification to the iOS Safari, something everyone else has implemented. And Apple themselves implement on desktop Safari.
Instead they made App Clips. While being useful, they are still the holding the ultimate power for access to Apple customers.
It's intended for developers/tech savvy people, but I think it's right on spot: if average non tech savvy people could easily download any app it'd be like opening a new expired can of worms. The reputation of iPhone platform in terms of reliability and security would plummet and the brand would be affected negatively.
Apple wouldn't want that. Even if it negatively affects me too, I get their point and have to agree with their stance.