Hacker News Reader

Comment by zepto | Hacker News Reader

Android is in fact the dominant platform by number of users, and has cool stuff like cloud gaming apps that iOS does not. There are also other aspects of the iPhone that many people prefer over Android phones, e.g. hardware features and quality.

The point about sandboxing is relevant because many people conflate sandboxing protections with the protections offered by App Review, and thus are afraid that non-App Store apps will be able to install viruses or brick their devices - which isn't the case.

Lastly, the automated malware screening that’s part of the App Review process can be offered separately, thus the risk of "catching malware” from non-App Store apps will be the same as with App Store apps.

And the hardware quality and features aren't things that android can just copy, because Apple has numerous government enforced monopolies on their technology called patents. This isn't a free market.

This is Hacker news, everyone reading this should be able to hack up something of personal use on their phone.

And they can. Nothing prevents that. If you think it does, you’ve been lied to.

Not true. Apple places a 7 day limit on developer mode side loaded apps when using a free account.

Sorry to link to Reddit https://www.reddit.com/r/sideloaded/comments/8ht5uy/question...

And there’s also a 3 app maximum

Although you can always pay Apple $99/year to get around it!

Plus the cost of an Apple computer to develop it on.

So what? There are plenty of other options if you want to develop software for you own use.

Not for on my iPhone! I can't compile on Linux and publish software onto an iPhone without major trickery.

I have the vision of hanging at the coffee shop, jamming to headphones, pop open the iPad, open the iCloud synced IntelliJ project I was working on my MacBook Pro in the morning. To those who would say, but that's not what an iPad is for - consider this thought: The iPad is a pretty good expression device. You can draw with the pencil in Good Notes. You can paint with your fingers in Procreate. You can make music with Garage Band. With the iPad keyboard, and Obsidian.app, it's a serious writing tool. So with all of these ways to express my passion, what I'd love to do is use the iPad to express my passion to code. Using my kindergarten brain, It looks like a computer that a person could use to code.

Apple seems to be investing in iPad software development capabilities - Swift Playground app. This is exciting - perhaps it will be the "iMovie" of Xcode...

An aside: When someone finally comes up with an eInk laptop, we developers in Austin can chill at patio bars and enjoy the sun.

It seems like you want to force Apple to adopt a roadmap you have laid out for them.

You have to be the least informed hacker in the world if you bought an thinking you could do that.

There are plenty of alternatives to the iPhone if you want to compile on Linux.

It'd be pretty trivial to throw together some automation that reinstalls your sideloaded apps nightly.

The device has to be unlocked, and non-Xcode builds require connecting the device to the computer using a cable.

So it’s not as trivial as it seems.

I actually forgot that Xcode could install wirelessly! To me, unlocking the device and connecting it to the computer (which could be a mac mini next to my bed) is completely trivial. It really doesn't get much easier.

I love the logical gymnastics you iphone fanboys go through to make your views fit the world we live in.

The world we live in is one where nobody is forced to buy an Apple product. If you don’t like what Apple does, don’t buy their products.

I don’t like what they do, but I also like their products.

Now what?

It’s up to you. Buy them if you want them. Don’t if you don’t.

It's not. You obviously never really developed anything using both xcode, the automated xcode build tooling, or an iPhone before.

I operated a whole bespoke enterprise build farm for iOS that did hundreds of headless xcode builds per day, plus I wired up automated app re-signing with a signing identity repository. It's a pain because Apple isn't super helpful if you're not on the straight and narrow path, but it's not rocket surgery. Just hooking up some actions to automate a build and install when 'phone plugged in' event is detected isn't that hard.

Apple has been gradually improving its toolchain. Finally their Buddybuild acquisition is yielding results.

You can always buy a developer account.

> afraid that non-App Store apps will be able to install viruses or brick their devices - which isn't the case.

It absolutely is the case.

> It absolutely is the case.

If that can happen, then that is a security flaw of the device and should be fixed, no?

I mean, reading a text could install a virus on iPhones last year, yet I didn't see people screaming that all texts should have to go through Apple to make sure they aren't a virus.

For heaven's sake, don't give Apple any more ideas!

> If that can happen, then that is a security flaw of the device and should be fixed, no?

Yes. It should be fixed.

Guess what? Nobody has ever in human history figured out how to make software that is free of security flaws. That’s why these things are only part of the solution.

> I mean, reading a text could install a virus on iPhones last year, yet I didn't see people screaming that all texts should have to go through Apple to make sure they aren't a virus

If you think application software is like a text message then you don’t know enough to comment on this issue.

> If you think application software is like a text message then you don’t know enough to comment on this issue.

If you think that was an example of what I think software is like, then you probably shouldn't comment on it either. I'm just commenting on the fact that, like you said, there's always going to be security issues and using them as the scapegoat for "why" this can't happen is a bad argument.

What's the difference between running an app ad-hoc right now (via XCode) vs allowing a user to download and install any app they want. The answer is, there isn't any except for artificial limitations put in place by apple.

Anything an app that is installed could do would be the same between the store, ad-hoc builds, or installed from a download. The security is in the platform, not the App Store. How many times have we seen something slip through Apple's review process? Fortnite got a full CC flow UI through, many apps back in the day would slip WiFi tethering into their app and get through. All it would take is a simple API call with a boolean to enable or disable the "security issue."

You could always do checks to see what API calls they are using and use that as a metric of "security" but that can also be done device-side. "Hey, this app is using a sketchy API that shouldn't be public, we're going to block it."

> like you said, there's always going to be security issues and using them as the scapegoat for "why" this can't happen is a bad argument.

No it isn’t. If you agree that there are always going to be security issues, then there is no reason why customers shouldn’t be able to choose a product where human moderation is used to mitigate them.

You haven’t made any case as to why customers should be denied this option.

>If you agree that there are always going to be security issues, then there is no reason why customers shouldn’t be able to choose a product where human moderation is used to mitigate them.

First of all, that is one of the worst arguments I've ever heard. A iMessage can install a virus, but you don't see people asking for human moderation of all of their messages on the remote chance that one message contains a virus.

I'll also just copy/paste my reply here since you decided to not reply to it.

> You haven’t made any case as to why customers should be denied this option.

Xbox Game Pass, done. Any time Apple bans someone from using a new technology, it harms the consumer and limits user choice.

> A iMessage can install a virus, but you don't see people asking for human moderation of all of their messages on the remote chance that one message contains a virus.

You keep making this silly silly argument.

A text message is not like a software application.

If you really thing the two are comparable, you honestly don’t know anything about computer technology.

You also clearly don’t understand security if you think a platform can be free of security flaws.

As for things slipping through app review. Obviously that happens. That proves that the platform isn’t secure, and that App review isn’t perfect.

If app review wasn’t there, even more things would ‘slip through’. What matters is not how many things slip through, but how many are stopped.

The platform security isn’t perfect, and nor is app review. Together they are much better than one would be alone. It isn’t hard to understand this if you want to.

> You keep making this silly silly argument.

> A text message is not like a software application.

> If you really thing the two are comparable, you honestly don’t know anything about computer technology.

Ya know, I'm not going to attack you like you seem so set on doing to me. But for reference, I'm a lead SWE working on mobile devices.

As for how a text is comparable. All I'm saying is you claim the platform would be vulnerable with sideload functionality, and what I'm saying is the platform is already vulnerable to the attacks you think this would open the door to. Letting users sideload apps won't make it any more or less vulnerable.

> The platform security isn’t perfect, and nor is app review. Together they are much better than one would be alone. It isn’t hard to understand this if you want to.

I'll say it again, but louder for those in the back. The security is built in to the platform, not app review. If the security was only through the appstore you would see hundreds of viruses in the store a day, controlled by a server side flag. Just like what Uber did to run code differently if the app was being used by reviewers. [1] Why do you think apps need permission to access your sensitive data? That's not the app politely asking while having the ability to get it anyway, that's the _platform_ security.

Now, mind commenting on the part you've ignored twice now? I'll quote it, verbatim, again for you.

"What's the difference between running an app ad-hoc right now (via XCode) vs allowing a user to download and install any app they want. The answer is, there isn't any, except for artificial limitations put in place by apple."

How is the platform so vulnerable and insecure currently? You claim this functionality will cause viruses and adware to run rampant, yet people can do this exact thing right now, with artificial limits (3 max, 7 days max) put in place by apple.

[1]: https://www.theverge.com/2017/4/23/15399438/apple-uber-app-s...

> Ya know, I'm not going to attack you like you seem so set on doing to me. But for reference, I'm a lead SWE working on mobile devices.

Then I assume you understand the difference between text and an executable and they they pose very different security risks.

If so, then we have to assume you are simply arguing in bad faith by pretending they are analogous.

> I'll say it again, but louder for those in the back. The security is built in to the platform, not app review.

This statement is completely false. Security is in both. You surely know that.

> If the security was only through the appstore you would see hundreds of viruses in the store a day, controlled by a server side flag.

No, because they could still be removed after detection.

In any case, this is a dishonest argument. Nobody is claiming that it’s only in the App Store. The claim is that the App Store is a way to catch issues that the platform security alone cannot.

Again, you clearly are aware of this.

You can already install malware to your device if you want to and sometimes even if you don't. Allowing other sources for installation is already build into phones.

What are you talking about?

Don’t you think that dominance worldwide might be attributed to the fact that you can get an Android phone for $50?

The fact that one does not have to sell own kidney to own smartphone definitely helps I think. Does it somehow make non Apple smartphones less of a product?

Not at all. But people aren’t buying Androids because they care about it being “open”.

What does this change?

It’s not dominant because of any inherent trait of Android besides it’s price.

I don't think you understand how this works. It's dominant. Just because you think iphone is better doesn't mean it's not dominant.

Classic Tesla fanboy logic

I’m saying just the opposite. If the argument is that people prefer Android over iPhones for reasons like “openness” [sic] that’s clearly not the case. Where users can afford iPhones either because they have the income or where carriers have easy payment plans, they buy IPhones - like in the US or the more affluent even in China.

People prefer a phone with a store curated by Apple.

Cloud gaming exists on iOS as well. And is just as insignificant there as it is on other platforms.

And you are being disingenuous by deliberately ignoring the manual checks that Apple's review team does to prevent malicious apps from being disseminated. I work for a bank and my Mac laptop has 6 apps pre-installed designed purely to prevent malware/viruses. The same will unquestionably be needed on iOS for those using it for sensitive tasks.

Macs offer the option to run apps without any sandboxing whatsoever – meaning an app can run totally unrestricted and read, modify, or delete any file of any other app, including most system files.

We’re not asking for that on iOS.

So there’s no reason to think you’ll ever need "6 apps pre-installed designed purely to prevent malware/viruses” on your phone.

You seem to be engaging in magical thinking by imagining that a sandbox can prevent all malware.

No serious security researcher would support this claim.

iOS provides many more security protections beyond sandboxing.

So what? It’s clearly not enough on its own.

When has it been not clearly enough?

Are you suggesting that iOS provides perfect security? If you think that, I am not going to bother to do the googling for you.

It provides far better security than Apple critics believe. Apple haters do not trust the company’s quality of engineering.

So you avoided the question.

Are you suggesting that iOS provides perfect security?

Far closer to perfect security than anti-Apple skeptics such as yourself would claim.

How many security flaws are there, and when do you anticipate that they will all be eliminated?

If you can’t answer these questions, then you can’t make any claim about it being close to perfect.

How many of those security flaws are mitigated by App Store curation, and how many of those flaws are already being let through?

At this point we are both asking each other to prove negatives now, as productive as that is. I think we can both agree to disagree.

Weird move. By asking those questions of me, you have proven my point:

You have shown that you don’t know anything about how many security flaws there are or how many are protected from by App Store curation, so your claims up to this point about security have simply been dishonest.

This isn’t about agreeing to disagree. It’s that you’ve just been making up false claims this whole time.

If your point is that App Store curation is insufficient, then I heartily agree with you.

https://www.ft.com/content/914ce719-f538-4bd9-9fdf-42220d857...

https://www.wired.com/story/apple-app-store-malware-click-fr...

https://appleinsider.com/articles/22/01/11/wordle-clones-fur...

Those links don’t address the fact they you’ve been lying up until now about your knowledge of iOS security.

Nobody said app store curation is perfect, just that it is necessary in addition to OS security.

It’s not clear what you are trying to do now other than to distract from being caught in a lie.

App Store curation is beneficial, but it is not absolutely necessary, and in many ways is lacking.

The fact that you cannot begin to imagine a world where Apple's engineering capabilities exists beyond the App Store, nor are aware of the many, many security features they have enabled on both iOS and MacOS [0], speaks of your own skepticism towards Apple's ability to get the job done beyond the App Store. I suggest you read up on Apple's work into system security [1] and elsewhere. It's quite fascinating!

[0] https://support.apple.com/guide/security/app-security-overvi...

[1] https://support.apple.com/guide/security/system-security-ove...

You still haven’t addressed the fact that you are lying about apple’s security.

You don’t know how many flaws there are, how long before they are fixed, or how many are protected against by the App Store.

You have no facts and yet you continue to make a claim you know you can’t support. Indeed you have presented links that show for certain that Apple’s security is not perfect.

It seems like your ideas about the perfection of Apple’s security exist only in your imagination.

> You don’t know how many flaws there are, how long before they are fixed, or how many are protected against by the App Store.

Do you know? I've provided many links about Apple's security, while you have only offered your own opinions. If you have any helpful information, it would definitely be appreciated.

It doesn’t matter how many links you post if they don’t answer the relevant questions:

How many security flaws are there, and when do you anticipate that they will all be eliminated?

If you can’t answer these questions, then you can’t make any claim about it being close to perfect, or even how good it is.

That is fair. I suppose then it is a question of faith in Apple's security abilities. I just happen to trust Apple to be more than their App Store.

I think Apple is more than their store too. I also think they if Apple is forced to allow alternate stores, users and developers will suffer, the industry will be set back, and a few scummy operators will take some rent.

I understand that point and it has been a hypothetical situation that has been debated for years, and is only now getting closer to (possibly) becoming true. I think fears of it are overblown, as I have discussed elsewhere, because it both portrays Apple as helpless and portrays those scummy operators as being all-powerful. It also underestimates user resistance towards having to deal with more app stores that they wouldn't want to, and also underestimates the potential for smaller indie developers that alternative app stores and alternative payment processors could unlock.

That is my position, and I'd rather discuss it at a different place, but thank you for letting me know where you stand, and now you know where I do.

Android is the dominant platform, and there is a lot of cool software missing. E.g. Any app that takes donations to charity or payments outside apple. Maybe not cool to you because you don't notice the cut apple takes.

Apple users don't even realise there is competition in the keyboard market.

Of the many cool apps missing are the ones that require root. Neither platform provide that so loads of apps are impossible.

Android is the only platform if you want control of your own mobile device.

Apple give two hoots about that because they have no competition in consumer markets.

Lots of people have old iPhones they could be using for a load of funky projects or just plain simple software projects but apple don't let them.

Some useful iPhone apps that don't exist.

Mobile web server. Pos device WiFi bridge. Portable software demo device. Non itunes music player. Non apple payment device. ...

An iPhone is just a computer that Apple tell you what you can do with.

a) Nothing is stopping you from charging people from outside the app e.g. your own web site. It's how Netflix works.

b) Multiple keyboards have existed on iOS for years.

c) Spotify and Tidal are examples of non iTunes music players.

d) Nothing is stopping you from running a web server, creating funky projects etc. You are just not allowed to disseminate to others through the App Store.

> a) Nothing is stopping you from charging people from outside the app e.g. your own web site. It's how Netflix works.

Most here are already familiar with Apple's 15-30% fee (requiring developers to raise prices by 17.6-42.9% to break even) for most app categories, which siphons money from developers who are smaller than Apple to entrench Apple's duopoly position.

Furthermore, even for free apps, Apple requires developers to pay the $99/year fee just to keep apps in the App Store. Without paying, the apps are removed. This already has a negative impact on the availability of free and open source apps on iOS, with an outsized effect on FOSS developers in areas with lower cost of living. For example, compare the huge selection of apps for Nextcloud features available to Android users via F-Droid (https://search.f-droid.org/?q=Nextcloud) to just Nextcloud (basic storage functions) and Nextcloud Talk on iOS.

> d) Nothing is stopping you from running a web server, creating funky projects etc. You are just not allowed to disseminate to others through the App Store.

That's a point in favor of the bill. Apple preventing entire categories of useful apps from entering iOS via the only accessible installation method for most users of average tech proficiency is evidence of consumer harm.

Nobody is making you install or purchase anything from outside the App Store if you don't want to, even after sideloading becomes an option in iOS. Sideloading is allowed in Android, and most users still install and purchase apps from the Play Store in regions where the Play Store is pre-installed.

a) iOS customers pay extra for the service protections of easy subscription management and keeping payment information out of shoddy payment platforms. Registered charities can accept Apple Pay to avoid the cut.

b) The Keyboard API is designed to be tiny and blocks broadcasting keystrokes. It is like it was not designed to be a general computing device.

c) Again not intended as a general purpose device. I recall early on they added hardware to the camera to prevent it from detecting out of sight spectrum to prevent it from being used to find heat leaks and the like.

d) Android is the only platform where other people can secretly control your device.

e) Apple gives lots of hoots. They are clearly trying to craft a specific experience.

f) True of most anything with a chip. Cars, game machines, smart TVs all have anti-tampering tech even without your banking data on them.

g) Web servers are often compromised so bad for security. Computers never made good WiFi bridges. Plenty of music apps. I see point of sale iPads all over the place.

h) yes. The idea of billions of devices out there with constantly running background Location/Bluetooth sniffers reporting to ad-tech is horrifying to me. It would make the AirTags stalking seem like a joke if every phone secretly tracked every Bluetooth.

> If there was a load of cool software that Apple was preventing from coming into existence, Android would be the dominant platform by now, because it would have all the cool stuff.

A mobile application that can't be shipped on iOS has a much lower total addressable market, which potentially makes it so that it isn't a commercially-viable undertaking for the developer. When I was working in the mobile space, I saw more than one great idea that never advanced to a product because of this factor.

There are also a lot of cases where a cross-platform mobile developer will kill an otherwise promising feature because they can't ship it on iOS and don't want to fragment their product by having different feature sets on each platform.

Perhaps you can name one such great idea.

Comedy?

https://techcrunch.com/2009/11/07/apple-has-no-sense-of-humo...

Hardly greatness without which the innovation of an entire industry is being suppressed.

Porn and Chrome probably

Uart over Bluetooth serial modules

Fetlife.

You can’t seriously be claiming that a FetLife app vs the fetlife website is major innovation.

That is rather reductionist. Users care about lots of things including the hardware itself, the camera, battery life, etc...

Sure, but that’s a matter of competition. Google and Samsung both have the resources to compete with Apple in those areas.

Like all the shitty games with circular ads that which I also think should not exist? Can't wait for an actual curated store.

How will this ‘curated store’ be profitable?

A curated app store doesn't need to be profitable to be useful for both users and developers. Example: F-Droid.

If you want F-Droid, Apple isn’t stopping you.

Yeah they are.

No they aren’t. If you want F-Droid, buy an android phone. Apple can’t stop you.

Why should others go out of their way to satisfy your preferences before accomplishing what they want? If you want to get apps exclusively from the App Store, just do so. Apple will certainly keep that option available and easy to choose for you.

I want F-Droid on iOS. Apple is preventing that, but looks like not for long.

No they are not. One can write / use a progressive web app and have the app installed and running without the need of an App Store at all.

“Progressive Web App” is not an app. It’s a website, and it’s moronic to pretend otherwise.

Android is a spyware shitshow and as such is in a different market.

Phones-where-you-are-not-the-product is monopolized by Apple.

Thank you for sensibility.

We all seem to forget that we as people have a choice. Either we go where other people go, or we chose to go somewhere else.

It is not a precondition to have success in society to use an Apple device, so why does it matter that they chose to operate the way they do?

A developer might want to target Apple specifically because AppStore provides a potentially high consumer lifetime value client for your offering; but guess what, if you were as valuable to your customer as Netflix, you could abide by Apple's rules completely and still be a successful company. The AppStore in app purchase doesn't matter -- Netflix iOS just says, 'good luck! figure out how to sign in!'

Which gets to the other part of this, side loading != pay through AppStore. The 30% rake is the wind for this bill's sail, and it's not right. Just mandate alternate payment links like EU / whoever.

Side loading will lead to more 0 clicks and NSO breakthroughs. The surface of attack is increasing.

Reply on news.ycombinator.com