Hacker News Reader

Comment by jclardy | Hacker News Reader

I'm the opposite, as looking at android, where do we see this? All big players are still in the play store, because the average user of those services doesn't want to be bothered going to a website, clicking scary looking buttons to enable third party installs, then manually update their own installed apps.

Basically the risk would be someone like TikTok dropping out of the store, but I find that unlikely. Maybe at the best they will have an "unrestricted" version with bonus features outside the app store. Visibility for indie apps is basically zero on the big platforms, but for the large players, being in the app store is actually important, at least for now, as users are used to going to the app store to search for software, and not just typing something into google.

The other thing is, these apps will still be sandboxed. Being available outside the store just means they can accept their own payments, they aren't going to have full system access to photos/contacts/files/etc. without explicit user permission, same as an app available via the app store.

View on HN

> I'm the opposite, as looking at android, where do we see this?

1) Android hasn't made things as hard for malware vendors as Apple has, and

2) Android's not as lucrative a market as iOS

Those together mean incentives are significantly different, so we might not see the same behavior on iOS as we have on Android, from companies that are upset about not being able to to distribute as-effective malware as they'd prefer. Like Facebook.

Android is a much bigger market worldwide. Only in the US and a few other rich places Apple is still the #1.

User count, yes. Expected value per user, and amount spent per user on software and computer services is far lower for Android, even if we only look at the US. That, combined with the relative ease of supporting a couple iOS versions on a handful of devices versus a whole universe of Android OS-device combos, is why a lot of apps go iOS-first if they're not doing dual-platform from day 1. The benefit for most monetization models is greater on iOS, and the cost of support tends to be lower.

>amount spent per user on software and computer services is far lower for Android

But why does that matter in this context

An alt-store stands to capture more value on iOS than Android, and spying on iOS users is probably a whole lot more lucrative than spying on Android users.

That, combined with the App Store restricting spying more than the Play Store does, is why we can't necessarily expect the iOS ecosystem to behave the same way as Android's, were iOS to get similar side-loading capabilities. A common argument goes that nothing will change on iOS, because it hasn't on Android, but the two markets are different enough that I don't find that a strong argument. Maybe it'll turn out to be right, but I don't think it's as much a slam-dunk argument as those advancing it seem to think it is.

> An alt-store stands to capture more value on iOS than Android, and spying on iOS users is probably a whole lot more lucrative than spying on Android users.

How so?

I think American Apple users just don’t realise how insignificant Apple market share is outside the US.

Android was open from the start. Giant like Amazon tried to kickstart alt stores. What did happen? Nothing.

I think people should stop drinking Apple fear mongering. It’s just aggressive lobbying to protect their cash cow.

> > An alt-store stands to capture more value on iOS than Android, and spying on iOS users is probably a whole lot more lucrative than spying on Android users.

> How so?

What... part of this remains unclear? It's the same incentives that drive iOS-first development choices, with the added wrinkle that the App Store restricts the potential of certain monetization schemes (spying on users) more than the Play Store does. All that means the incentives to distribute apps outside the App Store, or to launch an alt-store, are stronger than on Android.

> I think American Apple users just don’t realise how insignificant Apple market share is outside the US.

I do realize. I think you may be overestimating how much all those Android users spend, and how much their eyeballs (and personal data) are worth to advertisers, compared with iOS users.

> Android was open from the start. Giant like Amazon tried to kick start all stores. What did happen? Nothing.

My entire point is that there are enough differences between the two that we can't assume they'll behave the same.

Obviously the implication is that only plebs are using Android and affluent people are on iOS

Income demographics are almost certainly part of it, sure. I expect iOS also makes users feel safer or more comfortable spending money than Android does, and that the average iOS device in the wild is generally more pleasant to use than the average Android device. There could also be age-related demographic factors contributing (that is, Android users may skew older, and older people might spend less on software, and may tend to use their devices far less than younger smartphone owners—this is just a guess, though)

Whatever the reasons, iOS device owners use their devices a lot more, and spend a lot more money through them, than Android users, on average.

> use their devices a lot more, and spend a lot more money through them

Dark patterns are the same, by any other name. I left MacOS because the squeeze got too rough, and didn't even consider iOS for daily use since it's file syncing options are a clown show. If Apple has reached this market position through unfair or anticompetitive means, I don't see why or how it would stop regulators from ruling in favor of competition.

I doubt you're right that Apple's more-strongly leveraging dark patterns (... do they?) is the reason iOS users use their devices more, and spend more money on them. There probably are several things that all contribute, but I doubt that particular one ranks in the top-10, assuming the effect even goes that direction at all, and I'd certainly not bet that it does.

I mean, hell, Apple goes out of their way to let you know how much you're using the device and where you're spending (or wasting) your time. And they make managing e.g. subscriptions dead easy. Sure seems counterproductive if the secret of their success is dark patterns tricking us into spending more time on the devices, and spending more money.

- 27.71% worldwide is iOS.

- 56% in the US.

- 34% in Europe.

- 18% in Asia.

- 13% in South America. [2]

That all in mind Apple has 85% of the global share of smartphone profits. [1] Many Android players have a negative profit share.

[1] https://www.bloomberg.com/news/articles/2023-02-03/iphone-gr...

[2] https://gs.statcounter.com/os-market-share/mobile/

Those are numbers for smartphone sales, not the software on them. Hardware sales can be negative, sometimes even intended. Just look at console vendors for that.

Are you arguing that the average Android user spends more on apps than their phone is worth?

Anecdotally, most people I know might spend $20/year on App Store purchases (excluding streaming services if they don’t have a desktop computer).

I’ve made well over six figures for a few years and have never spent more than $100 in a year, the vast majority of those purchases for one off games/apps, not iap coins/tokens/etc.

That can't make the numbers look better, after all, Apple gets 30% of App Store sales, while Google takes the cut of Android apps sold through the Play store. And that gets even worse when you see Apple gets 67% of all app revenues too. [1]

[1] https://www.businessofapps.com/data/app-revenues/

Then just say that in the first place. I don't disagree that Apple users are much more likely to pay for software than Android users, but you don't need hardware sales to make that point.

I can see it your way. Point taken.

Unless your goal is propaganda, the incentive is measured in dollars etc., not eyeballs.

Pickpocketing is less of a problem in areas where people aren't carrying around cash and credit cards.

> In Q1 2022, Facebook had an average revenue per user (ARPU) of $48.29 in the US and Canada, $15.35 in Europe, $4.47 in Asia-Pacific, and $3.14 in the Rest of the World. Facebook reported a quarter-over-quarter decline in ARPU of 20% in the US and Canada, 22% in Europe, 18% in Asia-Pacific, and 5% in the Rest of the World.

https://www.globaldata.com/data-insights/technology--media-a...

Only by user count. Last I checked, apple's worldwide app store revenue was nearly 10x that of Google's app store revenue.

So are malware vendors looking for who spends the most on software or for biggest impact through sheer number of installations

I'm guessing they're looking for the users they can steal the most from in the least amount of time. Aka, the most lucrative.

Apple's ecosystem means that most of the devices are up to date, or close, and because they control the full pipeline, things behave better.

This means that targeting ios is easier (since they'll be on closer versions and behave uniformly) and that because they spend more money, which they have, means that targeting them is easier and more lucrative.

Most are looking to hack. If they're looking to build a botnet, android might be better.

> This means that targeting ios is easier

I don't think so? Android devices are much more likely to be vulnerable to well-known exploits. Stealing keys and passwords of course is much easier if your app can get root on the device.

Finding vulnerabilities on both will be complicated.

But targeting when there’s less device variances will make it easier, yes.

Apple is more lucrative in the sense that people spend significantly more money on their App Store.

Read the above comment regarding FBs breakdown of revenue per customer by region.

Citation needed

For the money part, https://www.businessofapps.com/data/app-revenues/

iOS is 15% of the mobile device market but generates 67% of the app revenue.

Yeah, I suppose this stuff isn't common-knowledge outside the commercial mobile development space.

There are complaints in this very thread about how shit the software selection is on the Play Store compared with iOS. This is why. Companies that have to, for whatever reason, pick only one platform to start on, usually pick iOS. If they add on Android later, they expect it not to make as much money as the iOS app, so may half-ass the port. In some cases, good apps that have enough revenue to keep them alive on iOS, may judge that an Android port won't be worth the added cost (especially smaller apps—think, one or two developer sorts of operations, they may run the numbers and project only a 20% revenue boost from adding an Android port, which may not be enough to cover the dev, testing, administrative, and support time the platform would require). There's a perception that, basically, Android users won't buy apps (which is... kinda true) and that's why the iOS version of an app might be ad-free and paid, while Android only gets an ad-supported variant—the vendor doesn't think creating and supporting a paid option on Android is worth the extra overhead.

I used to be a mobile developer, and I literally got death threats for charging $6 on Android. People just paid it on iOS and got on with using the app.

Also 85% of all the profit in the entire global smartphone market. [1] Roughly speaking nobody makes profit in smartphones other than Tim.

[1] https://www.bloomberg.com/news/articles/2023-02-03/iphone-gr...

iOS users spend more than Android users, and are even becoming the majority in the US. Here's some citation: https://nix-united.com/blog/are-android-vs-ios-users-really-...

Spend more, and use their devices a lot more, both Web and Apps. At least, last time I looked at market research data like this, which was admittedly 4-5 years ago.

Something that I think is often not considered when thinking about mobile device usage stats is the proportions of types of users the market is comprised of.

While I don't have any links to back the idea up, I suspect that Android's marketshare is somewhat inflated by users who'd normally be using feature phones — these users don't need anything more than the ability to make cell calls and maybe text occasionally, and even the absolute cheapest of cheap Android phones checks those boxes. There's no point in these users buying even a low-midrange Android phone, let alone a flagship or an iPhone. So while these users are technically Android users, they're not really smartphone users.

Also, the difference in rates of usage extends beyond phones. I think I read some of the same reports you did and compared to iPads, Android tablets are much more likely to end up forgotten in a drawer or collecting dust on a shelf. Having a recent low-midrange Android tablet myself (for Android app dev purposes) I would guess that this is at least partially due to how ridiculously low-spec cheap Android tablets are… mine cost almost as much as a refurbished iPad 9th gen on sale but doesn't perform a fraction as well as that model of iPad. Even my old Pixel 3XL runs circles around it.

Agree with the user base portions. My parents (in their 80's) each have 3 android phones because my dad keeps buying them for some reason. We never know which of their phones/features are currently active. My mom wasn't getting my texts and we just figured out that she doesn't have texting enabled. Not sure if it's a setting or that my dad picked a 90 day phone plan without text support. :-)

As someone used Android and Apple co-currently, this is it. Android apps I supported (camera and photo apps, some music) all went down in some form and were gone in some time. Furthermore, the quality was always lower than any iOS counterparts.

Apple apps almost never have these problems and are higher quality.

Put another way,Apple and iOS is becoming more like Google and Android.

My privacy isn't happy about this.

> I'm the opposite, as looking at android, where do we see this?

Where do we see Android devices with apps like Facebook preinstalled, unremovable and granted root permissions? All over the ecosystem.

Only Apple sells iPhones, so I wouldn’t worry about preinstalled 3rd party apps with root permissions like we see on Android phones.

Only Facebook makes the Facebook app, and I find it extremely easy to imagine a Facebook app that can only be sideloaded, so that Facebook can bypass the restrictions put in place by the App Store.

For instance, Apps are currently not allowed to degrade functionality if the user says no to a permissions request (e.g. location tracking).

Facebook has actually done this before with their Onavo VPN that intercepted all your web traffic in exchange for something like a $5 gift card every month. Distributed publicly using their internal enterprise certificate and got their cert revoked.

Sure, but that's not scalable.

Perhaps, but what I was emphasizing was that on iPhone such apps will likely not come pre-installed; neither by Apple (vs e.g. Samsung) nor by a carrier because I seriously doubt Apple would allow that.

Instead, what Apple is doing is finding a new balance that appease those who are attacking the legitimacy of the App Store (and its toll booth) while in practice the vast majority of iPhone users will retain their privacy.

> Perhaps, but what I was emphasizing was that on iPhone such apps will likely not come pre-installed; neither by Apple (vs e.g. Samsung) nor by a carrier because I seriously doubt Apple would allow that.

If Facebook is willing to pay to have their app preinstalled, unremovable, and granted root permissions on Android, why in the world wouldn't they be willing to force users to sideload their app on iOS?

In this hypothetical, Apple would agree to take Facebook funds to preinstall the app.

Otherwise I think you may be confused on what sideloading is.

They would sideload to do what exactly?

Any of a large number of things that Apple currently doesn't allow on the App Store.

Why in the world does it matter? If Facebook wants to use the iOS sideloading scene to promote organ harvesting or whatever, we use that to sue them. From the outside-looking-in, it seems like another one of those hissy-fit scenarios where Apple's petty disagreement with other companies actively reduces the capability of their devices.

Sue them for what? Gathering user data that users gave an explicit permission to gather?

Previously, the app devs wouldn't be able to, for example, lock out the entire app from being used, just because you didn't give them permissions for something that isn't vital for the app to function (e.g., location tracking or photo gallery). App Store rules prohibit that behavior, and those apps get rejected.

Sideloading would allow FB and others to do that and more, since they won't need to follow App Store rules anymore. And I don't think there is anything illegal about them doing it.

I don't use the Facebook app. I hardly ever use FB, anyway (I am an admin on a user group for an OSS project I authored), but their app is a well-known nightmare.

I use their Web interface, which, I suspect, they deliberately cripple, in order to try forcing me to use their app.

I wanted to check fb messenger on my phone for a marketplace thing so I logged into the website: wouldn’t let you look/ pushed you to the app and I couldn’t flip it into desktop mode

Yeah, I was forced to install Messenger. It sucks.

What exactly are those restrictions? Ios has a good sandbox model which is responsible for security.

They don't speak of the security model. But the compliance model, ie. "you can't block the entire app until the user enables precise 'always' location tracking".

But in terms of security, every jailbreak since ~iOS 8 besides checkm8 has been via a third-party app breaking out of the sandbox. The ramifications for shipping an exploit chain like this via the built-in app store is going to be extreme (possibly being blacklisted from iOS), but a sideloaded app can run such an exploit chain in the background (to install spyware if the user isn't on the most up-to-date version of iOS) with no consequence.

This is false and not how it works on macOS, worse I would consider this fearmongering.

What is false?

Facebook could pull Instagram and tell users to visit Instagram.com.

They can now block some/all of the app based on whether or not you've enabled location tracking.

And malware on macOS works different because macOS doesn't have the same security model as iOS. macOS apps can access large parts of the system after one or two security prompts, and Apple has gone on record that this is not the security level they want for iOS[0].

I guess you could mean that Apple would do notarization, but I can assure you that enough third parties would still fight Apple in court/via lobbying to remove all of Apple's oversight over app approval.

0: https://www.cultofmac.com/742918/craig-federighi-apple-softw...

Preinstalled and unremovable, sure. I've never heard of Facebook being given root, though? Do you have any more info about this?

> I'm the opposite, as looking at android, where do we see this?

For one, DJI drone software. It's available in the Apple store but you have to sideload it for Android. DJI isn't a small company, and there is quite a large professional market.

Edit: meant apple app store, not play store...fixed for clarity

Sorry, if it's available in the play store, why do I have to sideload it for Android?

Because Apple forced DJI to comply for their version, but since sideloading is available on Android as an alternative, they basically told Google to go pound sand.

Edit: I misspoke in my original, which I fixed

I suspect as well the version is Android has features the iOS one does not due to limitation placed on it from the store, Issues they got around by simply removing it from the draconian store.

Sure, but those are probably features good for DJI. It's far less obvious it would be features good for end users.

Is this actually true though?

It has been several years since I gave Android a try, but my experience was that the Android ecosystem (specifically the Google Play Store in the U.S.) was indeed much worse than iOS with apps distributing malware, destroying battery life and performance with background tasks, sending all your contacts off to their server, using push notifications for spam, etc. (To be clear, these things have also been problems on iOS, and my position continues to be that Apple should be even more restrictive about this stuff).

> I'm the opposite

You already can side load apps. Just buy an Android device. I liken this to people who buy a house near an airport then lobby to get the airport closed because they do not like the noise. I bought into IOS because of the walled garden and without it some app that I would prefer to get through the sanctioned app store will now only be available by side loading.

> I liken this to people who buy a house near an airport then lobby to get the airport closed

Well, no, in this case it’s the government going to see the pseudo-monopolist and telling them: "Party is over. There is going to be some competition there from now on." Something I most definitely cheer for.

> There is going to be some competition there from now on.

there already is competition- it’s called Android based phones. This is more akin the government telling Walmart they have to freely give shelf space away to anyone and everyone to sell anything they want.

> there already is competition- it’s called Android based phones.

The law is about digital store and aims at stopping the close tie between platform and stores. Android is completely irrelevant here.

> This is more akin the government telling Walmart they have to freely give shelf space away to anyone and everyone to sell anything they want.

No, it's akin to the government telling a city they can't mandate than its inhabitants have to shop at Walmart.

I don't understand why so many act as Apple apologists and feel the need to justify the current situation.

> I don't understand why so many act as Apple apologists and feel the need to justify the current situation.

Who’s acting as an apologist? I prefer it the way it is. It’s not like you don’t have a choice. If you want a device that offers the ability to sideload go buy an Android. I appreciate the fact that if anyone wants to offer an app on IOS they MUST go through the official app store to do so. Lets say for instance an app that I must have (example only) Facebook Messenger. Now that they (Facebook) can sideload they stop offering it in the app store. Now anyone that really needs that app either must sideload it or not have it. You think Facebook is going to honor all of the good privacy controls that IOS currently enforces?

That is a huge disservice to those that like the walled garden. It forces companies that want a presence on IOS to comply.

In this scenario Walmart is one of only two stores in the country, and while Walmart usually pays a few bucks for shelves, the merchants in question are happy to bring their own. They just need Walmart to get out of the way, not incur any real cost.

Some things can be sandboxed in software, some things are only socially-enforceable. For example, look at Apple's requirement to list everything an app does with the user's data. It's impossible to enforce that in software and still have functioning apps (trivial example: an app's back-end sells every single request made to it to some third party), but Apple was able to enforce it anyway via App Store rejections

We already have an example of what Meta would do with sideloading: trick clueless users into installing highly invasive spyware that inspects every traffic going in and out of your device, even MITM-ing TLS connections.

https://techcrunch.com/2019/01/29/facebook-project-atlas/

They did this by abusing their enterprise certificate.

As much as I'd like the ability to sideload apps, abuse by commercial vendors is a very real concern. With a few exceptions, commercial software has proven itself to be untrustworthy with the growth of surveillance capitalism. I'd rather that sideloading be reserved for free software.

> I'm the opposite, as looking at android, where do we see this?

fraud. we'll see lots and lots of fraud. a new avenue will be open.

Just make it hard to sideload, like the android dev mode.

Then your grandma won’t install anything, but power users can actually use their general purpose devices as such.

Power users can already sideload anything on iPhone. It's not even hard.

I guess the whole talk is about making side-loading easier.

what you’re seeing in the iPhone sideloading space is a product of a lot of hard work by many different people over many years. AltServer and the like (what I assume you’re referring to) are the best solutions we have, but come with significant downsides - iOS updates breaking the software, limits on how many apps you can install (last time i checked, you could only install 3), time constraints (need to ”re-sign” apps every week), software constraints (still can’t use JIT or other private APIs without Apple’s blessing), and - relative to using the App Store or Android sideloading - the setup procedure is pretty complicated. on both Macs and PCs, AltServer can be kind of difficult to set up.

all of this has prevented a legitimate sideloading scene from truly emerging on the iPhone - which, depending on where you ideologically stand on this, could be considered monopolistic.

i think there’s definitely room to make the process a lot easier - even if it’s just for power users.

When I first looked into this, free Apple developer accounts also could only use limited app entitlements: so no network extensions, VPN profiles, Apple push notifications, or other capabilities. NetworkExtension is basically the only reason I’m interested in iOS development at all, so a paid account was not optional.

It used to not be possible at all, and now you still have to repeat it regularly if you want to keep using the sideloaded application, which makes it close to useless for anything else than development. Of course, as expected from Apple, doing it from another OS than macOS is a huge PITA too.

It was always possible. Buy a developer certificate. $100/year, when whole iPhone is like $1500 is not that expensive. Consider it a premium service.

The whole iPhone I got was $100 itself, second hand, some older version that was still useful for development. Its purpose was to let me port my game engine to iOS. I managed to port a single app, run it on the phone and then decided to forget about iOS at all. The necessary effort to deal with all that stuff is crazy and it's better to spend all that time elsewhere.

Today that phone stays in the drawer and I can't run that app on it anymore; I'd probably have to spend hours figuring things out again just to redeploy it so I can launch it on my phone.

Meanwhile, on my actual phone, I can just scp a deb package and install it with dpkg, and it works until I uninstall it myself.

> looking at android, where do we see this?

Google doesn't prevent Meta or TikTok or any other apps from spying on you, as long as they also get to spy on you. So they have no incentive to build a competing store.

Apple, on the other hand, limits what apps are allowed to do.

What's preventing Apple from limiting what apps are allowed to do with iOS? It's got the same kernel as MacOS, presumably there's nothing stopping them from using the same venerated isolation technology, right?

What's the technology that enforces something like "apps are not allowed to degrade the user for denying permissions, except for features that actually use that permission". Or however Apple wrote the exact rule that prevents apps like FB from saying "give us access to all your contacts or we won't work at all".

As one example.

Nothing. Just like the technology that enforces something like "apps cannot record from the camera and train it on AI off-device" or the technology enforcing well-written and clear EULAs.

When an app on my phone asks for contacts access to work, I don't use it. The system works as-intended.

Edit:

> So Apple users can use FB on their phones

According to your logic, this is a net-negative. Is Apple trying to help or hurt their users here?

And when you don't use FaceBook, then Mark Zuckerberg personally feels sad!

No wait, no one cares.

Meanwhile, Apple says "if you try that, you won't get access to all our customers". And FB and Mark Zuckerberg listen to that threat. So Apple users can use FB on their phones, deny access to location tracking and their contacts and feel safe that FB won't ever say "add them back or we'll stop working".

> Basically the risk would be someone like TikTok dropping out of the store, but I find that unlikely.

Maybe it's the other way around. I don't know the current legislative status of the attempts to ban TikTok, but the most realistic mechanism for doing so would involve banning it from app stores. By enabling sideloading, Apple would be enabling TikTok to circumvent such a ban.

Fortnite isn't as big as Facebook, but it's still side-load only on Android and not available at all on iOS

DJI does not provide its app via play store and requires side loading :(

Possibly this is preparation for TikTok being forced out of the store by the US government? But they'd still like to offer it, to avoid losing business to Android if that becomes the only platform with TikTok.

It would be deliciously ironic if one hand of the US government forces Apple to allow side-loading while another other forces it to stop distributing apps.

I appreciate it's not just the US in either case, but the irony is still delicious.

(No way I'm allowing side loaded apps on my main phone though; would rather have a secondary phone for them if I'm forced to install them for whatever reason).

Reply on news.ycombinator.com