Hacker News Reader

Comment by superkuh | Hacker News Reader

Even if this is small progress the headlines and framing of the story are still doublespeak. Installing applications on your computer is the normal state of things. Walled gardens and not having control of your computer is the new weird thing. The word "sideloading" is a feudal concept and it's unquestioned use is dangerous for society.

Properly stated this story title is, "Installing applications on iOS 17 might be allowed Europe" which highlights the absurdity intrinsic in the practice of users not being able to install applications on their own computers as a default.

View on HN

We focus too much on criticizing language instead of ideas. IMHO, this just leads to tiresome and hollow debates. So, I’ll call that out here.

Also, your proposed rewording isn’t correct either because installing applications is already allowed. You can debate the App Store all you want, but it definitely does let you install apps.

On topic: This is silly and Apple should allow sideloading. I don’t buy the security argument because the security comes from the sandbox, not Apple’s poorly-run approval process.

Don't be mistaken: if you control the language, you've set the tone.

Yeah, sure. I get it. But I see a lot of people wasting a lot of time arguing about the definitions of words and how to spin them to try to gain the upper hand in The Discourse. I’m not sure it’s worth it. 1984 may not be a good guide anymore.

>criticizing language instead of ideas.

I have no idea how you came to this conclusion. It's obvious that I'm criticising the idea of "sideloading" not the word. You can call it some other arrangement of letters and the concept is still very dangerous.

And in this case it is also definitely true that apple does not let you install applications without someone paying them $100+ and their continued approval. The "let" is the key here.

Responding even though I know it’s not going to be fruitful.

The way I came to that conclusion is I read what you wrote, which primarily discusses the language, not the idea. See your references to “doublespeak”, “framing”, “headlines”, and “the word sideloading”.

You claimed “Installing applications on iOS 17 might be allowed in Europe” would be a more accurate headline. It wouldn’t be, because you can install applications via the App Store. If you wanted your headline to be both accurate and to discuss the approval process and fee, you would need to include that, as the original headline does by mentioning “sideloading”, the word that you take issue with but does at least actually raise the issue you’re concerned with.

This comment sure does seem to have a lot of criticism of language and none for ideas

Yeah, because I’m discussing that with the guy I was critiquing. You may notice I put my opinion on the substance of the conversation in my original reply.

The issue with such a statement is that the terms can and do mean different things to different people. I probably have a similar definition of computer and application as you, but many people, maybe the majority, may not.

For one thing they might think of a phone as a fundamentally different thing from a 'computer' with a different role. In fact I strongly suspect this is the majority view.

Within that people probably think of an 'application' as fundamentally a pre-screened, pre-approved, piece of software to enable some function specifically on the phone and within the phone's ecosystem. Not as any arbitrary piece of software. In fact that might all be seen as a feature, not a limitation, in the majority of people's eyes. Again I strongly suspect that is the case.

I used to think the same way, but not anymore. The amount and variety of attacks on the devices have increased too much in the last years. The device could be encrypted, money could be stolen, some malware could sit silently and do surveillance for who knows. I always wanted to install software on my iPhone without the manufacturing company deciding what I can and can not have (according to californian standards!), but would I let my kids do that nowadays? No way! Stay on the app stores, also on Windows and MacOS is the first line of defense. It‘s sad but the safest approach. Regular users don‘t need to install software on their own anymore, the same as they don‘t need to put processors, storage and Monitors together or install a sound card.

The security on the iPhone is from the app sandbox, not from app review.

It's trivial to get something past app review (eg. look at casino apps that were disguised as games)

On the Mac, staying on the Mac App Store makes sense because it is the easiest way to enforce you only install sandboxed apps.

On iOS, that's not going to be necessary, because every app on iOS is sandboxed.

> On the Mac, staying on the Mac App Store makes sense because it is the easiest way to enforce you only install sandboxed apps.

As an aside, I do believe you can use sandboxd with apps outside of the App Store, someone just has to write security policies for them.

This page suggests that Apple might want to deprecate use of sandboxd in favor of just the App Store[1], though.

[1] https://codeberg.org/valpackett/rusty-sandbox

> I do believe you can use sandboxd with apps outside of the App Store

Yes, you can, it's trivial to do so. However, Apple does not make it easy to find out if an app is sandboxed or not, or what permissions it has.

The warning that macOS shows when opening an app not from the Mac App Store does not differentiate between sandboxed and non-sandboxed apps.

The App Store is a poor line of defense, because it isn't about user security, it's about securing Apple's billion dollar app distribution monopoly moneyhose. User security is just a rhetorical afterthought.

When we forgo real system safety in favor of gatekeeping corporate revenue, that isn't security. In fact, such a scheme is responsible for mass distribution of malware. Apple's App Store is responsible for distributing over half a billion copies of Xcodeghost to iPhone and iPad users[1], and that's just one piece of malware.

[1] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...

I think you need to look at the system of incentives and alignment

If apple's billion dollar app distribution monopoly money hose results in security problems for people, then their billion dollar app distribution monopoly money hose will be in jeopardy since it's justification comes into question.

So what you see as a problem is what makes me feel the best about it. Apple is aligned with only secure apps on their store and apple is very unaligned with insecure apps.

To apple security is not just a cost center, but a pillar of the justification for their monopoly position.

It's a poor justification. You can cleanly implement a signing system for trusted developers (they've done it before), and it's obviously possible to distribute iPhone package files. All the pieces are in place, if it weren't for their $80 billion annual hayday then they wouldn't be dying on this hill in particular.

Maybe part of it is this security alignment issue, but upon scrutiny it's clearly a small and solvable piece of the puzzle. Imagine if Keurig tried using user safety to justify a 30% cut off every K-cup sold. Such an ecosystem is doomed to fail, especially at-scale and with completely arbitrary enforcement.

It sounds more like you’re upset about apples revshare model on their channel; Why do you care if all your competitors also have to pay it?

I don’t think the world got better because we got more channels on Tv, and I even think some of them might be dangerous and harmful to life…

That's fine. I'm not arguing for more channels, I just want them to let me use it for things other than the pre-approved and Apple-sponsored channels. This is akin to your TV manufacturer removing your HDMI input to force you to pay for cable.

Erm, Apple shares the cable subscription revenue with the people who make the content.

People like me.

You are literally talking about stealing my money. To me.

And this doesn’t seem strange to you?

> Why do you care if all your competitors also have to pay it?

Did you ever publish to appstore ? The amount of bullshit you have to go through so that an alternative payment method isn't reachable from mobile is insane, and they want % of a lot of things, not just sales/subscription - a lot of business ideas are unviable because of the policy.

Not to mention that your competitors don't have to pay the same, big players get special deals and exemptions, and Apple has first party advantage on the platform.

You've described literally every platform and physical store under the sun except desktop OSes.

> Did you ever publish to appstore ?

Yes.

> The amount of bullshit you have to go through so that an alternative payment method isn't reachable from mobile is insane, and they want % of a lot of things

You say insane, but you don't say why. Revenue-sharing is the best for content producers; I would definitely not want to go back to the retail model. What exactly are you trying to do?

> a lot of business ideas are unviable because of the policy.

A lot of business ideas are unviable without slavery! So what? I don't want that, and I hope you don't either! So what is it you actually want?

> Not to mention that your competitors don't have to pay the same, big players get special deals and exemptions,

I don't compete with "big players". If Apple didn't make an iPhone and I didn't make an app to put on it, I wouldn't get that money, and pretending otherwise won't make it so. The people I am competing with are in the same situation I'm in, and if they're getting success and I'm not, I think I should worry about what I can do.

> A lot of business ideas are unviable without slavery! So what? I don't want that, and I hope you don't either! So what is it you actually want?

Did you just compare freedom to choose alternative payment method to slavery? What a bizarre world, I don't know why I've even bothered to reply to your comments, lol.

> I don't compete with "big players". If Apple didn't make an iPhone and I didn't make an app to put on it, I wouldn't get that money, and pretending otherwise won't make it so. The people I am competing with are in the same situation I'm in, and if they're getting success and I'm not, I think I should worry about what I can do.

You're dictators wet dream.

"Don't care about unfair system, dig within yourself! If competitor is doing good under dictatorship it means the problem is within you!"

> Did you just compare freedom to choose alternative payment method to slavery?

Not at all. I said some businesses should not be viable and gave the simplest possible example I could think of.

And you did not agree.

Shame on you.

> You're dictators wet dream. "Don't care about unfair system, dig within yourself! If competitor is doing good under dictatorship it means the problem is within you!"

You're still not saying what you want to do and why it is good for society, just that the "dictator" is stopping you from doing it. "Alternative payments" can mean all sorts of things from money laundering to easier-to-steal, and I can't support those things.

> It sounds more like you’re upset about apples revshare model on their channel; Why do you care if all your competitors also have to pay it?

There's a Ukrainian saying

> Хрін з ним, що своя хата згоріла, головне у сусіда корова здохла

Which literally translates to "Who cares if house is burnt down, the most important is that neighbors' cow is dead" - that's you. Ever thought that maybe you and/or your comptetitor shouldn't have to pay in the first place or that shares are unfair?

> Ever thought that maybe ... shares are unfair?

No actually. I won't ever enter any other kind of business-relationship with a larger company unless they have real competition that affects price because my experience is that larger company will try to mess you up if there's any chance at short-term gain. A joint-venture is ideal protection, but with Apple my size makes that unlikely. Revenue-sharing is a fine alternative to me, and if my product becomes worth more than my share I can always renegotiate, even with a big company like Apple, because we both want the revenue to continue. That's the point.

The pure-play alternative is much harder for small companies and individuals because they need cash up-front to get into the market, but I do understand the advantages for big pockets who don't create value though -- I just don't have any intention of being a company so big that my only purpose in life is to group-together smaller companies that aren't good enough to survive on their own.

> then their billion dollar app distribution monopoly money hose will be in jeopardy

It only comes under jeopardy, if there are reasonable alternatives the Apple app store (not move to Android).

Otherwise, it's easy for Apple to say - we are now taking step x, y and z, and "trust us".

As a further separate but distinct response:

You are justifying why a monopoly app store is bad by showing a hack that resulted from downloading an app (xcode) from a source other than the app store.

  Security firm Palo Alto Networks surmised that because network speeds 
  were slower in China, developers in the country looked for local 
  copies of the Apple Xcode development environment, and encountered 
  altered versions that had been posted on domestic web sites. This 
  opened the door for the malware to be inserted into high profile apps 
  used on iOS devices.

I think you are also ignoring that apples app store position made it possible to authoritatively reach out to all who were effected as well as enact other remediation efforts.

This just shows that the App Store model is insufficient for user security, as the the security model was supposed to prevent malware from being distributed to users in the first place, no matter what malicious developers upload to the App Store. If Apple treats Xcode as App Store blessed because it believes it came from blessed sources like the App Store, instead of using real security measures, exploits will continue to be shipped to users. Similarly, if OSes don't implement real security that's independent of the App Store model, users will continue to be exploited in this way.

> I think you are also ignoring that apples app store position made it possible to authoritatively reach out to all who were effected as well as enact other remediation efforts.

Microsoft is able to do the same thing with Windows Defender without using the App Store model at all.

I can't give you a black and white response because I don't think the issue is as black and white as most seem to.

I think the app store is a tool and I think it is a powerful and useful tool. Can the tool be used for good? of course. Can it also be used for bad? most definitely. Can it be wielded poorly? yes.

I've used windows, linux, apple, and android, and I like Apple's environment the best. That environment is a consequence of apples choices. Apple limits my choices and I like that. I like having less choices. I don't want to have to think about software security, I want to think about how to spend time with my friends, and apple is a an environment that lets me think about how best to spend time with friends instead of thinking about software security.

Apple's restriction of my choices benefits me. I want apple to restrict my choices. I want there to be only one way to get apps on my device. That simplifies my life. I will pay more to have a more simple life. I will pay someone else to make better choices than I can make with my limited time. I want to do that.

If you don't like that, then don't use Apple. There is a perfectly working alternative to apple that you can use if you want to experience other choices. Apple has a monopoly on apple devices, but apple by no means has a monopoly on smart phones. I'm not sure there are even any major apps exclusive to apple. Apple is better because apple has more money to spend.

> Microsoft is able to do the same thing with Windows Defender without using the App Store model at all.

If apple scanned the apps I side-loaded and reported information about them to their servers that would upset me, that feels like a privacy violation.

Apple's bullying of companies with monopoly power to force privacy labels won me over greatly. They have a lot of good will for that. If apple continues to do things like that, I will continue to support an app store monopoly.

> Apple limits my choices and I like that. I like having less choices. I don't want to have to think about software security

How does this conflict with other users having a developer mode? Because you want Apple to have more unilateral authority over what other businesses are and aren't allowed to do?

It sounds like you have left the domain of "what's right for the market" and headed into the realm of "what I prefer". That's fine and decent anecdata, but completely useless to regulators who's job is to save the market. If Apple is stifling innovation or competition, even for a good cause, then we must codify the goodness and end the monopoly. That's progress, arbitrary corporate grudges are not.

It's an absurd argument. If you want to only install app store apps, then only install apps from the store. That's still possible you know, even if other people aren't forced to. That's why these arguments always boil down to bullshit about how you will be "forced" to use Facebook from outside the store and that would be terrible because being on Facebook on an iPhone is a human right or something.

If you like Apple telling you what to do, fine. Choose only from their menu.

If you don't like apple telling you what to do, use Android?

Apple products are the consequences of Apples decisions, you want what Apple produces but reject their decisions.

What if Apple's phone is better because it is a closed ecosystem?

Nobody is saying that. They're saying use an iPhone and then don't sideload apps. Easy!

> Microsoft is able to do the same thing with Windows Defender without using the App Store model at all.

But not for a lack of trying. Windows has tried to retrofit their App Store, just less successfully. One good example is the code signing racket, where it’s pay to play to avoid useless warnings that scare off people who don’t know better.

Look, you can somewhat reasonably prove the origin of a piece of software, but a domain name x509 cert would be better (only difference is validity needs to handle longer time ranges). The issue is all the “trusted” yadda yadda. Doesn’t matter if it’s an App Store, a holy enterprise certificate trafficker or the pope himself doing the blessing, it just doesn’t hold up. Maybe they could have a herd-protection like VSCode extensions: “50M+ users” so when I see an executable called “Facebook” with “35 users” I can stop and make my own judgment that it looks fishy. But that’s about UX for checking the vendor matches who you think it is, not blessing it.

> Similarly, if OSes don't implement real security that's independent of the App Store model, users will continue to be exploited in this way.

Spot on! Here’s the thing: sandboxing software on any of the big operating systems wasn’t there from the beginning, and that’s the billion dollar mistake. Sandboxing is the only real game changer in end-user security with iPhone/android over desktop, not the monopolistic app stores. Tbf, Apple at least has tried really hard to bring sandboxing to desktop but even they are not there yet. These mega corps should imo have seen it coming a decade earlier, when the web became vastly popular platform, much thanks to sandboxing.

I used to think like you, but not anymore. I am not interested in installing random software from other people, I want to install my own software to be able to have full control over my own device.

I don't care about 'regular users'. I care about myself.

You can do that already.

If you own a mac, run a specific software at least once a week, and limited to like 3 apps. For all practical purposes, this means “you can’t”.

> If you own a Mac

If you own an iPhone, it's actually very practical to also have a Mac.

> run a specific software at least once a week, and limited to like 3 apps.

What?

You get a license for a week only (without paying for a dev account), and has a limit of concurrently signing at most 7 apps (my parameters might not be exactly correct, but are roughly this), but a single application might require multiple signatures.

The most common way to make all this signing a bit more bearable is to have AltStore installed on your mac, which will automatically re-signs the select few apps you want in some hacky way (needs your Apple id and password).

The most common way is to pay $99 and use Xcode. I think in the long run, limiting the freedom of developers to choose whichever tools they like is actually hurting Apple, but let's not pretend that there is no practical way of running your own software on iOS.

Is that were true there would be no need for a European version, since sideloading is about a "practical way of running your own software".

My answers refer to ihatepython's original comment, and own software is understood there as "software I develop myself". I am not talking about own software in the sense of software you obtained from other people, which is what sideloading is about.

> The most common way is to pay $99 and use Xcode.

Don't you find it ridiculous that the "common" way to run software written by you on a $1k device that you bought is via buying $2k machine and paying 99$ yearly?

Not only do you have to own a mac, you have to keep everything updated to the latest version. This is problematic, considering that the OS gets worse and worse with every release, and some things break with new versions.

If I pay the fee and/or use something like altstore?

Yes.

So take five minutes to set up the parental controls on your children's devices. The idea that we should eliminate the ability to run arbitrary software "for the children" is completely ridiculous.

Then don’t buy an iPhone. I think it’s ridiculous that we are asking the government to save us from our own choices.

As much as you and I don’t like it, what Apple is doing is perfectly legal. And as much as you or I might support a change in the law, you’re not going to get my support if the legislation is truly universal and not just a narrow-band targeting of a single company for developing an ecosystem which resonated with a large number of people. Write some legislation which applies to ALL platforms which run software and maybe I’ll take it seriously.

Sometimes our choices lead us to results that no one wanted. For a classical example, check out "tragedy of the commons". In those cases, you do want someone to enforce cooperation from outside, and this is what's happening to Apple now.

> what Apple is doing is perfectly legal

Not in the EU starting this summer!

Although I agree with the second point: game consoles being general purpose computers should be treated the same.

> Then don’t buy an iPhone. I think it’s ridiculous that we are asking the government to save us from our own choices.

That's a great argument. I have even a better one:

Don't dictate what and how people use their devices that they paid for with their hard-earned money.

Yes it's your device, but it's not your software. You don't own the software. And it's the software which is stopping you from doing what you want.

All software effectively "dictates" how a device works, whether you're talking about an OS or an app. If you buy an app, you don't get to decide how it works. You don't like it? Don't buy it. I don't see a big push for people crying to the government to stop Activision from dictating how to play Call of Duty.

Apple doesn't dictate what software runs on your iPhone, any more than a toaster manufacturer dictates whether you can use it as a space heater, or Toyota dictating whether your car can function as a boat, or Epic Games dictating whether Fortnite can be used to prepare your taxes.

It's true that Apple doesn't make the process of running your own software easy, but you are legally entitled to break whatever barriers you like and replace the OS with a Linux distro. Have at it. It's great. I support it. And if you want legislation that requires hardware manufacturers to provide documented paths for installing alternative operating system software, I'd support that legislation eight days a week.

> Then don't buy an iPhone

Then don't enable side loading.

And what Apple is doing is actually not perfectly legal. That's the entire reason they're changing their policies. It's not like they enjoy having to compete with app stores that offer other payment providers or allow things like emulators.

I know how to not enable side-loading. There are a dozen friends and family members who I provide tech support to and I don't trust any of them to never follow the clearly written instructions which Epic will provide showing how to sideload Fortnite onto their phone.

Sure, maybe Epic can be trusted. But perhaps Meta decides that the latest/most desirable versions of Facebook, Instagram and WhatsApp have to be side-loaded. Now it's commonplace. Now everyone's phone has sideloaded apps installed.

Sure, maybe Meta can be trusted. But perhaps some new future TikTok-esque craze besets the mainstream, and it's in the form of a sideloaded app, made easy because sideloaded apps aren't unusual, and the company who makes this viral app is dodgy as f***.

But sure, it's always the user's choice.

It's not "the government saving us from our own choices".

It's us asking our democratically elected government to stop a giant corporation from telling us what to do with our own devices.

I like how you say that as though I hadn't already considered that point. Would it be too much to ask to perhaps give me the benefit of the doubt that I'm already aware of all of the major arguments for why Apple should allow sideloading?

Yes it's your device, but it's not your software. You don't own the software. And it's the software which is stopping you from doing what you want.

Really though I'm just saying that I resent arguments that fail to provide anything resembling a modicum of consistency around this. As far as I'm concerned, as long as Sony is allowed to keep the PlayStation locked down, Apple should have equal right to keep the iPhone locked down. And if you, the consumer, doesn't like it, don't buy a PlayStation. I realise this comes across as a trite, throwaway thing to say, but I absolutely mean it. It is, in my opinion, a slam dunk argument.

I think if you own the device, you do own the software, or framed the opposite way, if you don't own the software, you don't own the device

What you're proposing is not really ownership of the device in any meaningful way, but just a license to use it on somebody else's terms.

I don't want a world in which I don't own the device I pay for, so neither Sony nor Apple should be able to dictate what I do with them.

It's like selling you a screwdriver and then saying you can only use it with one specific brand of screw.

It's really nothing like your terrible analogy. Bad analogies are bad.

Ownership of software is clear-cut under the law: unless you hold the copyright, it's not yours. You have been granted permission to use the software under the restricted terms of a license. In practice though, the legal perspective isn't a useful one. It's another bad analogy, useful only because it's the one backed by law. What actually matters is what you can do.

It doesn't matter who "owns" it, you don't have the code needed to recompile the OS from source. Much less than sideloading apps, there are thousands of nominally trivial aspects of the OS which you cannot change without source code and a working build environment. Without this you don't have any ownership over the software in any useful sense.

You do own your piece of physical iPhone hardware, and it's yours to muck about with as much as you wish. But don't expect schematics or the ability to manufacture your own parts, or the ability to sideload more processing cores into the A14 chip, or replace the camera with a different module.

> As far as I'm concerned, as long as Sony is allowed to keep the PlayStation locked down.

I'm sure that now that the EU has finally woken up, gaming platforms will be under scrunity too. Mobile phones are a much more critical part of people's lives than game consoles, so it made sense to target them first.

I'm really not sure, because as much as the Hacker News crowd wants to believe otherwise, the entities exerting political pressure on Apple aren't doing so for the reasons you care about. It may result in an outcome you favour, but that's just a coincidence.

> As much as you and I don’t like it, what Apple is doing is perfectly legal.

Well, not in EU now

> I think it’s ridiculous that we are asking the government to save us from our own choices.

So you think it's better asking companies to save us from our own choices? And that doesn't strike you as even more ridiculous?

I think it's ridiculous that you think it sounds ridiculous. If people actually cared about this stuff, there would be a massive market opportunity for a competitor to make a product that satisfied people's demands. But they don't, so there isn't.

Most of the noise in the community is from people who just enjoy seeing Apple squirm and probably aren't even an Apple customer anyway. Meanwhile the entities spending real money to lobby governments on this issue actually only care about getting around Apple's increasingly consumer-protecting app review process — they tolerated the 30% fee right up until the very same month that Apple started forcing developers to inform users if they were tracking users between apps.

They want side-loading so they can track you, not so they can extract more money from you. Because they know they won't. Yes, entities like Epic might be able to sell apps with a lower marginal cost (not a lot lower, as they'll be handling stuff like fraud and refunds themselves, and Apple is still entitled to a software license fee) but the simple act of requiring consumers to enter their credit card number into an app is going to reduce transaction completion rates. I'd be willing to bet by at least 30%.

And how exactly the AppStore prevents it? By using the OSs sandbox, which will apply the exact same way to user installed programs — you won’t suddenly run as root.

AppStore checking is waaay overhyped as anything meaningful.

We should probably get rid of Safari / web browsers too in that case!

I used to think that way, but then I realized the Android/iOS stores are absolute cesspools. I would not trust young kids on there either.

Others are right, sandboxing is the real saving grace (and only if apps dont ask for a bajillion permissions which users will just click through so it will work). Apple is slowly trying to isolate apps even more, like they were in the early iOS days.

> Regular users don‘t need to install software on their own anymore, the same as they don‘t need to put processors, storage and Monitors together or install a sound card.

Uhuh, sure.

"Shut your mouth, pay and be happy"

But it's an user choice! Same happens on Android. There is a settings that you have to enable to install applications from other sources.

This is pure nonsense... giving user more choices is never a bad thing.

From a personal-computer-user point of view, installing an app from any source is normal.

For pre-iPhone cellphone users, your cellphone network operator controlled access to what apps were available for installation. This is was the most common, if not the only, method for cellphone app distribution. App makers (mostly java games) paid to get on that first page of downloadable apps. I'd add some references but Google seems to have amnesia about anything cellphone app distribution pre-iPhone.

Apple didn't have an app store initially. How Apple convinced cellphone network operators to cede app approval/control, I don't know. Perhaps it was "apple's way - take it or leave it".

Personal computers really are the exception which proves the rule. Whether it’s the software in your TV, your pre-smart phone, your car, or your game console, locked down has always been the norm.

The pc predates all of your examples, so I don't think it makes sense to say "has always been the norm". Has _become_ the norm, perhaps, but thats the entire point. It's not great that it has.

Being first doesn't make an example the most canonical.

It was the most common, but not the only method. You could (at least on Nokia phones) go to any wap site and download a .jad/.jar straight to your phone. I did that a lot on my series 30 (3510i).

I think other manufacturers allowed that as well, but I could only use the "free wap browsing trick" on Nokia phones, so I never explored that.

On most pre-iPhone cellphones you could install any .jar file, but there were 2 challenges:

Finding a .jar file that works on your phone was the biggest. Games often only supported a single screen resolution and so there were multiple .jar files for each game and you had to find the right one for your phone. Also sometimes even if you had the right screen resolution the .jar just crashed when you started it without any clue as to what's wrong (probably they needed more RAM or some platform specific code, but I was in high school back then so I didn't know much more about it)

In the early days, there was also the issue of how to get that .jar file to your phone. I distinctly remember old Nokia phones could download them through WAP (which was paid) or receive them through IrDA/Bluetooth, but themselves couldn't send applications through IrDA/Bluetooth (I think Sony Ericssons were the ones which could also send them....), This issue was later solved by microSD cards and USB cable transfers from PC.

I've never had much trouble finding compatible JAR/JAD files from legitimate sources. Usually, either your phone's model was auto detected to serve a compatible file, or you could select an appropriate version for apps that had resolution limitations.

Pirated JAR/JAD files were definitely hit and miss, but I don't think those are a great example.

Pre-iPhone phones, for example Nokia phones with Symbian on it, did allow you to install applications. I remember when I was in middle school with a Nokia N70 exchanging games with Bluetooth with my friends. Who had internet at home (that was only a bunch of people) did download games from forums and then send to everyone else, as well as music and videos. Same for other models of cellphones, they all had some sort of application format.

Then the first Android devices arrived, with the Android Market (long before Google Play) that did allow you to download apps. But most people again maybe they didn't have internet, or more simply wanted pay apps but didn't want to pay for them, just exchanged .apk like it was the norm. (Pirating by the way was much more present than these days, for example I don't recall a single person having a PlayStation without the modchip, and burned PS1/PS2 games where the norm).

It's only with the arrival of the iPhone that this was no longer possible. In fact I recall that the criticism of the first iPhones, till the iPhone 4, was that it was an overpriced device and that it did lack of the possibility to install applications and exchange files with bluetooth, like everyone was used to do. The iPhone was a niche product that was not diffused (when I was at high school I recall maybe 1/2 people having iPhones, all other one Android devices).

The thing on cellphone operators is maybe an US specific thing, I don't recall having anything like that in Europe, more specifically in Italy. Quite frankly till 10 years ago using the cellphone network for internet was unthinkable, because the prices where so high. Then arrived the contract that give you 100Gb of data a month for 10 euros, but back in the day internet was expensive, to the fact that just by pressing the internet button on a phone it did consume all your credit. This is probably also the reason why WhatsApp become so popular (you could chat with your home internet connection that now everyone had without consuming expensive SMS)

That is a good way of looking at it. What's missing is a catchy name to debase store-based installation similar to what was done through "sideloading". Perhaps "lord-loading", "begstalling", "babybiting", etc.

Apple-blessed install

Even on Windows if I send an EXE or MSI of my software to someone they get a scary security warning that prevents them from running it. The only guaranteed way around that is to be a big company (or a big open-source project).

If security really mattered, every OS would run applications in a proper sandbox, but why bother with that when you can just point your Web browser at a program running on someone else's server? Oh, but consent to these tracking cookies first.

they get a scary security warning that prevents them from running it.

The huge difference is that's only a warning, and not a cryptographically locked-down system unlike Apple's.

Call me paranoid, but I see it as a slippery slope. And for most users that security warning is as good as a cryptographic lockdown anyways.

They are certainly boiling the frog slowly.

And for most users that security warning is as good as a cryptographic lockdown anyways.

On the other hand, I find it ironic how a lot of "security professionals" will complain constantly about users accepting security warnings with no thought anyway (and they usually use this argument to justify their increasingly authoritarian measures of controlling them.)

It can be simultaneously true that a warning can be a barrier to adoption of your software product versus a competitor, and that a warning is not an effective barrier for a user who thinks they're installing an unreleased video game or going to receive millions of dollars of crypto from foreign royalty.

Actually, in a way, it is. All Microsoft has to do is revoke your application's signing certificate and Windows Defender will prevent it from running on Windows computers.

Apple does the same thing with Notarization and Gatekeeper on macOS. If they choose to revoke your signing certificate, Gatekeeper will prevent your software from running on macOS.

That means if you do, say or compete with something that Microsoft or Apple doesn't like, they can prevent your apps from running on their platforms.

How come I can run so much software compiled from source then?

I don't know what platform you're using, what app distribution method you used, where the code was compiled, if the code was signed, where it was signed and by who, etc.

A generic answer to your question is that the software was signed by whoever compiled or distributed the software, which can include your own machine. Your own key might be in your trust store or your app distribution method might put their key in your trust store. Both macOS and Windows will treat software compiled on the same system it is run on as blessed to run without strict signing checks.

On macOS, ad-hoc certificates can be used, but the OS will treat those binaries as if they're radioactive. If you compiled code on macOS, the system will treat that software specially on that specific system and allow you to run it[1]. On Windows, certificates can be added to trust stores. Chocolatey, for example, has their own signing certificate for all of the compiled open source software they have in their repositories, so Windows allows their software to run.

The biggest issue is what comes with software distribution itself, where your code isn't blessed by default by the system it was compiled on, or doesn't have signing certificates in the users' trust stores, and Gatekeeper and Windows Defender go out of their way to stop your users from running software with signing certificates they don't like.

[1] https://apple.stackexchange.com/a/426854

I compiled it myself. It’s not signed as far as I know. I didn’t disable anything…

macOS and Windows treat binaries compiled on the machine they're run on specially. Checkout out the StackOverflow link in my OP, it gives details on how binaries compiled on the same machine they're run on don't have the 'quarantine' bit set on macOS.

Likely because you've either disabled some of the overbearing security mechanisms at some point (smartscreen is a toggle and it's really frustrating if you're setting up a compiler toolchain) or you're running files that were produced on the local computer. If you disable all the privacy invading checkboxes during Windows setup (most don't), you partially neuter smartscreen as well.

Every browser I know uses the Mark of the Web to tell Windows that a file came from the internet. You'll have to store the file on a FAT32/exFAT drive to get rid of it. If a file comes from the internet, smart screen kicks in.

When a file is unsigned, smartscreen essentially prevents you from running the file. You can work around it, but I had to look up a tutorial myself.

If the file is signed, metadata will be extracted and submitted to Microsoft. If that fails or the exact binary hasn't been run on a certain amount of computers, smart screen will show a big scary warning despite your $500 a year digital signing certificate. This is something developers just have to deal with every time they update their applications, but most people won't be the first x to download the executable and applications using auto updaters download updated in the background can the necessary flags to work around smartscreen.

The restrictions are there, but they're not there for (most) development environments and for most users of popular software.

> If the file is signed, metadata will be extracted and submitted to Microsoft. If that fails or the exact binary hasn't been run on a certain amount of computers, smart screen will show a big scary warning despite your $500 a year digital signing certificate.

This is true and annoying, but only with regular certificates. The more expensive EV certificates bypass this “well known” check.

You can just turn off defender. And being specifically put in the malware list isn't the same and if clearly false could be used in court.

Stuff like this happens, and it tends to not get legal attention: https://news.ycombinator.com/item?id=27914752

I learned long ago, and keep it clearly in my mind, that what AV considers "malware" and what the user considers malware are not entirely the same.

and if clearly false could be used in court.

I do wonder if Windows becoming adware, but then the built-in antimalware detecting possible "competitors'" adware and removing it, could be challenged in court as anticompetitive behaviour.

The real issue is with software distribution.

You, personally, can turn off Windows Defender, but your users probably have no idea why the app they're trying to run doesn't work when they double click it. They're also probably shown multiple scary warnings that discourage them from using the app and trick them into thinking it's broken or malicious.

It's a hurdle just to convince users such an app isn't malware, and then it's an entirely other hurdle to help them actually run the software by bypassing Defender.

> That means if you do, say or compete with something that Microsoft or Apple doesn't like, they can prevent your apps from running on their platforms.

Are there examples of Microsoft actually doing that?

Ability to prevent known malware from being run in the majority of PCs after detection seems like a useful feature from the Internet health point of view.

Code signing and associated warnings are significantly different from fully prohibiting the execution of unapproved code, I'm not sure why people struggle with the distinction. Windows has been doing this mostly the same way for literal decades.

iOS has a full sandbox which would apply even to "side loaded" applications, which makes the arbitrary constraint even more ridiculous as a "for your own good" measure.

>If security really mattered, every OS would run applications in a proper sandbox,

these OSes were designed decades ago, before we really had a good grasp on security. there were other significant concerns as well, such as performance

also, modern OS toolkits, such as on macos and windows 11, are moving towards a permission and API model that will allow sandboxing. In fact, macos is moving quite quickly towards this.

And lastly, there is a widely deployed OS that runs all applications in a proper sandbox: chromeos

I think it's understood at this point by everyone in the industry that sandboxing is the future, but it's taking a while to get there.

> before we really had a good grasp on security

Not just that, but before we realised just how many people there would be trying to claw their way into any gap for all manner of dark purposes.

Early networked OS and protocol designers thought that people would, largely, cooperate with each other and share resources for the greater good.

I wish to live in their naively optimistic future, instead of the one with real humans :/

Fun fact: This is the reason google pivoted to the web, after being blocked as an alternative office suite on Windows.

They realized that they need to change the platform for distribution, and hence this is why the web (post-chromium) is now what it is...with all its absurd redundancies of APIs and bloat.

Only because Microsoft can't keep their shit together.

Apple is more complicated, because despite the absolute control they've established (no other browser engine / JIT compiler process allowed for whatever made up reasons) they did not face the European courts that forced Microsoft for the exact same thing to allow to install other Browsers.

And now we are stuck with Safari, repeating the loop, because Apple can't keep their shit together.

If you hate cookies you’re going to be posted when you find out what’s happening in native apps. It’s an order of magnitude worse they just don’t have to ask or inform you first

That is assuming Smartphone is a computer. Not agreeing or disagreeing, but the point is people have different interpretation. Some think it is an Appliance.

Sad that it has to come to this messy stage where the law has to be enforced. But then Apple isn't the same Steve Jobs Apple.

>Installing applications on your computer is the normal state of things.

It really wasn't. It wasn't normal to install arbitrary applications on the computers in your fridge, dishwasher, game consoles, flip phones, washing machines, etc. Platforms have varied over time in how open they are to having other people developing for them. iOS is an example of a more closed platform and has shown that closed platforms can be successful. You can see Windows as a more open platform in comparison which was also successful. How open a platform is comes with different trade offs.

The question is which of these is a general purpose computer and which isn't. IMHO if what people tend to do on a platform is the same as what they do on a PC then that platform should also be forced to be a general-purposed computer and allow (in some roundabout way) arbitrary application installation.

For example, a smartphone replaces a PC for a lot of people. I even know some people in their 20s that don't own a "normal" laptop/desktop and they do most of their general purpose computing on their phones. In the meantime, nobody uses a Nintendo Switch or their dishwasher to do a quick edit of an excel sheet or access their bank account even if they are technically capable of doing so.

What is your definition of "general purpose computer." I would disagree that PCs should allow for arbitrary application installs. Take for example chromebooks. They are one of the most secure PCs out there partly due to not allowing arbitrary apps to be installed.

But they do allow arbitrary code execution inside the Linux VM. You can also write your own extensions which is not arbitrary code but pretty close. Maybe arbitrary userland code is the correct term here.

> iOS is an example of a more closed platform and has shown that closed platforms can be successful.

It is successful despite being closed, not because of it.

Do you have any evidence backing this idea? It is reasonable to believe that the closed platform allowed for the platform to be more trust worthy making it grow faster due to more people seeing it as a platform they can trust. Or maybe an open platform would have led to mass piracy of apps meaning there is less motivation for developers to make apps.

> Do you have any evidence backing this idea?

First search in Google.

https://source.sheridancollege.ca/cgi/viewcontent.cgi?articl...

Also, from my own discussion over the years with different people, security topic popped up only when iOS fans tried to diss Android users.

This paper does not show that being closed was negative to the success of the iphone.

It does mention that "perceived security" was a factor.

Installing whatever you want on your computer is not necessarily the natural state; it’s not even how the industry started and it’s not how any other industry or devices work.

I also prefer to be able to do whatever I want with my own devices, but pretending like it’s an inalienable right, or a natural state, or has no disadvantages is disingenuous and not helpful to the debate.

Are they real downsides or just excuses cooked up by Apple to increase profits, and accepted by apple users to minimize cognitive dissonance?

The downsides are the obvious; security and privacy are better protected, malware is much harder to distribute and easier to shut down, fraud is more difficult.

You can absolutely disagree with the trade off, but pretending like it’s purely greed is obviously disingenuous.

> The downsides are the obvious; security and privacy are better protected, malware is much harder to distribute and easier to shut down, fraud is more difficult.

Is that so? https://lifehacker.com/great-now-the-apple-app-store-has-mal...

If the App Store had zero impact on the proliferation of malware, finding malware in the App Store wouldn’t be a news story in 2022. It would be well-known and expected to be teeming with just as much malware as the open Internet for the past fifteen years.

Of course it's the natural state and an inalienable right to modify or do with the things you own in the way you see fit.

When was the last time you asked the builders association if you could remodel your kitchen?

When was the last time you asked Honda if you could put new mags on your car?

This whole idea that devices aren't owned when you purchase them is asinine and and insult to humanity.

Your counter arguments that it's new in the industry is simply due to the fact they thought they could get away with it. Not because they thought it was their right.

You don't see Klein putting limits on what nails you can use with a hammer but you can bet your ass they would if they could.

the o. s. isn’t a hammer. it’s a service

i’m sure you can find an o. s. that lets you do whatever you want. but will it be updated regularly with security fixes? will it support the latest connectivity technology like 5g? will it have built in support for the latest compression formats to take high res pics and videos? will it work anywhere in the world?

if it does sure. go use it. i don’t think this exists and i’m happy to pay apple for a new phone that does this and upgrade every 5 years

Linux: am I a joke to you?

> but will it be updated regularly with security fixes? will it support the latest connectivity technology like 5g? will it have built in support for the latest compression formats to take high res pics and videos? will it work anywhere in the world?

Er. Yes? To all of those? Trivially? Heck, Android does those, with the FOSS ROMs typically doing better than the closed vendor solutions.

> Of course it's the natural state and an inalienable right to modify or do with the things you own in the way you see fit.

I agree. But that's not the same as the right to install whatever you want. It's not illegal to jailbreak a phone if you can and want to, but it's also not illegal for Apple to lock it down if they can and want to. That is and should be the default state. And it's the same for everything else, your car, washing machine, game console, etc. If you want general computers to be explicitly defined to include smartphones and uniquely regulated to force more requirements on manufacturers and more rights to users, then that's great—I agree with that—but at least admit it's a new and unique regulation and not the default state.

It's weird you chose houses and cars as your examples since they're both highly regulated in the opposite direction you’re asking for computers. You're heavily restricted to what you can modify in either of those and, as far as I know, there are no regulations that specifically require manufactures to allow users to modify anything. You can swap out parts on your car if it complies with regulations, but there's no law that you have to be able to install software; it's locked down harder than smartphones. And just like smartphones today, you do own it and can do what you want (excluding other regulations), but there’s no right to installation; it's just a lockdown/jailbreak competition between you and the manufacturer.

I’ve jailbroken my phones for years and love to do all sorts of personal modifications to my computers and other devices. I think regulations to protect device freedom are a great idea; I just want people to be intellectually honest about the debate.

> but it's also not illegal for Apple to lock it down if they can and want to.

That's the problem, it should be.

> It's weird you chose houses and cars as your examples since they're both highly regulated in the opposite direction you’re asking for computers. You're heavily restricted to what you can modify in either of those and, as far as I know, there are no regulations that specifically require manufactures to allow users to modify anything. You can swap out parts on your car if it complies with regulations, but there's no law that you have to be able to install software; it's locked down harder than smartphones. And just like smartphones today, you do own it and can do what you want (excluding other regulations), but there’s no right to installation; it's just a lockdown/jailbreak competition between you and the manufacturer.

That's what OS is for, it prohibits your from installing bomb instead of kitchen appliance. Repeat after me: Store. Does. Not. Dictate. Your. Usage. Of. Device.

> it’s not even how the industry started

Which industry? The very earliest computers ran software written by end-users.

The computer industry. Computers were devices that came with predetermined hardware and software for a long time until unbundling took over and became the de facto standard.

for a long time meaning until they were not personal computers?

of course I can't install any other software on a CAT scanner, that's the equivalent of what computers were at the beginning, they were single purpose machines, but they could be programmed by the owners almost immediately after being invented.

The computer industry started with microcomputers in the 70s, by the mid of the decade they were cheap enough that individuals could own them and write software for them.

But starting from the 60s students had the chance of sitting at a computer station and programming them to do whatever they wanted them to do, according to their at the time limited possibilities.

> I also prefer to be able to do whatever I want with my own devices, but pretending like it’s an inalienable right, or a natural state, or has no disadvantages is disingenuous and not helpful to the debate.

I own the freaking thing.

Sorry, I phrased that poorly. Actually you already can do whatever you want with it. As long as you’re not breaking other laws, you can do anything you want with your iPhone, including jailbreak it and install your own software.

What people are asking for isn’t the right to do whatever they want with their device—they already have that—they’re asking for the law to force Apple to design their OS in a certain way.

And again, maybe that law is the best idea and should be passed—there are certainly a lot of apparent advantages. But I’d ask people to be honest about what they’re asking for. It’s not granting the user any new freedoms; it’s taking away freedom from manufacturers.

It’s like copyright; most people (or at least a lot of people) consider it a good law that encourages more creative work and supports a healthy industry, but it too is a law that removes freedom rather than grants it.

You won't get the cops called on you for sideloading apps onto iPhones. You aren't "not allowed to".

Reply on news.ycombinator.com