Hacker News Reader

Comment by heavyset_go | Hacker News Reader

The App Store is a poor line of defense, because it isn't about user security, it's about securing Apple's billion dollar app distribution monopoly moneyhose. User security is just a rhetorical afterthought.

When we forgo real system safety in favor of gatekeeping corporate revenue, that isn't security. In fact, such a scheme is responsible for mass distribution of malware. Apple's App Store is responsible for distributing over half a billion copies of Xcodeghost to iPhone and iPad users[1], and that's just one piece of malware.

[1] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...

View on HN

I think you need to look at the system of incentives and alignment

If apple's billion dollar app distribution monopoly money hose results in security problems for people, then their billion dollar app distribution monopoly money hose will be in jeopardy since it's justification comes into question.

So what you see as a problem is what makes me feel the best about it. Apple is aligned with only secure apps on their store and apple is very unaligned with insecure apps.

To apple security is not just a cost center, but a pillar of the justification for their monopoly position.

It's a poor justification. You can cleanly implement a signing system for trusted developers (they've done it before), and it's obviously possible to distribute iPhone package files. All the pieces are in place, if it weren't for their $80 billion annual hayday then they wouldn't be dying on this hill in particular.

Maybe part of it is this security alignment issue, but upon scrutiny it's clearly a small and solvable piece of the puzzle. Imagine if Keurig tried using user safety to justify a 30% cut off every K-cup sold. Such an ecosystem is doomed to fail, especially at-scale and with completely arbitrary enforcement.

It sounds more like you’re upset about apples revshare model on their channel; Why do you care if all your competitors also have to pay it?

I don’t think the world got better because we got more channels on Tv, and I even think some of them might be dangerous and harmful to life…

That's fine. I'm not arguing for more channels, I just want them to let me use it for things other than the pre-approved and Apple-sponsored channels. This is akin to your TV manufacturer removing your HDMI input to force you to pay for cable.

Erm, Apple shares the cable subscription revenue with the people who make the content.

People like me.

You are literally talking about stealing my money. To me.

And this doesn’t seem strange to you?

> Why do you care if all your competitors also have to pay it?

Did you ever publish to appstore ? The amount of bullshit you have to go through so that an alternative payment method isn't reachable from mobile is insane, and they want % of a lot of things, not just sales/subscription - a lot of business ideas are unviable because of the policy.

Not to mention that your competitors don't have to pay the same, big players get special deals and exemptions, and Apple has first party advantage on the platform.

You've described literally every platform and physical store under the sun except desktop OSes.

> Did you ever publish to appstore ?

Yes.

> The amount of bullshit you have to go through so that an alternative payment method isn't reachable from mobile is insane, and they want % of a lot of things

You say insane, but you don't say why. Revenue-sharing is the best for content producers; I would definitely not want to go back to the retail model. What exactly are you trying to do?

> a lot of business ideas are unviable because of the policy.

A lot of business ideas are unviable without slavery! So what? I don't want that, and I hope you don't either! So what is it you actually want?

> Not to mention that your competitors don't have to pay the same, big players get special deals and exemptions,

I don't compete with "big players". If Apple didn't make an iPhone and I didn't make an app to put on it, I wouldn't get that money, and pretending otherwise won't make it so. The people I am competing with are in the same situation I'm in, and if they're getting success and I'm not, I think I should worry about what I can do.

> A lot of business ideas are unviable without slavery! So what? I don't want that, and I hope you don't either! So what is it you actually want?

Did you just compare freedom to choose alternative payment method to slavery? What a bizarre world, I don't know why I've even bothered to reply to your comments, lol.

> I don't compete with "big players". If Apple didn't make an iPhone and I didn't make an app to put on it, I wouldn't get that money, and pretending otherwise won't make it so. The people I am competing with are in the same situation I'm in, and if they're getting success and I'm not, I think I should worry about what I can do.

You're dictators wet dream.

"Don't care about unfair system, dig within yourself! If competitor is doing good under dictatorship it means the problem is within you!"

> Did you just compare freedom to choose alternative payment method to slavery?

Not at all. I said some businesses should not be viable and gave the simplest possible example I could think of.

And you did not agree.

Shame on you.

> You're dictators wet dream. "Don't care about unfair system, dig within yourself! If competitor is doing good under dictatorship it means the problem is within you!"

You're still not saying what you want to do and why it is good for society, just that the "dictator" is stopping you from doing it. "Alternative payments" can mean all sorts of things from money laundering to easier-to-steal, and I can't support those things.

> It sounds more like you’re upset about apples revshare model on their channel; Why do you care if all your competitors also have to pay it?

There's a Ukrainian saying

> Хрін з ним, що своя хата згоріла, головне у сусіда корова здохла

Which literally translates to "Who cares if house is burnt down, the most important is that neighbors' cow is dead" - that's you. Ever thought that maybe you and/or your comptetitor shouldn't have to pay in the first place or that shares are unfair?

> Ever thought that maybe ... shares are unfair?

No actually. I won't ever enter any other kind of business-relationship with a larger company unless they have real competition that affects price because my experience is that larger company will try to mess you up if there's any chance at short-term gain. A joint-venture is ideal protection, but with Apple my size makes that unlikely. Revenue-sharing is a fine alternative to me, and if my product becomes worth more than my share I can always renegotiate, even with a big company like Apple, because we both want the revenue to continue. That's the point.

The pure-play alternative is much harder for small companies and individuals because they need cash up-front to get into the market, but I do understand the advantages for big pockets who don't create value though -- I just don't have any intention of being a company so big that my only purpose in life is to group-together smaller companies that aren't good enough to survive on their own.

> then their billion dollar app distribution monopoly money hose will be in jeopardy

It only comes under jeopardy, if there are reasonable alternatives the Apple app store (not move to Android).

Otherwise, it's easy for Apple to say - we are now taking step x, y and z, and "trust us".

As a further separate but distinct response:

You are justifying why a monopoly app store is bad by showing a hack that resulted from downloading an app (xcode) from a source other than the app store.

  Security firm Palo Alto Networks surmised that because network speeds 
  were slower in China, developers in the country looked for local 
  copies of the Apple Xcode development environment, and encountered 
  altered versions that had been posted on domestic web sites. This 
  opened the door for the malware to be inserted into high profile apps 
  used on iOS devices.

I think you are also ignoring that apples app store position made it possible to authoritatively reach out to all who were effected as well as enact other remediation efforts.

This just shows that the App Store model is insufficient for user security, as the the security model was supposed to prevent malware from being distributed to users in the first place, no matter what malicious developers upload to the App Store. If Apple treats Xcode as App Store blessed because it believes it came from blessed sources like the App Store, instead of using real security measures, exploits will continue to be shipped to users. Similarly, if OSes don't implement real security that's independent of the App Store model, users will continue to be exploited in this way.

> I think you are also ignoring that apples app store position made it possible to authoritatively reach out to all who were effected as well as enact other remediation efforts.

Microsoft is able to do the same thing with Windows Defender without using the App Store model at all.

I can't give you a black and white response because I don't think the issue is as black and white as most seem to.

I think the app store is a tool and I think it is a powerful and useful tool. Can the tool be used for good? of course. Can it also be used for bad? most definitely. Can it be wielded poorly? yes.

I've used windows, linux, apple, and android, and I like Apple's environment the best. That environment is a consequence of apples choices. Apple limits my choices and I like that. I like having less choices. I don't want to have to think about software security, I want to think about how to spend time with my friends, and apple is a an environment that lets me think about how best to spend time with friends instead of thinking about software security.

Apple's restriction of my choices benefits me. I want apple to restrict my choices. I want there to be only one way to get apps on my device. That simplifies my life. I will pay more to have a more simple life. I will pay someone else to make better choices than I can make with my limited time. I want to do that.

If you don't like that, then don't use Apple. There is a perfectly working alternative to apple that you can use if you want to experience other choices. Apple has a monopoly on apple devices, but apple by no means has a monopoly on smart phones. I'm not sure there are even any major apps exclusive to apple. Apple is better because apple has more money to spend.

> Microsoft is able to do the same thing with Windows Defender without using the App Store model at all.

If apple scanned the apps I side-loaded and reported information about them to their servers that would upset me, that feels like a privacy violation.

Apple's bullying of companies with monopoly power to force privacy labels won me over greatly. They have a lot of good will for that. If apple continues to do things like that, I will continue to support an app store monopoly.

> Apple limits my choices and I like that. I like having less choices. I don't want to have to think about software security

How does this conflict with other users having a developer mode? Because you want Apple to have more unilateral authority over what other businesses are and aren't allowed to do?

It sounds like you have left the domain of "what's right for the market" and headed into the realm of "what I prefer". That's fine and decent anecdata, but completely useless to regulators who's job is to save the market. If Apple is stifling innovation or competition, even for a good cause, then we must codify the goodness and end the monopoly. That's progress, arbitrary corporate grudges are not.

It's an absurd argument. If you want to only install app store apps, then only install apps from the store. That's still possible you know, even if other people aren't forced to. That's why these arguments always boil down to bullshit about how you will be "forced" to use Facebook from outside the store and that would be terrible because being on Facebook on an iPhone is a human right or something.

If you like Apple telling you what to do, fine. Choose only from their menu.

If you don't like apple telling you what to do, use Android?

Apple products are the consequences of Apples decisions, you want what Apple produces but reject their decisions.

What if Apple's phone is better because it is a closed ecosystem?

Nobody is saying that. They're saying use an iPhone and then don't sideload apps. Easy!

> Microsoft is able to do the same thing with Windows Defender without using the App Store model at all.

But not for a lack of trying. Windows has tried to retrofit their App Store, just less successfully. One good example is the code signing racket, where it’s pay to play to avoid useless warnings that scare off people who don’t know better.

Look, you can somewhat reasonably prove the origin of a piece of software, but a domain name x509 cert would be better (only difference is validity needs to handle longer time ranges). The issue is all the “trusted” yadda yadda. Doesn’t matter if it’s an App Store, a holy enterprise certificate trafficker or the pope himself doing the blessing, it just doesn’t hold up. Maybe they could have a herd-protection like VSCode extensions: “50M+ users” so when I see an executable called “Facebook” with “35 users” I can stop and make my own judgment that it looks fishy. But that’s about UX for checking the vendor matches who you think it is, not blessing it.

> Similarly, if OSes don't implement real security that's independent of the App Store model, users will continue to be exploited in this way.

Spot on! Here’s the thing: sandboxing software on any of the big operating systems wasn’t there from the beginning, and that’s the billion dollar mistake. Sandboxing is the only real game changer in end-user security with iPhone/android over desktop, not the monopolistic app stores. Tbf, Apple at least has tried really hard to bring sandboxing to desktop but even they are not there yet. These mega corps should imo have seen it coming a decade earlier, when the web became vastly popular platform, much thanks to sandboxing.

Reply on news.ycombinator.com