Isn't it the other way around?
Allowing side loading on iOS doesn't seem like it would impact anyone that doesn't side load. (?)
Allowing side loading on iOS doesn't seem like it would impact anyone that doesn't side load. (?)
"Want the Facebook app? Follow these three easy steps to sideload our app." -> Now the rest of the iOS users lose the nice payment rails that Apple setup which result in higher privacy and lower fraud.
"Want to play Fortnite or any other Epic game? Get it in 3 simple steps."
It seems that companies don't want to risk users not install their apps because the installation is complicated.
If there is really a fear of this, make it so you can only sideload apps if the development mode is enabled, which requires a few steps.
This alone would it make it so most users won't use it for e.g. facebook, instagramm.
1. Epic. 2. Unlike Google, Apple each year pours thousands of hours of developer effort into making it harder for Facebook to track users without their consent. The difference between "what is allowed in the store" and "what is possible on the device" is greater on iOS.
I do think that it is a rare case that a company decides to not use the official appstore and the risk of all companies switching to their own appstore is minor.
Android does restrict more and more things you can do and there seems to be no strong movement to alternative appstores, which makes it difficult to know what impact the strong privacy settings on ios would be with an alternative appstore.
I kind of agree that less privacy protection this is a concern, but I think that should be solved by additional privacy laws.
The claim wasn't that nobody was sideloading for privacy settings. The claim was "Facebook doesn't use sideloading on the android platform, neither does any of the other big companies."
>I kind of agree that less privacy protection this is a concern, but I think that should be solved by additional privacy laws.
Oh, that's a great idea. We should definitely rely on laws alone for this. VC-backed technology firms are well-known for willingly abiding by the spirit of laws—especially privacy laws. They definitely aren't filled with people whose entire job is finding the slimist things they can get away with.
Or—and I'm just spitballing here—we could have both the additional privacy laws and also a competitive marketplace where at least one vendor decides to use privacy as a market differentiator while leaving people free to choose to buy from other vendors with other priorities.
You should have multiple options, but third parties should not be required to provide you with an option that gives you 100% of what you'd like to have.
"I get to choose" does not mean "I get to have a bespoke solution."
That's an interesting point. I wonder what other levers Apple would then adjust to keep them in? Maybe lower the Apple tax a bit, maybe something else. Probably a few possibilities that we haven't thought of too. :)
If I had a well designed bank vault I still wouldn't want would-be burglars unrestricted access to probe the lock design which could then be used to exploit other vaults of the same design. In this model, I would put a cage or bars or say, a walled garden around the lock mechanism to prevent unwanted hacking or characterization.
Yeah, I'm not aware of any good way to counter that kind of fear unless Apple wants to do so.
Unfortunately, countering that fear is 100% the opposite of what Apple want, so they're likely going to try and amplify it to the maximum extent instead.
That's actually a good thing.
Security by obscurity has been debunked for decades. This is not an acceptable argument for anyone who actually cares about security.
Information about nuclear weapons are kept obscure and I'm pretty sure the US government cares about security.
Defense in depth is a thing.
I can purchase an iPhone and a developer account and find the same exploits I could if sideloading was enabled. The "obscurity" doesn't exist to begin with.
Obscurity DID exist - you said yourself that you have to get a developer account. That's a barrier to entry, which is defense in depth. Dev accounts are a tiny proportion of iOS users.
Also, if alternate app stores were permitted, any exploits discovered via sideload could be deployed at scale. By not having alternate app stores the risk is reduced.
As well, assuming no alternate app stores exist and you managed to deploy your 0-day in an app on the original App store, Apple could discover it and have the means to remove the app quickly to mitigate damage. If alternate app stores existed, it adds additional red tape to get the exploit app removed and potentially allowing more damage to occur.
Defense in depth matters.
Maybe script kiddies wouldn't, but they're not the kind of thing to be worried about anyway.