Hacker News Reader

Comment by ryandrake | Hacker News Reader

I’m all for the “fake data” idea, but also: Apps should be required to gracefully handle the cases where users deny permission to access real data. I know last time I developed for iOS, it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission. Apps must gracefully handle it and continue running.

Also, and this was even longer ago, apps could not require users to have “an account” in order to run. I remember (this was over a decade ago) my company making a product change that forced users to have an account in order to function and we got (rightfully) rejected by the AppStore for this. It seems they must have softened this stance because I am seeing more and more apps that require an account to function.

View on HN

> apps could not require users to have “an account” in order to run

There is some big qualification missing or I don't understand what does that even mean. How could a banking app run without an account? An online game? The Twitter app nowadays? Dropbox/Nextcloud/...? Etc.

Yeah, I agree that for a lot of apps, requiring a account is just a marketing gimmick, but I don't think such a general rule could work.

Good question! We actually asked Apple exactly this when appealing the AppStore de-listing. How come others can require an account and we can't? What was it about our app that made us have to spend the engineering effort to add a guest login (this was a disingenuous argument that I advised against, since we deliberately spent engineering effort to require the login)?

Their response, not the exact wording since it was over a decade ago, was along the lines of: "1. We're reviewing your app, not theirs, so what they can do is irrelevant. 2. Your app core use case clearly functions without an account as evidenced by the previous versions having full functionality not requiring an account."

1. Is a standard Apple reply when you compare your app's treatment to others'. Everyone gets this when they bring another developer's app into the argument.

2. Called our bluff and is pretty hard to argue against unless we changed something core to our backend such that it now requires an account. Even if that was the case, I would expect Apple's response to be "change it back".

Throughout the whole exchange with Apple, I had to be Devil's Advocate, since I advised against the change to require an account from the start, being apparently the only person in the company who had actually read the AppStore guidelines. Nobody listened to me, of course.

> Nobody listened to me, of course.

Being the voice of "this is never, ever going to be accepted into the AppStore, it is a perfect example of what you can't do" can be a very lonely journey.

as long as you aren't the person who will ultimately pay for said failure, it doesn't matter if nobody listened to you. You just need the cover-your-ass evidence that you presented this evidence to the stakeholder (who is ultimately responsible for said failure).

Apple used COMMON SENSE? That's incredible. Google would never do that

Keep in mind GP mentioned this was over a decade ago. Common sense is way less likely to exist at scale.

One time Apple asked us why we needed bluetooth permission for an app that had the singular purpose of using bluetooth "iBeacons".

> We're reviewing your app, not theirs, so what they can do is irrelevant

rules for thee but not for me

Apple has never been fair with its review, sadly.

> I would expect Apple's response to be "change it back".

Companies should not have to bend over to apple's whims just to get their software in end user hands. Hopefully upcoming EU regulation will reign apple's overreach in a bit.

> rules for thee but not for me

"not for me" isn't what's happening in a comparison between two third party apps.

> Companies should not have to bend over to apple's whims just to get their software in end user hands. Hopefully upcoming EU regulation will reign apple's overreach in a bit.

Maybe in general, but I think a rule against requiring unnecessary accounts is a good rule. The EU should consider making that a regulation.

You’re celebrating the possibility that EU regulation will remove Apple’s ability to enforce good user experience?

Yes. Of course. Apple do not enforce anything like a good user experience. They enforce a good Apple experience.

Apple doesn't get to dictate what constitutes a good user experience. Especially for me - that is my prerogative and mine alone.

So yes, I will be extremely happy with it. This opens doors to all kinds of software that can compete with one another, and if I don't like it, I can simply uninstall it myself.

Just one more bit of anecdotal evidence to support your view.

Our app was rejected after review until we updated an external support doc to which the app linked. The doc contained system requirements for both iOS and Android devices, and we were specifically rejected for even having mentioned the competing operating system.

  > The doc contained system requirements for both iOS and Android devices, and we were specifically rejected for even having mentioned the competing operating system.

same, for us we just open all links in safari now, so if mentions of android show up its not "in the app"... an arguably worsened user experience for no good reason except to keep apple happy

If open doors did a better job of UX than apple, then you would have been using Android instead of iOS in the first place

You're confusing first party apps with third party apps. Also you're forgetting that this is a forum which is heavily biased to developers. I use Android because my phone isn't a fashion piece. Some of my users sadly use iOS. They want the software on the devices they purchased and own, but Apple is preventing us from delivering this to them unless we do exactly as Apple commands.

So in the end everyone loses, except Apple.

Let me push back against that a bit.

My phone is not a fashion piece. AFAICT the blue bubbles will show up with an old 4S just as well as with a 14 Pro Max.

I have an iPhone - which I got after many years with Android - because iMessage is an essential app for me. I live in the US, so my business partners do not have [choice of alternative messaging app] installed and they are not going to install it just for me. I'm a doctor working in a hospital that has two complete dead spots for cell reception, and whose IT department blocks WiFi calling. So I can't make phone calls on either service, and only on iOS can I get messages that are really, really important over the hospital WiFi.

I could talk until I was blue in the face about how other methods are better. Or how Apple is being a gigantic bunch of assholes by not using something other than vanilla SMS if you're not an iMessage user. But it's sitting at about 30:1, and you can either go along and be aware of important things going on, or you can be left out.

When business decisions are being made over those conversations, I'd be a fool to ignore it. I don't much like the iOS way, having gotten used to Android and LineageOS, but after my experience with the Nexus 6P that suffered the infamous "battery goes to shit overnight one day" problem that Google wouldn't fix, as well as being dropped from updates after two years, five years of security updates from model introduction sounded pretty nice.

> Or how Apple is being a gigantic bunch of assholes by not using something other than vanilla SMS if you're not an iMessage user.

What alternative would you suggest? And is that alternative as universal as SMS?

I'm a doctor, not a phone technologist!

But on Android, you can replace the default messaging app, and that app can have access to SMS as a fallback, so it's really easy to convince people to switch. "Hey, uh, plain messaging is annoying some of us, please install this app, we can all use it, but it will work even with people who don't have it over the regular text service."

Can't do that on iOS.

RCS

It's still getting rolled out a lot of places. Google sees it as the successor to SMS and it's built into native messaging apps. I recently saw cross-carrier support get enabled locally and that made it universal enough that so far anyone I message that's running Android is already connected via RCS.

Apple intentionally doesn't support RCS in order to keep imessages from interoperating with android.

a system that can deliver messages through SMS or wifi is better, especially one that was a protocol, not a product, and would allow multiple platforms to access

You’re being downvoted (clearly by multiple people) for having a valid opposing opinion in a subjective debate. Hate to see that kind of behavior on HN. Upvoted you to balance it out.

This is why upvote/downvote systems are trash.

Sure, they keep some actually bad opinions out, but they also keep correct but unpopular opinions out.

The Sun revolves around the Earth! Downvote Galileo!

Is the user experience on Mac bad? Macs let you install non-store apps, and somehow it works out fine.

No one is forcing you to install anything you don't want to. The only thing I want is having the ability to install anything I want to. If you don't want to install those things the solution is simple: Don't. You don't need Apple to make that decision for you.

While I wish I lived in a world of perfect competition, I also realize that I don't. System-wide rules against bad behavior are a lot more efficient.

> You don't need Apple to make that decision for you.

I also don't need an app making the decision of whether I need an account. Apple preserves that choice for users. And they're not making any decisions for the user about installing. Effectively zero apps will leave the store over this rule, so the user retains full choice over installing.

> System-wide rules against bad behavior are a lot more efficient.

I don't want Apple making many system-wide rules on behavior, even on Apple's own systems (which they share with their users.)

That being said, they're very right about this. Making the distinction between, on one side, apps that are useless without accounts (like banking apps) or apps that are made to help with already existing accounts, and on the other side apps that are just forcing accounts to capture and control the users, is a smart and thoughtful move.

Or (1) is: it’s impossible to create codified rules that have no false negatives and no false positives and we’re smart enough not to act like it’s possible.

You know, this is how almost every rule system on the planet operates. Ultimately there’s an arbiter whose job is to look at the totality of the case.

This has a nice demonstration at the following link (which was on hn recently):

https://novehiclesinthepark.com/

A better response would be: "Thank you for making us aware, we will revisit their evaluation or update the guidelines" (and then they would actually do so)

This isn't what's happening though. If you're a big app you get to do whatever you want, and if you're small then you have to do as you're told.

That would not be a better solution because it would entail either “solid” rules that are actually always fluctuating and/or people having prior assessments overturned after the fact.

As opposed to… humans working through a specific situation for a specific solution?

It would at least strive for equality, instead of letting the big boys do whatever the hell they want while punishing everyone else (and making it impossible to compete).

There's also the ethical concern about how apple (or their reviewer) can bully you specifically which means there is no other way to delivery our software to your users, other than complying with a bully.

The point isn’t to strive for equality, it’s to curate a healthy ecosystem.

Sure, the world is rife with ethical concerns.

If you were protesting a speeding ticket, I suspect the defense of “the guy next to me was going even faster” wouldn’t go very well.

Perhaps the standard should be, "If you are required to have an account to use this service, on or off the app, then you can require it on the app."

For context that would mean that to browse a site like Hacker News, you couldn't require an account, but to post you could. It covers things like Banks or Steam, etc.

Would that be workable?

That seems like a great policy to me. I bought a guitar tuner app in the past and that's exactly and all it did: act as a tuner. But it then got acquired by a company that sells guitar lessons and other things, and they completely f-ed up the app and it requires an account and a subscription now if you want to tune your guitar. Fortunately there are other options in the Play Store, but I paid like $15 or $20 for it at some point. This tempts me at a side comment about why I hate automatic updates, but I'll refrain. Luckily it was Android so I was able to backup the APK before they ruined the app, and I sideload it now. Along with old Pocket Casts, Audible, and a couple of others.

I only go to F-droid for these utility apps.

Guitar tuners, flashlights, QR scanners, etc. Open source hobby-sized projects which are done when they're done.

This is a terrific strategy! I'm going to do exactly this. Thanks for sharing.

Cythara on f-droid for guitar tuning!

Was that DaTuner? I got really annoyed by that too.

    > How could a banking app run without an account?

I use two banking apps that have a FAQ feature that's just a fancy wrapper for their respective online knowledge bases.

It's only due to laziness on their part that the entire app needs a login. Even if the only thing I'd like to do is browse the knowledge base.

Similarly, you shouldn't need to be logged in to queue up an arbitrary number of transactions. To execute them sure, but every banking app I've tried makes you login from the outset for no discernible reason.

How do you nominate which account to 'queue' up those transactions against? And what benefit does not logging in have when you have to login anyway to do actually do something? I'd rather everything be kept (relatively) secret and secure

For example, Gaia Maps. It's just a navigation app using publicly funded USGS or crowd sourced base maps, but by switching over to a user account requirement, they can con people into paying a monthly subscription for map "updates".

If you're going to rip people off with "software as a service" then you need to require an account.

Just because maps are based on public data doesn't mean that making them doesn't cost money.

There are many exceptions to the rule with Apple's policies. I knew a few app developers that could skirt many of the official rules, because they had friends that worked for Apple.

They’re lying to you then, because “friends that work for Apple” have no say in the App review process.

I cannot wait for the DMA to take effect early next year so I can install ANY other app store.

You are not creative enough. A banking app can run without an account by showing you interest rates for deposits and mortgages, and show you a map of their branch locations. An online game can run without an account by showing you a tutorial and videos of other people playing the game. The Twitter app should show you tweets without an account.

Many online games do not require an account. Ones that do not store things like level progression or inventory between play sessions.

You need an account for WoW, but not Unreal Tournament, to use 90's examples.

> it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission.

Meanwhile, WhatsApp still "punishes" users for denying contacts access by hiding everyone's names (only the phone numbers are shown), including for contacts that have their own names set in their own profiles.

Facebook^W Meta is scum.

> Meanwhile, WhatsApp still "punishes" users for denying contacts access by hiding everyone's names

Huh, had no idea that's why I only see numbers.

If I do allow contacts, does it show the name from contacts, rather than whatever display name they chose?

If so then I guess that's kind of a "technically we need contacts to display names, which are resolved locally" deal. But Apple could push back "you're big enough to plumb a display name through, not just resolve locally, and deal with spam implications" if they wanted to take a hard stand.

Worse, you can't even initiate conversations; if you've denied contacts access, the other user has to message you first.

At least for me on Android, which is wild.

The iOS shows a phone number input if you try to initiate a chat and have contacts permissions disabled. I'm not sure whether that's because it's to comply with app store regulations, or the product owners on both sides prioritizing different things. On both platforms you can still initiate chats without contacts access by using the wa.me domain, eg. wa.me/12125551234 for +1 (212) 555 1234.

Alternatively on Android, the app "Click to chat" is a tiny utility that directly opens up a WhatsApp chat with any given number:

https://play.google.com/store/apps/details?id=com.trianguloy...

The fact that this is necessary is wild.

Sometimes I need to contact somebody on Whatsapp one time or such, and I don't want to save their contact. But Whatsapp on Android shows only my own contacts to initiate chat. Like you said, wa.me is a way. I made this quick page for exactly this:

http://spa.bydav.in/num2wa.html

That's not true for me on iOS. I denied it access to my contacts, and I can still start a new conversation by entering a recipient's phone number.

https://wa.me/+theirnumber

WhatsApp has always done this (to my knowledge). Phone numbers -> name resolution is done using your contact list. At least last time I checked.

Usernames are not given much weight in the UI--there's no guarantee that my username reflects who I really am. Feels rightly more suspicious IMO to see a message from an unknown number than from "~Elon Musk".

I believe this happens regardless of whether the app has contact permissions or not.

The Whatsapp app could easily let you assign your own locally saved aliases to those phone numbers, when you're not sharing your address book. "Frankie" is a more usable moniker to me than "+12822745113". They could give us that ability in an afternoon. But they just won't. Because they want your address book. ALL OF IT.

I wish there were some kind of "modern tech" technical review panel on board in, say, EU and US regulatory institutions. Not to impose or forbid certain changes, but to curate an evilness score. Publicly.

And then if a monopolistic company consistently enshittifies things, when the time comes to apply a penalty (for some anti-competitive legal reason), the regulators will apply the reputation ("evilness") score as a multiplier (or divider, if you will) on the sum of the fine.

Evilness can't be measured and expressed fully objectively. So citizens should be able to override a reputation score mutation (remember, they're public) through a referendum.

An advantage of this approach would be that it could increase citizen awareness that things don't have to be this shitty. I'm occasionally amazed by how friends and colleagues put up with being pushed around by their OSes, their apps, their phones, sometimes to the point that cognitive dissonance makes them into apostate apologists.

> Phone numbers -> name resolution is done using your contact list. At least last time I checked.

Nope. With contacts permission granted, unknown numbers turn into ~names (per user's own profile) automatically. When you revoke the permission, the ~name is hidden to punish you.

> [...] there's no guarantee that my username reflects who I really am. Feels rightly more suspicious IMO to see a message from an unknown number than from "~Elon Musk".

It's an entirely separate problem, and as old as mail itself (which predates computers by many millenia). Would you know whether to trust elonmusk@twitter.io, without looking it up?

> Would you know whether to trust elonmusk@twitter.io, without looking it up?

I would hate to dismiss someone for a troll only to realize they are not the real elon musk

I discovered the other day that WhatsApp (on Android at least) will not let you start a conversation with someone without selecting them from your contacts.

I don't mind fake personal data, like contacts or photos, but once you get into locations I'm iffy.

If it's being used locally for showing your location on a map, or searching for nearby businesses, sure, give it fake data.

But if you're talking about an app that does internet speed tests and maps the speeds for different cellular providers, or lets users report local weather conditions to improve forecasts, then I have no problem with those apps being able to say "Either give us an accurate location, or give us no location, we don't want your fake location."

The platforms would have to be an adjudicator of which apps get an exemption for users contributing back data that will affect other people rather than just influencing their own browsing experience.

I think Apple has come up with some good middle grounds on this, you don't have to grant an app "precise location," and you can grant photo access via a system provided image picker that only shows the app photos that you've selected.

True freedom is freedom to do things that others might not like.

Like the freedom to operate a service that only accepts real location data?

As long as I have freedom and means to feed it fake data as real data :)

Worst offender is google photos on iOS - you can’t even open the app without giving it all photos access. Selected photos doesn’t count. Even just to view photos already saved in the cloud.

Discussed recently on ATP[1] - this is a huge security hole. If you give access to all photos, apparently the app can search through the EXIF data to extract locations and timestamps, and build up a very accurate timeline of your whereabouts.

1: https://atp.fm/542

Is it though?

If you want Google Photos to back up your photo library… it needs full access to everything to do that.

Very very few apps should need full photo access. But photo backups/cloud libraries are the one I can think of that do.

I was actually surprised no one on ATP brought that up.

Ok but what if you don’t want to use Google Photos for that?

Genuine question: what else does it do? I thought that was all it was for.

Answered upthread:

> view photos already saved in the cloud

I wish Apple stripped sensitive metadata from photos by default when interacting with third party apps/sites. The few services that actually need this data could request an additional permission.

As an app developer I don’t want users to send me location metadata with their photos, but there’s no easy way to communicate this to non-technical users.

That's incorrect, I just tried it on iOS.

When you open it, it defaults to the "Photos" tab which has a message (not a dialog) asking for all photos access. But if you switch to any other tab (like Search or Library) you've got access to all of your photos in the cloud.

On the one hand you wouldn't realize that if you never tried tapping another tab. But on the other hand, the main "Photos" tab is designed to access all of your local photos and show whether or not they're backed up. Most (although not all) people are probably using Google Photos for this (to save local photos to the cloud), so it at least makes some sense for it to be the main tab with a prominent request.

Those tabs are new as of a few months ago.

Here's a screenshot [1] showing how the permissions prompt originally blocked you from navigating to the other tabs, and some additional reports of the issue [2] [3]. What's worse is that very old versions of the app worked fine in view-only mode without these invasive permissions demands, but then Google decided to update the app to be completely useless unless you surrendered all your photos.

I'm surprised Apple allowed the app on their store for over a year, with what appeared to be a clear violation of their policies.

[1] https://imgur.com/a/l2sErQQ

[2] https://support.google.com/photos/thread/1939628/use-ios-goo...

[3] https://old.reddit.com/r/googlephotos/comments/rhoyb1/google...

This shouldn't have even been possible. iOS should have never given apps a way to tell whether they've been denied permissions to any photos. From their perspective, it should just look like you don't have any photos if you deny them all.

Just checked and it appears they’ve fixed this. For years it would occupy the entire screen and not permit accessing any other tabs. (You can find threads from last year discussing this).

However they still don’t offer a way to upload specific photos, and if you attempt to share only selected photos in the ios settings app they detect that this isn’t all photos.

It’s partially correct. I installed the Google Photos app with the intention of sharing some photos from my phone to a shared album. As far as I can tell, it is not possible to give Google Photos access to a limited selection of photos. The app just tells you to go back and give access to all photos.

You can access all your cloud photos without granting access to any local photos -- that was the main point.

Yes you're correct that there's no way to give access to only selected local photos, but that permission also doesn't really make sense for the app. Its main purpose is to back up all of your photos automatically.

If you want to upload individual photos just do it directly from photos.google.com. It's a single click. There's no reason to install the app at all.

Almost as bad is the FLIR app. You have to give it permission to view all photos, or else it won't let you save a photo. iOS specifically has an API that allows saving photos without photo access.

Seems weird that an app needs to be able to tell if it got access to all or just some photos

Agreed, so obnoxious, especially since as you say the OS has a “select some photos” permission setting that they should be able to play nice with.

> Apps should be required to gracefully handle the cases where users deny permission to access real data

Or else? You're suggesting an organizational solution to a technical problem. This can't possibly work. Fake data is the only practical solution to this, such that the app would see the permission as granted when it is not actually granted.

I don't think those things are mutually exclusive— lots of policies are affected by technical requirements and lots of technical design and development is affected by policy. CAN-SPAM did a great job of keeping legal businesses with aggressive marketing (within the reach of American law) from trapping people in email subscriptions, and technology has done a great job of tamping down the rest. Neither is perfect but they're both effective at the level they need to be. If a software company requires signing in without needing it for their core service, or requires you to link a social media account even though it's entirely unnecessary (e.g. Kinja,) I'd argue that those are more policy than technical, and a technical solution would probably struggle with them.

And sure, what's "necessary" for the app is nebulous, but the law has tests for differentiating between two nebulous states. Even a policy that had way too much grey area, like fair use, would still protect users more than "app developers can do whatever they want as long as it's in the privacy policy."

The technical solution is to make the output of having denied permission identical to the output of there being no data. On iOS, if you deny permission to access devices on the local network, the app has no way of knowing - it just sees that there are no devices available.

> being no data

"but sure you have photos on your phone, if your phone tells me there aren't any then it's lying"

Yeah, fake data. I remember there was an Android Xposed(?) mod that did that, was quite funny to see heaps of fake names in contact list

But it is possible to not have photos on your phone, e.g. if it is a new one, or if you prefer to use a separate camera, or you are not the person to take pictures.

else not be allowed in the App Store, a stick apple is more than happy to wield

It should be illegal for a device manufacturer to retain any kind of control over devices after sale. Some governments are finally realizing this.

So no, this is not a viable solution in the long run. Besides, Android is a thing. I personally have never used an iPhone as my real phone precisely because of this — I can't install modded apps, I can't install pirated apps, etc etc. It's not okay to have to jailbreak the thing to make it usable.

So you and me have both worlds to choose from (not gonna reiterate pros/cons hundredth time). You are living in yours, but I have to lose mine.

By me I mean all those people who chose Apple for what it is and ignore Android for what it is, with regards to what we’re talking about.

You have no real problem, only intrusive ideology. Please relax and leave us alone. We’ll speak for ourselves when we feel wronged.

As an app developer, I do have a very real problem. I don't want Apple to impose their agenda on me and act like they own the relationship between me and my users. In particular, Apple should have no opinion on what kind of UGC my app contains if it's rated 18+. Apple should also stop protecting their own products by rejecting apps that cut into their market. But of course, Apple would do none of these things voluntarily, so that's where regulators need to step in.

If you want your device to be controlled by Apple, keep installing apps exclusively from the app store when the sideloading inevitably comes. Just like you can already choose to do on macOS.

So which app does Apple reject that cuts into “their market”?

Office apps (iWork)? There is Office 365, GSuite

Storage providers (iCloud)? All third party storage providers show up next to iCloud when you use the file dialog box - DropBox, Box, Google Drive, One Drive

Streaming apps (AppleTV)? There are dozens and when you search for a TV show or movie, the AppleTV app will tell you which subscribe services have it?

Streaming music (Apple Music)? Spotify, Tidal and Pandora are all on the App Store?

Etc…

> do have a very real problem. I don't want Apple to impose their agenda on me and act like they own the relationship between me and my users

Guess what? I as an end user don’t want to have a “relationship” with you. When I pay for an app, I don’t want to give every Tom, Dick and Harry my credit card information. When I get ready to cancel my subscription, I don’t want to have to deal with you.

> So which app does Apple reject that cuts into “their market”?

Netflix's "you can't sign up through the app" is a prime example of this that immediately comes to mind but there are many more.

An argument can be made that hey.com is, in a way, competitor to the paid iCloud subscription. Yet Apple acts as if they own that relationship and that the app store was valuable in bringing the users to the app: https://www.hey.com/apple/iap/

Do you really think it's fair that all competing services have to be 30% more expensive than Apple's own ones if they play by Apple's rules?

There used to be lots of iOS apps that allowed streaming pirated music. Everyone, including Apple, was seemingly fine with that and never asked where the music came from. But then, suddenly, when Apple Music was preparing to launch, all those apps started magically getting rejected for breaking the rule on "illegal file sharing".

> When I pay for an app,

Stop right here. No one was talking about paid apps. My initial point was about free apps. But if you so insist, in a FREE market, app developers would offer two options: pay through Apple with their 30% tax, or pay directly without it. I'll let you figure out which option most people would choose.

> Netflix's "you can't sign up through the app" is a prime example of this that immediately comes to mind but there are many more.

He said the app was “rejected” as in not allowed in the store.

> Do you really think it's fair that all competing services have to be 30% more expensive than Apple's own ones if they play by Apple's rules?

Well seeing that neither Netflix, Hey or Spotify allow in app purchases and don’t pay Apple 30%…

> There used to be lots of iOS apps that allowed streaming pirated music. Everyone, including Apple, was seemingly fine with that and never asked where the music came from

When has Apple ever allowed apps that focused on pirated music?

And Apple has been selling music on the iPhone since the day it was introduced - well to be pedantic, three months after it went in sale.

> But if you so insist, in a FREE market, app developers would offer two options: pay through Apple with their 30% tax, or pay directly without it.

And there is nothing stopping you from doing that. In fact, Spotify did that for awhile.

in a FREE market, app developers would offer two options: pay through Apple with their 30% tax, or pay directly without it

In reality they will make scummest apps possible and ignore the AppStore completely. Only very big players and those whose primary target is AppStore anyway will offer two options.

>I don't want Apple to impose their agenda on me and act like they own the relationship between me and my users.

That will be solved if/when they need to allow alternate App stores. But even then, The App store is Apple's own store, right? They make their own rules on what's allowed or no on their store.

I have no issues with them controlling their store (as an android user, Google does the same despite having much less care). I'm just glad they are seemingly being forced to open up for stores that want different rules.

Yes, some ios devs have a problem using dark patterns and peeking into where their nose doesn’t belong, but it’s not a problem anyone wants to solve or consider as such.

We choose it because it repels this “me wanna you should they need to” attitude. Please make apps that obey the rules or ignore the platform. Don’t tell anyone what they have to do for you without a contract.

No, you can't choose to only install apps exclusively from the app store on macOS because the macOS app store is a barren wasteland. The MAS makes it very clear that the only reason app developers put up with the iOS app store restrictions is because they have no choice.

The Mac is from a different time and has a very different user base than phones. By your argument the Play Store on Android makes it clear that the reason app developers put up with app stores is because of user patterns. On phones users are used to getting apps from the built-in store, so that's where they look for apps. Trying to sell an app via a website and APK download just doesn't work; users don't bite. There are alternative Android stores, most notably (outside of China) Amazon's and Samsungs. But both are wastelands, and devices with those stores typically also ship with the Play Store.

I don't think "app store competition" is going to be much of a factor for iOS post-DMA, but I do expect hobbyists and open source developers to congregate around AltStore or something and create a repository of free utility apps without having to pay Apple's developer fees.

> By your argument the Play Store on Android makes it clear that the reason app developers put up with app stores is because of user patterns

that is correct. If android users were more willing to use alternate stores, Google would have less control.

That said, I do enjoy being able to sideload apps with no hassle. Google may not allow 18+ apps or some emulators but I can find those no problem.

Google Play Store begs to differ

Google Play's rules on things like UGC are much more relaxed to begin with.

> It's not okay to have to jailbreak the thing to make it usable.

I guess we'll have to tell millions of users that their iPhones are all unusable, then. Imagine the shock!

It might not be as much of a problem in the US, but it is a real pain in the ass people have to contend with, for example, in Russia. I've seen it myself. Apple is enforcing US sanctions against some Russian companies, which means they can't have an iOS app. At all. I heard stories about how a sanctioned bank would load some kind of shadily signed copy of its app onto people's iPhones in branches. For Android, that same bank just hosts a self-updating apk on their website — with no intermediates to tamper with their app distribution.

Besides, being able to install modified apps is an important leverage against companies that don't act in their users' best interest. This way you can still use their services, but do so on your own terms.

This sounds like a good thing; the sanctions are working as intended.

>This sounds like a good thing; the sanctions are working as intended.

Whether the effect is "good" depends on if you think someone's device should serve its user or some government.

Did sanctions really intend to affect regular people who have exactly zero say in the matter though?

That is what sanctions do, so either no politician has ever thought about the implication of sanctions or it's an intended effect.

There's two possible explanations.

1. They don't think about these kinds of second-order effects. They see that this company is somehow involved with the government and that's it. Their electorate won't care about these kinds of details because they're "doing something" to supposedly stop the war sooner.

2. They think that Russians would somehow revolt against the government. This doesn't work — the Russian government lacks any meaningful feedback mechanisms. By protesting, you'd expose yourself to immense personal risks for no discernible effect. Unless you're a heavily armed private army heading straight for Moscow.

I strongly disagree that these are the only 2 possible explanations. The first is clearly not true — these second order effects are well known and often discussed, and the fact that sanctions are used in circumstances when the population is not expected to revolt shows that the second one isn’t the only remaining reason to use sanctions.

What if I (like so many others) want my device manufacturer to retain some kind of control of my device after sale?

You will act as if app store is still the only way to install apps on your iPhone.

If you don’t like a product, just buy a different one.

They didn't say not allowed on devices, they said not allowed in the app store. Your complaint is valid but completely off topic.

I've argued before that when companies retain control of the device after the sale, that it should not be legally classified as a sale.

It should be enforced as a rental.

Either I own my property and control my property, or it's not my property. If not mine, whose is it? All we need to look is who controls it then.

This is all first-sale doctrine stuff. And I don't believe any new laws need be made to enforce this.

Unless you are some big name that they can't afford to lose

It's not a tech problem though, and tech culture is already too eager to find technical "solutions" to societal and organizational problems like this.

Or just not use the app…

The guideline to be able to access apps without an account still exists, but the enforcing might have become lighter - or it's just the random fluctuations in review qualities we all know by now :)

Both of them still exists, but of course in some situations it doesn't make sense, so there is a lot of leeway depending on the reviewers. My experience is positive here, I can't remember the last time an app did not allow me to not have an account or manually provide data when it made sense.

https://developer.apple.com/app-store/review/guidelines/#dat...

  (iv) Access [...] Where possible, provide alternative solutions for users who don’t grant consent. For example, if a user declines to share Location, offer the ability to manually enter an address.  
  
  (v) Account Sign-In: If your app doesn’t include significant account-based features, let people use it without a login [...]

Thanks for doing the work by digging up and linking to the actual guidelines! That's pretty close to how the wording was all those years ago. Like all things AppStore, the enforcement is what ends up being uneven and subject to Apple's discretion and judgment. Which is a good thing IMO. Without publisher discretion, you just get scummy developers who rules-lawyer their way onto the app store.

Every smart home app seems to want an account on Android. Maybe they have a different path on Apple, related to HomeKit or similar, but I'm a bit skeptical.

Tasmota + CloudFree + Home Assistant and never make an account again and have full control over the devices in your home. No accounts and your lights still work when your internet is down.

I love my home assistant installation and didn’t even know about Tasmota/Cloudfree. Thanks for sharing, this is the next logical step to fully detaching from subscriptions/accounts.

Esphome is also good to learn about here.

I also like the part where it is harder for a device to call home if it doesn't have wi-fi at all.

> I’m all for the “fake data” idea, but also: Apps should be required to gracefully handle the cases where users deny permission to access real data.

That lies in gesture of app developer and that will not happen for the apps you'd want to use that feature (or the fake data feature) with.

> Apps must gracefully handle it and continue running.

Would this include… not doing anything? A notice that to use the app that you must grant access?

I hate apps that do that … BUT:

I am thinking of a logistics application that I wrote that requires location access. It effectively serves no purpose without location access.

It’s a small app that we offer to our clients. Not an app for the general public. But it is a situation where I don’t want the app to continue doing anything without location access.

It depends on the app. For example, I can’t view my balance in my banking app if I don’t sign in to an account, but I can find nearby ATMs or pull up the number for customer service.

The logistics app could offer some features like phone numbers, support hours, or even account management features without location access, so users can still get access to those things even if they can’t enable location (or are in Airplane Mode, for instance).

And then the core part of the app could have a message explaining why location access is essential. Perhaps with a link to a privacy policy or other document to explain how it will be used and handled safely. I love apps that do that and even have a button I can tap to go straight to the proper settings screen to grant access (or in some cases I can tap and the app will request again, so I can say yes this time).

In this case the users of the app are our clients employees. No location access is not an option for them.

Nobody wants to call in their location, nor do our clients want to setup some process for that.

Your case is special, but think about a maps app that requires login and location, when you want to simply measure the walking distance between two points.

I believe there’s a special publishing mode for yours, but not sure how it works irl.

I would imagine they just mean "you can't crash or abruptly exit." Telling the user "please grant location access to use the app" and providing a button to try again is probably fine.

I think it depends on the function that the permission access provides. If permission use is core to the app (like your app is a map with a dot for the user's location that has no other functionality like business searching), then, you're probably allowed to just sit there with an empty map doing nothing until the user consents.

If location access is peripheral to the core function of the app, it's a different story. Like your Yelp and one of many functions of your app is to "search nearby" then you can't just have a screen that does nothing until the user consents.

EDIT: Yes, for OP's use case, you'd just appeal to Apple and prove that the app has no other purpose besides the use case that requires location. I've done this in the past successfully.

Yes, the comment I was replying to specified that they are like the map app with no other functionality:

> I am thinking of a logistics application that I wrote that requires location access. It effectively serves no purpose without location access.

One middle ground between requiring location access and failing to run at all would be to ask the user to provide an address. That way the user would have some control over what info they provide.

Agree. Any app that requires location access should be able to accept a manually introduced location as a fallback when the user doesn't desire to grant location permission.

Which is consistent with what would happen anyways with the above idea of providing fake data when the permission is rejected.

> it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission

It's been the same since runtime permissions on Android, which was like Marshmallow i believe

https://developer.android.com/training/permissions/requestin...

Policy is one thing, but enforcement is what really matters. Do Google Play reviewers actually reject apps that hold core functionality hostage?

If apps are threatened with fake data, they will quickly find it's better to let users opt out gracefully, no regulation required.

I wish I could use apple products without an account. But an apple id is required for running apps, because you can only get and install apps through the app store.

I would like the equivalent of a "de-google'd android phone" on ios.

The point of civil disobedience is often to ensure the non-graceful handling being protested results in a very non-graceful effect. Companies soften their stance real quick when the hard positions they hold cost them a lot more. Apps punish users - there must absolutely be a feedback effect of users punishing apps.

Couldn't find another place to put this comment but how do I get the privilege of posting an Ask HN discussion starter thread for startup advice?

I believe it’s just a thread with “Ask/Show/Tell HN:” in its title.

How that works with banking apps? What can they do without an account? Maybe a web view to the home page of the bank.

As someone who works in banking - We don't show anything other than login and enrollment (and maybe a link for account opening, if the FI has it). Apple has yet to complain.

> it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission.

Sounds a lot like EU's GDPR: you must show a cookie popup but if the user denies it then you must still serve the content.

(When companies grow large enough, they become suspiciously similar to governmental regulators.)

Apple allows Bloomberg even though it requires an account.

> It seems they must have softened this stance because I am seeing more and more apps that require an account to function.

On Apple they compromised by requiring that apps with a login support "Sign In with Apple." Since you can signup with an anonymous iCloud email, this is almost as effective as not needing to create an account.

Reply on news.ycombinator.com