Hacker News Reader

Comment by heavyset_go | Hacker News Reader

> Yes, it's been Apple's modus operandi with the App Store from the start: trick consumers into thinking the App Store being a monopoly is the only thing that can protect them against malware, illicit and questionable app content, pirated software, scams, and fraud.

Which is ironic, considering that the App Store is likely one of the largest malware distribution vectors on the planet.

Looking at one virus alone, the App Store distributed half of a billion copies of it to iPhones and iPads[1]. Similarly, there are multimillion dollar scams on the App Store, as well[2].

[1] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...

[2] https://www.theverge.com/2021/2/8/22272849/apple-app-store-s...

View on HN

That one virus on the App Store was one of, if not the biggest known instance of a virus on the App Store, and your article gives a number four times smaller than half a billion. From your [1]:

> But now, thanks to emails published as part of Apple's trial against Epic Games, we finally know how many iPhone users were impacted: 128 million in total, of which 18 million were in the US.

> "In total, 128M customers have downloaded the 2500+ apps that were affected LTD. Those customers drove 203M downloads of the 2500+ affected apps LTD," Dale Bagwell, who was Apple's manager of iTunes customer experience at the time, wrote in one of the emails.

> Apple also disclosed the apps that included the malicious code, some incredibly popular such as WeChat and the Chinese version of Angry Birds 2.

Still a huge deal, particularly in China, but considering all the virus really did was collect some device info (less information than most ad networks) (and maybe it was able to open URLs and popups on command)[1] and it was the biggest virus on the App Store ever (that I can find), maybe not as awful as you suggest.

The scams on the App Store, yeah that's pretty bad. Though, can you point me at a marketplace as big as the App Store without loads of scams?

[1]: https://www.lookout.com/blog/xcodeghost#what-does-it-do

> all the virus really did was collect some device info (less information than most ad networks)

Nah, that would mean that what really protects iOS users from malwares is just a good sandboxing mechanism and not the "human" control of the App Store. That would also mean that bypassing the App Store shouldn’t be a real security issue.

It’s pretty clear that it’s both. Claiming otherwise is a bit disingenuous. An app store with no human or automatic validation and not $100 would have a magnitude or two more malware.

Can you back that up with an example, perhaps the Android Play Store? Is there significantly more malware on recent (last ~5 years) versions of Android than similarly recent versions of iOS?

Google play store also uses human review.

The question is whether there’s more malware on stores like f-droid, and the answer is yes, there is of course significantly more malware.

This even pollutes the official Play Store to some extent because of course google can’t put the foot down too hard when Facebook et al can simply “start their own app stores” to bypass review if they really want to. Malware rates are much higher on android in general.

https://arstechnica.com/information-technology/2020/09/joker...

> Though, can you point me at a marketplace as big as the App Store without loads of scams?

Not the person you're replying to but isn't that the point?

Apple uses the excuse of security to hold a monopoly.

You are shown that this is by no means as secure as they want you to believe.

Then you argue that "of course, with a market that big!"

So basically you are proving that Apple uses the excuse of security to hold a monopoly.

Not only that, it proves the opposite of the claim.

Suppose there were multiple app marketplaces for iOS. Then some of them could be extremely selective by finding a niche, and thereby be more trustworthy than any unified store that has to carry a million general purpose apps with only cursory evaluation from various publishers of little or unknown reputation.

> > Though, can you point me at a marketplace as big as the App Store without loads of scams?

GNU/Linux repositories.

The biggest of those is NPM, I think, which appears to be between 50% and 100% as big as the app store. Let's call that equal in size, shall we?

https://nitter.net/npm_malware has twenty postings in the last 19 hours, quite far from "without".

NPM is not a Linux repository.

NPM is also used by Windows an MacOS machines, and who knows which else. *BSD? Anything that runs JavaScript?

Probably OP was thinking about the deb and rpm repositories of the main distributions but yes, NPM and the likes are other examples of large repositories.

Yes, I meant deb/rpm repositories. NPM is not a Linux repo, it's multipurpose, with lots of proprietary software.

It's the open part of it that's comparable to the app store in size. The closed part is in addition.

I agree there are linux-only repos that are ~1% of that size and contain little or no malware or abuse. That's true whether you measure size in updates per day or total count of packages, so 1% seems reachable without considerable malware problems.

> so 1% seems reachable without considerable malware problem

Another plausible explanation is that pure FLOSS repos are free fron malware.

The largest Linux repo is nixpkgs.

> The biggest of those is NPM, I think

No, it's not even a Linux package repository. Think repositories for Debian, Fedora, Arch, etc.

I mentioned it because it contains a lot of GPL-licensed packages, and a lot of it's used on linux, and it's at least near the scale of the app store. It falls a little short along all three axes, but it seems to be the closest.

I don't think either Debian, Fedora or Arch are anywhere close to a million packages or a thousand updates per day. Well below 10%. They're GNUish and 100% linux, but really bad on the size axis.

The app store has at least two classes of problems that those three don't have, and have to handle the problems at much higher scale. "Those guys manage to handle a simpler problem at much smaller scale, so it's possible for the app store too" is hardly an argument.

Is the malware in NPM in the GPL part? I guess no, so this is my point: FLOSS repos can be trusted.

Yes it is. Most likely also in the other part, although link I included doesn't mention any of that. The key appears to be: A large repo with lots of uploaders, some of which guard their passwords poorly.

As long as a FLOSS repo is small and has few uploaders, it'll be safe. Hardly a model for a big and busy repo like the app store, of couse.

No, npm is not a Linux distribution. It's a programming language package manager and package repository.

The distinguishing feature of Linux distributions is the existence of maintainers. Human beings who put in effort into maintaining the quality and integrity of the packages and keeping them up to date. We Linux users generally trust those people, and they stand between us and all the software developers out there. To get to us, you gotta go through them. And they generally aren't in the habit of allowing obvious malware into the software repositories. That's why we trust them in the first place.

Contrast that to repositories like npm, pypi, rubygems, cargo which are all designed so that any random person can make an account and push up any package they want. There's no checking. Accounts might be compromised by or outright bought by malicious actors. Just like popular browser extensions which get bought and converted into malware.

> Though, can you point me at a marketplace as big as the App Store without loads of scams?

Maybe the issue is being so big then. Which is exactly why the EU did this in the first place. So Apple has yet another lever to comply: reduce their size.

How’s that compare to android though? For the most part apple’s walled garden IS safer and more privacy preserving than android.

What kind of take is this? The main channel for apps is extremely similar to iOS's App store. I highly doubt if there is a difference, it's due to non-Google App stores or sideloading.

Isn’t that the point?

> I highly doubt if there is a difference, it's due to non-Google App stores or sideloading.

Tech journalists have literally warned Android users that they need to be wary of apps from inside Google's walled garden.

> With malicious apps infiltrating Play on a regular, often weekly, basis, there’s currently little indication the malicious Android app scourge will be abated. That means it’s up to individual end users to steer clear of apps like Joker. The best advice is to be extremely conservative in the apps that get installed in the first place. A good guiding principle is to choose apps that serve a true purpose and, when possible, choose developers who are known entities. Installed apps that haven’t been used in the past month should be removed unless there’s a good reason to keep them around.

https://arstechnica.com/information-technology/2020/09/joker...

Once you've submitted apps for review enough times, you get to know how arbitrary the review process is.

Many, many people game the system in terms of in-app payments, e.g. showing a link to subscribe on their website but hiding the link for the review.

If they can't catch that, why do you they can catch anything?

I disable autoupdate for apps on android, since all it does is bring in more ads normally. I manually update webview every once in a while and that's it.

Also, most of my apps come from fdroid anyway.

If Apples system is better they should be able to compete successfully in a free market. The don't seem willing to attempt that.

You are free to choose an android phone or an Apple one; that part of the market is absolutely free. Apple is the top seller of smartphones, I believe this qualifies as "competing successfully".

At least in the US, imessage gives apple an effective monopoly. Their are strong social repercussions for not having imessage. If you want to be included you pretty much must have an iPhone.

Apple is well aware of this and plays into it hard.

Oh stop it, Apple isn’t responsible for people’s choice of friends, they do need to provide a UI affordance that someone may not be getting messages displayed corrected

> Oh stop it, Apple isn’t responsible for people’s choice of friends, they do need to provide a UI affordance that someone may not be getting messages displayed corrected

Apple has been repeatedly requested to change the colour to a less ugly shade, or to give users the choice to disable the feature or to give Android apps an API of some sort so they can comply with whatever Apple's requirements and get the blue text boxes.

Apple hasn't taken action because they like the current state of affairs, they want the social ostracism of non-Apple users.

> At least in the US, imessage gives apple an effective monopoly. Their are strong social repercussions for not having imessage. If you want to be included you pretty much must have an iPhone.

That's because people are idiots. There's nothing that iMessage does that whatsapp, telegram, kakao, line can't do. In fact, US/Canada are the only ones that actually use SMS or iMessage, as far as I know, and the rest of the world use other messaging apps. I have been living in Canada for 5 years already, and in no instance I had any issue whatsoever. I now use iPhone, but nobody talks to me via iMessage, it's all either Messenger or Whatsapp, or Instagram

If Apple is able to hold such a stronghold over Americans because of something so easily bypassed, then you deserve to be controlled, really.

> that part of the market is absolutely free.

That part of the market not being separate from the other part of the market is the issue. There could be a dozen different reasons that someone might want an iPhone over some competitor, and if they buy one for that reason, they're stuck with Apple's store even if they would have chosen something else given the option.

Not only that, the markets are tied together in both directions.

Suppose that you do want to go into competition with Apple and Google and make your own competing phone platform. The biggest problem you're going to have is that people expect you to have a lot of apps available for your phone before they'll buy one, but you have to have a lot of customers before anyone will make apps for your platform.

The traditional way to solve this is by creating a cross-platform framework and then giving developers an incentive to use it, generally by making it easy to distribute apps to existing platforms. For example, Valve wants game developers to develop for SteamOS, so they provide cross-platform frameworks and a distribution system that also works on popular incumbent platforms like Windows. Then developers make games that run on Windows and incidentally also on Linux/SteamOS, and now there are more games available for SteamOS than ever before and it's the most promising competitor to Windows for PC gaming in a long time.

Conversely, Microsoft is prevented from making an app store for iOS, so they can't do that and their ambition to create a viable competitor to Apple and Android faltered. Likewise Ubuntu Touch and Firefox OS and every other attempt to create a viable alternate phone platform. And then you say "just buy a different phone platform" -- as if that wasn't the problem.

> that part of the market is absolutely free.

https://en.wikipedia.org/wiki/Tying_(commerce)

I should also be free to run whatever software I want on the phones I bought. Don't care about Android or iOS. I want to run Linux, postmarketOS.

android just checks every app for safety (play protect) and isolates every app at system level. solutions for sideloading are actually very simple.

so, is it "safer"? what's "safer" about it? or is it really just a meme apple has successfully perpetuated about it's limitations?

This week I removed adware from Android, which is installed according to the following scheme: a person sees a fake advertising notification about an infection, then even trying to close it opens Google Play or another store with some kind of antivirus with a generic name like xcleaner, to make it harder to find it among others, and installs it. Then this application starts working in the background and every 2-3 minutes creates full-screen advertising banners with vibration, also about infections with links to other garbage. It does not exist in the list of applications and in the activity list as soon as the banner is closed. While it is there, instead of its name it shows a webview, and you need to guess to go from the list of processes to the application in order to see its real name and delete it.

A year ago, I also saw a fake advertisement for a squid game. These fake advertisements have already become a meme, but they also offer to download from Google Play a slightly similar game, where after quickly clicking on the screen, the smartphone will suddenly prompt you to buy an expensive subscription and then you will not be able to cancel it, because Google does not provide for them refund. This idea comes from SMS scams since j2me platform, and judging by the comments on this game, people are still losing money, especially if they leave their phones to children.

I don't use ios and won't say whether manual moderation there helps prevent the same crap, but let's not ignore that if you're not tech-savvy, this Android security alternative is pretty easy to get around.

literally the same "scam ad - scam app" pipeline exists on ios. ads exist, bad scammy ads exist, garbage apps exist, stuff slips through app moderation filters, or just stays around and gets by because it's juuust enough for it to not be outright malware. bad ads and apps are unfortunately not a platform specific problem, nor are they really "solved" by either of platforms.

funnily enough, some bits of it might be worse because ios and app store are promoted as 'being secure' period, almost unequivocally - so it ends up being a thing like 'well, ios is secure and this app is on the store, so it's all good, right?", which doesn't always happen to be the case.

My Grandfather had 3 different SMS apps installed on his android when I looked at it one day. Each of them had tried to take over as the primary app.

AFAIK, This cannot happen on Apple.

I still think there ought to be some solution that includes both "apps can't force/trick you into changing defaults" and "owner of device can still choose to change defaults".

From what I’ve observed in this thread, there seems to be an over abundance of faith in competition and freedom to tinker.

I think that this is faith, not objectivity - which is misplaced in this specific scenario.

The challenge isn’t market dynamics, but rule breaking and predation on victims.

Non tech inclined people are targets/marks for bad actors.

Malicious websites, innocuous messages, hard to avoid buttons - are all designed to circumvent good intentions.

This is resolved with rule enforcement, retributive and governance powers.

If we are adamant about competition, then apple being locked down while Android remains open is about the best you will see.

There is. It's called iOS.

are you asking what is safer about, eg, selinux vs regular linux? I think that is pretty self-evident that a constrained user experience results in a reduced attack surface.

these questions are silly if you pivot them to be about other things rather than the fruit company, just like the arguments that "[company] needs to run open-infrastructure so other companies can build commercial products on [company] servers".

It's rather obvious they're being asked in bad faith with the intention of dragging down the discussion. You know perfectly well what SELinux and application sandboxing are for, and that they're net benefits.

Maybe but the vast majority of people have zero issues with malware and don't really care about the perceived advantage of privacy (just Apple marketing because they can't sell ads, if they could they wouldn't give a shit).

I take care of Android devices used by elderly people, and they have just zero issues. Not anymore than they would have with iOS.

All this is nonsense talk trying to help the indefensible position of Apple. Most people also use Windows computers with no monopolistic app store and even though sometimes they are problems they almost always come from user errors. Most of the time it's poor choices, generally from greedy behavior (trying to get stuff for free without knowing much).

If a user doesn't know what it's doing, it can ask someone for help or stick with Apple's App Store if that suits him. Allowing other possibilities for more competent people doesn't change this fact one bit.

my mother has thousands of notifications from the browser, from all the websites that request permission to show them.

Her phones become really slow because of this.

Late reply, but that is definitely "user error"; and the iPhone will exhibit the same problem if you allow any random app notifications access. There are plenty of bad actors, even on iOS. For example, even Uber Eats will target you with ads if you dare allow all permissions for notifications just to get orders tracking...

In fact, their notification system makes it complicated to just allow specific behavior and not something else. It's not better than the notification settings in typical web apps. As a day one user of iOS, I find it funny that you complain about notification out of all things, because if there is one place where iOS is just as fucked as every other platform it's notifications...

Nowadays I have resorted to basically denying notification for everything but the few stuff where they are actually relevant...

Also, you should correctly set things up for your mother and refuse notification prompt for every website and just whitelist the few that might be usefull..

> Which is ironic, considering that the App Store is likely one of the largest malware distribution vectors on the planet.

Sorry but the actual statistics from mobile security companies that track this stuff show otherwise. From Nokia's Threat Intelligence Report 2020 (https://pages.nokia.com/T005JU-Threat-Intelligence-Report-20...):

Among smartphones, Android devices are the most commonly targeted by malware. Android devices were responsible for 26.64% of all infections, Windows/PCs for 38.92%, IoT devices for 32.72% and only 1.72% for iPhones.

Android malware infections are an order of magnitude higher compared to iPhones.

(I tried to look for data from more recent years but iPhones don't show up in the reports after 2020.)

Citing xcodeghost as a big smoking gun of Apple malfeasants is absurd. Apple handled that whole situation really well considering it came from a bunch of downloader websites where the attacker had modified clang and Xcode.

Meanwhile I can’t even get them to approve a simple midi remote app…

They need to “investigate”

Reply on news.ycombinator.com