Hacker News Reader

Comment by summerlight | Hacker News Reader

Why should we trust Apple for security in that context? Apple also provides all those functionalities via their proprietary API, which is not even audit-able. If Apple really believes in that argument, they should disable their own API as well.

View on HN

You have to trust someone if you're using a computing device connected to the Internet. The point of being in Apple ecosystem is that you trust Apple, and then (supposedly) you can not trust anyone else. To many that's a very strong proposition.

> The point of being in Apple ecosystem is that you trust Apple,

This seems to be over-generalization? Users are using Apple devices because those are good products, not because they want to delegate every single trust problem to the Apple ecosystem. That might be a great proposition for people like you, but there is a significant number of people who consider it a compromise rather than a value.

Users trust Apple because Apple is ultimately accountable for security breaches on iOS devices. If a 3rd party app causes a data breach it does not matter if the breach was made possible by compliance with regulations like the DMA, Apple will still take the blame.

> Users trust Apple because Apple is ultimately accountable for security breaches on iOS devices.

As a long time user of Windows which historically had an incomparably large amount of security incidents, I can assure you that Apple won't get blamed that much for 3rd party data breach unless it involves Apple's own service and user data.

Since you’re a commenter on HN I’m going to assume you’re a tech person. I’m not talking about tech people, who through their discussions try to find the correct person/company to blame for issues.

I’m talking about the general public. If a story about a data breach in a 3rd party app — affecting iOS users — hits the news cycle, Apple will take the blame and their brand reputation and sales will be impacted. It doesn’t matter whose fault it really is, Apple is the face of the iPhone and through their walled garden they have accepted final responsibility for everything that occurs on iOS.

I don't see how this matters to the GP's argument. Windows was a virus hotbed for decades and that does not appear to have affected its reputation in a meaningful way.

That’s because Windows’ reputation was already mud. Microsoft made their business on corporate users anyway. Apple is a consumer brand. A data breach on iOS is like nudity in a Disney movie: utterly brand-destroying.

Windows was both. If you were buying a computer in the early 2000s, it was almost certainly a Windows PC.

Right, but Apple built their brand on being the alternative to Windows for people who didn’t want to deal with security issues, viruses, crashes, bundled junkware, etc.

You can draw a direct line between Apple’s original marketing pitch (easy to use, simple, secure, appliance-style computing) and the iOS walled garden. Just as you can with Disney and their family-oriented brand. It’s not a compelling argument to say that other film studios have nudity in their films when Disney is the brand at issue.

That was because Microsoft abused their monopoly in operating systems at the time to force OEMs to use their OS on all their computers in order to maintain the industry discounts on OEM licensing.

Also because there weren’t really any credible alternatives

Back in the day MSFT bolted IE into the operating system to a greater degree than Apple has done with Safari - a ton of the DLL's relied on IE for a lot of UI components and IE had ActiveX that literally hosted executable content in a browser window. It's almost like they hung out a sign on every PC and Windows server that said "please p0wn this machine" and lots of the bad actors in the world came knocking.

They didn't take security seriously when they were laying down the architecture for Windows because they didn't think they had to. Apple is taking the exact opposite approach. They're fairly obsessed with security and privacy because that's one of the big selling points for the whole iOS ecosystem. They miss things because they (like us) live in the real world but they do pay a lot of attention to it and the number of updates for things like 0day defects that arrive within days of the defects being reported tells me that this continues to this day.

Apple doesn't have a monopoly. Per https://gs.statcounter.com/os-market-share/mobile/worldwide Android has twice the market share that iOS has. The reason for all of this generated drama is found in https://www.businessofapps.com/data/app-revenues/. The key bullet points are:

"App Revenue Key Statistics

* Mobile ad spend in 2022 reached $362 billion, a 7.7% increase on the previous year * Android and iOS app consumer spending increased to $135 billion in 2023 * iOS was responsible for 66% of app consumer spending in 2023 * Games accounted for 60% of consumer app spending in 2023. Google Play contributed 41% of the total amount * Subscription revenues increased to $45.6 billion in 2023, iOS was responsible for 76% of that revenue"

The real reason for all this foolishness can be found in these bullet points. 66% of $135 billion is $89.1 billion, and lots of people would love to get a piece of that pie without dealing with Apple (who built and owns the stack). It isn't a monopoly, though, and all of that monopoly talk is misdirection.

Windows doesn’t have a reputation. It’s the default. Nobody actually likes using windows you just have to. Do you really think there are people out there asking for advertisements in their start menu?

To this day, I prefer windows, and I have to switch between Mac and windows all day every day.

What was the last 3rd party breach Apple took the blame for?

Fappening. Apple took all of the blame and then we got mandatory MFA. The logjc works even if it’s the own users fault for getting scammed.

I as an Apple user will blame Apple for design choices that lead to 3rd party breaches of my data and privacy.

>there is a significant number of people who consider it as a compromise rather than a value.

I suspect that from Apple's perspective, it is definitively not a significant number.

For Apple, ownership of the "trust problem" is an intrinsic part of "making good products".

> For Apple, ownership of the "trust problem" is an intrinsic part of "making good products".

Yes, this might be true. And the majority of elected officials in EU fundamentally disagrees with that statement.

> And the majority of elected officials in EU fundamentally disagrees with that statement.

Well, EU can and will force, fine, or ban US companies as they see fit but there is not some fundamental correctness to their viewpoint

Any fundamental correctness of their viewpoint is by virtue of them representing more people (EU citizens) than Apple's CEO represents (himself and, I guess, the Apple corporation, if you count that). On moral issues, the fundamentally "correct" viewpoint (if there is one) is, by definition, the one that more people say is the fundamentally "correct" viewpoint.

What you should be comparing is the percentage of the market the EU represents in the total market available to Apple. EU politicians are accountable to their population. Apple’s CEO is accountable to every Apple customer. The EU does not now, nor has it ever, constituted a majority of Apple revenue.

I don't believe the concept of a market has any fundamental place in morality, and my morality isn't limited to any particular "market".

Indeed, who apple is or isn't able to sell to, doesn't affect what people think is moral or immoral.

As for Apple's CEO representing Apple's customers: Are you sure? We didn't elect him. We just bought stuff made by an organization he currently runs.

So you think government can prove morality, but markets cannot? If you don't think government is a marketplace where the currency is political capital, then you have a naive view of how governments work. Also, I don't believe the EU is a direct democracy, so the representative morality is lossy. Have you never disagreed with a decision made by a politician you voted for?

I'm saying that customers decide whether or not to buy from Apple based on whether they resonate with them from a moral standpoint, at least as part of their decision to purchase their products. And I said Apple's CEO is accountable to their customers, not that they represent them. Yes, they're also accountable to shareholders, as your sibling comment points out. But if the company screws up enough to elicit a popular boycott, you can bet the reason shareholders will be exercising that accountability is due to the actions of the customer base.

Yes, a democratic government represents the people, and thus their moral stance. A market sells stuff. There's really no relationship between the two nouns. No reason to compare them. You might as well ask, "So the people can decide what's moral, but a jar of pickles can't?" Yes, that's correct. A jar of pickles is technically a market, so this analogy applies particularly well.

> I'm saying that customers decide whether or not to buy from Apple based on whether they resonate with them from a moral standpoint

I fully believe that you might do that yourself. There's no evidence everyone else does, or even that a majority do. Especially since most people aren't informed of working conditions involved in manufacturing Apple products (or indeed, many others' products).

It's just not believable that everyone thinks that buying a product = agreeing with every single moral stance made by the person currently running the company. And what if he changed his mind tomorrow? Would he offer a full refund to everybody who asked for one?

> And I said Apple's CEO is accountable to their customers, not that they represent them.

He's not accountable to them, only to the board*, but we're discussing representation - that is, speaking on behalf of a people, according to those people, not you or I or the speaker individually. If you mentioned accountability while we were on the topic of representation, and I returned us to the topic of representation, you're welcome :)

[*]: Your example illustrates this: a complex chain of accountability from CEO to Corporation and BoD to Corporation and Corporation to shareholders is required for any action to happen. Being accountable to customers means customers can decide to fire him _directly_.

> you mentioned accountability while we were on the topic of representation

Because they are interrelated concepts. Without accountability you can’t be trusted to faithfully represent someone. “Representation” without accountability is autocracy.

Also, chill with the condescension.

You are right, they may relate, and thus can be easy to confuse for each other when one is being discussed. So we have to be extra careful when bringing one up in a discussion about the other.

In this case, though, the CEO is not accountable to customers, and the CEO does not represent customers, so not too confusing. He is accountable to the BoD (nobody else can fire him) and represents the corporation. The interests of other parties, including customers, are secondary to, and when opposed lose to, the interests of the corporation.

I'd argue that's not the case. CEO's are accountable to share holders, not its customers. And before you say its the same thing, there are a lot of pubically traded companies who get away with unlawful actions that direct effect its customer's for a long, long time without their bottom line being effected.

Governments in other countries have come to a different view, and it's for Apple to determine how worth it is for them to conform to the view come to by the representatives of the EU citizens versus catering to markets with other regulatory regimes.

China represents twice as many people as the EU. This is not an enticing argument. Can you at least qualify this with democratic representation?

Which free and democratic election did Xi win?

none, which is what the comment was complaining about.

Thank you for your comment. In the spirit of interpreting it in the most charitable way possible, I assume that when you say "China", you mean the Chinese government. The answer is that Chinese government doesn't necessarily represent people living in China. As you say, it is not democratic. That leaves us with few indicators of representation.

It has control over the people living in China, true, but I do not think controlling a person, being able to put them in jail if they don't obey you, is the same thing as representing them.

Yeah, as I’ve said before: the root problem here is that the EU wants to outlaw apples business model.

People don’t think of it that way, they tell themselves all the reasons why that’s a good thing, but that’s ultimately what it is - a legislative solution to end the “android vs iOS” debate for all time.

The argument is walled gardens shouldn’t exist, so the solution is to either legislate requirements that apple destroy the walls, or that they exit the market. That is a statement that most android advocates would agree with.

And the EU will largely just keep ratcheting up the legislation until that happens. Driving apple out is the point - walled gardens are (in the EU sense) unacceptable and the option for a walled-garden business model needs to be removed from the market.

Apple is (correctly) perceiving this and pulling out of the market, first by dropping the affected features, and I’m sure there will be a “next compliance requirement” before many years too.

Apple is free to switch to a less fascistic business model.

Is SELinux also fascistic? Grow up.

if someone wants to sell systems where the only supported configuration is SELinux, why should that be illegal?

I feel like this is a win for consumers - I'd much rather there remain more OS competition on mobile devices[1] but if Apple wants to pursue a business model that excludes large portions of the world from their customer base that's their decision. I don't believe there exists any maliciousness from the EU towards Apple - they do, after all, benefit greatly from corporation tax revenues from Apple and iPhones are still quite popular in the EU. I think at the end of the day there's just a difference in the social expectation of privacy and freedom between the EU and NA. Apple, being primarily steeped in NA's expectations for freedom, hasn't built an ecosystem that is compatible with the EU's higher expectations.

1. Still hoping to see something amazing RIM!

I don't see how you can call EU having any expectation of freedom when commenting about a law which forces a company to comply to regulation.

This actively reduces freedom, the freedom of running your business. You just don't care about it.

If you don't like walled gardens you can just not use them (I certainly never bought anything Apple for this very reason), there's no need to infringe on the freedom of everyone else who wants to use walled gardens.

The EU is in general becoming increasingly less free, thanks to barely elected bureaucrats who line up their pockets with sponsors money.

I think this is a great example of what I had mentioned as social differences of freedom between the EU and NA - in NA the freedom of businesses is often well protected up until it causes actual harm to human beings[1] - in the EU the freedom of human beings tend to be given priority of those of companies. It's important to remember that there are a lot of freedoms in this world and they often conflict in major ways. A quote that I love is "Your right to swing your arms ends just where the other man's nose begins". Freedoms are extremely easy to guarantee if they're non-conflicting but that's rarely the case. In this case the EU is siding with the freedoms of the customers rather than the freedom of the corporation - whether that makes the society less or more free overall is a matter of opinion.

1. I'd point to a great example from one of our current justices in this regard: https://www.theguardian.com/law/2017/mar/23/neil-gorsuch-sup...

That dissent sent him to the top of the Heritage Foundation SC shortlist for being a corporate kowtowing stooge.

> line up their pockets with sponsors money.

That's not just an EU problem though. It seems to be well established (and perhaps worse?) in many places.

> If you don't like walled gardens you can just not use them (I certainly never bought anything Apple for this very reason), there's no need to infringe on the freedom of everyone else who wants to use walled gardens.

No-one's forcing Apple customers to go outside the walled garden. They can still source their apps from only the Apple App Store.

Companies don't have freedom. People do. Companies are a collection of people that have a responsibility to the people who allow them to operating by charters. In our current age, I'd say that justice in this regard isn't operating as it should, because our governments are allowing selfish individuals within companies to do illegal stuff that go against the original intent of charters. Individuals that would normally be held accountable for their actions are now being protected from being prosecuted for harms they commit while being part business.

Companies are designed and allowed, by characters, to operate within the scope of whats good for society. If it harms the public good then it needs to be reigned in. I have no illusions that companies have the same standing and rights as living beings do. They are lifeless entities meant to be subject to the will of people.

>This actively reduces freedom, the freedom of running your business. You just don't care about it.

In the same way Right to Repair, Minimum Wage, and Disciminatory hiring affects the freedom of running a business, sure. Unfortunately, rules are written in blood and this is happening because other businesses at this point abused the point of labor or customer satisfaction and needed to get dinged for it.

In this case, Blame Microsoft, I guess. Heck, even Google. we already know the result of a closed system abusing its platform and large share to make its product worse. I'm glad we're actually jumping into this before it's too late (like we usually do).

> NA's expectations for freedom

That'd be "corporate freedom" rather than "end user freedom" yeah?

That's my impression of what the NA model of freedom seems to mean these days.

Because of course elected officials without any expertise, representing a very small minority of humanity, are the best arbiters of reality.

Non experts have to rule on expert subjects all the time - sometimes this goes hilariously wrong (like the internet being a series of tubes) but usually what happens is that the non-expert relies on the testimony of experts to make their judgement.

Politicians aren't expected to be experts due to the immense breadth of subjects they need to consider - they're expected to consult experts. Whether an individual politician is an expert[1] is pretty irrelevant.

All of these statements are about our general expectations of politicians - whether you think politicians adhere to that point or have comments on specific politicians is beside the scope of my comment. As a less controversial example it might be good to instead consider how judges operate who are expected to provide well reasoned judgements on subjects they know nothing about.

1. Sometimes those former expert politicians are the worst of all since they _think_ they know the way things are and won't listen to actual experts but they've been out of the industry so long that they've lost their familiarity with the subject.

>sometimes this goes hilariously wrong (like the internet being a series of tubes)

That didn't go hilariously wrong, though - the internet is a series of tubes. Not physically (copper cables aren't tubes) but he obviously wasn't talking about specific stuff but broad-strokes analogy (his exact line was "It's not a big truck. It's a series of tubes."), and his description was basically accurate.

Unlike trillion-dollar corporations?

> Users are using Apple devices because those are good products,..

For general populace good also include secure by default.

"every single trust problem to the Apple ecosystem." is rather technical point that very few people would even understand meaning of it.

> significant number of people who consider it a compromise

How significant compare to iPhone user base?

Why can’t I choose to trust Apple for iOS and another developer for other functionality that runs on iOS?

We do this all the time. I don’t uniquely depend on Microsoft for stuff that runs on Windows. Same for stuff that runs on macOS. And on Linux I’m not even sure who I’m trusting from the ground up other than a huge and disparate collection of people.

So what makes iOS so unique that it can’t run PWAs, which is little more than adding some chrome and a handful of APIs to already pre-existing browser capabilities.

What an F’ing joke. And the bigger joke are the Apple fans who are going out of their way to defend Apple sticking it up their nether parts.

It’s not unique to Apple. It’s an inherent problem to securing Turing machines.

If you are not an Apple user not an Apple fan why do you care so much about Apple and its users?

I'd rather trust a public (not-for-profit) institution that actually had a real incentive to protect user security. Instead we get for-profit companies that have a vested interest (conflict of interest) to do security the way it thinks it should be done. In my experience, that usually is bad for the people that are using the platform because there is no real surety that security is being done for the sake of the users.

Apple has no interest in working with public institutions that have a close relationship with the people they serve. That's a big red flag in my book. You cant trust a company that serves content and hardware and at the same time trust them with security. It's too many eggs in one basket, to easy of a target for rogue entities (NSA) even if they have good motives .

Which public institutions do you find have real concern for their users? In which country?

https://eff.org, https://fsfe.org, https://edri.org.

And to a degree, that’s why developers tend to hate Apple. They paint us as a pack of crims trying to steal from unsuspecting Apple users.

I think you are conflating the relationship between consumers/developers and the corporation (that you work for?).

I don't hate Apple, but rather realise that it's bottom line and fiduciary duty to its shareholders is stronger than what is best for us (consumers/developers).

I do not trust the corporate marketing one bit (and honestly, why should I?).

This behaviour of Apple just further supports that view. As a company, it seems to believe that it is somehow above following the rules meant to benefit consumers/developers, which goes against what the company has been marketing its self with since the 80's.

So lets stop the 'Leave Apple alone (and us that work there)' crying, and just acknowledge what the whole thing revolves around.

It’s possible to hate them and recognize why they’re doing at the same time though…although I do think there’s also a hefty dose of arrogance and self importance in there. I’m old enough to remember when we (devs) felt this way toward Microsoft…so if I was Tim Apple I’d include that risk in my calculus cause what came next was two decades in the penalty box.

Seems like they hate us (developers) back though so it’s a mutual relationship I suppose.

> They paint us as a pack of crims trying to steal from unsuspecting Apple users.

Have you seen the world around you for the past 20 years or so? I'd say this characterises developers (well, companies they work for at least) quite well, don't you think?

No, I’d say the vast majority of reputable developers are not trying to scam you.

But there are some trying to scam you…and some of those are also in the App Store…as long as they use IAP to scam you all is well.

There are two kinds of trust, I may trust Apple to not intentionally steal data. But I may trust Signal to create a more inherently secure messenger, or I may trust Google to create technically a more secure browser.

What Apple and some users here are saying that users don't have intelligence to judge it and so will have to trust only Apple.

But that's what the EU is willing to reform. Apple isnt a EU company, hell it may even not contribute much to the tax base, there's less reason to trust them in exchange for gatekeeping against EU companies trying to generate tax revenue on their plarform.

Trusting Apple is nice in the US where it's probably a net contributor to the country's development. Elsewhere, not so.

Well, while the argument is entirely bogus as "PWAs are unsafe" implies that loading web pages in that browser itself is unsafe and thus stopping PWAs but not loading pages is pointless, you do have to have full trust in Apple for security of your device as they are the sole provider for the core platform providing most of the security primitives used.

That just doesn't exclude trusting others as well.

> Well, while the argument is entirely bogus as "PWAs are unsafe" implies that loading web pages in that browser itself is unsafe

Except that's exactly what Apple is saying. Their engine -- and their brand depends on it -- offers users assurances arbitrary engines do not offer. Apple says PWAs are safe because Safari is safe, while not-Safari PWAs are not-safe.

And, if not safe, Apple is at least accountable.

Google's brand, for instance, does not depend on it: https://www.engadget.com/the-morning-after-google-will-settl...

Apple’s inability to protect its “brand” while doing what nearly every other platform owner in the world does routinely does not justify monopolistic and anti competitive behavior.

Well, that link definitely plays in Apple's favour :)

It doesn’t matter - they are going to support third party browsers anyway.

They are just afraid the browsers will host PWAs better than Safari does, making them a more viable alternative to the App Store.

> Except that's exactly what Apple is saying.

You misunderstand. If a foreign browser engine was to be made available for PWAs, it would be because the user installed the browser and browsed the web with it. In other words, if loading a web page in this browser was unsafe - which is what a PWA is - the user would already be compromised. PWA or bookmark does not matter.

PWAs do not change the risk profile. PWAs only get a few extra APIs, but nothing major. Location, microphone, webcam, bluetooth, usb, etc. are all standard web APIs available to web pages, not PWA specific.

The argument that PWA specifically has a special risk profile is null and void. The only sensible reasoning is that Apple is strongly against opening their platform at all (their way of implementing compliance is borderline malicious), and maybe want to weasel their way out of any effort they can avoid (allowing users to install new types of apps is zero work, changing which app opens a link by default is near-zero, while allowing users to replace the engine for PWAs require a bit more integration).

>implies that loading web pages in that browser itself is unsafe

Since when was loading web pages ever considered safe, at least by those who actually breathe computer?

It's frankly alarming how much trust we (must) give to Arbitrary, Remotely Executed Code(tm), especially given how many attack vectors are remote code executions.

Never, but the world wide web is the one force of nature even Jobs couldn't fight back against. I'm sure he tried, too. So like most "too popular" stuff, it was given an exception that no other type of app would ever dream of.

Well, that's a different argument altogether. Whether you consider browsing the web in any browser safe or not, the fact that PWAs do not change the risk profile of loading such pages remain true.

We don't entirely trust Apple. We just trust them more than other vendors.

Who is "we"?

Probably the folk upvoting my comment.

This is a false dichotomy. Completely trusting any single entity who doesn't really care about you (and only cares about extracting money from you) is riskier than trusting FLOSS, which is being constantly verified by independent actors.

That is not really how it works though. Look at the amount of limping, poorly implemented FLOSS software there is out there where the maintainers show no interest at all or there is no funding to support it. Look at the whole OpenSSL mess a while back.

I honestly prefer to pay a vendor who will (a) complete a product until it's usable (b) be motivated to maintain it because they are paid and (c) be motivated to maintain it because they are scared of the bad PR of not maintaining it.

Apple OSes are insecure by design to aid surveillance (sneak.berlin)

43 points by vitplister 4 months ago | 32 comments

https://news.ycombinator.com/item?id=37875370

Apple fined $8.5M for illegally collecting iPhone owners' data for ads (gizmodo.com)

334 points by nixcraft on Jan 8, 2023 | 134 comments

https://news.ycombinator.com/item?id=34299433

Apple's Cooperation with Authoritarian Governments (jessesquires.com)

468 points by ig0r0 on March 31, 2021 | 291 comments

https://news.ycombinator.com/item?id=26644216

Apple reportedly dropped plan for encrypting backups after FBI complained (2020) (theverge.com)

425 points by samename on Jan 14, 2021 | 137 comments

https://news.ycombinator.com/item?id=25777207

Using an Apple device requires trust in Apple even if you run a 3rd party operating system let alone a 3rd party application on their OS.

Apple’s business model excludes Clickjacking, stealing personal Information, stealing passwords, commissions from redirects, commissions from gambling sites redirects. Those in that business use browser plugins to get inside your security boundary so your argument maybe over my head or baby bath water thing

I don't trust anyone, but historically they seem on par with the big guys like Microsoft and Google. At some point you accept someone's security model or you roll your own system I guess and hope you're better than the security teams at these companies?

Reply on news.ycombinator.com