Alternative iOS App Stores Only Work for 'Grace Period' When Outside of EU | Hacker News Reader

Alternative iOS App Stores Only Work for 'Grace Period' When Outside of EU

macrumors.com

49 pointstcfhgj80 comments

On a somewhat related note, I love the pizazz the European Commission is demonstrating on their DMA website. ( https://digital-markets-act.ec.europa.eu/index_en )

There's a ticking countdown labelled "Compliance time!", currently at 01DAYS 08HOURS 21MINUTES 21SECONDS as of writing, with the 7 March 2024 at 22:59 deadline below.

Luv that time to become "compliant".

DMA became a regulation in Nov 2022, they had like 18 months.

Like with GDPR, everyone waited until the last second.

Tim Cook must leave before he destroys Apple. They are indeed modern-day Microsoft. Apple needs its Satya Nadella before it's too late.

I really hope Europe slaps them a 20b fine for this mockery. This is obviously illegal. Europe doesn't care about the broders, it cares about rights it's citizens.

I don't understand how they can think that their malicious compliance strategy will work out for them. It's a PR disaster.

Who does Cook have advising him? Elon Musk?

The average Apple fan hardly cares, they happily believe that a walled garden “protects” them from malware.

And when malware gets occasionally through, it is because walled garden should be actually a concrete sphere buried 1km under the ground.

Restricting updates of apps after the grace period seems risky from a security perspective... It could leave apps with critical vulnerabilities in circulation for too long.

Eh? That can't be right! I thought Apple cared about their customers? /S

Right, so in order to avoid this security risk it is imperative you only use the Apple app store.

What is the name for this behavior? A protection racket?

Tim Cook chomping on a cigar: "It'd be a shame if something unfortunate was to happen to those nice apps of yours..."

"Nice device you gotz there. Wud be a real shame if some sort of malicious-like character wud getz his hands on it. Capeesh?"

Remember that this is an artificial limitation imposed by Apple, not by the EU.

For whatever it's worth, I would expect any security vulnerability in an iOS app to be a vulnerability of iOS itself, and not the app.

By your logic Unix is insecure just because an admin is allowed to install a trojan? The OS itself cannot stop the user from installing malicious software.

You are not an admin of the iphone unless you jailbreak it

You have enough “admin” access to install a trojan.

What iOS trojan are you referring to that is not a vulnerability of iOS itself?

Phishing apps posing as trusted sources (ie a fake banking app), a key logging browser, anything pertaining to trust. None of these are vulnerabilities to the OS itself.

All sms, phone calls and websites can be used to scam people.

On iOS, "users" are not "admins"

iOS has a significantly different security model than 'Unix'. iOS apps being significantly more sandboxed and restricted, technically, prevents many things an 'admin' could otherwise do.

Just disable the apps, then the vulnerabilities don’t matter.

So now apple think that my rights as a consumer for products I purchased in the EU don't apply when i am away from the EU? How much longer will the EU tolerate this behaviour before we start seeing fines in the billions.

The DMA allows for fines of up to 10% of total worldwide turnover. I'm not sure this is a fight Apple should be picking.

Apple seems to be bouncing ideas off the EU with respect to compliance here. Realistically I guess they have one “grace period,” however long that is, before they start violating anybody’s rights. So, they could take that time to negotiate with the EU and come up with a way to prove your EU citizenship outside the EU.

I don’t think the EU cares to protect us Americans just because we imported a phone from the EU. So, I bet it’ll be citizenship based somehow.

Residency not citizenship. A country's laws apply to anyone in the country not just its citizens. Technically if you are American visiting EU the DSA consumer protection applies to you the moment you land.

The law applies to Apple’s presence in the EU. The EU could order Apple’s EU branch to allow anyone to install an App Store. In the sense that sovereign states can write their laws however they want.

Looking into it, they use the phrase “end user” a lot, but don’t seem to specify resident, citizen, or anything, at least as far as I see. It is a complicated law so I probably missed it.

People here seem really confident about who’s covered, but nobody is providing links, so I think everybody is just going off vibes.

I hear that Apple will be disabling the USB C port and it will only work with Lightning adaptors while you're in the US.

the dongle company ecocide

I'm an EU citizen living in the US. I'm pretty sure this is a violation of my rights. Do I have standing to sue?

No, because the EU has no jurisdiction in the US.

The EU has jurisdiction over EU citizens.

... No. It has jurisdiction in the EU. Just like Americans cannot come here and exercise random rights that the US legislator decided to grant that the EU hasn't. Try to carry a gun in public in Germany and see how that works out for you, for example.

They do have jurisdiction in the EU, like you say. Apple exists in the EU.

In the case of GDPR compliance it is trickier because you can easily end up doing business with entities that will never be in the EU, so while the EU might think their laws apply worldwide, the extent to which you “have” EU rights as an EU citizen in any enforceable way is questionable.

Apple wants to do business in the EU, so the EU can write whatever laws they want, including laws that govern Apple’s worldwide behavior.

Article 3(2) is crystal clear. The GDPR applies to activities who target subjects in the union, or controllers and processors established in the union. Apple has an establishment in the EU specifically so that, when it processes the data of subjects outside the EU, it's a different legal entity not established in the EU who is acting. This includes EU citizens who are not in the EU right now. I know it's a long document, but if you have any doubts, read this: https://www.edpb.europa.eu/our-work-tools/our-documents/guid... I cannot possibly summarize dozens of pages of regulation in an HN comment, so it'll be beneficial for everyone if we all start with the same knowledge.

Examples 9 and 14 seem pretty odd, the US and the Turkish company don’t have any presence in the EU. They can break the laws of the EU in the sense that I can break the laws of China or Saudi Arabia; I’m not going there so I don’t care what their courts think about me.

I think this is a bad way to write a law, because if no court that I care about is going to enforce it, I can violate it. So, it is misleading to the citizens of the EU to say that they are protected by these laws.

Under GDPR, I believe they do (at least in EU courts). It's a law that applies to EU citizens, not just to EU jurisdictions. I do not know if that is the case with the DMA, however.

(Note: not a EU citizen but have had to deal with something related in the past)

Wrong, he doesn't stop being a EU citizen just because he's in the US, EU law still applies.

But you don't have EU rights attached to your person as a citizen. If I go to a place and commit a crime according to the local laws, I'll be charged. Well, similarly, if I go to a place where it says I don't have a certain right, then I don't have that right when I'm in that place.

Yes I do. It means exactly that. US persons have US rights no matter where they are. Doesn't mean local laws don't also apply. Same for EU citizens. I have 3 different citizenships, so I have 3 different sets of rights that apply simultaneously and they follow me around everywhere.

Why is that so hard to understand?

It is hard to understand because often those laws are contradictory (the US first and second amendment rights contradict the laws of many countries).

It also doesn’t make sense in relation to how courts work practically; courts enforce your rights by punishing entities that violate them. If the local court doesn’t care about your rights from your other countries, and a local entity violates them, in what sense do you practically have those rights?

Because (in this case) the EU will punish Apple in the EU for taking away your rights, even though you are not in the EU. Your rights still apply.

You very much do have those rights in a practical sense.

It's hard to understand because it's wrong. Again, apart from certain fundamental rights (e.g. right to life) you only "have" are the right that are granted by the local laws. What does it mean to "have" a right? It's means you're able to exercise it. Can you exercise your right to bear arms in Germany? No. Can you exercise your right to free speech in North Korea? No. Etc. You only have these rights when you're in your own country. You may enjoy similar rights in similar countries, but that's about it.

I suppose the question is if you have a "right to bear arms" or a "right to bear arms that shall be unhampered by the government of the USA" - and either way, you don't have a "right to 3rd party app stores" in this case, Apple has an obligation to provide a service to you (an EU citizen), without certain restrictions. That seems a lot more reasonable for applying no matter where you are at the time.

You still have the right to bear arms if you're not in the US, it's just you've also got to obey local laws too.

You're confusing local laws and the rights you attain through citizenship or something else.

You don't have right to guns in Germany if they are contrary to local laws, otherwise you do.

I have rights to consular protection from the EU outside of the EU.

My GDPR rights don't stop because I'm outside the EU.

Tell me which one of these I'm wrong about.

> You're confusing local laws and the rights you attain through citizenship or something else.

I'm not confusing anything.

> You don't have right to guns in Germany if they are contrary to local laws, otherwise you do.

Then how do you reconcile that with your statement that "US persons have US rights no matter where they are"?

> I have rights to consular protection from the EU outside of the EU.

The EU offers no consular protection. Member States do.

> My GDPR rights don't stop because I'm outside the EU.

Yes, they do. https://www.edpb.europa.eu/our-work-tools/our-documents/guid...

The EU absolutely offers consular protection.

https://www.consilium.europa.eu/en/policies/consular-protect...

As a general point: as a foreign citizen you are expected to respect both laws of your country and of the country you reside. As an EU citizen you can't marry twice only because you're spending your vacation in Dubai. And so on. But the GP was about suing in the EU, for their rights affected during their sejour in the US.

Sorry, but that's just plain wrong. You can get a second marriage in Dubai if you so wish. It just won't be recognized at home. And so on. Extraterritorial jurisdiction is a thing but it's very restricted https://en.m.wikipedia.org/wiki/Extraterritorial_jurisdictio...

I can't carry assault rifle to my local Aldi's in Amsterdam if I visited the EU even though I have that right as a US citizen...

Get back to me when US law prohibits carrying around alternate app stores on your phone.

If you go outside the EU, you’ll be interacting with entities that don’t want to do business in the EU, so they won’t care about what rights the EU thinks you have.

In this case, Apple does clearly want to do business in the EU, so the EU might be able to get them to comply worldwide.

You still have to comply with (some) EU laws regarding privacy and customer protection. See GDPR. Even if you don't do business in the EU, you have to comply with GDPR because their citizens live worldwide, and their data is protected everywhere. You will be fined if someone sues you for GDPR violations.

Do you have any examples where this actually happened and the fine was paid?

Yes, here: https://iapp.org/news/a/does-the-recent-fine-for-a-canadian-...

I found a bunch of articles noting that the fine was imposed but I wasn’t able to find any indicating that it was actually collected.

It doesn't work that way. For example, an EU citizen can't go to a Middle Eastern country and demand certain privileges.

When you leave your territory, your jurisdiction changes.

Did you purchase your iPhone in the EU? A product sold in the EU is subject to EU law. Other laws may also be applied depending on where it is physically, but those EU laws will always still apply. Those are the conditions under which products are allowed to be sold in the EU. If they don't want to abide by those rules, then they just need to not sell the items in the EU.

The way the legal system works in the US is that anybody can sue anybody, but if your case is dumb you’ll probably get tossed out. Might be expensive, etc. If you are serious about this, you’ll need a lawyer, so you can start by finding one and asking them.

My layman guess: you’ll have about as much luck an American who expects their second amendment rights to be honored worldwide.

I'm not talking about suing in a US court. I'm talking about suing in an EU court.

Apple seems to be bouncing plans off the EU to see what sticks, so maybe they’ll add some special way to prove you are an EU citizen outside the EU, or something like that.

If you bought the phone in the EU, then yes.

This is just more bullshit from Apple. They can't take your rights away just because you're not physically in the EU. If you have an EU phone, then it should work with alternate stores everywhere.

You won't need to sue, Apple will reverse itself soon enough.

I doubt law works that way. If you visit a country where smoking weed is illegal you still get arrested even if its legal in your country.

If only people would stop pretending that IPs have a geographical location. They don't. And never will.

Your phone most definitely has a geographical location though, and also a GPS receiver.

I can disable it on Android, I hope you can do it on iOS too.

>The country or region of your Apple ID must be set to one of the countries or regions of the European Union, and you must physically be located in the European Union.

>Your device eligibility for alternative app marketplaces is determined using on-device processing with only an indicator of eligibility sent to Apple. To preserve your privacy, Apple does not collect your device's location.

https://support.apple.com/en-us/118110

>Based on our findings, the new system internally called “countryd” was silently added with iOS 16.2, but is not being actively used for anything so far. It combines multiple data such as current GPS location, country code from the Wi-Fi router, and information obtained from the SIM card to determine the country the user is in.

https://9to5mac.com/2023/04/25/ios-16-restrict-features-base...

I suppose all future lawsuits with Apple need to be hyper hyper detailed in order to prevent Apple from making these half-ass “good faith” attempts at doing the bare minimum, definitely not in good spirit of the law at all.

I’m honestly a bit taken back by how hostile they are acting. Apple genuinely seems to be in their Microsoft era now and it’s not looking good for them. They should be ashamed of themselves.

This is going to be a security and compliance issue when EU citizens are traveling for work for extended periods, and now they can’t patch apps.

Was this Apple’s goal all along, to force people into using their official App Store? Why do they not put these rules on their own App Store?

Not really. In the EU, the emphasis lies on interpreting the spirit of the law rather than its letter - known as "teleological interpretation". It seems apples (and other big tech) lawyers constantly make this mistake :)

Unless the grace period is a year or more this is just another finger to apples customers and European legislation (which will likely receive a patch if Apple are too skimpy with the grace period duration).

Are the alternative app stores hosted on Apple servers? Serious question.

I vaguely (and very possibly incorrectly) remember something about the GDPR still applying to EU citizens who are traveling outside of the EU. Does the same kind of thing not apply to these new digital marketplace laws?

AFAIR gdpr is not based on location but on citizenship so even if you are outside of the EU they should not be able to process your data (thus quite a lot of places improved either the process or blocked EU users)..

App store should be the same, especially considering that you configure location in your iPhone profile so that should be relevant here..

I would suggest with candor using a vpn (kill switch) but that is probably covered (by apple)

Next comes vpn through a router

Next comes turning off the radios (airplane mode) but I forgot radios don't completely turn off in iphones (feature)

Next would come the tinfoil hat (faraday cage) stage /s

Airplane mode doesn't disable receiving radios, like GNSS chips.

I have to assume that's why they mentioned that they wouldn't "collect" your location data, but the phone likely will.

Are there even any alternative App Stores?

Did you read the article at all? At least 3 are planned, one of which by Epic who have been pushing for alternative app stores for years.

Yeah I read it. As you say, the ones they mention are planned. So not available.

If there are none, this seems pretty moot right now. Things may change should people actually start using them in large numbers.

Movivention, one of those 3, is scheduled to launch March 7th, two days after the release of iOS 17.4.

https://mobivention.com/presse-en-2/mobivention-revolutionis...

Reply on news.ycombinator.com