Hacker News Reader

Comment by ankit219 | Hacker News Reader

Think Apple's argument about Epic having previously flouted the rules openly might be good enough. For a third party app store, Apple is pretty much giving the keys to your phone to the said app store. If there is a company which has demonstrated they won't play by the rules, it's not a huge stretch to say that it may harm the security of the model. While the EU wants the company/iphone to be more open, it also puts the onus of keeping it secure on the company itself.

Another reason I believe they are on sure footing is that they got the rejection from the law firm, which I presume knows what they are doing, just as they did during the 2020 shenanigans from Epic.

View on HN

If Apple's security model really is that weak, it sure sounds like they should pull their products off the market until they fix it.

There shouldn't be rules from the manufacturer about what a third party app store can do. If so, this scheme is already a complete failure.

How do you ensure security of a device without rules from a manufacturer?

Through security enhancing features in the operating system, like not allowing processes to access other's memory spaces. Or prompting users to allow an application to use potentially harmful api's. What do you think is the role of an operating system?

I combined both OS and manufacturers since in this case they are from the same company.

Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers".

And for web browsers, which are basically an inner-OS, making sure that plug-ins can't read arbitrary content from the pages you visit.

And given that "phone" is an app, that it can't wiretap all your calls.

Also, one of the fights between Apple and Facebook was basically stuff which, by my reading, was stuff Facebook wanted to do which was illegal under GDPR: https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-priv...

There's also stuff which is bad for the device, but I'm not sure if it really ought to be Apple's responsibility to prevent, like crypto miner libraries running on-device as an income stream for the developer.

> Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers".

"This keyboard app requires access to network resources, do you want to allow this?" Or better yet, let the operating system block apps from using both network resources and keyboard api's.

> And for web browsers, which are basically an inner-OS, making sure that plug-ins can't read arbitrary content from the pages you visit.

My web browser allows me to choose when I want an extension to have access to a web page.

> "And given that "phone" is an app, that it can't wiretap all your calls."

I'm gonna guess it does this with a man-in-the-middle attack. "The operating system has detected that this phone app always calls the same number. We have disabled it for security reasons." Also if you buy a phone, it might be reasonable to let there only be one phone app.

I'm kind of tired of people claiming the hand-holding argument, that apple helps people who do not understand technology. My sister uses apple devices exclusively, but at her work, her employer regularly does tests for phishing and she always fails. It is time people get educated about how to use their computing devices. These devices have been around long enough that people who fall for obvious scams should be considered incompetent.

> "This keyboard app requires access to network resources, do you want to allow this?" Or better yet, let the operating system block apps from using both network resources and keyboard api's.

So, either a "we want this for analytics" message on the popup for fakers, or no analytics for legit developers.

Now sure, I personally don't think app development benefits all that much from analytics and would be happy if analytics were outlawed in entirety by the EU, but 95% of websites have been howling about how important they are since they were forced to request consent for that with the GDPR.

> My web browser allows me to choose when I want an extension to have access to a web page.

So does mine. Why do you think this is a counter-argument? It's a well-known security issue, it's still on the HN front page: https://news.ycombinator.com/item?id=39620060

And every time I set up a new computer, I have to check very carefully to make sure I'm installing a well-recognised ad blocker rather than one of the huge number of look-alike scams — I have to be right every time, the scammers only have to fool me once.

> I'm gonna guess it does this with a man-in-the-middle attack. "The operating system has detected that this phone app always calls the same number.

Why? I was thinking "record message, upload to website". Same deal as with keyboard, except the permission popup can also say "VoIP".

> I'm kind of tired of people claiming the hand-holding argument, that apple helps people who do not understand technology. My sister uses apple devices exclusively, but at her work, her employer regularly does tests for phishing and she always fails. It is time people get educated about how to use their computing devices. These devices have been around long enough that people who fall for obvious scams should be considered incompetent.

Congratulations, that's at least 94.6% of the population you've just described there: https://www.weforum.org/agenda/2017/02/a-quarter-of-adults-c...

To put it another way, your standards are too high. I don't know much chemistry, so I need the chemicals in my daily life to be regulated; I don't know much law, so I need governments to deem that certain contractual clauses are invalid on my behalf; I don't know much biology, so I need the government to prevent snake oil salesmen selling snake oil for all potential ills.

Should private companies be the regulator? Sometimes the law requires it, sometimes the law forbids it. I'm comfortable (if not happy) letting the governments decide what Apple must and must not do, for the exact same reason that I have been comfortable (if not happy) letting Apple decide what developers can do.

I do know computers, and I like messing around with them much as StyroPyro likes messing with terrifyingly high powered lasers[0], much as The Thought Emporium likes messing with terrifying man-made horrors beyond comprehension[1], much as Colin Furze liked making a hoverbike with "no steering, it has no brakes, it's got two accelerators and not even a seat"[2]… asking everyone to take on that responsibility just because I'd like more freedom, isn't as good as you think it is.

[0] https://www.youtube.com/watch?v=xNmbvaUzC8Q

[1] https://www.youtube.com/watch?v=Z_ZGq8Tah0k

[2] https://www.youtube.com/watch?v=soxxPyaAT1k

> asking everyone to take on that responsibility just because I'd like more freedom, isn't as good as you think it is.

That's news to me. I haven't yet told my mom how to enable developer settings on her Android device, but apparently she's at risk because an optional setting exists on her phone.

While we're at it, let's remove all the potential scam-vectors on iOS. Like you said, it's just not good to ask people to accept the responsibility for more freedom. First we have to remove the App Store, to prevent stuff like fake LastPass apps from being accidentally installed on your phone. Next we have to remove SMS and calling capabilities - both are hot-spots for social engineering attacks, and cannot be trusted without direct supervision. Gotta axe Safari too, can't have people randomly sharing information over the internet without exposing them to risk. Apple Music too, can you imagine how dangerous it is letting your child use a platform filled with expletives and free speech?

Soon enough we'll have it, the perfect phone. It's featureset? Oh, I though we were designing jewelry.

> Given one of the things you can get on an app store is a replacement keyboard, "security" is, in addition to all the things you listed, "make sure there are no installable key-loggers".

And what makes you think Apple can stop these apps on their own app store before they cause harm?

I sense this pervasive belief on HN that Apple's reviews are infallible, or that they magically catch malware, when in reality it's just some low ranking person installing the app and navigating through it to spot obvious flaws, usability issues, rule breaches, and ensure that the developer doesn't try to direct users to their website to purchase a subscription for cheaper, the usual anti-competitive stuff.

Unless you can point out a step in the review process where a security expert sits down and reverse engineers the app, and every subsequent update, to verify that it doesn't steal user data?

It's only when someone raises the suspicion that things get looked into, reported and taken off the store. At least web extensions have the benefit of being written in Javascript which is easier to inspect. At no point does Apple ask you to hand over source code.

> I sense this pervasive belief on HN that Apple's reviews are infallible

Our language makes booleans easier to communicate than nuances.

For example, I absolutely do not consider their reviews infallible, I just didn't think it would come across that way when I wrote the comment you're responding to.

None of the things you mention is the responsibility of Apple to decide. They are all choices I get to make as the device owner. Apple can decide what ships on the device, and what is for sale in their very reputable store, but not outside of it.

The thing you are missing is that once third party stores is allowed, the responsibility and security burden is also shared with those third party stores who have to comply the same way to EU rules or risk being fined and lose reputation the same way.

It is not Apple's job to protect its customers from third party stores malware. They just have to build a secure OS with a safe apple store while allowing third parties to provide stores.

> It is not Apple's job to protect its customers from third party stores malware. They just have to build a secure OS with a safe apple store while allowing third parties to provide stores.

Yes... it is.

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A... (section 64 paragraph 3)

> In all cases, the gatekeeper and the requesting provider should ensure that interoperability does not undermine a high level of security and data protection in line with their obligations laid down in this Regulation and applicable Union law, in particular Regulation (EU) 2016/679 and Directive 2002/58/EC. The obligation related to interoperability should be without prejudice to the information and choices to be made available to end users of the number-independent interpersonal communication services of the gatekeeper and the requesting provider under this Regulation and other Union law, in particular Regulation (EU) 2016/679.

"the gatekeeper and the requesting provider"

Apple is still on the hook in combination with the requesting provider that doesn't intentionally deploy malware.

Apple is likely claiming that Epic has in the past demonstrated clear and willful circumvention of their own security and rules. Apple would be putting itself at risk by allowing Epic to deploy applications given Epic's past history of intentionally trying to harm Apple's reputation and would compromise Apple's high level of security in data protection that it is required to follow under Union law. Apple would likely state that Epic has shown that it would intentionally break the law to harm Apple - and that's a believable concern.

EU mandates that gatekeepers work towards privacy and safety of the customers as a requirement in the DMA/DSA.

From this link[1]:

> Obligations for very large platforms that reach more than 10% of the EU’s population to prevent abuse of their systems by taking risk-based action and through independent audits of their risk management systems.

They have a mandate to prevent abuse of their platforms from other apps or third party app store. This is in conjunction with opening up the same ecosystem for everyone else.

[1]:https://commission.europa.eu/strategy-and-policy/priorities-...

I doubt that Apple would accept to be responsible and liable for the security of software from other companies. Epic would ensure the security of their software in the same or similar ways as Apple does it for their software. The operating system provides the security framework, the makers of applications are responsible for the security of their software within that framework.

You don't, it's up to the device owner.

The problem with that argument is that Apple is demonstrably incapable or unwilling of securing their devices, despite the walled garden. Pegasus and a dozen other spyware exploit iOS vulnerabilities which have remained open for at least a couple of _years_ and Apple seemingly doesn't care.

The only way to secure a device is to actually give control of the device to the user. But that would imply no more Apple tax, so Apple would rather die on that hill than follow the DMA. Add to that their psychopathic need for control.

Reply on news.ycombinator.com